Bypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
summary
A hybrid semi-simulated, semi-native emulator called KDENU maps registers into kernel mode, uses Unicorn C++ bindings, and injects real parameters from kernel dumps to run Windows drivers with preserved structured exception handling and parallelized multithreading. Implementation hooks special instructions, proxies system calls to real ndll when safe, and falls back to emulation otherwise. Demo shows synchronized threads and correct SE flow against a widely used anti‑che engine that manipulates MSRs, LSTAR, DBGCTL, DR7 and last-branch records; a security-cookie bug in LIF is reported and PR merged, code open-sourced.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:08Rootkit analysis motivation
- 3:15Rootkit basics and methods
- 5:02Emulators for rootkit analysis
- 6:09Existing emulation solutions
- 9:00SEH and multithreading importance
- 12:38Hybrid emulator design goals
- 13:43Emulator core design
- 15:09Kernel dump for emulation
- 16:13Advanced hooking techniques
- 17:43Real machine interaction
- 19:09Handling structured exception handling in emulation
- 20:18Multithreading support
- 21:21Live emulator demo
- 22:06Anti-debugging techniques
- 22:48MSR detection methods
- 24:19Hypervisor detection techniques
- 27:15Evasion for driver analysis
- 28:02Emulator evaluation
- 28:47Future plans and release
- 29:32Acknowledgments
- 30:14Q&A
related talks
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
32mIntroduction to Windows Kernel Mode Debugging
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
48mNext Level Cheating and Leveling Up Mitigations
28mDigtool: A Virtualization-Based Framework for Detecting Kernel Vulnerabilities
40mAndroid Rootkits: Analysis from Userland and Kernelland
41mUsing Microarchitectural Design to Break KASLR and More