WErFault errors about r77-rootkit HOT 8 CLOSED

Looks like some injected application is crashing and maybe restarting each time it crashes, causing this "WerFault loop".

Could you check the EventVwr to see which application it is? If you could provide some details on that and the info from EventVwr, I could try to reproduce the issue.

Also, just to keep in mind: If you are implementing r77 in your application, make sure that your application isn't injected by r77. You can do this by using the $77 prefix.

from r77-rootkit.

The old installer writes to AppInit_DLLs, but I did not use this technique in the new version, because:

1. It is simply ignored, when secure boot is enabled
2. It only loads, into processes, where kernel32.dll is loaded
3. It requires the DLL to be stored as a file. This file sooner or later gets detected and deleted
4. This registry value is highly suspicious and monitored

You can use it, thought, but I don't recommend it. I would rather investivate in your issue further.

If the app that's crashing is one of your own projects, then please make sure, that:

• r77 is not loaded into the process. Use the file prefix, if possible.
• If the process is fileless and you can't use the prefix, then try to debug. Use the Test Console on your development machine to inject r77 into your application and see what causes the crash. Let me know if there is anything odd that may be a bug in r77.

If the crashing app is a Windows component, then it is a bug that should be fixed. In this case, I need info about the process, the OS and the EventVwr log entry.

from r77-rootkit.

Glad to hear everything is working as expected :)

I've also updated the documentation with best practices for implemenation. It's not yet on the website as a PDF. But the dev-branch contains the current Documentation.docx

from r77-rootkit.

Yes, I know which app it is!! ok, thank you very much! That error comes any time I create a new file with the prefix name. I will now install a new VM and try to reproduce this error and i will let you know.

from r77-rootkit.

can I use the old installer C# to install it?

from r77-rootkit.

Thank you very much for this info!!

from r77-rootkit.

A question: Do you have the errors in your initial post with the old installer, or with the new installer (1.0.x)? I never tested the new DLL's with the old AppInit_DLL installer.

Regarding C#: Yes, it is possible and very trivial. Have a look at Intall.cpp. All it does is this:

1. Read the stager executable from the resources and write it to two registry keys
2. Create two scheduled tasks, and run both

(on Windows x86, do each task only once)

Install.cpp has source code comments that explain how the installation is implemented.

I won't port it to C#, but it should be fairly trivial to implement the installer as a C# method in your project. The file InstallStager.exe contains both DLL's and the r77 service. I'd also recommend you to read my documentation as it describes the complete process and what exactly to consider when using the rootkit.

You can basically write a downloader for InstallStub.exe.

from r77-rootkit.

Yes, I got the error with the old version of the installer, but the dll's I use is from the new version .!! thank you for taking the time to answer me!! You have done great work here!! I will take a look yes!

from r77-rootkit.