As promised in my earlier blog post, I’ve finalized the utility and made it available for download here. I won’t be releasing source code for the moment because I don’t want to encourage people to start adding this kind of code into their own malware programs, nor to encourage the Symantec folks to start unprotecting every process on the system.
So until then, have fun with the tool, whether it is to explore previously protected processes, or to try out various system and application behaviour when certain processes are made protected. Here’s a screenshot of audiodg.exe after being unprotected. Try it on your own system to see the before/after difference.
[...] Vista’nýn tüm "mükemmel" korumalarýný geçebiliyor. Site ve deneme programý için; Alex Ionescu’s Blog » Introducting D-Pin Purr v1.0 – 32bit Edition Kaðýttan bir gemiyim özenle buruþturulmuþ, Üfürülmüþ yelkenime tüm çocukluðum, [...]
Vista Güvenliði(mi?)
Vista g…
[...] Ionescu posted a proof of concept program that utilizes Vista Protected Processes to it’s own advantage, making evil malicious programs [...]
Why the program deletes the drmkaud.sys and not
crusoe.sys:drmkaud.sys when finishing?
Also I’m curious, what is the meaning of 12th bit
of dword @offset 224h in EPROCESS ?
Lock/unlock proc?
[...] Ionescu no se a limitado a simples palabras, sino que para demostrarlo ha publicado D-Pin Purr v1.0 32bit Edition, que es una herramienta que puede descargarse pero no analizarse en profundidad, puesto que el [...]
So, how do I download and try this applet??? Do not seem to find download button here??? Thanx
the word here is actually a link. =P
don’t worry, i understand that it’s hard to notice a four letter link.
[...] Ionescu developed the program, called D-Pin Purr, to show that Vista features designed to protect media files can also be used to protect other [...]
[...] parece, también un riesgo de seguridad. El desarrollador Alex Ionescu habrÃa logrado desarrollar un programa que permite, utilizando el sistema de DRM de Windows, esconder procesos maliciosos como virus y [...]
I don’t know if the application does what it says but it runs without error on Windows XP :p
Processos Protegidos no Windows Vista
O paper da McAfee citado no post anterior faz um belo trabalho em descrever as técnicas usadas pelos
C0000034 – Internal Error !!
Защищенные процеÑÑÑ‹ ВиÑÑ‚Ñ‹ оказалиÑÑŒ не Ñлишком защищенными
ÐÐ»ÐµÐºÑ Ð˜Ð¾Ð½ÐµÑку (Alex Ionescu) выложил в открытый доÑтуп утилиту, позволÑющую прои
@dfranklin – I had to create [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and add a REG_DWORD value named Type. Once I did that, dpinpurr worked. Previously, it displayed the same error (“[C0000034] – Internal error.”).
@dfranklin – I got the same error, until I created [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and added a REG_DWORD named “Type”.
Hi Alex, thanks for the info on protected processes and your POC tool. Unfortunately, I am unable to download the tool (dpinpurr.zip) from the link provided. Seems as though the link is broken? I am in the process of writing a white paper on user-mode memory scanning (on 32-bit and 64-bit Windows) for malicious content, which requires enumerating all processes and reading their virtual address space (commit pages). I would like to try out the tool on protected processes on Vista. Also, how do you go about reading a protected process’s address space in Vista from user-mode? or kernel-mode? For memory scanning on Vista, in case of protected process, would it be useful to simply un-protect the process, read its virtual address space and then protect it back again? If the memory content is found to be malicious, it could then be flagged as malicious.
Regards,
Eric Kumar
http://fightmalware.blogspot.com
[...] Lage sein, DRM-geschützte Prozesse bei “Bedarf” ein- und auszuschalten. In seinem Weblog zeigt er entsprechende Screenshots, die die einwandfreie Funktion der Software belegen [...]
[...] 25, 2009 I could only find two previous attempts at doing this – D-Pin Purr, which is heavily obfuscated, and this PDF which contains the solution but doesn’t present [...]
[...] anuncian que han roto esa protección. El investigador de seguridad que lo ha roto ha publicado la utilidad para proteger y desproteger archivos en Vista, pero no publica las [...]
Hi Alex,
The download link seems dead. Can you please update?
Thanks,
Danny
Telebuzz…
Я подпиÑалÑÑ Ð½Ð° RSS ленту, но ÑÐ¾Ð¾Ð±Ñ‰ÐµÐ½Ð¸Ñ Ð¿Ð¾Ñ‡ÐµÐ¼Ñƒ-то в виде каких-то иероглифов
Как Ñто иÑправить? http://woman911.ru/ ….
Bitmix…
Радует, что ваш блог поÑтоÑнно развиваетÑÑ. Такие поÑÑ‚Ñ‹ только прибавлÑÑŽÑ‚ популÑрноÑти. http://questiontourism.ru/ ….