last version of wincheck

it`s last because of
My former employer was so so nice that he allowed me to publish this build. Btw I seek new job

Download
Mirror

Changelog: 

• add support of Windows 1909
• add support of new RFG relocs. As usually kernel itself has bad IMAGE_DYNAMIC_RELOCATION_TABLE - it contains zero type somewhere inside IMAGE_DYNAMIC_RELOCATION
• add dumping of WMI_LOGGER_CONTEXTs for InfinityHook detection (with -wmi option)
• add dumping of PsAltSystemCallHandlers
• add dumping of PoPdcCallbacks (with -pofx option)
• add dumping of PpmPlatformStates (with -ppm option)
• add dumping callbacks registered with RtlRegisterFeatureConfigurationChangeNotification function 

there will be no more new versions of wincheck

bcs all source code belongs to my former employer
I do not have time and motivation to rewrite it for free
Sorry

wincheck rc8.61

download
mirror
Changelog:

• add support of Windows 10 RS4, 1809 & 1903
• add support of Windows 10 build 18922, but seems that this build hangs on RPC interfaces enumeration
• add dumping of AlpcpLogCallbackListHead (with -alpc option)
• add dumping of CfgMgr32.dll!CM_Register_Notification registered callbacks
• add dumping of providers from mpr.dll
• add new comdline options:
  • -denc - dump ntdll registered enclaves
  • -dynf - dump registered dynamic functions from RtlpDynamicFunctionTable
  • -dkt - dump kernel tracepoints
  • -vf - dump kernel verifier tables
  • -fs - dump DRIVER_OBJECTs registered with IoRegisterFsRegistrationChangeMountAware function
• lots of bugs was fixed (and added as usually)

wincheck rc8.60

download
mirror
Changelog:

• add some support of meltdown patched kernels. It seems that Microsoft backported from w10 InterruptObject to KPRCB on windows 8.1. so all offsets below this field were shifted downward and previous version of wincheck produced BSODs
• add dumping of SYSTEM_KERNEL_VA_SHADOW_INFORMATION
• add support of windows 10 build 17063
• add lots of new WNF IDs names from ADK version 10.1.16299

wincheck rc8.59

download
mirror
Changelog:

• add support of numerous versions of windows 10 insider preview - up to ~17025
• add -dsip option to dump SIPs from crypt32.dll
• add -dac & -dsac options to dump activation contexts and system activation contexts. based on this code from @deroko
• add dumping of rpcrt4 security providers
• add dumping of ETW private loggers (-wmi option)
• add lots of WNF IDs names
• add dumping of registered with winnsi!NsiRpcRegisterChangeNotification notifications

wincheck rc8.58

download
mirror
Changelog:

• add support of numerous versions of windows 10 insider preview - up to 16257
• add -j option to dump jobs
• add -dwf option to dump win32k filtering bitmaps
• add support of DelegatedNtdll
• add dumping of kprocess.LdtBaseAddress &LdtTableLength (based on this paper)

wincheck rc8.57

download
mirror
Changelog:

• add support of numerous versions of windows 10 insider preview - up to 16193
• add dumping of FilterConnectionPorts
• add support of RFG (and v2 too) 
• add dumping of ntdll!ProtectedPolicies
• add dumping of kernel etw traces (-wmi option)
• add dumping of EPROCESS.WnfContext
• add dumping of WNF kernelmode callbacks (-wnf option)

wincheck rc8.56

download
mirror

changelog:

