Hacker News Reader

Comment by wslh | Hacker News Reader

Shameless plug: if you are looking for something similar to DTrace but for Windows that can be also used in Python or any other COM capable programming language... you can take a look at our Deviare Hooking Engine: https://github.com/nektra/Deviare2

Additionally, we have other open source instrumentation engines like https://github.com/nektra/Deviare-InProc (better and more secure than Detours, check [1]), RemoteBridge: https://github.com/nektra/RemoteBridge. SpyStudio will also be open sourced very soon: http://www.nektra.com/products/spystudio-api-monitor/

[1] https://www.blackhat.com/docs/us-16/materials/us-16-Yavo-Cap... and https://www.blackhat.com/docs/us-16/materials/us-16-Yavo-Cap...

View on HN

Can Deviare handle rewriting RIP-relative instructions over 5 bytes long starting within the first 5 bytes? E.g.:

  0:000> uf python27!Py_GetPath
  python27!Py_GetPath [c:\minonda\conda-bld\work\python-2.7.12\pc\getpathp.c @ 688]:

    688 00000000`1e1054f0 4883ec28        sub     rsp,28h
    689 00000000`1e1054f4 488b055dc51d00  mov     rax,qword ptr [python27!module_search_path (00000000`1e2e1a58)]

That second mov instruction will get trampled if you overwrite the `sub rsp,28h` with a jmp, so you need to relocate it as well, which requires re-calculating the RIP-relative IMM32 address embedded within the instruction.

I've found a lot of hooking libraries couldn't handle that.

Hi @threntnelson, yes. The generated code will consist in a copy the sub opcode and the mov will be converted to an absolute mov. Sometimes there is no 1-1 conversion so they are converted to several instructions preserving register values if they must be temporarily used.

interesting.

by the way, i got a google security warning on chrome trying to get to one of the nektra blog pages: Google Safe Browsing recently found harmful programs on blog.nektra.com.

also, have you considered an open source anti-virus program at nektra ? One based on stuff like what's available here: http://www.nsrl.nist.gov/nsrl-faqs.html

Hi @naveen99.

We upload precompiled samples but time to time Google marks us as harmful when they aren't. Feel free to download the source code from https://github.com/nektra/. Visual Studio projects are provided too.

Thanks. Will do.

Yes, we are working on that. Basicly Google is giving that notice because the samples were not signed.

We don't plan to make an antivirus since we don't see a business there but some anti virus companies are using our products.

Reply on news.ycombinator.com