new plugin callbackmon

configure.ac

@@ -484,6 +484,16 @@ if test x$plugin_rootkitmon = xyes; then
   AC_DEFINE_UNQUOTED(ENABLE_PLUGIN_ROOTKITMON, 1, "")
 fi
 
+AC_ARG_ENABLE([plugin_callbackmon],
+  [AS_HELP_STRING([--disable-plugin-callbackmon],
+    [Enable callbackmon plugin @<:@yes@:>@])],
+  [plugin_callbackmon="$enableval"],
+  [plugin_callbackmon="yes"])
+AM_CONDITIONAL([PLUGIN_CALLBACKMON], [test x$plugin_callbackmon = xyes])
+if test x$plugin_rootkitmon = xyes; then
+  AC_DEFINE_UNQUOTED(ENABLE_PLUGIN_CALLBACKMON, 1, "")
+fi
+
 AC_ARG_ENABLE([DISABLE_ATOMS],
   [AS_HELP_STRING([--disable-atoms],
     [Disable atom table parsing in hidsim plugin @<:@no@:>@])],
@@ -781,6 +791,7 @@ LibHookTest:  $plugin_libhooktest
 IPT:          $plugin_ipt
 HidSim:       $plugin_hidsim
 Rootkitmon:   $plugin_rootkitmon
+Callbackmon:  $plugin_callbackmon
 -------------------------------------------------------------------------------
 Deprecated Plugins
 WMIMon:       $plugin_wmimon

src/main.cpp

@@ -342,6 +342,10 @@ static void print_usage()
         "\t                           The JSON profile for fwpkclnt.sys\n"
         "\t --json-fltmgr <path to json>\n"
         "\t                           The JSON profile for fltmgr.sys\n"
+#endif
+#ifdef ENABLE_PLUGIN_CALLBACKMON
+        "\t --json-netio <path to json>\n"
+        "\t                           The JSON profile for netio.sys\n"
 #endif
         "\t -h, --help                Show this help\n"
     );
@@ -453,6 +457,7 @@ int main(int argc, char** argv)
         opt_hidsim_random_clicks,
         opt_rootkitmon_json_fwpkclnt,
         opt_rootkitmon_json_fltmgr,
+        opt_callbackmon_json_netio,
         opt_json_hal
     };
     const option long_opts[] =
@@ -519,6 +524,7 @@ int main(int argc, char** argv)
         {"hid-random-clicks", no_argument, NULL, opt_hidsim_random_clicks},
         {"json-fwpkclnt", required_argument, NULL, opt_rootkitmon_json_fwpkclnt},
         {"json-fltmgr", required_argument, NULL, opt_rootkitmon_json_fltmgr},
+        {"json-netio", required_argument, NULL, opt_callbackmon_json_netio},
         {"json-hal", required_argument, NULL, opt_json_hal},
         {NULL, 0, NULL, 0}
     };
@@ -831,6 +837,11 @@ int main(int argc, char** argv)
                 options.fltmgr_profile = optarg;
                 break;
 #endif
+#ifdef ENABLE_PLUGIN_CALLBACKMON
+            case opt_callbackmon_json_netio:
+                options.netio_profile = optarg;
+                break;
+#endif
 
             case 'h':
                 print_usage();

src/plugins/Makefile.am

@@ -338,6 +338,11 @@ sources += rootkitmon/rootkitmon.h
 sources += rootkitmon/private.h
 endif
 
+if PLUGIN_CALLBACKMON
+sources += callbackmon/callbackmon.cpp
+sources += callbackmon/callbackmon.h
+endif
+
 ###############################################################################
 sources += plugins.cpp plugins.h plugins_ex.cpp plugins_ex.h plugin_utils.cpp plugin_utils.h private.h type_traits_helpers.h hook_helpers.h
 sources += output_format.h output_format/common.h output_format/csvfmt.h output_format/deffmt.h output_format/jsonfmt.h output_format/kvfmt.h

src/plugins/callbackmon/README.md

@@ -0,0 +1,31 @@
+# Abstract
+
+The _callbackmon_ plug-in detects overwritten/deleted/added callbacks in various kernel structures.
+
+## Description
+
+The plug-in collects already installed callbacks at the beginning of the analysis and compares them with the snapshot, created at the end of analysis.
+
+List of structures that callbackmon currently monitors:
+
+* `PspCreateProcessNotifyRoutine`
+* `PspCreateThreadNotifyRoutine`
+* `PspLoadImageNotifyRoutine`
+* `KeBugCheckCallbackListHead`
+* `KeBugCheckReasonCallbackListHead`
+* `CallbackListHead`
+* `SeFileSystemNotifyRoutinesHead`
+* `PopRegisteredPowerSettingCallbacks`
+* `IopNotifyShutdownQueueHead`
+* `IopNotifyLastChanceShutdownQueueHead`
+* `RtlpDebugPrintCallbackList`
+* `IopFsNotifyChangeQueueHead`
+* `IopDriverReinitializeQueueHead`
+* `IopBootDriverReinitializeQueueHead`
+* `KiNmiCallbackListHead`
+* `IopUpdatePriorityCallbackRoutine`
+* `PnpProfileNotifyList`
+* `PnpDeviceClassNotifyList`
+* `EmpCallbackListHead`
+* `PsWin32CallBack`
+* `netio.sys gWfpGlobal callbacks`