- Use WinDbg for kernel debugging - Understand basic inner
working of disk driver - Understand virtual hidden drive
creation - Reverse engineering Max++ driver infection technique
- Operating Systems - Assembly Language - Operating System
Security This tutorial continues the analysis presented in
Tutorial 20. We reveal how Max++ uses a modified disk driver to
handle I/O requests on the disk it created (its name is
"\\?\C2CAD..."). Recall that in section 4.2.3 we showed you
Max++ creates a new IO device and hooks it to the malicious
driver object, so that whenever an IO request is raised on this
device the request will be forwarded to driver object 8112d550,
as shown below. Pay attention to the value of MajorFunction
(0xfae36bde), this is where IO requests are handled. Obtaining
the module base address, we can easily calculate its offset:
_+2BDE. kd> dt _DRIVER_OBJECT 8112d550 +0x000 Type : 0n4 +0x02c
DriverInit : 0xfae4772b long +0 +0x030 DriverStartIo : (null)
+0x034 DriverUnload : (null) +0x038 MajorFunctio