• add support of windows 10rtm, build 14279 & 14295
• add dumping of g_pAuditingFuncs
• add dumping of hal!InterruptController
• add dumping of PICO. Sample of output:
  PspPicoProviderRoutines at FFFFF803D2F42EA0:
 DispatchSystemCall: FFFFF803B997B4B0 \SystemRoot\system32\drivers\LXCORE.SYS
 ExitThread:         FFFFF803B997B4E0 \SystemRoot\system32\drivers\LXCORE.SYS
 ExitProcess:        FFFFF803B997B450 \SystemRoot\system32\drivers\LXCORE.SYS
 DispatchException:  FFFFF803B997B1E0 \SystemRoot\system32\drivers\LXCORE.SYS
 ProcessTerminate:   FFFFF803B997B480 \SystemRoot\system32\drivers\LXCORE.SYS
 WalkUserStack:      FFFFF803B997B630 \SystemRoot\system32\drivers\LXCORE.SYS
 ProtectedRanges:    FFFFF803B9930400 \SystemRoot\system32\drivers\LXCORE.SYS
 GetAllocatedProcessImageName: FFFFF803B997B650 \SystemRoot\system32\drivers\LXCORE.SYS
• fix wnf identifiers
• fix WFP callouts for w8.1 & w10
• lots of bugs were fixed

wincheck rc8.55

download
mirror
Changelog:

• add support of windows10 build 10074
• add -gahti option to dump win32k!gahti
• add -sockets option to dump from tcpip.sys sockets and established connections. xp/w2k3 only
• add -sockets6 option to dump from tcpip6.sys sockets and established connections. xp/w2k3 only
• add checking win32k!gDxgkWin32kEngInterface
• add Period in timers dump
• lots of bugs were fixed

Cezurity cota in wincheck logs

Nothing new and interesting actually:
SDT entry 44 (ZwDuplicateObject) hooked BA8000CC !
SDT entry 7A (ZwOpenProcess) hooked BA800060 !
SDT entry 80 (ZwOpenThread) hooked BA800096 !
SDT entry C1 (ZwReplaceKey) hooked BA800138 !
SDT entry CC (ZwRestoreKey) hooked BA80016E !
SDT entry ED (ZwSetSecurityObject) hooked BA800102 !

Process notifiers:
[0] B9BB78D0 cz_cota.sys

Registry notifiers:
[0] B9BBCC10 cz_cota.sys

IopNotifyLastChanceShutdownQueueHead:
 [0] DevObj 8AF07F18 Drv 8AF2CB40 \??\C:\WINDOWS\system32\Drivers\cz_ddall.sys
And new fltmgr instance:  
 INSTANCE 8AA5F720:
  IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION: 8AA5F864
   PreOperation:            B9718EE0 cz_cotam.sys
   PostOperation:           00000000
  IRP_MJ_CREATE: 8AA5F8AC
   PreOperation:            B9719270 cz_cotam.sys
   PostOperation:           00000000
  IRP_MJ_WRITE: 8AA5F894
   PreOperation:            B9719020 cz_cotam.sys
   PostOperation:           00000000
  IRP_MJ_SET_INFORMATION: 8AA5F87C
   PreOperation:            B9718F50 cz_cotam.sys
   PostOperation:           B9718FA0 cz_cotam.sys
  IRP_MJ_CLEANUP: 8AA5F8C4
   PreOperation:            B9718FD0 cz_cotam.sys
   PostOperation:           B9719000 cz_cotam.sys

 INSTANCE 8AAA2008:
  IRP_MJ_CREATE: 8AAA214C
   PreOperation:            B9BC3AE0 cz_cota.sys
   PostOperation:           B9BC3A40 cz_cota.sys
  IRP_MJ_SET_INFORMATION: 8AAA2164
   PreOperation:            B9BC3930 cz_cota.sys
   PostOperation:           00000000


wincheck rc8.54

download
mirror
Changelog:

• add support of windows10 build 10041.
• add -obcb key for dumping object type callbacks. Sample from machine infected with dr.web (btw this north papua av consider wincheck as process.injecter, hell yeah):
  ObType Process (FFFFFA800CCCBBC0):
 DumpProcedure:        0000000000000000
 OpenProcedure:        FFFFF80003365620 \SystemRoot\system32\ntoskrnl.exe
 CloseProcedure:       FFFFF8000334C9A0 \SystemRoot\system32\ntoskrnl.exe
 DeleteProcedure:      FFFFF8000334BC50 \SystemRoot\system32\ntoskrnl.exe
 ParseProcedure:       0000000000000000
 SecurityProcedure:    FFFFF8000337D530 \SystemRoot\system32\ntoskrnl.exe
 QueryNameProcedure:   0000000000000000
 OkayToCloseProcedure: 0000000000000000
 2 callback(s):
  cb[0] operation 3
   PreOperation FFFFF88001157914 \SystemRoot\system32\drivers\dwprot.sys
  cb[1] operation 3
   PreOperation FFFFF88004890E30 \SystemRoot\system32\DRIVERS\VBoxDrv.sys
   PreOperation FFFFF8800488EBD0 \SystemRoot\system32\DRIVERS\VBoxDrv.sys

• add tables checking inside wudfx02000.dll

wincheck rc8.53

Download
Mirror
Changelog:

• improve support of different user-mode modules from w10
• add dumping of lsasrv!g_pLsaExtensionTableLsaDb

wincheck rc8.52

Add support of windows 10 (Technical Preview‎, build 9879 & 9926)

Download
Mirror

wincheck rc8.51

Download mirror
Changelog:

• add checking of some callbacks in MS crt modules (like purecall_handler, pInvalidArgHandler etc)
• add MiFlags dumping
• some bugs were fixed

wincheck rc8.50

Download changelog
Add support of windows 8.1 rtm

wincheck rc8.49

Download mirror
Changelog:

• add checking of shims inside apphelp.dll
• add checking of ole32 hook callbacks like pfnInitHookOle/pfnUninitHookOle/pfnEnableHookObject etc
• add some identification of applications within AppContainer
• add checking of KernelBase.dll!pfnAdjustObjectAttributesForPrivateNamespace (windows 8.1 only)
• some other bugs were fixed

wincheck rc8.48

Download mirror
Changelog:

• add some support of windows server 2012 r2
• fixed logic for addresses extracting from windows 8.1 preview win32k.sys
• fixed opening of protected processes on windows 8.1 preview
• add checking of dxgi!g_pDebugPrivate & dxgi!g_pDXGIMessage
• some other bugs were fixed 

wincheck rc8.47

Download mirror
Changelog:

• interrupts dumping now works on w8.1 preview 32bit
• fixed NDIS interfaces under w8.1 preview
• fixed registry notifiers for w8.1 preview 64bit
• modules loaded by wdfldr now shown under w8.1 preview
• fixed WMI regentries for w8.1 preview 64bit
• add dumping handlers registsred with KdRegisterPowerHandler

wincheck rc8.46

Download mirror
Some initial support of windows 8.1 preview was added
Known problems:

• -idt option does not work on 32bit w8.1. Btw !idt command in windbg also shows trash
• NDIS interfaces are not shown 
• registry notifiers are not shown on w8.1 64bit
• modules loaded by wdfldr are not shown

how Rootkit.Avatar looks like in wincheck logs

Many thanks to Anton Cherepanov for wincheck log from infected machine
Detailed description of avatar can be found here

1) FS Change notifiers
FS Change notifiers: 3 (actual 3)
DriverObj 8B6A31B8 addr 8362CBDA \SystemRoot\system32\drivers\fltmgr.sys
DriverObj 8BEC91B8 addr 8C477D40 UNKNOWN
DriverObj 8B6A31B8 addr 8362CBDA \SystemRoot\system32\drivers\fltmgr.sys

2) Pnp Notifiers
Pnp Notifiers: total 19, readed 19
...
 Pnp[6] CategoryHardwareProfileChange DEVINTERFACE_MT_COMPOSITE addr 92FE793A \SystemRoot\system32\DRIVERS\CompositeBus.sys
 Pnp[7] CategoryHardwareProfileChange DEVINTERFACE_DISK addr 8B618180 UNKNOWN
 Pnp[8] CategoryHardwareProfileChange DEVINTERFACE_HIDDEN_VOLUME addr 8356D3E0 \SystemRoot\system32\DRIVERS\volmgr.sys
 
3) numerous driver patches