R0Nav 1.0

I have developed a variation of Dayznavigator called R0Nav, which can run in hidden and unnoticed for BE. The same works thanks to an injection of type ring0 hiding all threads of the process set (in this case a browser). As you know BE scans system memory sniffing modifications but with this, running in kernel mode, it can not detect the presence of the original DayzNav code by sd (for now injected only in Firefox). I have verified that it works undetectable from 2 months ago. Unfortunately I'm afraid to publish the program because it is still in testing stage and there is a risk (minimum) to account ban. I would also have to fix performance problems (a fall of approximately 25% of fps, which for now I can not patch -EDIT: Now FIXED-). Please I ask administrators to advise me what to do. Those who want to help me with testing -at your own risk- please let me know (you must have: 32 bit OS version, XP or 7 only) . You may wonder if it will be free, I reply that while I have time it will. Sorry for my poor English. Greetings from Argentina.

Confirmed: Release date: 11/5/2012

Part of the code that compiles part of ring0 driver:

Code

Code:

#include <ntddk.h>
#include "process.h"

typedef unsigned char BYTE, *PBYTE;

WCHAR *ProcessToHide[128];
ULONG NbProcessToHide=0;

ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformationAddress = NULL;   

LONGLONG UserTime=0, KernelTime=0;

NTSTATUS ZwQuerySystemInformationHook(
            IN ULONG SystemInformationClass,
            IN PVOID SystemInformation,
            IN ULONG SystemInformationLength,
            OUT PULONG ReturnLength)
{

   NTSTATUS status;
   PSYSTEM_PROCESS_INFORMATION curr;
   PSYSTEM_PROCESS_INFORMATION prev;
   ULONG i;

   status = ((ZWQUERYSYSTEMINFORMATION)(ZwQuerySystemInformati  onAddress)) (
					SystemInformationClass,
					SystemInformation,
					SystemInformationLength,
					ReturnLength );

   if( !NT_SUCCESS(status) ) 
      return status;
   
   if(SystemInformationClass!=5) // not a process request
      return status;       
   
   for(i=0; i<NbProcessToHide; i++) {
      
      curr = (PSYSTEM_PROCESS_INFORMATION)SystemInformation;
      prev = NULL;
            	 
      while(curr) {
         //DbgPrint("Current item is %x\n", curr);
         if (curr->ProcessName.Buffer != NULL) {   
                                   
            if( curr->ProcessName.Length == wcslen(ProcessToHide[i])*2 &&
                !memcmp(curr->ProcessName.Buffer,ProcessToHide[i], curr->ProcessName.Length)) 
            {                                                                       
            
               if(!prev) {
                  // we are first process     
                  if(curr->NextEntryDelta) // if there is a process after it
                     // first process becomes this one
			         (PBYTE)SystemInformation += curr->NextEntryDelta;
			      else 
                     // no process ! >_>
                     SystemInformation = NULL;
			   }
			   else {
                  // there was a process before
			      if(curr->NextEntryDelta) // if there is a process after
			         // previous process leads to next 
			         prev->NextEntryDelta += curr->NextEntryDelta;
			      else	
			         // previous process is the last one =)
			         prev->NextEntryDelta = 0;    
			   }	
            } 
            else
               // not a process to hide, prev ptr go to this process
               prev = curr;  
         }

         // curr go to next process
         if(curr->NextEntryDelta) 
            ((PBYTE)curr += curr->NextEntryDelta);
         else 
             curr = NULL;
      }
   }
   
   return status;
}

Nice to see people working on new stuff instead of leeching it , looking forward to seeing it finished.

Originally Posted by Pi0j0

I have developed a variation of Dayznavigator called R0Nav, which can run in hidden and unnoticed for BE. The same works thanks to an injection of type ring0 hiding all threads of the process set (in this case a browser). As you know BE scans system memory sniffing modifications but with this, running in kernel mode, it can not detect the presence of the original DayzNav code by sd (for now injected only in Firefox). I have verified that it works undetectable from 2 months ago. Unfortunately I'm afraid to publish the program because it is still in testing stage and there is a risk (minimum) to account ban. I would also have to fix performance problems (a fall of approximately 25% of fps, which for now I can not patch). Please I ask administrators to advise me what to do. Those who want to help me with testing -at your own risk- please let me know (you must have: 32 bit OS version, XP or 7 only) . You may wonder if it will be free, I reply that while I have time it will. Sorry for my poor English. Greetings from Argentina.

