вторник, 9 августа 2016 г.

ida 6.95 has been released

changelog
useful changes:
  • PE: added detection of entry point from incremental linking by Visual Studio 
  • FLIRT: added signatures for Windows Driver Kits 7-10
  • FLIRT: added detection of GsDriverEntry for Windows Drivers 
but still no support of apisetschema in PE imports, yeah

среда, 13 июля 2016 г.

FilterConnectionPorts

Under windows 10 there are some very strange objects in root directory
They are created by Filter Manager (fltmgr.sys) and is used for communication between user-mode applications and filesystem minifilters. Lets see how we can enumerate and dump this

четверг, 30 июня 2016 г.

tcpip port pools in fresh windows 10 builds

It seems that old good TcpPortPool & UdpPortPool were removed since est. build 14251 and were replaced with more complex structure stored in TcpCompartmentSet & UdpCompartmentSet

Lets see how we can get access to port pools
from InetCreatePortPool:
  push  50506E49h                       ; Tag
  push  26A8h                           ; NumberOfBytes
  mov   edi, ecx
  mov   esi, edx
  push  200h                            ; PoolType
  mov   [ebp+var_4], edi
  call  ds:__imp__ExAllocatePoolWithTag@12


some memory was alloced with tag InPP. Time for windbg

среда, 25 мая 2016 г.

KiServiceTable from w10 build 14342 x64

In healthy windows (for example w10 build 14332) KiServiceTable looks like:
.rdata:00000001402DE4C0 KiServiceTable  dq offset NtAccessCheck ; DATA XREF: KiInitializeKernel+5EF o
.rdata:00000001402DE4C8        dq offset NtWorkerFactoryWorkerReady
.rdata:00000001402DE4D0        dq offset NtAcceptConnectPort
.rdata:00000001402DE4D8        dq offset NtMapUserPhysicalPagesScatter


And in w10 build 14342 like:
.rdata:00000001402E1380 KiServiceTable  dd 0DECCCh              ; DATA XREF: KiInitializeKernel+600 o
.rdata:00000001402E1384        dd 0E44ECh
.rdata:00000001402E1388        dd 4E3470h
.rdata:00000001402E138C        db  20h
.rdata:00000001402E138D        db 0AFh ; ï
.rdata:00000001402E138E        db  64h ; d
.rdata:00000001402E138F        db    0


so I had to write a IDC script to convert this offsets to normal view:
#include <idc.idc>

static get_pe_base()
{
  auto addr, segm;
  addr = GetLongPrm(INF_MIN_EA);
  segm = SegByName("HEADER");
  if ( segm != BADADDR )
    return addr;
  return addr - 0x1000; // ditry hack
}

static main(void)
{
  auto base, cnt, addr, tab, i;
  base = get_pe_base();
  addr = LocByName("KiServiceLimit");
  if ( addr == BADADDR )
  {
    Warn("Cannot find KiServiceLimit");
    return;
  }
  cnt = Dword(addr);
  tab = LocByName("KiServiceTable");
  if ( tab == BADADDR )
  {
    Warn("Cannot find KiServiceTable");
    return;
  }
  for ( i = 0; i < cnt; i++, tab = tab + 4 )
  {
    MakeDword(tab);
    addr = Dword(tab);
    MakeComm(tab, sprintf("%x", addr + base));
    add_dref(tab, addr + base, dr_O);
  }
}

KiServiceLimit .eq. 0x1c2