Introducting D-Pin Purr v1.0 - 32bit Edition
As promised in my earlier blog post, I’ve finalized the utility and made it available for download here. I won’t be releasing source code for the moment because I don’t want to encourage people to start adding this kind of code into their own malware programs, nor to encourage the Symantec folks to start unprotecting every process on the system.
So until then, have fun with the tool, whether it is to explore previously protected processes, or to try out various system and application behaviour when certain processes are made protected. Here’s a screenshot of audiodg.exe after being unprotected. Try it on your own system to see the before/after difference.
April 7th, 2007 at 11:52 am
[...] Vista’nn tm "mkemmel" korumalarn geebiliyor. Site ve deneme program iin; Alex Ionescu’s Blog Introducting D-Pin Purr v1.0 - 32bit Edition Kattan bir gemiyim zenle buruturulmu, frlm yelkenime tm ocukluum, [...]
April 7th, 2007 at 12:00 pm
Vista Gvenlii(mi?)
Vista g…
April 8th, 2007 at 1:26 am
[...] Ionescu posted a proof of concept program that utilizes Vista Protected Processes to it’s own advantage, making evil malicious programs [...]
April 8th, 2007 at 8:05 am
Why the program deletes the drmkaud.sys and not
crusoe.sys:drmkaud.sys when finishing?
Also I’m curious, what is the meaning of 12th bit
of dword @offset 224h in EPROCESS ?
Lock/unlock proc?
April 9th, 2007 at 5:58 am
[...] Ionescu no se a limitado a simples palabras, sino que para demostrarlo ha publicado D-Pin Purr v1.0 32bit Edition, que es una herramienta que puede descargarse pero no analizarse en profundidad, puesto que el [...]
April 10th, 2007 at 3:41 am
So, how do I download and try this applet??? Do not seem to find download button here??? Thanx
April 15th, 2007 at 10:55 am
the word here is actually a link. =P
don’t worry, i understand that it’s hard to notice a four letter link.
April 15th, 2007 at 3:17 pm
[...] Ionescu developed the program, called D-Pin Purr, to show that Vista features designed to protect media files can also be used to protect other [...]
April 16th, 2007 at 12:02 pm
[...] parece, también un riesgo de seguridad. El desarrollador Alex Ionescu habría logrado desarrollar un programa que permite, utilizando el sistema de DRM de Windows, esconder procesos maliciosos como virus y [...]
April 18th, 2007 at 3:22 pm
I don’t know if the application does what it says but it runs without error on Windows XP :p
April 25th, 2007 at 2:04 am
Processos Protegidos no Windows Vista
O paper da McAfee citado no post anterior faz um belo trabalho em descrever as técnicas usadas pelos
May 22nd, 2007 at 7:41 pm
C0000034 - Internal Error !!
June 4th, 2007 at 10:34 am
Защищенные процессы Висты оказались не слишком защищенными
Алекс Ионеску (Alex Ionescu) выложил в открытый доступ утилиту, позволяющую прои
September 3rd, 2007 at 10:07 pm
@dfranklin - I had to create [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and add a REG_DWORD value named Type. Once I did that, dpinpurr worked. Previously, it displayed the same error (”[C0000034] - Internal error.”).
September 5th, 2007 at 7:41 am
@dfranklin - I got the same error, until I created [HKLM\SYSTEM\CurrentControlSet\Services\drmkaud] and added a REG_DWORD named “Type”.
January 20th, 2008 at 9:39 pm
Hi Alex, thanks for the info on protected processes and your POC tool. Unfortunately, I am unable to download the tool (dpinpurr.zip) from the link provided. Seems as though the link is broken? I am in the process of writing a white paper on user-mode memory scanning (on 32-bit and 64-bit Windows) for malicious content, which requires enumerating all processes and reading their virtual address space (commit pages). I would like to try out the tool on protected processes on Vista. Also, how do you go about reading a protected process’s address space in Vista from user-mode? or kernel-mode? For memory scanning on Vista, in case of protected process, would it be useful to simply un-protect the process, read its virtual address space and then protect it back again? If the memory content is found to be malicious, it could then be flagged as malicious.
Regards,
Eric Kumar
http://fightmalware.blogspot.com
November 19th, 2008 at 3:17 pm
[...] Lage sein, DRM-geschützte Prozesse bei “Bedarf” ein- und auszuschalten. In seinem Weblog zeigt er entsprechende Screenshots, die die einwandfreie Funktion der Software belegen [...]
January 25th, 2009 at 5:20 am
[...] 25, 2009 I could only find two previous attempts at doing this - D-Pin Purr, which is heavily obfuscated, and this PDF which contains the solution but doesn’t present [...]
February 4th, 2009 at 4:32 pm
[...] anuncian que han roto esa protección. El investigador de seguridad que lo ha roto ha publicado la utilidad para proteger y desproteger archivos en Vista, pero no publica las [...]
April 14th, 2009 at 12:29 pm
Hi Alex,
The download link seems dead. Can you please update?
Thanks,
Danny