2013 - FTRACE (ELF Function Tracing) for Linux x86_32/x86_64. (TR4)

- Get Ftrace v0.2

Features:

• Function call tracing

• Shows function args as strings

• Shows function args as pointer to either heap, stack, or data segment

• Distinguishes local calls from PLT (shared library) calls. Shows both.

• Return value printed in execution sequence

• Lists program dependencies

• Does not rely soley on symbols, therefore working on stripped ELF Binaries.

• Complete control flow displaying branches within ELF sections (Such as .plt)

  Ftrace uses:

• Reverse engineering complex programs

• Hostile programs: Malware analysis (Although limited by its use of ptrace)

• Debugging software

Screenshot of ftrace:

2013 - ELF Demon (Process possession) v0.1 (TR2)

-Get ElfDemon v0.1 source code

Description:
This project was stemmed from an idea I had some years ago, and I recently worked out some
code for fun. The idea is to inject a dynamically linked executable into an existing process,
and take control. Once execution of the parasite executable finishes, it passes control back to the
original program, thus 'possessing' the process. The goal being a form of anti-forensics
or data contraception, since the program that is being injected does not require its own
process ID. This is much different than shared library injection for several reasons.

1. The code being injected is not position independent code, and therefore handling manual
relocations is tricky, and requires disassembling instructions that must be changed, such as
a 'mov' instruction that moves an address into a register; if this address references the old
memory base, then it must be fixed up to handle the relocation. This is tricky and error prone,
and would be ideal with a PIE executable since they can be relocated easily. The reason relocation
is necessary is because we don't overwrite the original program that is running in memory, since
we want to pass control back to it when the 'evil' executable is done running.

2. The program we are injecting is dynamically linked, to libc at a minimum. If the program were
to be executed by execve() it would go through the full dynamic linking and loading process. The
ELF Demon software handles all of this, including the dynamic linking, by fixing up the PLT/GOT
of the 'evil' program with addresses that we resolve from the libc that is already mapped into
memory.

Further goals (Some nearly accomplished):

• Handle injecting executables that have dependencies beyond just libc

• Inject a thread with sys_clone(), that allows the malicious executable
  and the host to run concurrently in the same address space.

elfdemon requires udis86 disassembler library to be installed on your system. Read the README file for more details.

2011 - VMA Voodoo (DARPA CFT) (TR2)

VMA Voodoo is a Linux userland memory forensics and monitoring software
It was funded through the DARPA CFT program, and titled 'Linux VMA Monitor'.

Features:

• Process memory infection heuristics engine (Detection and disinfection) aware of:

• - PLT infections

• - PLT/GOT infections

• - Function trampolines

• - Shimmed control flow changes of many types

• - Illegal code modifications

• - Shared library injection (Through shellcode/dlopen/LD_PRELOAD)

• - Packed executables

• - Injected modules

• - Misc. VMA anomalies

• ELF Binary integrity checker

• ELF Binary virus detection/disinfection engine aware of:

• - Text segment padding, and reverse padding infections

• - Data segment infections

• Proces image forensics features:

• - Process image snapshots

• - Reconstruction of process image back into functional executable

• - Unpacking of protected executables

• HIDS Daemon:

• - Runs 24/7 scanning all process image

• - Reports malware through classification system

• - Can update admins through email notifications

• GTK GUI:

• - Incorperates the primary detection/disinfection features

• - Very simple to use (And still very incomplete)

• - Logging/Messaging system for intrusion detection

  Limitations:

• Currently works on Linux 32bit Only

• Snapshot metadata system not complete

VMA Voodoo source code may be released at an undetermined date...

Many more projects coming, my goal is to add atleast one a day. It takes time
to clean code up, add README's etc.

2010 - Kprobe instrumentation based kernel patching code (TR1)

-Get Kprobe rootkit (jkit v0.1) source code

Description:
The Jkit rootkit (Meaning jprobe rootkit) is the product of a phrack paper I wrote
in 2010 called Linux kprobe instrumentation (Phrack Paper)
and is one of two pieces of code presented in the paper illustrating how the linux kernel
debugging functionality can be used for modifying kernel memory and hijacking control flow
which proves useful for both security professionals and attackers. I have at times used this
method to reliably hook functionality into the kernel while implementing different types of LKM
security patches over the years. As an example to the hacker community I wrote a small rootkit
that performs file hiding by hooking a combination of functions, and redirecting file streams.
For more information read the paper linked above titled Linux kprobe instrumentation

2008 - Quenya - Interactive ELF Binary hacking and Reversing interface (TR2)

-Get Quenya v0.1 source code

Description:
Quenya is a reversing system, similar to eresi's elfsh, but not nearly as stable.
It was a project I started and completed in a months time, and was the manifestation of my
strong desire to both learn ELF hacking better, as well as to have a simple way to modify and
analyze process images and binaries. The name Quenya is named after J.R.R Tolkeins ELF language;
One being Sindarin, and the other Quenya. Quenya has many fun and interesting features and also
comes with some code for some different viruses and infectors.

