hfiref0x / wdextract

Extract Windows Defender database from vdm files and unpack it

WDExtract

Extract Windows Defender database from vdm files and unpack it

• This program distributed as-is, without any warranty;
• No official support, if you like this tool, feel free to contribute.

Features

• Unpack VDM containers of Windows Defender/Microsoft Security Essentials;
• Decrypt VDM container embedded in Malicious software Removal Tool (MRT.exe);
• Extract all PE images from unpacked/decrypted containers on the fly (-e switch):
  • dump VDLLs (Virtual DLLs);
  • dump VFS (Virtual File System) contents;
  • dump signatures auxiliary images;
  • dump GAPA (Generic Application Level Protocol Analyzer) images used by NIS (Network Inspection System);
  • code can be adapted to dump type specific chunks of database (not implemented);
• Faster than any script.

List of MRT extracted images, (version 5.71.15840.1) https://gist.githubusercontent.com/hfiref0x/e4b97fb7135c9a6f9f0787c07da0a99d/raw/d91e77f71aa96bdb98d121b1d915dc697ce85e2a/gistfile1.txt

List of WD extracted images, mpasbase.vdm (version 1.291.0.0) https://gist.githubusercontent.com/hfiref0x/38e7845304d10c284220461c86491bdf/raw/39c999e59ff2a924932fe6db811555161596b4a7/gistfile1.txt

List of NIS signatures from NisBase.vdm (version 119.0.0.0) https://gist.githubusercontent.com/hfiref0x/e9b3f185032fcd2afb31afe7bc9a05bd/raw/9bd9f9cc7c408acaff7b56b810c8597756d55d14/nis_sig.txt

Usage

wdextract file [-e]

• file - filename of VDM container (*.vdm file or MRT.exe executable);
• -e optional parameter, extract all found PE image chunks found in VDM after unpacking/decrypting (this including VFS components and emulator VDLLs).

Example:

• wdextract c:\wdbase\mpasbase.vdm
• wdextract c:\wdbase\mpasbase.vdm -e
• wdextract c:\wdbase\mrt.exe
• wdextract c:\wdbase\mrt.exe -e

Note: base will be unpacked/decrypted to source directory as %originalname%.extracted (e.g. if original file c:\wdbase\mpasbase.vdm, unpacked will be c:\wdbase\mpasbase.vdm.extracted). Image chunks will be dumped to created "chunks" directory in the wdextract current directory (e.g. if wdextract run from c:\wdbase it will be c:\wdbase\chunks directory). Output files always overwrite existing.

Build

• Source code written in C;
• Built with MSVS 2017/2019 with Windows SDK 17763/18362 installed;
• Can be built with previous versions of MSVS and SDK's.

Related references and tools

• PowerShell unpack script for packed VDM containers, https://gist.github.com/mattifestation/3af5a472e11b7e135273e71cb5fed866
• Windows Defender Emulator Tools, https://github.com/0xAlexei/WindowsDefenderTools
• Porting Windows Dynamic Link Libraries to Linux, https://github.com/taviso/loadlibrary
• MpEnum, https://github.com/hfiref0x/MpEnum
• libmpclient, https://github.com/UldisRinkevichs/libmpclient

N.B.

No actual dumped/extracted/unpacked binary data included or will be included in this repository.

3rd party code usage

Uses ZLIB Data Compression Library (https://github.com/madler/zlib)

Authors

(c) 2019 - 2020 WDEXTRACT Project

wdextract's Issues

Request for blog post

Hello hfiref0x,

I am reading through your blogs https://swapcontext.blogspot.com/2019/11/introduction.html

I wanted you to make one more blog post on "WDExtract - Journey", where i am expecting to learn the path you used to reverse the vdm files and how the base structures for RMDX was reversed ?

