2

Often times I've heard viruses using "hooks" and "embeding" themself into files. For example from Wikipedia's article on Mebroot

The Trojan tries to avoid detection by hooking itself into atapi.sys. It also embeds itself in the Ntoskrnl.exe.

What is a hook? What does mean to embed? An executable file (like Ntoskrnl) isn't like a text file where you can just append stuff to the end. As far as I know, you can't arbitrarily modify an executable (if I'm wrong, then my question is how do viruses do it?).

1

Malicious software will often use the Windows API (Application Program Interface) to perform it's activities. In some cases malware will monitor and hook these function, there are many ways to do this:

  • Inline
  • IAT (Import Address Table)
  • EAT (Export Address Table)
  • Guard Pages

Hooking a function allows the program to analyse and/or modify the function parameters or return result. This can be used to hide from antivirus solutions, load more malicious code into other processes etc...

Inline hooking is often achieved by overwriting the first few bytes of the function with a jump to malicious code.

IAT and EAT hooks are modifications to the PE (Portable Executable) header which redirect called functions to the malicious code.

Guard Pages can be used to hook functions as the malware can set guard pages on the first bytes of a function and handle the exception when the memory is executed.

Infecting / Embedding code in executables requires in-depth knowledge of the PE format. Using the Windows API a program can read and write to files on disk. The basic steps a program would need to follow to infect an executable:

  • Open the executable file with read and write access

  • Create a new section in the executable and write the shellcode into the file

  • Modify the PE Entry Point to point to the virtual address of the new section

If you are interested in the PE format, I suggest this link - http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf

1

Sometimes the terms embedding and hooking are used interchangeable, but from my point of view the goal of embedding is more to add new behavior rather than to change the behavior or to observe it which would be rather hooking.

It is possible to add arbitrarily code to an executable by introducing custom code and a jump to it from the original code. That is possible by altering the executable file or the process of loading the file. For example the mebroot trojaner embeds itself to ntokrnl.exe by using a component which is able to intercept all disk operations to modify the ntokrnl.exe file as it is loaded.

  • "intercept all disk operations" - this is a good example of a hooked operation. – Will Jul 18 '17 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.