mirror of
https://github.com/CheckPointSW/VectoredOverloading
synced 2026-06-06 19:44:22 +00:00
chkp-elism
ca514348e1
* Add files via upload * Create manifest.json * Create CODEOWNERS * Update CODEOWNERS --------- Co-authored-by: Ilya Rokhkin <ilyaro@checkpoint.com>
20 lines
1.3 KiB
Markdown
20 lines
1.3 KiB
Markdown
# VectoredOverloading
|
|
|
|
Vectored Overloading is a local PE injection technique that was first observed in the *KidKadi* malware.
|
|
|
|
It works by manipulating the load of a legitimate DLL using Hardware Breakpoints (HWBP) and Vectored Exception Handling (VEH) to change the DLL section object on-the-fly.
|
|
|
|
Essentially, the technique does the following:
|
|
|
|
* Creates a `SEC_IMAGE` mapping from a legitimate DLL (e.g. `wmp.dll`)
|
|
* Maps a payload PE over this image memory
|
|
* Sets its entrypoint to `0` and forces the `DLL` flag in the `FileHeader->Characteristics` field
|
|
* Sets a HWBP on `NtOpenSection` & loads any legitimate DLL
|
|
* When the Windows loader calls `NtOpenSection`, the VEH emulates the syscall by skipping it and replacing the `OUT` parameters, so that section object is now that of the payload. The VEH also sets a new HWBP on `NtMapViewOfSection`
|
|
* The loader tries to map the section into memory and then triggers the VEH on `NtMapViewOfSection`
|
|
* The VEH replaces the `OUT` parameters of the syscall and skips its execution, emulating a mapping of the malicious PE's view
|
|
* The loading proceeds and the Windows loader now takes care of handling imports and further processing of the malicious PE image
|
|
* The entrypoint is invoked, executing the payload
|
|
|
|
For a more detailed analysis, please refer to our blogpost:
|