P.S.
Sorry for using git issues for raising this request, since i dont have any mode of reaching you. Thanks for your excellent works.

about rmod_header

typedef struct rmod_header {
ULONG r_magic;
ULONG r_time;
ULONG r_crc;
ULONG r_flags;
ULONG r_codeoffset;
ULONG r_codelen;
ULONG r_extraoffset;
ULONG r_extralen;
ULONG r_initmodule;
ULONG r_cleanupmodule;
union {
ULONG r_relocno;
ULONG r_dbversion;
} DUMMYUNIONNAME;
ULONG r_importno;
ULONG r_hostos;
ULONG r_exportno;
ULONG r_truecodelen;
ULONG r_numberofrecords;
} rmod_header, *prmod_header;

Compile 32 bit

Hello
I cannot compile 32bit version. Some errors with zlib. Download 32 bit .lib and .dll, but have such error.

Can you compile it or this is impossible?

__signature_type

enum __signature_type {
SIGNATURE_TYPE_UNKNOWN = 0x0,
SIGNATURE_TYPE_RESERVED = 0x1,
SIGNATURE_TYPE_VOLATILE_THREAT_INFO = 0x2,
SIGNATURE_TYPE_POLYVIR32 = 0x21,
SIGNATURE_TYPE_KVIR32 = 0x20,
SIGNATURE_TYPE_PEFILE_CURE = 0x3D,
SIGNATURE_TYPE_PEHSTR = 0x61,
SIGNATURE_TYPE_PEHSTR_EXT = 0x78,
SIGNATURE_TYPE_PEHSTR_EXT2 = 0x85,
SIGNATURE_TYPE_ELFHSTR_EXT = 0x8C,
SIGNATURE_TYPE_MACHOHSTR_EXT = 0x8D,
SIGNATURE_TYPE_DOSHSTR_EXT = 0x8E,
SIGNATURE_TYPE_MACROHSTR_EXT = 0x8F,
SIGNATURE_TYPE_DEXHSTR_EXT = 0xBE,
SIGNATURE_TYPE_JAVAHSTR_EXT = 0xBF,
SIGNATURE_TYPE_PEPCODE = 0x8A,
SIGNATURE_TYPE_BOOT = 0x44,
SIGNATURE_TYPE_MAC_CURE = 0x3E,
SIGNATURE_TYPE_MACRO_PCODE = 0x42,
SIGNATURE_TYPE_MACRO_SOURCE = 0x43,
SIGNATURE_TYPE_KCRCE = 0x80,
SIGNATURE_TYPE_NID = 0x55,
SIGNATURE_TYPE_CKSIMPLEREC = 0x50,
SIGNATURE_TYPE_CKOLDREC = 0x11,
SIGNATURE_TYPE_KPAT = 0xBB,
SIGNATURE_TYPE_BADREC = 0xD,
SIGNATURE_TYPE_DOS_VCL = 0xE0,
SIGNATURE_TYPE_NSCRIPT_NORMAL = 0x27,
SIGNATURE_TYPE_NSCRIPT_SP = 0x28,
SIGNATURE_TYPE_NSCRIPT_BRUTE = 0x29,
SIGNATURE_TYPE_NSCRIPT_CURE = 0x2C,
SIGNATURE_TYPE_RPFROUTINE = 0x53,
SIGNATURE_TYPE_RPFROUTINE_OLD = 0x3F,
SIGNATURE_TYPE_SIGTREE = 0x40,
SIGNATURE_TYPE_SIGTREE_EXT = 0x41,
SIGNATURE_TYPE_CLEANSCRIPT = 0x49,
