вторник, 19 ноября 2019 г.

last version of wincheck

it`s last because of
My former employer was so so nice that he allowed me to publish this build. Btw I seek new job


  • add support of Windows 1909
  • add support of new RFG relocs. As usually kernel itself has bad IMAGE_DYNAMIC_RELOCATION_TABLE - it contains zero type somewhere inside IMAGE_DYNAMIC_RELOCATION
  • add dumping of WMI_LOGGER_CONTEXTs for InfinityHook detection (with -wmi option)
  • add dumping of PsAltSystemCallHandlers
  • add dumping of PoPdcCallbacks (with -pofx option)
  • add dumping of PpmPlatformStates (with -ppm option)
  • add dumping callbacks registered with RtlRegisterFeatureConfigurationChangeNotification function 

пятница, 15 ноября 2019 г.


I commited today plugin for processing 64bit kernel resource with name "FUNCTIONEXTENTLIST" (located in RCDATA)

It seems that processing of this resource happens in huge unnamed sub called from famous KiFilterFiberContext, so this is apparently part of PatchGuard. Format of this resource relative simple.
At start we have signature CTXE for compressed data (LTXE for noncompressed but I have never seen this). Data unpacking with RtlDecompressBufferEx function. In packed data we have table with pair offsets, first to RUNTIME_FUNCTION recognised from IDA and second to some additional RUNTIME_FUNCTION (which usually skipped in IDA Pro for unknown reason)

And even after calling this plugin there are lots of some valid RUNTIME_FUNCTION in .pdata section - I don`t know why

четверг, 14 ноября 2019 г.

понедельник, 2 сентября 2019 г.

new RFG reloc types

It seems that est since build 18922 Microsoft turned on retpoline
This is implemented as RFG relocations with 3 new type:

Type 3
    DWORD       PageRelativeOffset : 12;
    DWORD       IndirectCall       : 1;
    DWORD       IATIndex           : 19;

Looks like IAT function calling patch:
     call    cs:__imp_PshedFreeMemory
     nop     dword ptr [rax+rax+00h]

Type 4
    WORD        PageRelativeOffset : 12;
    WORD        IndirectCall       : 1;
    WORD        RexWPrefix         : 1;
    WORD        CfgCheck           : 1;
    WORD        Reserved           : 1;

Looks like call reg patch:
    call    rax
    nop     dword ptr [rax]

Type 5
    WORD        PageRelativeOffset : 12;
    WORD        RegisterNumber     : 4;

Looks like call reg in switch patch:
   mov     ecx, ds:rva off_14000DEBC[rdx+rdi*4]
   add     rcx, rdx
   jmp     rcx             ; switch jump
   db 4 dup(0CCh)

I patched today my RFG plugin to IDA Pro to support this new types

пятница, 12 июля 2019 г.

wincheck rc8.61

  • add support of Windows 10 RS4, 1809 & 1903
  • add support of Windows 10 build 18922, but seems that this build hangs on RPC interfaces enumeration
  • add dumping of AlpcpLogCallbackListHead (with -alpc option)
  • add dumping of CfgMgr32.dll!CM_Register_Notification registered callbacks
  • add dumping of providers from mpr.dll
  • add new comdline options:
    • -denc - dump ntdll registered enclaves
    • -dynf - dump registered dynamic functions from RtlpDynamicFunctionTable
    • -dkt - dump kernel tracepoints
    • -vf - dump kernel verifier tables
    • -fs - dump DRIVER_OBJECTs registered with IoRegisterFsRegistrationChangeMountAware function
  • lots of bugs was fixed (and added as usually)

пятница, 31 мая 2019 г.

CfgMgr32.dll!CM_Register_Notification registered callbacks

Declaration of CM_Register_Notification:

CMAPI CONFIGRET CM_Register_Notification(
  PVOID               pContext,
  PHCMNOTIFICATION    pNotifyContext
It`s easy to recover structures stored in EventSystemClientList:
field32bit offset64bit offset
WORD - signature 0xF09700

sample of output on windows w10 build 18898:

вторник, 26 марта 2019 г.

Windows 10 1809 kernel sensors

After reading this article I was curious which info Mocrosoft gather in it`s telemetry. There is some theoretical possibility to ask Microsoft via MVI but link to "apply for membership" gives 404, lol. So as usually run IDA Pro and start with KeInsertQueueApc function

We can see that code checks EtwThreatIntProvRegHandle and somewhere inside function calls etw logger function EtwTiLogInsertQueueUserApc. So lets collect other etw loggers reffered to
EtwThreatIntProvRegHandle (and EtwSecurityMitigationsRegHandle too)

  • EtwThreatIntProvRegHandle - called from KeInsertQueueApc and IopfCompleteRequest
  • EtwTiLogSetContextThread - called from PspWow64SetContextThread & PspSetContextThreadInternal
  • EtwTiLogAllocExecVm - called from MiAllocateVirtualMemory
  • EtwTiLogProtectExecVm - called from NtProtectVirtualMemory
  • EtwTiLogReadWriteVm - called from MiReadWriteVirtualMemory
  • EtwTiLogDeviceObjectLoadUnload - called from IoDeleteDevice & IoCreateDevice
  • EtwTiLogDriverObjectLoad - called from IopLoadDriver & IoCreateDriver
  • EtwTiLogMapExecView - called from NtMapViewOfSection & MiMapViewOfSectionExCommon
  • EtwTiLogSuspendResumeProcess - called from PsThawProcess, PsFreezeProcess, PsResumeProcess & PsSuspendProcess
  • EtwTiLogSuspendResumeThread - called from PsSuspendThread & PsResumeThread
etw loggers reffered to EtwSecurityMitigationsRegHandle
  • EtwpTimLogMitigationForProcess - called from MiAllowImageMap
  • EtwTimLogProhibitDynamicCode - called from MiArbitraryCodeBlocked
  • EtwTimLogProhibitWin32kSystemCalls - called from PsConvertToGuiThread
  • EtwTimLogProhibitNonMicrosoftBinaries - called from MiValidateSectionSigningPolicy
  • EtwTimLogProhibitChildProcessCreation - called from SeSubProcessToken
  • EtwTimLogProhibitLowILImageMap - called from MiAllowImageMap