четверг, 2 марта 2017 г.

ida plugin for RFG fixups processing

I commited today code for Ida Pro plugin for RFG fixups processing - for both version 1 & 2

It seems that by default during automatic loading of pe files Ida don`t load .reloc section (where usually located RFG fixups). In such case I ask if you want to add new segment:
Sure it works only if original input file (you can extract it with get_input_file_path function) is still available. Also I used dirty hack - I am too lazy to parse PE file by hand, and it seems that node "$ PE header" keeps all sections (even not loaded in base !) in supvals

enjoy

Update: it seems that buggy ida sdk don`t contains doCode function and auto_mark_range actually does not take into account end argument, so body of prologs looks ugly

среда, 1 марта 2017 г.

IMAGE_DYNAMIC_RELOCATION_TABLE.Version 2

it seems that around since w10 build 15007 format of rfg relocs was changed and field IMAGE_DYNAMIC_RELOCATION_TABLE.Version now has value 2. So lets install platform SDK for 15003 and see what was changed

First remarkable thing is that IMAGE_LOAD_CONFIG_DIRECTORY now has two additional fields:
    WORD       DynamicValueRelocTableSection;
    WORD       Reserved2;
    // since w10 build 15003 ?
    ULONGLONG  GuardRFVerifyStackPointerFunctionPointer; // VA
    DWORD      HotPatchTableOffset;

} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;
 
so sizeof(IMAGE_LOAD_CONFIG_DIRECTORY64) is now 0xf4

вторник, 7 февраля 2017 г.

apisetschema.dll from windows 10 build 15025

lots of new modules was added:
  • win-core-registry-fromapp
  • win-gaming-expandedresources
  • win-gaming-gamemonitor
  • win-ngc-serialization
  • win-security-isolatedcontainer
  • win-shcore-path
  • onecore-appmodel-tdlmigration 
  • onecore-hcap-svf
  • onecore-hnetcfg
  • onecore-mpc-input
  • onecore-shlwapi
  • onecore-spectrumsyncclient
  • win-adsi-activeds
  • win-appcompat-aepic
  • win-appmodel-restrictedappcontainer-internal
  • win-audiocore-spatial
  • win-base-rstrtmgr
  • win-core-iuri
  • win-core-winsrv
  • win-deployment-productenumerator
  • win-dx-dinput8
  • win-eventing-pdh
  • win-fs-cscapi
  • win-gaming-gamechatoverlay
  • win-gdi-gdiplus
  • win-hyperv-compute
  • win-kernel32-process
  • win-kioskmode-config
  • win-mapi-mapi32
  • win-mininput-inputhost
  • win-mm-wmvcore
  • win-net-netbios
  • win-net-netshell
  • win-net-nfdapi
  • win-nfc-semgr
  • win-ntuser-rawinput
  • win-odbc-odbc32
  • win-parentalcontrols-setup
  • win-resources-deployment
  • win-rtcore-ntuser-winevent
  • win-security-appinfoext
  • win-security-certpoleng
  • win-security-slc
  • win-shell-aclui
  • win-shell-comctl32
  • win-shell-efsadu
  • win-shell-ntshrui
  • win-shell-shdocvw
  • win-wnv

вторник, 15 ноября 2016 г.

W32pServiceTableFilter from windows 10 build 14951 x64

kd> ? nt!KeServiceDescriptorTableFilter
Evaluate expression: -8795428636992 = fffff800`2799b6c0

kd> dps fffff800`2799b6c0
fffff800`2799b6c0  fffff800`278f4450 nt!KiServiceTable
fffff800`2799b6c8  00000000`00000000
fffff800`2799b6d0  00000000`000001c4
fffff800`2799b6d8  fffff800`278f4b64 nt!KiArgumentTable
fffff800`2799b6e0  ffffa344`ba544bc0 win32k!W32pServiceTableFilter

fffff800`2799b6e8  00000000`00000000
fffff800`2799b6f0  00000000`0000049c
fffff800`2799b6f8  ffffa344`ba5462d4 win32k!W32pArgumentTableFilter