VICE: Catch the Hookers!
Jamie Butler introduces VICE, a pioneering tool to detect kernel-level API hooking, inline function patches, and rootkit stealth techniques.
Summary
The Anatomy of Kernel and Userland Hooking
Jamie Butler explores the internal mechanisms that Windows rootkits use to conceal unauthorized activity from administrators and security tools. Hooking techniques intercept system execution flow across user mode and kernel space, modifying function behavior before returning results to caller applications.
Inline Function Patching and Call Table Hijacking
Rootkits commonly alter function entry points through inline trampolines, overwriting existing prologue instructions with unconditional jumps to malicious payloads. In addition to inline patches, attackers target call tables such as the System Service Descriptor Table (SSDT), the Interrupt Descriptor Table (IDT), and user-mode Import Address Tables (IAT) to redirect critical API queries.
Architecture of the VICE Detection Engine
VICE (Versatile In-memory Code Execution detection tool) scans operating system memory to identify unauthorized modifications without relying on static signature files. The engine inspects code sections in active memory, validating memory page permissions, detecting byte-level disassemblies that diverge from disk images, and identifying redirected export addresses.
Detecting Direct Kernel Object Manipulation
Beyond API hooking, Butler analyzes Direct Kernel Object Manipulation (DKOM), a stealth technique that modifies kernel data structures like the active process list without patching code. VICE addresses these advanced evasion patterns by correlating scheduler execution threads against object manager process lists to uncover completely hidden threats.
(AI summary — Gemini 3.8 Flash)
Related talks
Main Stage·53 min
Alexandre Borges
Alexandre Borges examines modern advanced malware samples are used to infect countries and they make part of the current cyber war, cyber espionage and financial attacks.
Main Stage·37 min
Itzik Kotler · Tomer Bitton
Itzik Kotler and Tomer Bitton explores the day of the updates at DEF CON 17, examining kernel-exploitation and practical defenses.
Main Stage·56 min
Sherri Sparks · Jamie Butler
Sherri Sparks and Jamie Butler details sherri Sparks & Jamie Butler, "Shadow Walker" - Raising The Bar For Rootkit Detection Last year at Black Hat, we introduced the rootkit FU.