
		=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
			Being More Stealth To Be Harder To Spot
		=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

	.-------------.
	| First Words |
	'-------------'
		
		First when writing a Virus/Worm we come to the part where we
	always have to deal with the the registery editor by adding strings
	in there. And by doing that it becomes more eaiser for anyone to spot
	it, so what do we do to overcome this ?, and the answere is quiet easy
	we simply hook the API responsible for getting the value of a specified
	string in the registery editor which is 'RegEnumValueW'.

		But question is what will happen when we hook that API, and the
	the answere is even more easier, when we hook that API we will control
	it's behaviour meaning we will be the ones who decide whether to return
	a successful or fail call of the function.

		Now let's get to know more about that API itself and what does it
	do and much much more... :)

	.-----------------.
	| API Information |
	'-----------------'
		
		Windows 95      : Yes
		Windows NT      : Yes
		Win32 Platforms : Yes
		Import Library  : advapi32.lib
		Header File     : winreg.h

		I begin first by showing what does that API is used for.

	RegEnumValueW :: A function used to enumerate the values for the specified
			 open registery key, and the function copies one indexed
			 value name and data black each time it is called.
		
		Then i show you how it's declared and how it looks like/

	LONG RegEnumValue(
		HKEY		hKey,
		DWORD		dwIndex,
		LPTSTR		lpValueName,
		LPDWORD		lpcbValuName,
		LPDWORD		lpReserved,
		LPDWORD		lpType,
		LPBYTE		lpData,
		LPDWORD		lpcbData
	)

	-) hKey (Handle of key to query)
		:: Identifies a currently open key or any of the following
		   predefined reserved handle:
			A) HKEY_CLASSES_ROOT

			B) HKEY_CURRENT_USER

			C) HKEY_LOCAL_MACHINE

			D) HKEY_USERS
		NOTE: The enumerated values are associated with the key
		      identified by 'hKey'.
	
	-) dwIndex (Index of value to query)
		:: Specifies the index of the value to retrieve, this parameter
		   should be 'ZERO (0)' for the first call to 'RegEnumValueW'
		   function and then incremented for another following calls.
		NOTE: Since the values are not ordered, any new value will have
		      an arbitary index, so that means that the function may
		      return values in a non-ordered order, in another words
		      any order.
	
	-) lpValueName (Address of buffer for value string)
		:: It points to a buffer that recieves the name of the value,
		   including the NULL '\0' termintaing character.

	-) lpcbValueName (Address for size of value buffer)
		:: It points to a variable that specifieses the size in characters
		   of the buffer pointed to, by the 'lpValueName', this size should
		   include the NULL '\0' terminating charaacter, when the function
		   returns, the variable pointed to, by 'lpcbValueName' contains the
		   number of characters stored in the buffer but the count returned
		   doesn't include the NULL '\0' termintaing character.

	-) lpReserved (Reserved data)
		:: A reserve data, it is mainly set as NULL.

	-) lpType (Address of buffer for type code)
		:: It points to a variable that recieves the type code for the value
		   entry, it can also be set to NULL if the type code is not required
		   but here are the type code anyway they can be one of the following 
		   constants:
			A) REG_BINARY
				:: A binary data in any form.
			B) REG_DWORD
				:: A 32-Bit number.
			C) REG_DWORD_LITTLE_ENDIAN
				:: A 32-Bit number in little-endian format, the most
				   significant byte of word is the high-order byte.
			D) REG_DWORD_BIG_ENDIAN
				:: A 32-Bit number in big-endian format, the most
				   significant byte of word is the low-order byte.
			E) REG_EXPAND_SZ
				:: A NULL '\0' terminated string that contains unexpanded
				   refrences to environment variables.
				NOTE: It will be a Unicode or ANSI string depending on 
				      whether you use the Unicode or ANSI functions.
			F) REG_LINK
				:: A unicode symbolic link.
			G) REG_MULTI_SZ
				:: An array of NULL '\0' terminated strings, terminated
				   by two NULL characters '\0\0'.
			H) REG_NONE
				:: Non defined data type.
			I) REG_RESOURCE_LIST
				:: A resource list.
			J) REG_SZ
				:: A NULL '\0' terminated string.
				NOTE: It will be a Unicode or ANSI string, depending on
				      whether you use the Unicode or ANSI functions.


