So in this video, we'll be seeing how to bypass the MSI.
So MSI stands for Anti-Malware scan interface.
So this is the deal.
And in this data we have these functions.
I opened this letter in the paper and here you can see in the export section, you can see all of these
functions.
And one important function is MSI scan buffer.
So what this function does is it will scan the input for any malicious strings.
If there are any malicious strings, then this going to bracket this.
MSI will be working with the Windows Defender and this.
You can see this function results will be evaluated by the defender, not only defender if you have
any other antivirus.
So that antivirus can also work with this.
So the Windows Defender is on and if I type in work.
Mimi get.
Then you can see the script contains malicious content and has been broken by your antivirus software
that is defender.
So what we are going to do is in this video will be patching this scan buffer so we make this function
return true so that the Windows Defender continues.
Will not detect the string as a malicious one.
And you can also use some obfuscation techniques I can see.
So here, if I type in work, we make it.
And this Windows Defender is updated.
And here you can see.
And here you can see these obfuscations are also getting treated by the latest Windows defender.
So we are going to patch this.
But this amp, this can buffer function.
So whenever this data are loaded, so data is rooted in this PowerShell and we need to find the best
address.
And if you find the base address of the data residing in that process, you can calculate the function
at this, you can calculate the exports and you can find the function in that data and you can just
modify with the return value one.
So in this video, we'll be walking through the code I have written.
Took me like one day.
So let's get started.
It is somewhat Randy Court and you can if you have watched my previous video so like passing experts
and passing PFA then it should be good if you do not watch.
I highly recommend watching this videos so the file.
So this program takes arguments.
One is process side and the dealer name and the function name you want to patch.
So after that we are going to retrieve the DL based address using this create to have that snapshot.
So it will take the snapshot of the process at the current time and you will be enumerating the first
module and then we will be using this module 32 next.
To enumerate the modules and if the name is equals to the one we have given in the command line argument,
then we are going to say a found in modules that is the full path of the data and the database entries
and the size of the image.
So the size of the image is size of image from the optional header.
And then we got the visitors.
So we know where that error is going on and there are no words.
You can start parsing this p file.
And you can see open process.
This is our access, so you can filter the access permissions like read, write, query information,
etc. So for the demonstration purposes, let's give this full access and passing the process side.
So we got the end to the process and we have the database address so we can read out memory.
You can read out the memory from that address.
Like if you read starting 64 bytes, that is going to be the dos stub.
You can see the stub here.
And this this is a revenue.
If you go to this offset, you will go to the this P and t header study.
So like that you can read the process memory using the read process.
So read process memory the process to hand it to the process and the data remote based address and you
create a new byte area that is the size of image dos.
So that asset is a starting one and we are going to read the 64 bytes from that memory into this buffer
byte byte, buffer dos, and we are going to use the function called bytes to shutter.
So this is a generic type.
So it will.
So what we're doing is we are allocating some memory in our own process space of these bytes, and then
we are going to converting that structure pointer into the structure.
So whatever memory residing at that, whatever data residing at that pointer will be converted to the
structure of that.
P So that is the dynamic type.
If you pass image the setter at this, it will convert into image if you pass an integer, if you convert
into interior.
So that is the advantage of generics.
We can get the dynamic return type.
In the same way we are going to process the next four bytes that is signature.
So the remote base press is revenue.
So if I go to this 100000, so if I go to F zero.
So this you can see if, uh, for 5045 that is, that stands for P.
And then you can.
You can go and you can write these checks.
If there is if this is not fair, then you can return that.
This is not fair.
So our next one is we are going to pass this file header that is 20 bytes, I guess.
And same, and the offset will be changing the set revenue plus four.
So these plus four is signature and then you get the file header and the next one is we are going to
pass the optional header.
So this one.
Optional header and in this option, a header.
If you look at the export address and here you can see four zero.
So at this offset from the base address, you will have this image export directory.
I made the export descriptor again.
So here you can see this is the export.
So here you can see now we've got the optional header and.
We are going to.
Export this one into image export directory.
So if you go to the.
So these are the characteristics and this is the name M.C. Data.
You can see here if you go to this address.
So you can go to the offset.
You can see the MSI data.
So go to.
E file six here.
Now you can see the screen saver data.
So that is the outset, this one.
So I have written another function that is Read Progress Memory Stream.
So what this what this does is if you do the.
So if you go to a base address or if I give this address out this year, then it will start reading
byte by byte until it faces the null byte.
