In the process of malware analysis, we should not miss any clues. The devil is in the details. This article will introduce how to traverse the list of unloaded modules in the Windows kernel, allowing us to hit the last hiding place of the malware, leaving them nowhere to hide.
Unloaded modules in WinDBG
The lm command, as a commonly used command in WinDBG, not only outputs the current loaded module list, but also outputs an unloaded module list at the end:
In the scenario of malicious sample analysis, this unloaded list could potentially be a breakthrough point, because malware authors might only focus on hiding in the regular infrastructure, but ignore the modules they have used and unloaded. Sometimes we can use this as a breakthrough point to find more clues.
Windows support for the unloaded list
In the leaked Windows source code, there is a global variable named MmUnloadedDrivers that points to the unloaded module list.
The corresponding data structure of this global variable can be found in base\ntos\inc\mm.h:
- typedef struct _UNLOADED_DRIVERS {
- UNICODE_STRING Name;
- PVOID StartAddress;
- PVOID EndAddress;
- LARGE_INTEGER CurrentTime;
- } UNLOADED_DRIVERS, *PUNLOADED_DRIVERS;
Its corresponding traversal code can be found in base\ntos\mm\shutdown.c:
- VOID MiReleaseAllMemory ( VOID )
- {
- ......
- if (MmUnloadedDrivers != NULL) {
- Entry = &MmUnloadedDrivers[0];
- for (i = 0; i < MI_UNLOADED_DRIVERS; i += 1) {
- if (Entry->Name.Buffer != NULL) {
- RtlFreeUnicodeString (&Entry->Name);
- }
- Entry += 1;
- }
- ExFreePool (MmUnloadedDrivers);
- }
- ......
- }
And MI_UNLOADED_DRIVERS is defined in base\ntos\mm\mi.h:
- #define MI_UNLOADED_DRIVERS 50
So, the system saves information of up to 50 unloaded modules at most. If it exceeds this number, it will delete the oldest one in the current saved list and then save the name (note, not including the path) of the latest unloaded module at the end of the list.
Traversing the unloaded module list
After understanding the basic data structure, assuming we can now get the address of the global variable MmUnloadedDrivers through the _internal_get_MmUnloadDriver_address function, we can easily write the traversal code, as follows:
- NTSTATUS enumerate_unloaded_modules()
- {
- ULONG_PTR Index = 0;
- PULONG_PTR MmUnloadedDrivers = _internal_get_MmUnloadDriver_address();
- if (NULL == MmUnloadedDrivers) return STATUS_UNSUCCESSFUL;
- for (Index = 0; Index < MI_UNLOADED_DRIVERS; ++Index)
- {
- PUNLOADED_DRIVERS each_unloaded_module = (PUNLOADED_DRIVERS)*MmUnloadedDrivers + Index;
- if (MmIsAddressValid(each_unloaded_module) && MmIsAddressValid(each_unloaded_module->ModuleName.Buffer) && \
- (each_unloaded_module->ModuleName.Length == each_unloaded_module->ModuleName.MaximumLength || \
- each_unloaded_module->ModuleName.Length + sizeof(WCHAR) == each_unloaded_module->ModuleName.MaximumLength))
- {
- PKE_UNLOADED_MODULE buffer = ExAllocatePoolWithTag(PagedPool, \
- sizeof(KE_UNLOADED_MODULE), UTL_ULDMDL_ALLOCATE_TAG);
- RtlZeroMemory(buffer, sizeof(KE_UNLOADED_MODULE));
- buffer->StartAddress = each_unloaded_module->StartAddress;
- buffer->EndAddress = each_unloaded_module->EndAddress;
- buffer->ModuleName.Length = each_unloaded_module->ModuleName.Length;
- buffer->ModuleName.MaximumLength = each_unloaded_module->ModuleName.MaximumLength;
- buffer->ModuleName.Buffer = ExAllocatePoolWithTag(PagedPool, \
- each_unloaded_module->ModuleName.MaximumLength, UTL_ULDMDL_ALLOCATE_TAG);
- if (each_unloaded_module->ModuleName.Buffer && MmIsAddressValid(each_unloaded_module->ModuleName.Buffer))
- {
- RtlCopyMemory(buffer->ModuleName.Buffer, each_unloaded_module->ModuleName.Buffer, \
- each_unloaded_module->ModuleName.Length > MAX_PATH ? MAX_PATH : each_unloaded_module->ModuleName.Length);
- }
- _internal_copy_buffer_to_r3(buffer, sizeof(KE_UNLOADED_MODULE));
- }
- }
- }
Verify the result:
It can be seen that apart from the driver utils.sys used for this traversal, the list is consistent with the list output by the lm command at the beginning of this article.