Added HackingTeam anti-Cuckoo function as a check

pafish/Makefile.linux

@@ -4,7 +4,7 @@ LINK      = i686-w64-mingw32-gcc
 WINDRES   = i686-w64-mingw32-windres
 OBJ       = Objects/MingW/main.o Objects/MingW/common.o Objects/MingW/utils.o Objects/MingW/debuggers.o Objects/MingW/sandboxie.o \
             Objects/MingW/vbox.o Objects/MingW/gensandbox.o Objects/MingW/wine.o Objects/MingW/vmware.o \
-            Objects/MingW/qemu.o Objects/MingW/hooks.o Objects/MingW/cpu.o Objects/MingW/pafish_private.res
+            Objects/MingW/qemu.o Objects/MingW/hooks.o Objects/MingW/cpu.o Objects/MingW/cuckoo.o Objects/MingW/pafish_private.res
 LINKOBJ   = $(OBJ)
 LIBS      = -lwsock32 -liphlpapi -lsetupapi -lmpr -lole32 -lwbemuuid -loleaut32 -s
 INCS      =
@@ -57,5 +57,8 @@ Objects/MingW/hooks.o: $(GLOBALDEPS) hooks.c
 Objects/MingW/cpu.o: $(GLOBALDEPS) cpu.c
 	$(CC) -c cpu.c -o Objects/MingW/cpu.o $(CFLAGS)
 
+Objects/MingW/cuckoo.o: $(GLOBALDEPS) cuckoo.c
+	$(CC) -c cuckoo.c -o Objects/MingW/cuckoo.o $(CFLAGS)
+
 Objects/MingW/pafish_private.res: Objects/MingW/pafish_private.rc
 	$(WINDRES) Objects/MingW/pafish_private.rc --input-format=rc -o Objects/MingW/pafish_private.res -O coff

pafish/Makefile.win

@@ -4,7 +4,7 @@ LINK      = gcc.exe
 WINDRES   = windres.exe
 OBJ       = Objects/MingW/main.o Objects/MingW/common.o Objects/MingW/utils.o Objects/MingW/debuggers.o Objects/MingW/sandboxie.o \
             Objects/MingW/vbox.o Objects/MingW/gensandbox.o Objects/MingW/wine.o Objects/MingW/vmware.o \
-            Objects/MingW/qemu.o Objects/MingW/hooks.o Objects/MingW/cpu.o Objects/MingW/pafish_private.res
+            Objects/MingW/qemu.o Objects/MingW/hooks.o Objects/MingW/cpu.o Objects/MingW/cuckoo.o Objects/MingW/pafish_private.res
 LINKOBJ   = $(OBJ)
 LIBS      = -lwsock32 -liphlpapi -lsetupapi -lmpr -lole32 -lwbemuuid -loleaut32 -s
 INCS      =
@@ -57,5 +57,8 @@ Objects/MingW/hooks.o: $(GLOBALDEPS) hooks.c
 Objects/MingW/cpu.o: $(GLOBALDEPS) cpu.c
 	$(CC) -c cpu.c -o Objects/MingW/cpu.o $(CFLAGS)
 
+Objects/MingW/cuckoo.o: $(GLOBALDEPS) cuckoo.c
+	$(CC) -c cuckoo.c -o Objects/MingW/cuckoo.o $(CFLAGS)
+
 Objects/MingW/pafish_private.res: Objects/MingW/pafish_private.rc
 	$(WINDRES) Objects/MingW/pafish_private.rc --input-format=rc -o Objects/MingW/pafish_private.res -O coff

pafish/cuckoo.c

@@ -0,0 +1,64 @@
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "types.h"
+#include "cuckoo.h"
+
+/**
+ * Cuckoo Sandbox definitions.
+ */
+/**
+ * Extra space allocated with the hooks information structure.
+ */
+#define TLS_HOOK_INFO_RETADDR_SPACE 0x100
+
+/**
+ * Hook informnation stored by Cuckoo at FS:[TLS_HOOK_INFO].
+ */
+struct hook_info {
+	unsigned int depth_count;
+	unsigned int hook_count;
+	unsigned int retaddr_esp;
+	unsigned int last_error;
+	unsigned int ret_last_error;
+	unsigned int eax;
+	unsigned int ecx;
+	unsigned int edx;
+	unsigned int ebx;
+	unsigned int esp;
+	unsigned int ebp;
+	unsigned int esi;
+	unsigned int edi;
+};
+
+/**
+ * Read the address of the hooks information in the TLS.
+ */
+struct hook_info *read_hook_info() {
+	void *result = NULL;
+
+	__asm__ volatile ("mov %%fs:0x44,%%eax" : "=a" (result));
+
+	return result;
+}
+
+/**
+ * Cuckoo stores the return addresses in a extra space allocated in conjunction
+ * with the hook information function. The only way to check if the structure
+ * is valid is to calculate what is the minimum and maximum value for the
+ * return address value location.
+ */
+int cuckoo_check_tls() {
+	struct hook_info *info = read_hook_info();
+
+	if (info == NULL) {
+		return FALSE;
+	}
+
+	unsigned int minimum = ((unsigned int) info + sizeof(struct hook_info));
+	unsigned int maximum = minimum + TLS_HOOK_INFO_RETADDR_SPACE;
+
+	return (info != NULL) && (info->retaddr_esp >= minimum && info->retaddr_esp <= maximum) ?
+		TRUE : FALSE;
+}

pafish/cuckoo.h

@@ -0,0 +1,8 @@
+
+#ifndef CUCKOO_H
+#define CUCKOO_H
+
+int cuckoo_check_tls();
+
+#endif
+ 

pafish/main.c

@@ -17,6 +17,7 @@
 #include "vmware.h"
 #include "qemu.h"
 #include "cpu.h"
+#include "cuckoo.h"
 
 /*
 	Pafish (Paranoid fish)
@@ -452,6 +453,16 @@ int main(void)
 	}
 	else print_not_traced();
 
+	/* Cuckoo detection tricks */
+	printf("\n[-] Cuckoo detection\n");
+	printf("[*] Looking in the TLS for the hooks information structure ... ");
+	if (cuckoo_check_tls() == TRUE) {
+		write_log("Cuckoo hooks information structure traced in the TLS");
+		print_traced();
+		write_trace("hi_cuckoo");
+	}
+	else print_not_traced();
+
 	printf("\n\n");
 	printf("[-] Feel free to RE me, check log file for more information.");