If it fails, then if you read the null, then that means the string has been terminated.
So it will read the year and then as a bill and if it faces the null byte, then it will return.
So we are just this is a very convenient process to read the string from the remote process.
So you can see if I have also set this limit to 50 because.
I think no more.
Not only the functioning cannot be more than 50 can be more than 50, but in normal it's just the limit.
So we are reading byte by white, and if it's comparing with the zero, then we are getting that first
thing and returning that string.
So that is this function does for the remote process.
If it's in the rocker process, we can use the marker dot to.
A pointer to string ends.
So.
And we are parsing the exports.
Now, our exports structure contains all of this information.
Now we are going to read the experts journal so you can just.
A real person sitting at that.
Exports our name offset.
Now we are going to pass these exports.
So this this is the number of functions and number of names.
B So that means there are no other functions that are exported by ordinary only.
So if I go to address of names, if I go to this house and here you can see these values, if you pass
these four bytes, you'll get the value ei7.
So if I go to uh, e file seven three.
I regret.
Actually, I regret the name.
AMC closed session.
And if I go to the next four bites, that is five, eight, four.
I really got the next to function.
That is an MSI race.
So like that we are going to loop over this one so this we can call this one as the name pointer.
So this one is called Export address table and this one is called Export name Table and this one is
called export Ordinal Table.
So I have created three pointers which are just adding the base address, plus this value based address,
plus this value and the basic response this value.
So these are the three pointers, entry .8.3 and you already pointed.
Now we can just print out these addresses.
Now, what we're going to do is we are going to loop over all these names and we are going to find out
which function we have given in the common argument.
So we are going to read this memory entry point or press eye into four.
So into four is the looping.
So we want to loop four bytes each time and we are converting this into the string.
So here you can see we are using again this feed memory string.
And then onwards we are going to.
So if I found this one, you can see if I want to find the address of this function.
M.C. Crow Session.
So this is the fascist element.
So this is the first element.
And you see the first element in the order of name ordinance that is zero zero.
So you go to that index in this order of functions.
So here the value is zero or what two bytes.
And if you go to the zero at this.
This address are functions.
And here you can see 2520 is actual address of that function.
So here you can see that is being passed by the p.
B.
So it's a saying the same applies to the AMCs can buffer.
So the AMCs can buffer is the fourth element in this, hundreds of names.
And if you look at the fourth element in the address of name address.
One, two, three and four.
So the third one, so zero three index.
So if you go to the address of functions zero.
One.
Two and three.
So it will be.
25402540.
So here you can see 2540.
So this will be the address of their function.
So that is what we are going to pass here.
The precious memory is what Pointer So we will be here stepping too, because the index takes only the
two bytes word.
And then we are reading the process memory at that location.
At that index you can see current what into for that index and we will get the address in this address
by area and then we are going to write the this opcode.
So this is actually more common one and written.
So you can.
So move.
Politics.
Come on, Britain.
So what is the function in assembly?
We take the.
Yeah.
And our researchers as the function return value.
If the function returns one, then the defender will not have anything that there are no malicious things.
So click on assemble and you can copy this.
So that is the same area.
And then we are writing at that function.
So we got the function address that is 2450 and we are going to overwrite this bytes.
We are also changing the water product so that we can rehydrate.
And finally, we are writing those bytes into that function.
And after that we are reading at that function address to verify if our payload is successfully returned
or not.
So that is what we are doing.
So.
So the function bytes can be like this, so assume these are the function bytes.
So we are just.
Replacing some of the bites with the mauve oryx come on one and return.
So whenever this function gets executed, it will one will be copied into our X register and it will
directly return.
So these bytes are just
empty once that does nothing.
So you can also assume like this one.
So here you can see if the arguments end is not equal to three.
I'm directly exiting, so you can compare that to this one.
So.
All right, so let's go and.
So let's mimic it.
And it's not just getting hit by defender.
So we the process and.
And the dealer name.
AMC Dealer and AMC can buffer.
Now we are going to hit enter.
And here you can see the phone in modules and see the detail and the base addresses this one.
And so the image export are the stable export name, stable and stable and the function contains index
three.
So we.
Just like we have passed from manually operating at this one and with the payroll.
So this is the more common one written and after written we have read from that function address and
we got the same bytes.
So that means our function has been patched.
Now, if I go and invoke memory card and here we can see we can successfully, uh, fool this defender
to think that this is not a malicious string.
So that's how you bypass this CMC by patching the function in memory.