Part of the code that compiles part of ring0 driver:

Code

Code:

#include <ntddk.h>
#include "process.h"

typedef unsigned char BYTE, *PBYTE;

WCHAR *ProcessToHide[128];
ULONG NbProcessToHide=0;

ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformationAddress = NULL;   

LONGLONG UserTime=0, KernelTime=0;

NTSTATUS ZwQuerySystemInformationHook(
            IN ULONG SystemInformationClass,
            IN PVOID SystemInformation,
            IN ULONG SystemInformationLength,
            OUT PULONG ReturnLength)
{

   NTSTATUS status;
   PSYSTEM_PROCESS_INFORMATION curr;
   PSYSTEM_PROCESS_INFORMATION prev;
   ULONG i;

   status = ((ZWQUERYSYSTEMINFORMATION)(ZwQuerySystemInformationAddress)) (
					SystemInformationClass,
					SystemInformation,
					SystemInformationLength,
					ReturnLength );

   if( !NT_SUCCESS(status) ) 
      return status;
   
   if(SystemInformationClass!=5) // not a process request
      return status;       
   
   for(i=0; i<NbProcessToHide; i++) {
      
      curr = (PSYSTEM_PROCESS_INFORMATION)SystemInformation;
      prev = NULL;
            	 
      while(curr) {
         //DbgPrint("Current item is %x\n", curr);
         if (curr->ProcessName.Buffer != NULL) {   
                                   
            if( curr->ProcessName.Length == wcslen(ProcessToHide[i])*2 &&
                !memcmp(curr->ProcessName.Buffer,ProcessToHide[i], curr->ProcessName.Length)) 
            {                                                                       
            
               if(!prev) {
                  // we are first process     
                  if(curr->NextEntryDelta) // if there is a process after it
                     // first process becomes this one
			         (PBYTE)SystemInformation += curr->NextEntryDelta;
			      else 
                     // no process ! >_>
                     SystemInformation = NULL;
			   }
			   else {
                  // there was a process before
			      if(curr->NextEntryDelta) // if there is a process after
			         // previous process leads to next 
			         prev->NextEntryDelta += curr->NextEntryDelta;
			      else	
			         // previous process is the last one =)
			         prev->NextEntryDelta = 0;    
			   }	
            } 
            else
               // not a process to hide, prev ptr go to this process
               prev = curr;  
         }

         // curr go to next process
         if(curr->NextEntryDelta) 
            ((PBYTE)curr += curr->NextEntryDelta);
         else 
             curr = NULL;
      }
   }
   
   return status;
}

PM me for skype if you get stuck on something... I'm here to help.

looks interesting should release some kind of download people can test easily and report bugs, cant wait for finsih product

Originally Posted by Sabino

looks interesting should release some kind of download people can test easily and report bugs, cant wait for finsih product

I am finishing the last details of testing because there is a high risk of blue screen if not covered all scenarios. The version of Windows 64-bit will not be supported In This Release. (see: Kernel Patch Protection - Wikipedia, the free encyclopedia). I will upload a video in a few hours showing how it works, please be patient. I guess the final version should be ready by next week.

I could test if you but I have a 64bit system but quite a powerful PC so fps drop (if that's what you mean) is not a big problem

You realize BE now scans every single byte right? Virtually nothing is hidden.

Originally Posted by lockdown6435

You realize BE now scans every single byte right? Virtually nothing is hidden.

It will still work as using this makes a process invisible to be and they therefore can't read its memory
Btw you could just have used any root kit too, no need to recode its functionality despite the academic use

Originally Posted by lockdown6435

You realize BE now scans every single byte right? Virtually nothing is hidden.

Actually not exactly true. BE runs in ring 3 has no privileges to access memory ring0. If BE could scans that sector would be highly invasive and the possibility of a failure in the operating system will increase a lot.

---------- Post added at 07:25 PM ---------- Previous post was at 07:18 PM ----------

Originally Posted by sd333221

I thought about it. but I'd rather do it myself to improve performance and minimize errors this may cause. I also added some improvements to make it even more difficult to detect. The idea is to last for a long time without being detected.

thanks for replying sd

I could Also Help test it out for you, i Also have a windows 7 64-bit system

Originally Posted by starwiper

I could Also Help test it out for you, i Also have a windows 7 64-bit system

Originally Posted by Pi0j0

The version of Windows 64-bit will not be supported In This Release. (see: Kernel Patch Protection - Wikipedia, the free encyclopedia).

I need a little more time for the 64-bit version, sorry

Originally Posted by Pi0j0

I need a little more time for the 64-bit version, sorry

I would be happy to test it out for you mate, 32bit windows 7

Great work by the way, It's awesome seeing people helping out..that's what the dayz community is all about

Pm me on here or add me on skype Inten5ity if you want me to test...

Cheers

I wouldn't mind installing a 32bit OS on a seperate partition/hdd for testing purposes. So until you have 64bit working I'd like to test the 32bit version

Que buena onda un argento en mpgh

Suerte con el proyecto!
Edit: Tengo 32 bit así que puedo ayudarte

Saludos

no 64 bits support :/

R0Nav 1.0

Post a Reply

Tags for this Thread