They are created by Filter Manager (fltmgr.sys) and is used for communication between user-mode applications and filesystem minifilters. Lets see how we can enumerate and dump this
from function fltmgr!FltCreateCommunicationPort:
PAGE:0003A159 lea eax, [ebp+var_20]
PAGE:0003A15C push eax
PAGE:0003A15D xor eax, eax
PAGE:0003A15F push eax
PAGE:0003A160 push eax
PAGE:0003A161 push 28h ; size
PAGE:0003A163 push eax
PAGE:0003A164 push eax
PAGE:0003A165 push [ebp+arg_8]
PAGE:0003A168 push FilterConnectionPortType ; object type
PAGE:0003A16E push eax
PAGE:0003A16F call ds:__imp__ObCreateObject@36
so size of FilterConnectionPort is 0x28 and this is _FLT_SERVER_PORT_OBJECT struct:
kd> dt fltmgr!_FLT_SERVER_PORT_OBJECT
+0x000 FilterLink : _LIST_ENTRY
+0x008 ConnectNotify : Ptr32 long
+0x00c DisconnectNotify : Ptr32 void
+0x010 MessageNotify : Ptr32 long
+0x014 Filter : Ptr32 _FLT_FILTER
+0x018 Cookie : Ptr32 Void
+0x01c Flags : Uint4B
+0x020 NumberOfConnections : Int4B
+0x024 MaxConnections : Int4B
Sample of wincheck output:
FilterConnectionPortType 8998CBF0 at 84DBBDF0
MicrosoftMalwareProtectionControlPortWD:
ConnectNotify: 81A68DA8 \SystemRoot\system32\drivers\WdFilter.sys
DisconnectNotify: 81A79706 \SystemRoot\system32\drivers\WdFilter.sys
MessageNotify: 81A60EE0 \SystemRoot\system32\drivers\WdFilter.sys
Cookie: 899958AC
Flags: 0
NumberOfConnections: 1
MaxConnections: 1
storqosfltport:
ConnectNotify: 858DD716 \SystemRoot\system32\drivers\storqosflt.sys
DisconnectNotify: 858DD7CE \SystemRoot\system32\drivers\storqosflt.sys
MessageNotify: 858DD818 \SystemRoot\system32\drivers\storqosflt.sys
Cookie: 00000000
Flags: 0
NumberOfConnections: 0
MaxConnections: 1
MicrosoftMalwareProtectionAsyncPortWD:
ConnectNotify: 81A68DA8 \SystemRoot\system32\drivers\WdFilter.sys
DisconnectNotify: 81A79706 \SystemRoot\system32\drivers\WdFilter.sys
Cookie: 899958CC
Flags: 0
NumberOfConnections: 1
MaxConnections: 1
MicrosoftMalwareProtectionPortWD:
ConnectNotify: 81A68DA8 \SystemRoot\system32\drivers\WdFilter.sys
DisconnectNotify: 81A79706 \SystemRoot\system32\drivers\WdFilter.sys
Cookie: 899958B4
Flags: 0
NumberOfConnections: 1
MaxConnections: 1
WcifsPort:
ConnectNotify: 8DBAE402 \SystemRoot\system32\drivers\wcifs.sys
DisconnectNotify: 8DBAE41A \SystemRoot\system32\drivers\wcifs.sys
MessageNotify: 8DBAE43E \SystemRoot\system32\drivers\wcifs.sys
Cookie: 00000000
Flags: 0
NumberOfConnections: 0
MaxConnections: 3E8
MicrosoftMalwareProtectionRemoteIoPortWD:
ConnectNotify: 81A68DA8 \SystemRoot\system32\drivers\WdFilter.sys
DisconnectNotify: 81A79706 \SystemRoot\system32\drivers\WdFilter.sys
Cookie: 899958C4
Flags: 0
NumberOfConnections: 1
MaxConnections: 1
WcnfsPort:
ConnectNotify: 8DBC8D84 \SystemRoot\system32\drivers\wcnfs.sys
DisconnectNotify: 8DBC8D9C \SystemRoot\system32\drivers\wcnfs.sys
MessageNotify: 8DBC8DC0 \SystemRoot\system32\drivers\wcnfs.sys
Cookie: 00000000
Flags: 0
NumberOfConnections: 0
MaxConnections: 3E8
MicrosoftMalwareProtectionVeryLowIoPortWD:
ConnectNotify: 81A68DA8 \SystemRoot\system32\drivers\WdFilter.sys
DisconnectNotify: 81A79706 \SystemRoot\system32\drivers\WdFilter.sys
Cookie: 899958BC
Flags: 0
NumberOfConnections: 1
MaxConnections: 1
Комментариев нет:
Отправить комментарий