SilentMoonwalk: PoC Implementation of a fully dynamic call stack spoofer
SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from the control flow.
The tool currently supports 2 modes, where one is actually a wrong patch to a non-working pop RBP frame identified, which operates by shifting the current RSP and adding two fake frames to the call stack. As it operates using synthetic frames, I refer to this mode as “SYNTHETIC”.
When selecting the frame that unwinds by popping the RBP register from the stack, the tool might select an unsuitable frame, ending up in an abruptly cut call stack, as observable below.
Synthetic Call Stack Mode
A silly solution to the problem would be to create two fake frames and link them back to the cut call stack. This would create a sort of apparently legit call stack, even without a suitable frame which unwinds calling POP RBP, but:
- You would lose the advantage of the desync technique
- The stack would be still unwindable
- The resulting call stack could seem legit just on the first glance, but it would probably not pass a strict check
The result of the _synthetic spoof can be observed in the image below:
Note: This operation mode is disabled by default. To enable this mode, change the CALLSTACK_TYPE to 1
Desync Stack Mode
This mode is the right solution to the above problem, whereby the non-suitable frame is simply replaced by another, suitable one.
Copyright (c) 2022, Alessandro Magnosi, Arash Parsa, Athanasios Tserpelis