SIGNATURE_TYPE_DEFAULTS_DEPRECATED = 0x54,
SIGNATURE_TYPE_DEFAULTS = 0x58,
SIGNATURE_TYPE_TITANFLT = 0x30,
SIGNATURE_TYPE_TARGET_SCRIPT = 0x4A,
SIGNATURE_TYPE_TARGET_SCRIPT_PCODE = 0x90,
SIGNATURE_TYPE_TUNNEL = 0x99,
SIGNATURE_TYPE_TUNNEL_X86 = 0x99,
SIGNATURE_TYPE_TUNNEL_X64 = 0x9A,
SIGNATURE_TYPE_TUNNEL_IA64 = 0x9B,
SIGNATURE_TYPE_TUNNEL_ARM = 0xB6,
SIGNATURE_TYPE_GENSFX = 0x56,
SIGNATURE_TYPE_UNPLIB = 0x57,
SIGNATURE_TYPE_PATTMATCH = 0x51,
SIGNATURE_TYPE_PATTMATCH_DEVELOPER = 0x52,
SIGNATURE_TYPE_PATTMATCH_V2 = 0x77,
SIGNATURE_TYPE_PATTMATCH_V2_DEVELOPER = 0x76,
SIGNATURE_TYPE_FULLMD5 = 0x5A,
SIGNATURE_TYPE_DBVAR = 0x5B,
SIGNATURE_TYPE_THREAT_BEGIN = 0x5C,
SIGNATURE_TYPE_THREAT_END = 0x5D,
SIGNATURE_TYPE_FILENAME = 0x5E,
SIGNATURE_TYPE_FILEPATH = 0x5F,
SIGNATURE_TYPE_FOLDERNAME = 0x60,
SIGNATURE_TYPE_LOCALHASH = 0x62,
SIGNATURE_TYPE_REGKEY = 0x63,
SIGNATURE_TYPE_HOSTSENTRY = 0x64,
SIGNATURE_TYPE_MINITHREAT_GROUP = 0x65,
SIGNATURE_TYPE_MINITHREAT = 0x66,
SIGNATURE_TYPE_STATIC = 0x67,
SIGNATURE_TYPE_MINISTATIC = 0xB9,
SIGNATURE_TYPE_DIFFOP = 0x68,
SIGNATURE_TYPE_LATENT_THREAT = 0x69,
SIGNATURE_TYPE_REMOVAL_POLICY = 0x6A,
SIGNATURE_TYPE_WVT_EXCEPTION = 0x6B,
SIGNATURE_TYPE_TRUSTED_PUBLISHER = 0x70,
SIGNATURE_TYPE_ASEP_FILEPATH = 0x71,
SIGNATURE_TYPE_DELTA_BLOB_OLD = 0x72,
SIGNATURE_TYPE_DELTA_BLOB = 0x73,
SIGNATURE_TYPE_DELTA_BLOB_RECINFO = 0x74,
SIGNATURE_TYPE_ASEP_FOLDERNAME = 0x75,
SIGNATURE_TYPE_VDLL = 0x79,
SIGNATURE_TYPE_VERSIONCHECK = 0x7A,
SIGNATURE_TYPE_SAMPLE_REQUEST = 0x7B,
SIGNATURE_TYPE_VDLL_X86 = 0x79,
SIGNATURE_TYPE_VDLL_X64 = 0x7C,
SIGNATURE_TYPE_VDLL_IA64 = 0x91,
SIGNATURE_TYPE_VDLL_ARM = 0x9C,
SIGNATURE_TYPE_RPFROUTINE_V2 = 0x7D,
SIGNATURE_TYPE_SNID = 0x7E,
SIGNATURE_TYPE_FOP = 0x7F,
SIGNATURE_TYPE_FOPEX = 0x89,
SIGNATURE_TYPE_VFILE = 0x83,
SIGNATURE_TYPE_SIGFLAGS = 0x84,
SIGNATURE_TYPE_PEMAIN_LOCATOR = 0x86,
SIGNATURE_TYPE_PESTATIC = 0x87,
SIGNATURE_TYPE_UFSP_DISABLE = 0x88,
SIGNATURE_TYPE_IL_PATTERN = 0x8B,
