idov31/cronos

PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.

Hi there! 👋

👨🏻‍💻 About me:

I am an experienced security researcher who has worked in various cybersecurity roles. My main interests are OS internals, reverse engineering, kernel development and exploit development. In my free time, I am working on projects regarding evasion, persistence, and injection methods for UEFI, kernel, and user mode. Based on these, I publish educational papers and presents talks to give back to the cybersecurity community.

📧 Feel free to contact me via Twitter, Telegram or mail regarding any of my projects or publications.

💭 Currently working on:

• New projects

• New papers

• New talks

🌐 My blog posts:

• Lord Of The Ring0

• timeout /t 31 && start evil.exe

• Rust101 - Building a ransomware

• The good, the bad and the stomped function

• UdpInspector - Getting active UDP connections without sniffing

🗣️ Talks:

• Kernel Games: The Ballad of Offense & Defense - X33fCon 2024
• (Lady|)Lord Of The Ring0 - BSidesTLV 2023

⚒️ Programming Languages ⚒️

                           

📊 My stats 📊

cronos's Issues

Reproduction Issues

Hello,

Bit out of scope of this repo - but I have tried to recreate this POC as a learning exercise.

• https://github.com/joshfinley/SleepObfuscationTimerDemo/blob/main/SleepObfuscationTimerDemo/SleepObfuscationTimerDemo.c
• https://github.com/joshfinley/SleepObfuscationTimerDemo/blob/main/SleepObfuscationTimerDemo/Sleep.asm

However, something is causing an illegal instruction execution - I believe its because the decryption is not occurring properly.

If you would be so kind as to check my reproduction and offer guidance on the issue, it would be much appreciated.

Crash After First SleepEx With MASM

Curious why you are using NASM if you are already building this project inside of Visual Studio? I tried to convert your NASM code into MASM (it should be a direct translation):

REDACTED

I am calling it the same as your example from the C code but it is crashing after the first SleepEx. Where did you get the RSP calculations for the CONTEXT structures? How can I debug what is causing the issue after the first SleepEx?