Quenya Features:

• ELF Header/Phdr/Shdr/Sym modifications

• - Add sections, segments, symbols

• Relocatable code injection

• Function hijacking

• Process image reconstruction

• Malware unpacking (UPX, Elfcrypt, etc.)

• Disassembly and code modification (Cracking software etc.)

• Built-in uselrand exec

• readelf features (To view and analyze headers, symbols, relocations, etc.)

• Interactive command line

• Utilizes libptrace (Very minimally, as it has awesome features) written by Scrippie

2008 - LPV -> Linux ELF Padding Virus (TR2)

-Get LPV Virus source code

Description
This little virus was my first actual ELF virus. Its behaviour is that
once it has ran, it injects itself into the first uninfected executable file
that it sees (Within the CWD). Any file that gets infected by this virus
will infect other executables, upon runtime. It is a traditional virus in
the sense that it copies itself to other programs. It uses Silvio's original
method of utilizing a PAGE of padding between the text and data segment.
It is written in almost 100% C, and was tested on 32bit Linux years ago.
To compile: gcc -nostdlib lpv.c -o lpv

2008 - ElfScure (Section header obfuscation technique)(TR3)

-Get ElfScure source code

Description
ElfScure is a simple tool I designed along time ago (Same as the 'sht randstrtab'-
feature in Quenya. It does a high level obfuscation technique that randomly orders the
strings of the section header string table. After one elfscures a binary, readelf -S
will reveal that the sections are in completely random order which leaves a reverse engineer
confused as to where things are at, I.E the .plt section will not longer appear to reflect the PLT code.
This trick can also be used to randomize symbol names, which is one of the high level tricks
used as an option in a neat Software Protection agent I am writing right now.

2009 - kD (kernel Detective) Linux/FreeBSD kernel rootkit HIDS (TR2)

-Get kernel detective source code

Description
This software is a host intrusion detection system for Linux and FreeBSD that uses myriad techniques
to detect kernel rootkits. Its abilities range from detecting syscall table modification, to the
notorious debug register rootkits. It has a daemon called kmtd (Kernel malware tracker daemon)
that runs 24/7, scanning kernel memory, and utilizing safe copies of vmlinux and System.map as known good
code and memory data. Another daemon kmond runs hidden and does not show up in the process list
and serves the purpose of monitoring kmtd to make sure that it isn't altered or killed. It restarts kmtd
upon a crash or failure of the daemon. Forensics details are emailed (insecurely as of now) to the sysadmins
listed in the configuration file. The configuration process and also live monitoring sessions are performed
by a GUI (jKMT) written in Java by Sean Harney (chrak), who is skilled and talented friend of mine; all
communication between GUI and Daemon happen over SSL. The daemon kmtd periodically runs an external set of
custom programs that each are designed to investiage a specific aspect of the kernel. Here is a list of
the special functionality tools.

Kernel forensics tools used by kD

• /dev/kmt_mem driver

• - Gives read access to kernel memory, and will only allow the PID tied to the inode of kmtd to access it.

• - Can give write access for disinfection process.

• - Is an LKM driver for Linux (FreeBSD has unrestricted /dev/kmem)

• kmemstat

• - Resolves alternative runtime patching info (.altinstructions)

• - Applies alternative code patch knowledge to heuristics

• - Compares text segment of kernel memory to text segment of vmlinux

• - Can analyze kernel datatypes and functions by address or symbol name

• - Displays infection code upon detection, and can disinfect through custom kpatch.

• dr_chk

• - Debug register rootkit detection

• - Detects patched do_debug (int1) handler

• - Can detect many, but not all DR rootkits.

• ktraq

• - Detects (And disinfects) sys_call_table modification

• - Utilizes /proc/kallsyms or System.map

• dps

• - Detects phony sys_call_table's such as those used by suckIT

• - Simple, but effective

• ksymstat

• - Kernel symbol interception detection

• - Detects trampolines/hooks

• - Scans every single function in the kernel for hooks

  Story behind kD:
  This project was alot of fun, and only endured for 2 months. I had to cease working on it
  because I went to work at a company to work on a product that was extremely similar.
  Therefore kD is in a TR2 prototype stage. I wrote the code 5yrs ago, and
  have since improved much as an engineer, but the right technology is in the code to successfully
  detect and identify kernel rootkits in Linux and FreeBSD (Minimal fBSD testing)

