??????

1
?????? ?????????? ???????

• ????????? ???????
• ??????? ????????????
• ?.?. ???????

2
???? ???????

• ????????????? ?????? ? ??????????? ???????????? ?
  ??????????? ?????? ? ??????????? ???????? host OS
• ? ?????????? ? ??????? ????? ??????????
  ???????

3
??????????? ???????? ??????????? ??????? ????? ??
??????? ????????
Rtenicxp.sys (Guest OS NIC driver)
Interrupts
PCI configuration space
Port I/O
Memory Mapped I/O
DMA
DevNICFwd (Virtual NIC)
NICFwd.sys (Host OS NIC driver)
Interrupts
PCI configuration space
Port I/O
Memory Mapped I/O
DMA
RTL8168
4
DMA (Direct Memory Access)

• ??????????? ????????? ?????????? DMA
• ???????????????? ?????? ?????????? ? ??????
  ??????
• ? ????????? ????????? ?????? ?????????? DMA ?????
  ?????????? ?????? ??????????

5
DMA, ???????

• ????????? ??????? guest OS ???????????? ??? DMA
  ??????? ????????? ??????? ??????, ?????
  ????????????????? ? host OS

6
DMA, ???????
Driver
ntoskwrp.exe
ntoskrnl.exe
IoGetDmaAdapter()
Guest Memory
Guest
Host
VBox Memory
ntoskrnl.exe
Host Memory
IoGetDmaAdapter()
7
DMA, ?????????
Driver
1
ntoskwrp.exe
ntoskrnl.exe
IoGetDmaAdapter()
Guest Memory
Guest
Host
VBox Memory
2
3
ntoskrnl.exe
Host Memory
IoGetDmaAdapter()
8
1. ??????????? ???? guest OS
ntoskrnl.exe
ntoskrnl.lib (import library)
dumpbin
dll2lib
exports2wrapper.py
ntoskrnl.lib (static library)
.c,.h (ntoskwrp sources)
.def
cl (compiler)
link (linker)
ntoskwrp.exe
9
2. ???????? ????????? ????? guest OS ? host OS

• ????????????? ???????? ? ???? ???????
  ?????????????? ?????? host OS ? guest OS ?
  ????????
• ?????????????? guest OS ? host OS ??????
  ?????????? ????? ?????????????????? backdoor
  ???????

10
2. ???????? ????????? ????? guest OS ? host OS
(???????????)

• ?????????
• ???????? ????????? ????? guest OS ? host OS
• ????????? ?????????? guest OS ?? ????? ????????
  ?????????
• ??????????? ???????? ????????? ??? ??????????????
  ????????? ? guest OS, ? ????? ?????

11
2. ???????? ????????? ????? guest OS ? host OS
(???????????)

• backdoor ??????? ?? ????????
• ???????? ????????? ??????????? ????????? ?
  ???????????? ??????????
• ?.?. ? VirtualBox ????? ???????? ????????????, ??
  ??????????? ????????? ?????????? guest OS
• ??????????? ?????????? ???????? ??????

12
3. ??????????????? ????????? ? ??????

• Guest OS ?????? ????? ??????????? ??????/?????? ?
  ?????????? ??? DMA ?????? (? host?)
• ?????????? ??????????????? ????????? ?
  ??????????????? ???????? ?????? ?? ???????????
  ?????? ? host OS

13
?????????

• ?????????? ?????????? ??????? ?????? ???????????
  ???? ??
• ?????????? ?????? ???????? ????????? ????? guest
  OS ? host OS
• ??????????? ????????? ???????? ????????? ? ????
  guest OS, ??????????? ??????? ????? ?
  ????????????? ???????? ??????? ????? ? host OS

14
?????

• ?????????? ??????????????? ????????? ? ?????? ???
  DMA
• ???????????? ??????? ????????????? ?????? ?
  ?????????? ??????????? ? ??????????? ??????

15
??????? ?? ????????

• ???? ???????