Restore SSDT(Shadow)

If the SSDT(Shadow) was hooked by bad guys, how can we restore it to the original state? 😟

Unhook SSDT

x64

To unhook SSDT, we must obtain the original value of the SSDT function offset which has been replaced. Well it's a little trick to do this.

First, we have to calculate the offset from SSDT base address to kernel base address, for example in WinDbg ( Machine OS is Win7 x64):

1: kd> lmDmnt
Browse full module list
start             end                 module name
fffff800`03e50000 fffff800`0443a000   nt         (pdb symbols)          C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\3844DBB920174967BE7AA4A2C20430FA2\ntkrnlmp.pdb

1: kd> dps nt!KeServiceDescriptorTable
fffff800`04101840  fffff800`03ed1300 nt!KiServiceTable
fffff800`04101848  00000000`00000000
fffff800`04101850  00000000`00000191
fffff800`04101858  fffff800`03ed1f8c nt!KiArgumentTable

We have 

ntBase = 0xfffff80003e19000;
ntTableBase = 0xfffff80003e9a300;
// So the offset is  
tableRva = ntTableBase - ntBase; // --> 0x81300
// table offset to file base in ntoskrnl.exe file
tableOffset = RvaToOffset(tableRva);  // --> 0x80900

Then read the kernel executable to memory (just like we read ntdll.dll in SSDT HOOK) to get original SSDT base in file ( the default path is "c:\windows\system32\ntoskrnl.exe", but to double-check, we get its image path from kernel module information )

and analyze its PE header to get its ImageBase field.

Then read the first bytes of the SSDT in ntoskrnl.exe file buffer. ( For simplicity, I read them in a binary file editor which is the same as in a program)

and compare them with the real SSDT contents in kernel memory. ( Shows in windbg)

as mentioned in SSDT HOOK, the real kernel function address equals value >> 4 plus table base address.

for example the first SSDT function offset is

and the first 8 bytes in SSDT in ntoskrnl.exe file buffer showed above are

Here comes the climax of the play.

0040d9a0=000000014048ECA0−0000000140000000−813000040d9a0 = 000000014048ECA0 - 0000000140000000 - 81300

which is

originalOffset=originalBytes−(ntDefaultBase+tableRva)originalOffset = originalBytes - (ntDefaultBase + tableRva)

So we can conclude that the originalBytes in nt file is actually the default address of its corresponding kernel function .

Now we can calculate the original SSDT value of any SSDT function with its index even if SSDT has been modified in runtime.

Combine together

So the steps to get the original value of any SSDT function is:

  1. Get kernel base address ntBase and SSDT base address ssdtBase ( like in Hook SSDT(Shadow)),

  2. Calculate the RVA between them: tableRva

  3. Read ntoskrnl.exe in memory and get its default image base address ntDefaultBase and original SSDT buffer ssdtFileBase

  4. For any function we can calculate its default SSDT value with its SSDT index ,which is

x86

In X86 platform the thing is very similar.

First we need to get the kernel base and SSDT base , as shown in Windbg:

we have

Then read the nt file into memory( note that we need to get the right file path from SystemModuleInformation by ZwQuerySystemInformation)

and analyze its PE header to get its ImageBase field.

The first few bytes at ssdtFileBase are : ( Opened in binary editor)

and the first few bytes at real SSDT in kernel memory are：

So we have

840c4c30 = 00679c30 - 00400000 + 83e4b000

which is

originalValue=defaultAddress−ntDefaultBase+ntBaseoriginalValue = defaultAddress - ntDefaultBase + ntBase

Then we can calculate the original SSDT value of any SSDT function with its index.

Unhook Shadow

Unhooking Shadow SSDT is very similar to unhooking SSDT. The steps are almost the same.

x64

  1. Find win32k base address w32kBase and Shadow SSDT base address w32kTable ( look Find SSDT(Shadow) base address and Find win32k.sys base address)

  2. Calculate the RVA between them: w32kTableRva

  3. Read win32k.sys into memory and get its default image base w32kDefaultBase and original Shadow SSDT w32kTableFileBase

  4. For any function in Shadow SSDT, we can calculate its original value by its index, which is

x86

  1. ...

  2. ...

  3. ...

  4. The original value in Shadow SSDT is

PreviousHook SSDT(Shadow)NextMisc

Last updated