Defeat advanced WMI hardware sensor evasion checks (al-khaser Bypass)

capemon.c

@@ -562,6 +562,8 @@ void init_private_heap(void)
 }
 
 extern CRITICAL_SECTION readfile_critsec, g_mutex, g_writing_log_buffer_mutex, g_interactive_debugger_lock;
+DWORD g_wmi_tls_index = TLS_OUT_OF_INDEXES;
+DWORD g_wmi_tracker_tls_index = TLS_OUT_OF_INDEXES;
 BOOLEAN g_dll_main_complete;
 OSVERSIONINFOA g_osverinfo;
 
@@ -604,6 +606,8 @@ BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, LPVOID lpReserved)
 
 		InitializeCriticalSection(&g_mutex);
 		InitializeCriticalSection(&g_writing_log_buffer_mutex);
+		g_wmi_tls_index = TlsAlloc();
+		g_wmi_tracker_tls_index = TlsAlloc();
 
 		// read the config settings
 		read_config();
@@ -690,7 +694,19 @@ BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, LPVOID lpReserved)
 		if (!g_config.tlsdump && !g_config.interactive)
 			notify_successful_load();
 	}
+	else if (dwReason == DLL_THREAD_DETACH) {
+		extern void TlsWmiThreadCleanup(void);
+		TlsWmiThreadCleanup();
+	}
 	else if(dwReason == DLL_PROCESS_DETACH) {
+		if (g_wmi_tls_index != TLS_OUT_OF_INDEXES) {
+			TlsFree(g_wmi_tls_index);
+			g_wmi_tls_index = TLS_OUT_OF_INDEXES;
+		}
+		if (g_wmi_tracker_tls_index != TLS_OUT_OF_INDEXES) {
+			TlsFree(g_wmi_tracker_tls_index);
+			g_wmi_tracker_tls_index = TLS_OUT_OF_INDEXES;
+		}
 		// in production, we shouldn't ever get called in this way since we
 		// unlink ourselves from the module list in the PEB
 		// so don't call log_free(), as it'll have side-effects

config.c

@@ -1453,6 +1453,18 @@ void parse_config_line(char* line)
 			if (g_config.hook_watch)
 				DebugOutput("Config: Hook watch enabled.\n");
 		}
+		else if (!stricmp(key, "wmi-cache-size")) {
+			g_config.wmi_cache_size = (int)strtoul(value, NULL, 10);
+			DebugOutput("Config: WMI cache size set to %d.\n", g_config.wmi_cache_size);
+		}
+		else if (!stricmp(key, "wmi-voltage-reading")) {
+			g_config.wmi_voltage_reading = (int)strtoul(value, NULL, 10);
+			DebugOutput("Config: WMI voltage reading set to %d.\n", g_config.wmi_voltage_reading);
+		}
+		else if (!stricmp(key, "wmi-temperature-reading")) {
+			g_config.wmi_temperature_reading = (int)strtoul(value, NULL, 10);
+			DebugOutput("Config: WMI temperature reading set to %d.\n", g_config.wmi_temperature_reading);
+		}
 		else if (!stricmp(key, "sleep-skip-seconds")) {
 			g_config.sleep_skip_seconds = (int)strtoul(value, NULL, 10);
 			DebugOutput("Config: Sleep skip seconds set to %d.\n", g_config.sleep_skip_seconds);
@@ -1504,6 +1516,9 @@ void read_config(void)
 	g_config.loaderlock_scans = 1;
 	g_config.spoofed_cpu_count = SPOOFED_CPU_CORE_NUM;
 	g_config.syscall = 1;
+	g_config.wmi_cache_size = 32768;
+	g_config.wmi_voltage_reading = 12000;
+	g_config.wmi_temperature_reading = 3000;
 	g_config.sleep_skip_seconds = 10;
 
 	StepLimit = SINGLE_STEP_LIMIT;

config.h

@@ -336,6 +336,9 @@ struct _g_config {
 	int trace_times;
 	char *trace_into_api[EXCLUSION_MAX];
 	int hook_watch;
+	int wmi_cache_size;
+	int wmi_voltage_reading;
+	int wmi_temperature_reading;
 	int sleep_skip_seconds;
 };
 

docs/configuration.md

@@ -75,6 +75,9 @@ They are typically defined in the analysis configuration file (e.g., `config.ini
 | `fake-rdtsc` | Boolean | Enable fake RDTSC (Read Time-Stamp Counter) results. |
 | `nop-rdtscp` | Boolean | NOP (No Operation) the RDTSCP instruction. |
 | `cpu-count` | Integer | Spoof the number of CPU cores (default: 4). |
+| `wmi-cache-size` | Integer | Spoof the L1/L2/L3 cache memory size in bytes returned via Win32_CacheMemory queries (default: 32768). |
+| `wmi-voltage-reading` | Integer | Spoof the voltage reading in millivolts returned via Win32_VoltageProbe queries (default: 12000). |
+| `wmi-temperature-reading` | Integer | Spoof the thermal zone sensor temperature in tenths of Kelvins returned via Win32_ThermalZoneInfo queries (default: 3000). |
 | `ntdll-protect` | Boolean | Enable write protection on `ntdll.dll` code (enabled by default). |
 | `ntdll-unhook` | Boolean | Enable protection against `ntdll` unhooking (via `NtReadFile`). |
 | `ntdll-remap` | Boolean | Enable `ntdll` remapping protection. |

hook_com.c

@@ -40,7 +40,7 @@ BOOL ContainsNamespace(const wchar_t* resource, const wchar_t* target) {
 	return FALSE;
 }
 
-__declspec(thread) BOOL bHookViaWbemLocator;
+#include "hooks.h"
 HOOKDEF(HRESULT, WINAPI, WbemLocator_ConnectServer,
 	_In_	PVOID			_this,
 	_In_	const BSTR		strNetworkResource,
@@ -63,9 +63,9 @@ HOOKDEF(HRESULT, WINAPI, WbemLocator_ConnectServer,
 		ContainsNamespace(strNetworkResource, L"ROOT\\Microsoft\\Windows\\TaskScheduler")
 	)) 
 	{
-		bHookViaWbemLocator = TRUE;
+		SetHookViaWbemLocator(TRUE);
 		set_com_hooks(NULL, NULL, *ppNamespace);
-		bHookViaWbemLocator = FALSE;
+		SetHookViaWbemLocator(FALSE);
 	}
 
 	LOQ_hresult("com", "uu", "NetworkResource", strNetworkResource, "User", strUser);