SIGNATURE_TYPE_IL2_PATTERN = 0xA6,
SIGNATURE_TYPE_UNS = 0x92,
SIGNATURE_TYPE_AEL_RECORD = 0x93,
SIGNATURE_TYPE_SIG_RECORD = 0x94,
SIGNATURE_TYPE_PEBMPAT = 0x95,
SIGNATURE_TYPE_AAGGREGATOR = 0x96,
SIGNATURE_TYPE_SAMPLE_REQUEST_BY_NAME = 0x97,
SIGNATURE_TYPE_KPATEX = 0xBC,
SIGNATURE_TYPE_REMOVAL_POLICY_BY_NAME = 0x98,
SIGNATURE_TYPE_THREAD_X86 = 0x9D,
SIGNATURE_TYPE_THREAD_X64 = 0x9E,
SIGNATURE_TYPE_THREAD_IA64 = 0x9F,
SIGNATURE_TYPE_THREAD_ARM = 0xB7,
SIGNATURE_TYPE_FRIENDLYFILE_SHA256 = 0xA0,
SIGNATURE_TYPE_FRIENDLYFILE_SHA512 = 0xA1,
SIGNATURE_TYPE_SHARED_THREAT = 0xA2,
SIGNATURE_TYPE_VDM_METADATA = 0xA3,
SIGNATURE_TYPE_VSTORE = 0xA4,
SIGNATURE_TYPE_VDLL_SYMINFO = 0xA5,
SIGNATURE_TYPE_BM_STATIC = 0xA7,
SIGNATURE_TYPE_BM_INFO = 0xA8,
SIGNATURE_TYPE_NDAT = 0xA9,
SIGNATURE_TYPE_FASTPATH_DATA = 0xAA,
SIGNATURE_TYPE_FASTPATH_SDN = 0xAB,
SIGNATURE_TYPE_DATABASE_CERT = 0xAC,
SIGNATURE_TYPE_SOURCE_INFO = 0xAD,
SIGNATURE_TYPE_HIDDEN_FILE = 0xAE,
SIGNATURE_TYPE_COMMON_CODE = 0xAF,
SIGNATURE_TYPE_VREG = 0xB0,
SIGNATURE_TYPE_NISBLOB = 0xB1,
SIGNATURE_TYPE_VFILEEX = 0xB2,
SIGNATURE_TYPE_SIGTREE_BM = 0xB3,
SIGNATURE_TYPE_VBFOP = 0xB4,
SIGNATURE_TYPE_VDLL_META = 0xB5,
SIGNATURE_TYPE_PCODEVALIDATOR = 0xB8,
SIGNATURE_TYPE_MSILFOP = 0xBA,
SIGNATURE_TYPE_LUASTANDALONE = 0xBD,
SIGNATURE_TYPE_MAGICCODE = 0xC0,
SIGNATURE_TYPE_CLEANSTORE_RULE = 0xC1,
SIGNATURE_TYPE_VDLL_CHECKSUM = 0xC2,
SIGNATURE_TYPE_THREAT_UPDATE_STATUS = 0xC3,
SIGNATURE_TYPE_VDLL_MSIL = 0xC4,
SIGNATURE_TYPE_ARHSTR_EXT = 0xC5,
SIGNATURE_TYPE_MSILFOPEX = 0xC6,
SIGNATURE_TYPE_VBFOPEX = 0xC7,
SIGNATURE_TYPE_FOP64 = 0xC8,
SIGNATURE_TYPE_FOPEX64 = 0xC9,
SIGNATURE_TYPE_JSINIT = 0xCA,
SIGNATURE_TYPE_PESTATICEX = 0xCB,
SIGNATURE_TYPE_KCRCEX = 0xCC,
SIGNATURE_TYPE_FTRIE_POS = 0xCD,
SIGNATURE_TYPE_NID64 = 0xCE,
SIGNATURE_TYPE_MACRO_PCODE64 = 0xCF,
SIGNATURE_TYPE_BRUTE = 0xD0,
SIGNATURE_TYPE_SWFHSTR_EXT = 0xD1,
SIGNATURE_TYPE_REWSIGS = 0xD2,
SIGNATURE_TYPE_AUTOITHSTR_EXT = 0xD3
};