	-) lpData (Address of buffer for value data)
		:: It points to a buffer that receives the data for the value entry,
		   it can also be set as NULL if the data is not required.

	-) lpcbData (Address for size of data buffer)
		:: It points to a variable that specifieses the size pointed to by 'lpData'
		   in bytes.
		NOTE: When the function returns the variable pointed to by 'lpcbData'
		      contains the number of bytes stored in the buffer, 'lpcbData' can be
		      NULL, only if 'lpData' is NULL.

	Hmmm... that was pretty long, but we did actually learned something by now, which is
	the API itself, all its parameters and constants used by it too, so the only thing left
	is the return value of the API, so we can know if our function was succesful or failed.

	-) Return Value Of The API
		If the function succeeds, the return value is 'ERROR_SUCCESS'.
		If the function fails, the return value is a nonzero error code defined in 'WINERROR.H'.


	Now i think you you got to know what we are going to do in here, what we are going to
	handle is the return value especially because that's what concerns us, since that's
	what determines whether the function succeeded or failed, but still how it can be done ?,
	and what will we get by doing is, first how we are we gong to do this i will explain it
	later one you just wait, as about what we will get by doing this is hide our string in the
	registery editor without anyone seeing them, meaning you can have a string in the registery
	editor but noone can ever see it because we control that when we hooked that API, so we can
	now have our Virus/Worm have it's own strings in the registery editor without anyone even 
	having any notice in another words we are more stealth, and we just covered out our tracks.

	.-------------------------------------.
	| Understanding The Conept Of Hooking |
	'-------------------------------------'

		At first, before writting the code, one should have at least some knowledge regarding
	API's, Hooking and its techniques, PE file structure, if you don't
	know it all or don't have what it takes then i suggest you to read more on those or just
	continue reading this tutorial as it's fully explainable and all the codes are heavily commented.
	
		Anyway here it goes, first let's know what 'Hooking' do and so on, Our goal is generally 
	to replace the code of some function with our code. This problem can be sometimes solved before 
	running the process. This can be done mostly with user level process which are run by us and the 
	goal is for example to change the program behaviour. So When talking about 'Hooking' I mean the 
	full change of API. So, when calling hooked API, our code is run immediately. I do not deal with 
	cases of API monitoring only. I will talk about complete hooking however you can do the hooking
	work anyway you want but for now you follow what i will do :).

		Here is a generel overview of the PE file format according to what i learnt from but i 
	will trim it a bit because i won't get into details about that which can take me very long time
	to explain =) 


	+-----------------------+
	|        MS-Dos		|
	|       MZ Header	|
	|-----------------------|
	|   MS-Dos Real Mode	| ---> ("MZ") Signature
	|     Stub Program	|
	|-----------------------|
	|       PE File		| ---> ("PE") Signature
	|      Signature	|
	|-----------------------|  
	|+------ PE File ------+|  
	||	 Header	       || 
	||---------------------|| 
	||    .text Section    || ---> Module Code
	||	  Header       ||  
	||---------------------||  
	||    .data Section    || ---> Initialized Data (Global Static Data)
	||	  Header       ||
	||---------------------||
	||    .idata Section   || ---> Imported Functions
	||	  Header       ||
	||---------------------||
	||    .edata Section   || ---> Exported Functions
	||	  Header       ||
	|+---------------------+|
	|     Debug Symbols	| ---> Present If Switched On DEBUG SWITCH In Compilation, Usefull For Debugging
	+-----------------------|

