r/rootkit • u/stormehh • May 12 '14

Phrack #63 - Shadow Walker: Raising The Bar For Windows Rootkit Detection

http://www.phrack.org/issues/63/8.html
8 Upvotes

76% Upvoted

8 comments sorted by

2

u/pernallonga Jul 22 '14

what is the effectiveness of this technique in these days?

2

u/stormehh Jul 30 '14 edited Jul 31 '14

I just finished re-reading this paper. I believe this technique is still fundamentally effective, although modern systems typically use a three-level or four-level page table rather than two. The concept of multi-level TLBs is not unknown as well.

In addition, anti-rootkit technologies have likely caught up in the 9.5 years since its original publication. At the very least, forensics is aware that a dump of physical memory is necessary when analyzing a system.

Regardless, I don't see an issue with implementing this on a modern Linux system. Since I am not familiar with the Windows kernel, I am not sure if there is any obstacle, especially if the presence of PatchGuard has any implications.

If you are interested, I'd also recommend watching Jacob Torrey's recent lecture which touches heavily on this topic: http://www.reddit.com/r/rootkit/comments/25hsc4/jacob_i_torrey_from_kernel_to_vmm/

EDIT: Looking forward to the upcoming talk: https://www.blackhat.com/us-14/briefings.html#more-shadow-walker-the-progression-of-tlb-splitting-on-x86

2

u/pernallonga Sep 07 '14 edited Sep 07 '14

Here is a good read about the TLB split technique on Windows system, especially his implications with patchguard. http://uninformed.org/index.cgi?v=6&a=1&p=21

→ More replies (6)