Re: [Vol-users] Finding API-Hooks

Hmm, strange. This seems to be an issue with distorm3 decoding instructions differently on different platforms. On OSX the hooks in both silentbanker and zeus are fine, but as you noticed - neither show up on Windows. For example: On OSX: $ python Python 2.6.1 (r261:67515, Jun 24 2010, 21:47:49) [GCC 4.2.1 (Apple Inc. build 5646)] on darwin Type "help", "copyright", "credits" or "license" for more information. distorm3.Decode32Bits): ... print op.__dict__ ... {'mnemonic': 'JMP', 'operands': [<distorm3.Operand object at 0x1004e3c50>], 'flowControl': 'FC_UNC_BRANCH', 'instructionClass': 'ISC_INTEGER', 'flags': [], 'rawFlags': 1280, 'opcode': 83, 'address': 0L, 'instructionBytes': '\xe9\x91\xbf=\x8f', 'dt': 1, 'valid': True, 'size': 5} $Id: distorm.py 186 2010-05-01 14:20:41Z gdabah $ On Windows: C:\volatility20>python Python 2.6.5 (r265:79096, Mar 19 2010, 21:48:26) [MSC v.1500 32 bit (Intel)] on win32 Type "help", "copyright", "credits" or "license" for more information. distorm3.Decode32Bits): ... print op.__dict__ ... {'mnemonic': 'JMP', 'operands': [<distorm3.Operand object at 0x01850530>], 'flowControl': 'FC_UNC_BRANCH', 'instructionClass': 'ISC_INTEGER', 'flags': [], 'rawFlags': 1280, 'opcode': 462, 'address': 0L, 'unusedPrefixesMask': 0, 'instructionBytes': '\xe9\x91\xbf=\x8f', 'dt': 1, 'segment': 255, 'valid': True, 'isSegmentDefault': False, 'size': 5} $Id: distorm.py 186 2010-05-01 14:20:41Z gdabah $ Given the same 5 bytes of input, running on OSX it computes opcode 83 and on Windows it computes opcode 462. I have opened an issue with distorm3 which you can track here: http://code.google.com/p/distorm/issues/detail?id=25 In the meantime, if you want to fix this for yourself, change the following line of malware.py: http://code.google.com/p/malwarecookbook/source/browse/trunk/malware.py#1885 From: - elif op.flowControl == 'FC_UNC_BRANCH' and op.opcode == 83 and op.size > 2: + elif op.flowControl == 'FC_UNC_BRANCH' and (op.opcode == 83 or op.opcode == 462) and op.size > 2: After hearing back from the distorm3 developer(s), I'll decide how to proceed, but at least you can use that quick patch in the meantime if you're running apihooks on Windows. MHL On Mon, Aug 15, 2011 at 6:53 AM, Michael Felber &lt;MichaelFelber(a)gmx.net&gt;wrote: