{"id":3333,"date":"2015-10-26T14:30:09","date_gmt":"2015-10-26T14:30:09","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3333"},"modified":"2025-02-15T00:34:12","modified_gmt":"2025-02-15T00:34:12","slug":"heavens-gate-and-a-chameleon-code-x8664","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/10\/26\/heavens-gate-and-a-chameleon-code-x8664\/","title":{"rendered":"Heaven’s gate and a chameleon code (x86\/64)"},"content":{"rendered":"

A so-called heaven’s gate<\/a> is not only a built-in feature of a 64-bit Windows, but also a neat reversing trick. It can be used (and is) by malware authors to temporarily switch the code execution between 32- (WOW64) and 64-bit long mode. While operating in a 64-bit long mode it executes the 64-bit instructions and this can be used to execute some funny stuff before returning to 32-bit code (f.ex. can be used to detect a debugger).<\/p>\n

The trick is very old, many blogs describe how to mix 32- and 64-bit code execution pipelines while using it and that’s why it is a part of the topic I am going to talk about today.<\/p>\n

A few years back I was looking at a sample that used the heaven’s gate trick, but apart from this, it also contained another trick – a chameleon code – a stream of bytes that could be executed as both 32- and 64-bit code, depending on the context. I found it to be quite cool and took a mental note of that malware family.<\/p>\n

I recently came across a different sample from the same family malware and since its analysis reminded me about that supercool trick, I thought it would be nice to write a post about it.<\/p>\n

The sample hash is E4AB5596CB8FBE932670A6A5420E7AB9 (note it is old, from 2013).<\/p>\n

Note: Mind you that before it reaches the heaven’s gate\/chameleon code it will try to stop you by using a couple of known and lesser-known anti-reversing tricks (there is a number of them, and they are quite creative; I won’t describe it in detail not to spoil the fun in case you want to take a stab at the sample yourself).<\/p>\n

The 32-bit code right before jumping far to 64-bit code:<\/p>\n

\"heavensgate1\"<\/a>Immediately after the far jump we land in 64-bit code.<\/p>\n

\"heavensgate2\"<\/a>Note the offsets of instructions on both screenshots.<\/p>\n

Btw. while I am not the biggest fan of windbg for day to day work, its ability to reverse such chameleon code ‘on the fly’ comes really handy.<\/p>\n

After some more jumps and calls the code eventually ends in these 2 places (left 32-bit, right 64-bit – 2 different VMs):<\/p>\n

\"heavensgate3\"<\/a>We can compare the opcodes and their meanings side by side:<\/p>\n

\"heavensgate4\"<\/a>They both execute in their respective modes (32- and 64-).<\/p>\n

The inability to distinguish between code and data is a well known fact. Ability to code a program that is binary level-identical and executes flawlessly on two different architectures is a completely different animal.<\/p>\n

For what it’s worth – it was written in fasm.<\/p>\n","protected":false},"excerpt":{"rendered":"

A so-called heaven’s gate is not only a built-in feature of a 64-bit Windows, but also a neat reversing trick. It can be used (and is) by malware authors to temporarily switch the code execution between 32- (WOW64) and 64-bit … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,10,9,44],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3333"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3333"}],"version-history":[{"count":12,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3333\/revisions"}],"predecessor-version":[{"id":9869,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3333\/revisions\/9869"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}