	
	Important part for us here is the Import Address Table (IAT) in the '.idata' part. This part contains 
	description of imports and mainly imported functions addresses. Now it is important to know how are 
	PE files created. When calling arbitrary API indirectly in programming language (that means we call it using 
	it's name, not using its OS specific address) the compiler does not link direct 
	calls to the module but it links call to IAT on jmp instruction which will be 
	filled by process loader while OS is loading process to the memory. This is why
	we can use the same binary on two different version os Windows where modules 
	can be loaded to another addresses. Process loader will fill out direct jmp 
	instructions in IAT which is used by our calls from the program code. So, 
	if we are able to find out specific function in IAT which we want to hook, 
	we can easily change jmp instruction there and redirect code to our address.
	Every call after doing this will execute our code. Advantage of this method 
	is its perfection. Disadvantage is often amount of functions which should be 
	hooked (e.g. if we want to change program behaviour in the file searching APIs
	we will have to change functions FindFirstFile and FindNextFile, but we have to 
	know that these functions have its ANSI and WIDE version, so we have to change 
	IAT address for FindFirstFileA, FindFirstFileW, FindNextFileA and also 
	FileNextFileW. But there still some others like FindFirstFileExA and its WIDE 
	version FindFirstFileExW which are called by previous mentioned functions. 
	We know that FindFirstFileW calls FindFirstFileExW but this is done directly
	- not usinig IAT. And still some others to go. There are e.g. ShellAPI 
	functions like SHGetDesktopFolder which also directly calls FindFirstFileW or 
	FindFirstFileExW). But if we will get all of them, the result will be perfect.


	PCSTR pszHookModName = "kernel32.dll",pszSleepName = "Sleep";
	HMODULE hKernel = GetModuleHandle(pszHookModName);
	PROC pfnNew = (PROC)0x12345678,		//new address will be here
		pfnHookAPIAddr = GetProcAddress(hKernel,pszSleepName);

	ULONG ulSize;
	PIMAGE_IMPORT_DESCRIPTOR pImportDesc = 
		(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(
			hInstance,
			TRUE,
			IMAGE_DIRECTORY_ENTRY_IMPORT,
			&ulSize
		);

	while (pImportDesc->Name)
	{
		PSTR pszModName = (PSTR)((PBYTE) hInstance + pImportDesc->Name);
		if (stricmp(pszModName, pszHookModName) == 0) 
		break;   
		pImportDesc++;
	}

	PIMAGE_THUNK_DATA pThunk = 
	(PIMAGE_THUNK_DATA)((PBYTE) hInstance + pImportDesc->FirstThunk);

	while (pThunk->u1.Function)
	{
		PROC* ppfn = (PROC*) &pThunk->u1.Function;
		BOOL bFound = (*ppfn == pfnHookAPIAddr);

		if (bFound) 
		{
			MEMORY_BASIC_INFORMATION mbi;
			VirtualQuery(
				ppfn,
				&mbi,
				sizeof(MEMORY_BASIC_INFORMATION)
			);
			VirtualProtect(
				mbi.BaseAddress,
				mbi.RegionSize,
				PAGE_READWRITE,
				&mbi.Protect)
			)

			*ppfn = *pfnNew;

			DWORD dwOldProtect;
			VirtualProtect(
				mbi.BaseAddress,
				mbi.RegionSize,
				mbi.Protect,
				&dwOldProtect
			);
			break;
		}
		pThunk++;
	}

	Result of calling Sleep(1000) can be for example this:

	00407BD8: 68E8030000	push 0000003E8h
	00407BDD: E812FAFFFF	call Sleep

	Sleep:     ;this is jump on address in IAT
	004075F4: FF25BCA14000	jmp dword ptr [00040A1BCh]
 
	Original Table:
	0040A1BC: 79 67 E8 77 00 00 00 00
      
	New Table:
	0040A1BC: 78 56 34 12 00 00 00 00

	So the final jump is to 0x12345678

	*** I Would Like To Thank 'Holy_Father' For Providing The Previous Example.


	After reading this you should be able to know how to acheive what i was talking about
	and ofcourse you can achieve more stealth by hooking the right API's, also you can see
	more info about hooking either in some other time if i did or by checking 'Holy_Father'
	tutorial.
	
	That's all and have fun.


*****************
* Sinclaire/DCA *	** Peace...Out **
*****************	