DojoLoader: Generic PE loader for fast prototyping evasion techniques

by ·

DojoLoader

DojoLoader is a generic PE loader initially created to prototype sleep obfuscation techniques with Cobalt Strike UDRL-less raw Beacon payload, in an attempt to reduce debugging time with UDRLs.

DojoLoader borrows the MemoryModule implementation of the DynamicDllLoader project by ORCA000 and expands on that adding modularity and the following features:

  1. download and execution of (xored) shellcode from HTTP of from file
  2. dynamic IAT hooking for Sleep function
  3. Three different Sleep obfuscation techniques are implemented in the Hook library
    • RW->RX
    • MemoryBouncing
    • MemoryHopping

Rw->RX sleep obfuscation is a classic RW -> encrypt -> Sleep -> decrypt -> RX -> RW -> encrypt scheme.

MemoryBouncing is a different (from publicly available techniques) sleep obfuscation that aims to evade public RX->RW detections and involves the following steps:

  1. Copy mapped PE to a buffer and encrypt it
  2. Free mapped PE address
  3. do sleep time (e.g. SleepEx)
  4. Allocate RWX address on the same address where PE was mapped
  5. decrypt the buffer and copy it over the RWX memory

RX->RW detection is evaded by avoiding VirtualProtect and hiding the payload during sleep by freeing the payload memory area.

MemoryHopping is another different (from publicly available techniques) sleep obfuscation that aims to evade public RX->RW detections and involves the following steps:

  1. save the return address
  2. copy the mapped PE bytes to a buffer and optionally encrypt it
  3. Free the memory of the mapped payload
  4. allocate RWX memory on a different address
  5. calculate the delta and adjust the return address accordingly
  6. copy bytes from the buffer to the newly created memory region
  7. perform relocations on the copied bytes
  8. resume execution from the adjusted return address

Download & Use

Tags: