2026-03-09 02:03:04 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 文档分享睡眠混淆技术，通过定时内存加解密与权限切换规避检测。重点解析Ekko和Cronos利用TimerQueue、ROP链及NtContinue实现休眠加密的机制。同时探讨防御方案，涵盖Hunt-Sleeping-Beacons对可疑计时器、异常调用栈等特征的扫描，以及EtwTi-FluctuationMonitor利用ETW监控内存权限波动的原理，为攻防对抗提供技术参考。 综合评分： 85 文章分类： 免杀,红队,二进制安全,安全工具,实战经验

cover_image

【转载】睡眠混淆技术分享

Arcueid Arcueid

隐雾安全

2026年3月8日 10:06 四川

好文推荐

文章作者：先知社区(Arcueid)

文章来源：https://xz.aliyun.com/news/17512

睡眠混淆是用于对抗内存检测的一项技术在特定的触发器触发或定时执行内存加解密改变权限来规避AV检测

下面通过几个开源项目学习这种技术

sleep obfuscation

EKKO

https://github.com/Cracked5pider/Ekko

VOID&nbsp;EkkoObf( DWORD SleepTime )&nbsp;{&nbsp; &nbsp; &nbsp;CONTEXT&nbsp;CtxThread&nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};
&nbsp; &nbsp; &nbsp;CONTEXT&nbsp;RopProtRW&nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};&nbsp; &nbsp; &nbsp;CONTEXT&nbsp;RopMemEnc&nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};&nbsp; &nbsp; &nbsp;CONTEXT&nbsp;RopDelay&nbsp; &nbsp;&nbsp;=&nbsp;{&nbsp;0&nbsp;};&nbsp; &nbsp; &nbsp;CONTEXT&nbsp;RopMemDec&nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};&nbsp; &nbsp; &nbsp;CONTEXT&nbsp;RopProtRX&nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};&nbsp; &nbsp; &nbsp;CONTEXT&nbsp;RopSetEvt&nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};
&nbsp; &nbsp; &nbsp;HANDLE&nbsp;&nbsp;hTimerQueue&nbsp;=&nbsp;NULL;&nbsp; &nbsp; &nbsp;HANDLE&nbsp;&nbsp;hNewTimer&nbsp; &nbsp;=&nbsp;NULL;&nbsp; &nbsp; &nbsp;HANDLE&nbsp;&nbsp;hEvent&nbsp; &nbsp; &nbsp;&nbsp;=&nbsp;NULL;&nbsp; &nbsp; &nbsp;PVOID&nbsp; &nbsp;ImageBase&nbsp; &nbsp;=&nbsp;NULL;&nbsp; &nbsp; &nbsp;DWORD&nbsp; &nbsp;ImageSize&nbsp; &nbsp;=&nbsp;0;&nbsp; &nbsp; &nbsp;DWORD&nbsp; &nbsp;OldProtect&nbsp;&nbsp;=&nbsp;0;
&nbsp; &nbsp; &nbsp;// Can be randomly generated&nbsp; &nbsp; &nbsp;CHAR &nbsp; &nbsp;KeyBuf[&nbsp;16&nbsp;]= {&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55,&nbsp;0x55&nbsp;};&nbsp; &nbsp; &nbsp;USTRING&nbsp;Key&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};&nbsp; &nbsp; &nbsp;USTRING&nbsp;Img&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;{&nbsp;0&nbsp;};
&nbsp; &nbsp; &nbsp;PVOID&nbsp; &nbsp;NtContinue&nbsp;&nbsp;=&nbsp;NULL;&nbsp; &nbsp; &nbsp;PVOID&nbsp; &nbsp;SysFunc032&nbsp;&nbsp;=&nbsp;NULL;
&nbsp; &nbsp; &nbsp;hEvent &nbsp; &nbsp; &nbsp;= CreateEventW(&nbsp;0,&nbsp;0,&nbsp;0,&nbsp;0&nbsp;);&nbsp; &nbsp; &nbsp;hTimerQueue = CreateTimerQueue();
&nbsp; &nbsp; &nbsp;NtContinue &nbsp;= GetProcAddress( GetModuleHandleA(&nbsp;"Ntdll"&nbsp;),&nbsp;"NtContinue"&nbsp;);&nbsp; &nbsp; &nbsp;SysFunc032 &nbsp;= GetProcAddress( LoadLibraryA(&nbsp;"Advapi32"&nbsp;), &nbsp;"SystemFunction032"&nbsp;);
&nbsp; &nbsp; &nbsp;ImageBase &nbsp; = GetModuleHandleA( NULL );&nbsp; &nbsp; &nbsp;ImageSize &nbsp; = ( ( PIMAGE_NT_HEADERS ) ( ImageBase + ( ( PIMAGE_DOS_HEADER ) ImageBase )->e_lfanew ) )->OptionalHeader.SizeOfImage;
&nbsp; &nbsp; &nbsp;Key.Buffer &nbsp;= KeyBuf;&nbsp; &nbsp; &nbsp;Key.Length &nbsp;= Key.MaximumLength =&nbsp;16;
&nbsp; &nbsp; &nbsp;Img.Buffer &nbsp;= ImageBase;&nbsp; &nbsp; &nbsp;Img.Length &nbsp;= Img.MaximumLength = ImageSize;
&nbsp; &nbsp; &nbsp;if&nbsp;( CreateTimerQueueTimer( &hNewTimer, hTimerQueue, RtlCaptureContext, &CtxThread,&nbsp;0,&nbsp;0, WT_EXECUTEINTIMERTHREAD ) )&nbsp; &nbsp; &nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;WaitForSingleObject( hEvent,&nbsp;0x32&nbsp;);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;memcpy( &RopProtRW, &CtxThread, sizeof( CONTEXT ) );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;memcpy( &RopMemEnc, &CtxThread, sizeof( CONTEXT ) );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;memcpy( &RopDelay, &nbsp;&CtxThread, sizeof( CONTEXT ) );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;memcpy( &RopMemDec, &CtxThread, sizeof( CONTEXT ) );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;memcpy( &RopProtRX, &CtxThread, sizeof( CONTEXT ) );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;memcpy( &RopSetEvt, &CtxThread, sizeof( CONTEXT ) );
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// VirtualProtect( ImageBase, ImageSize, PAGE_READWRITE, &OldProtect );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRW.Rsp &nbsp;-=&nbsp;8;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRW.Rip &nbsp; = VirtualProtect;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRW.Rcx &nbsp; = ImageBase;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRW.Rdx &nbsp; = ImageSize;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRW.R8 &nbsp; &nbsp;= PAGE_READWRITE;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRW.R9 &nbsp; &nbsp;= &OldProtect;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// SystemFunction032( &Key, &Img );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemEnc.Rsp &nbsp;-=&nbsp;8;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemEnc.Rip &nbsp; = SysFunc032;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemEnc.Rcx &nbsp; = &Img;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemEnc.Rdx &nbsp; = &Key;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// WaitForSingleObject( hTargetHdl, SleepTime );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopDelay.Rsp &nbsp; -=&nbsp;8;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopDelay.Rip &nbsp; &nbsp;= WaitForSingleObject;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopDelay.Rcx &nbsp; &nbsp;= NtCurrentProcess();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopDelay.Rdx &nbsp; &nbsp;= SleepTime;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// SystemFunction032( &Key, &Img );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemDec.Rsp &nbsp;-=&nbsp;8;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemDec.Rip &nbsp; = SysFunc032;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemDec.Rcx &nbsp; = &Img;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopMemDec.Rdx &nbsp; = &Key;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// VirtualProtect( ImageBase, ImageSize, PAGE_EXECUTE_READWRITE, &OldProtect );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRX.Rsp &nbsp;-=&nbsp;8;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRX.Rip &nbsp; = VirtualProtect;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRX.Rcx &nbsp; = ImageBase;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRX.Rdx &nbsp; = ImageSize;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRX.R8 &nbsp; &nbsp;= PAGE_EXECUTE_READWRITE;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopProtRX.R9 &nbsp; &nbsp;= &OldProtect;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// SetEvent( hEvent );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopSetEvt.Rsp &nbsp;-=&nbsp;8;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopSetEvt.Rip &nbsp; = SetEvent;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;RopSetEvt.Rcx &nbsp; = hEvent;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;puts(&nbsp;"[INFO] Queue timers"&nbsp;);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopProtRW,&nbsp;100,&nbsp;0, WT_EXECUTEINTIMERTHREAD );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopMemEnc,&nbsp;200,&nbsp;0, WT_EXECUTEINTIMERTHREAD );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopDelay, &nbsp;300,&nbsp;0, WT_EXECUTEINTIMERTHREAD );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopMemDec,&nbsp;400,&nbsp;0, WT_EXECUTEINTIMERTHREAD );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopProtRX,&nbsp;500,&nbsp;0, WT_EXECUTEINTIMERTHREAD );&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CreateTimerQueueTimer( &hNewTimer, hTimerQueue, NtContinue, &RopSetEvt,&nbsp;600,&nbsp;0, WT_EXECUTEINTIMERTHREAD );
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;puts(&nbsp;"[INFO] Wait for hEvent"&nbsp;);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;WaitForSingleObject( hEvent, INFINITE );
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;puts(&nbsp;"[INFO] Finished waiting for event"&nbsp;);&nbsp; &nbsp; &nbsp;}
&nbsp; &nbsp; &nbsp;DeleteTimerQueue( hTimerQueue );&nbsp;}

首先创建了一个事件一个TimerQueue

然后获取NtContinue用于切换线程上下文 SystemFunction032 用于加密

CreateTimerQueueTimer的第三个参数是个回调RtlCaptureContext 用于获取线程上下文填充到CtxThread

在if内进行ROP的初始化利用NtContinue切换rip 依次执行修改内存属性加密 sleep 解密修改内存属性

对应的函数参数作者给出了注释

以上这些事是工作线程做的最终SetEvent 使控制流返回主线程

CreateTimerQueueTimer 底层调用ntdll!RtlCreateTimer 调用了ntdll!TpSetTimerEx 调用了ntdll!TppSetTimer

在TppSetTimer中调用TppETWTimerSet 最终会调用NtTraceEvent记录

但是实际上在TppEtwTimerSet上下断并断不下来

SharedData是空的

Cronos

https://github.com/Idov31/Cronos

创建定时器同样通过RtlCaptureContext 获取线程上下文

从加载的所有模块中搜特征码

同样通过Ntcontinue切换上下文

QuadSleep纯汇编实现

rcx: pop rcx; ret

rdx: pop rdx; ret

r8: add rsp,20; pop rdi; ret

r9: SleepEx

调用SleepEx从而APC

修改内存属性为RW -> 加密 -> 解密 -> 修改内存属性为RWX

检测

Hunt-Sleeping-Beacons

具体WorkFactory相关知识可以参考

https://urien.gitbook.io/diago-lima/a-deep-dive-into-exploiting-windows-thread-pools/attacking-worker-factories