  Challenges:
  kernel Detective, detects kernel rootkits in Linux. For many obvious reasons this is diffcult
  since the compromised kernel has override control on possibly any functionality that a HIDS
  is using to detect that very compromise. kD takes many precausions, such as
  persistently checking the hash sum of files that it uses for the integrity of finding code
  and memory discrepency. I believe the most confusing challenge I ran into was upon realizing
  that the Linux kernel pathes its own text segment at runtime with alternative runtime
  patching for runtime memory barriers. The vmlinux (Which is compressed in vmlinuz)
  can have its section header table rebuilt, and a section called .altinstructions exists which
  contains the code instructions that will be used to in replacement of other code in the kernel
  This decision allows the Linux community to pump out many stock kernels that will run on many
  CPU types, with better tailoring towards specific CPU functionality. kernel Detective must analyze
  the ELF vmlinux altinstructions section (And .altinstr_replace) in order to make sure that any
  discrepencies it finds when analyzing memory, are really hostile and not just modifications made
  by the kernel itself. Many other fun challenges existed as well, it has been many years sine I even
  looked at this code.

  Screenshot of kernel Detective GUI detecting a debug register rootkit!

  
  
  
  
  
  

  2009 - PAPER: Modern day ELF Runtime infection via GlobalOffsetTable poisoning

  -Read paper here on vxheaven!

  Description:
  Not all of the topics in this paper were new, but it presents a technique to bypass PaX
  mprotect()/mmap() restrictions that prevent attackers from injecting code into a process image.
  The result of the paper is a shared library injector that is able to inject a shared library
  into a process image without using ptrace() to inject shellcode into the target program image.
  Instead we manipulate the vsyscall table into executing the necessary syscalls to
  map a custom shared object into the process image, and then perform function hijacking through the
  global offset table. Improvements definately could have been made by handling relocatable
  code and applying the relocations in memory, but the goal of the paper was really to introduce
  fiddling with the vsyscall table, although there are strong intro sections to ELF, dynamic linking
  and ptrace, as well.

  
  
  
  
  
  

  2008 - ELF Reverse padding injector (A technique for ELF binary patching, or virus)

  -Get reverse text-infector source code

  Description:
  This small piece of software injects a parasite into an executable using what I feel is
  the best approach when needing to inject large amounts of code. Infact you can inject as much
  as you want. Quenya is capable of this as well, but this is the first code I experimented with.
  The idea is to extend the text segment in reverse (backwards) so that the parasite code exists
  right after the initial ELF file header, and right before the program header table. This allows
  one to inject shellcode, or a relocatable object, or whatever into an executable, and since the
  code is being injected into the text segment, there is no need to mess with the segment permissions
  whereas data segment injections require adding execute perms to the data segment (On NX bit systems).
  This code works on 32bit ELF executables, but I recently used the same algorithm on a 64bit project
  where I really test the limits of advanced instrumentation concepts.
  
  
  
  
  

  2008 - Lavren's Quest (32bit Linux RPG Video game) (TR1)

  <-Get Lavrens Quest source code

  Description:
  When I was about 24 I got kind of interested in video game dev. I was playing alot of
  Fallout 3, and thought it would be fun to design video games instead of security software.
  I spent nearly 2 months writing 'Lavren's Quest' which is a top down RPG that uses mostly
  open source graphics; 3D Rendered into 2D sprites. It uses libSDL for sound and video.
  I hired someone to do the hero graphics, twice. The second guy flaked out, so the main character
  graphics switch between a guy that looks one way (More cartoony) and then another guy who looks more
  professional, depending on what angle you are walking. The game engine is mostly done, but I don't
  have enough graphics to complete it, and I got bored after a shortwhile. There is a spell system
  and an inventory system. You can purchase potions, and receive quests. There is a soundtrack,
  and attack sounds. The game often crashes unexpectedly and is nearly unplayable, and the code
  is a good example of lazy security practices, and poor runtime complexity. But c'mon, it was my
  first video game... oh and I did create a simple scripting interpreter to easily add NPC's, Enemies
  and quests, as I soon realized that hardcoding these in C were a pain in the ass. Here are some
  screenshots, enjoy! NOTE: Run ./INSTALL_DEPS.sh on ubuntu to apt-get necessary sdl stuff, then
  type make (Which uses g++).

  Do not run Lavrens Quest as Superuser!

  

  Stay tuned for more projects. Atleast 1 daily will arrive over the next month. Cleaning up
  old code and writing README's etc. -Elfmaster

  
  
  
  
  
  

ExploreConsciousness

About

Bit Lackey - A servile follower of bits
Bitlackeys research is an independent group of entities who's interest reside in the idea/paradigm
that computer security is an Art, a philosophy, and a beautiful representation of freedom
of thought, information, and collective forces that drive technology with computer science
to revolutionary propulsions. These philosophies, and research principles result in software
and technology that allows us as institutions or individuals to secure our privacy so that it
is possible to harden our systems, and strengthen our minds towards the myriad forces of wicked
that daunt our prospects and threaten our chance of enlightenment.

Philosophy
Explore consciousness, research our minds, propogate research, write code, and take care of our own.
Kwizatz Coderack - 2014 (aka elfMaster)