直接跟进process_scanner::scan_processes

对传进来的process数组进行扫描具体的扫描行为定义在

suspicious_timer

通过NtQuerySystemInformation 查询进程句柄信息获取所有WorkerFactory

每个WorkerFactory都有对应的StartRoutine 由其创建的工作线程执行

通过NtQueryInformationWorkerFactory 可以查询StartRoutine

这里通过该API查询获得StartParameter 一个指向 TP_POOL的指针

TimerQueue就处于这个结构中

typedef&nbsp;struct&nbsp;_FULL_TP_POOL&nbsp;{&nbsp; &nbsp; &nbsp;struct&nbsp;_TPP_REFCOUNT&nbsp;Refcount;&nbsp; &nbsp; &nbsp;long&nbsp;Padding_239;&nbsp; &nbsp; &nbsp;union&nbsp;_TPP_POOL_QUEUE_STATE&nbsp;QueueState;&nbsp; &nbsp; &nbsp;struct&nbsp;_TPP_QUEUE* TaskQueue[3];&nbsp; &nbsp; &nbsp;struct&nbsp;_TPP_NUMA_NODE* NumaNode;&nbsp; &nbsp; &nbsp;struct&nbsp;_GROUP_AFFINITY* ProximityInfo;&nbsp; &nbsp; &nbsp;void* WorkerFactory;&nbsp; &nbsp; &nbsp;void* CompletionPort;&nbsp; &nbsp; &nbsp;struct&nbsp;_RTL_SRWLOCK&nbsp;Lock;&nbsp; &nbsp; &nbsp;struct&nbsp;_LIST_ENTRY&nbsp;PoolObjectList;&nbsp; &nbsp; &nbsp;struct&nbsp;_LIST_ENTRY&nbsp;WorkerList;&nbsp; &nbsp; &nbsp;struct&nbsp;_TPP_TIMER_QUEUE&nbsp;TimerQueue;&nbsp; &nbsp; &nbsp;struct&nbsp;_RTL_SRWLOCK&nbsp;ShutdownLock;&nbsp; &nbsp; &nbsp;UINT8 ShutdownInitiated;&nbsp; &nbsp; &nbsp;UINT8 Released;&nbsp; &nbsp; &nbsp;UINT16 PoolFlags;&nbsp; &nbsp; &nbsp;long&nbsp;Padding_240;&nbsp; &nbsp; &nbsp;struct&nbsp;_LIST_ENTRY&nbsp;PoolLinks;&nbsp; &nbsp; &nbsp;struct&nbsp;_TPP_CALLER&nbsp;AllocCaller;&nbsp; &nbsp; &nbsp;struct&nbsp;_TPP_CALLER&nbsp;ReleaseCaller;&nbsp; &nbsp; &nbsp;volatile&nbsp;INT32 AvailableWorkerCount;&nbsp; &nbsp; &nbsp;volatile&nbsp;INT32 LongRunningWorkerCount;&nbsp; &nbsp; &nbsp;UINT32 LastProcCount;&nbsp; &nbsp; &nbsp;volatile&nbsp;INT32 NodeStatus;&nbsp; &nbsp; &nbsp;volatile&nbsp;INT32 BindingCount;&nbsp; &nbsp; &nbsp;UINT32 CallbackChecksDisabled :&nbsp;1;&nbsp; &nbsp; &nbsp;UINT32 TrimTarget :&nbsp;11;&nbsp; &nbsp; &nbsp;UINT32 TrimmedThrdCount :&nbsp;11;&nbsp; &nbsp; &nbsp;UINT32 SelectedCpuSetCount;&nbsp; &nbsp; &nbsp;long&nbsp;Padding_241;&nbsp; &nbsp; &nbsp;struct&nbsp;_RTL_CONDITION_VARIABLE&nbsp;TrimComplete;&nbsp; &nbsp; &nbsp;struct&nbsp;_LIST_ENTRY&nbsp;TrimmedWorkerList;&nbsp;} FULL_TP_POOL, * PFULL_TP_POOL;

通过判断函数地址以确认是否恶意

blocking_apc

遍历堆栈检查是否调用了KiUserApcDispatcher

blocking_timer

遍历堆栈，检查是否调用了 RtlpTpTimerCallback

abnormal_intermodular_call

检测异常调用堆栈通过判断kernelbase或kernel32 是否是由ntdll调用过来的以决定是否恶意

因为正常情况下是不存在这种调用的

return_address_spoofing

检测返回地址是否为 jmp rbx, jmp rbp等

stomped_module

遍历调用堆栈判断其返回地址的模块是否是原始共享模块(即未被修改) 来判断是否恶意 (一些关键dll不在此列)

hardware_breakpoints

检测DR0-3 DR7 从而判断是否启用了硬件断点以判断是否恶意

non_executable_memory

判断地址是否没有任一执行权限 PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY

调用堆栈中的地址没有执行权限这是不正常的

EtwTi-FluctuationMonitor

https://github.com/jdu2600/EtwTi-FluctuationMonitor

Black hat ASIA 2023 You Can Run, but You Can’t Hide – Finding the Footprints of Hidden Shellcode 提到

一块内存反复的修改权限是不正常的可以设置一个阈值当该内存修改次数达到阈值时告警

通过订阅Microsoft-Windows-Threat-Intelligence的KERNEL_THREATINT_KEYWORD_PROTECTVM_LOCAL

设置回调判断是否是第一次发生权限变化

变化后插入g_ImmutableCodePages 即标记为不可变

如果后续发生变化且是不可变的则输出…is fluctuating 也就是说这里的阈值是1

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：隐雾安全 Arcueid Arcueid《【转载】睡眠混淆技术分享》