ZwQueryLicenseValue in windows 8 user-mode

appidapi.dll

• appid-EnableV2

appidsvc.dll

• appid-EnableV2

d3d9.dll

• TerminalServices-RemoteConnectionManager-b7857721-7a62-4a37-aff3-253fe2b8b0e8-MaxSessions

lsasrv.dll

• LSA-Policy-EnableTrustedDomains

lsm.dll

• TerminalServices-RemoteConnectionManager-AllowMultipleSessions
• TerminalServices-RemoteConnectionManager-b7857721-7a62-4a37-aff3-253fe2b8b0e8-MaxSessions

netjoin.dll

• WorkstationService-DomainJoinEnabled

sppwinob.dll

• Security-SPP-GenuineLocalStatus

sppobjs.dll

• Kernel-ExpirationDate

shell32.dll

• Security-SPP-GenuineLocalStatus
• Security-SPP-TokenActivation-AdditionalInfo

This license names used to determine if current windows license is time-based:

• Security-SPP-Reserved-TBLProductKeyType
• Security-SPP-Reserved-TBLState
• Security-SPP-Reserved-TBLRemainingTime

Also I wrote simple console program dumpwlic to hex-dump license value by name. Sample of using:

using ZwQueryLicenseValue in windows 8 drivers

Function ZwQueryLicenseValue gets the data for a particular license value. As you can see the first argument is PUNICODE_STRING for some license feature name. Let's see which names are checked in windows 8 kernel mode

kernel

• Kernel-ProductInfo - in function RtlGetProductInfo
• Kernel-ProductInfoLegacyMapping - in function RtlGetProductInfo
• Kernel-VirtualDynamicPartitioningSupported
• Kernel-VmPhysicalMemoryAddAllowed
• Kernel-RegisteredProcessors
• Kernel-CsChecksDisabled
• Kernel-PersistDefectiveMemoryList
• Kernel-ExpirationDate
• Kernel-MemoryMirroringSupported
• WSLicensingService-LOBSideloadingActivated

Also function RtlpGetWindowsPolicy checks following names:

• WindowsExcludedProcs
• Kernel-MUI-Number-Allowed
• Kernel-MUI-Language-Allowed
• Kernel-MUI-Language-Disallowed
• Kernel-MUI-Language-SKU

hal.dll

• Kernel-RegisteredProcessors

win32k.sys

• Microsoft-Windows-Core-THQAEnabled
• Microsoft-Windows-Core-AllowMultiMon

WNF notifiers

It seems that windows 8 has some new (undocumented as usually) mechanism to call user-mode code from kernel - WNF
There are several new exported functions in ntdll.dll related to it:

• RtlAllocateWnfSerializationGroup
• RtlEqualWnfChangeStamps
• RtlPublishWnfStateData
• RtlQueryWnfMetaNotification
• RtlQueryWnfStateData
• RtlQueryWnfStateDataWithExplicitScope
• RtlRegisterForWnfMetaNotification
• RtlSubscribeWnfStateChangeNotification
• RtlTestAndPublishWnfStateData
• RtlUnsubscribeWnfNotificationWaitForCompletion
• RtlUnsubscribeWnfNotificationWithCompletionCallback
• RtlUnsubscribeWnfStateChangeNotification
• RtlWaitForWnfMetaNotification
• RtlWnfCompareChangeStamp
• RtlWnfDllUnloadCallback
• RtlpWnfNotificationThread - this one really called from kernel mode

Also several new functions in SSDT:

• NtWaitForWnfNotifications
• NtUnsubscribeWnfStateChange
• NtUpdateWnfStateData
• NtSubscribeWnfStateChange
• NtQueryWnfStateData
• NtQueryWnfStateNameInformation 
• NtDeleteWnfStateName
• NtDeleteWnfStateData
• NtCreateWnfStateName

I`ll describe here only user-mode structure which holds pointers to notifiers

fltmgr diagnostic messages

from driver verifier.Content of FltvMessageTable (to enlarge collection):

hypervisor callbacks in w8

There are couple of exported functions to set up some hypervisor related callbacks

HvlRegisterWheaErrorNotification
Set WHEA callback into global variable HvlpWheaErrorNotificationCallback

HvlRegisterInterruptCallback
Set up to 5 (in w8 release preview up to 8) callbacks in global array HvlpInterruptCallback. This callbacks are called in HvlRouteInterrupt:

• index 0 - from KiHvInterrupt
• index 1 - from KiVmbusInterrupt0
• index 2 - from KiVmbusInterrupt1
• index 3 - from KiVmbusInterrupt2
• index 4 - from KiVmbusInterrupt3

callback tables in Fwpkclnt.sys on w8

It seems that under w8 there are couple of undocumented exported functions called to set some callback tables - FwpsL2DispatchTableAndGlobalsSet0 & FwpsTcpIpDispatchTableAndGlobalsSet0:

Check for example FwpsTcpIpDispatchTableAndGlobalsSet0 in disasm:
    mov edi, edi
    push ebp
    mov ebp, esp
    mov eax, [ebp+arg_4]
    push esi
    mov esi, [ebp+arg_0]
    push edi
    mov edi, TcpIpDispatchTable
    push 2Ah
    pop ecx
    rep movsd


We see here that arg_0 are copied to some variable which I named as TcpIpDispatchTable. It can easy be obtained with static analysis. FwpsL2DispatchTableAndGlobalsSet0 looks identical

Sample of output from w8 release preview:

Fwpkclnt.sys exports on w8

to compare with

kernel shims in w8

It seems that windows 8 kernel now has some support for driver shims.
Exported functions to provide this functionality are:

• KseRegisterShim
• KseRegisterShimEx
• KseUnregisterShim

Shim descriptor has structure like this one:

struct shim_descriptor
{
  DWORD Size;
  GUID *guid;
  wchar_t *Name;
  PVOID unk1;
  PVOID HookDriverUntargeted; // func ptr
  PVOID HookDriverTargeted;   // func ptr
  PVOID HookTab;              // ptr to hooks descriptor table
};


KseRegisterShim called twice in ntoskrnl.exe with two shim descriptors:

Win7VersionLieShim
GUID: 3E28B2D1-E633-408C-8E9B-2AFA6F47FCC3
Hooks RtlGetVersion & PsGetVersion functions

KseDsShim
GUID: BC04AB45-EA7E-4A11-A7BB-977615F4CAAE
Hooks:

• IoCreateDevice
• PoRequestPowerIrp
• ExAllocatePoolWithTag
• ExFreePoolWithTag
• ExAllocatePool
• ExFreePool

Sims apply in MiDriverLoadSucceeded function (by IAT hooking in KsepApplyShimsToDriver):

generic access rights mapping in w8

Name	ObjectType	Read	Write	Execute	All
AlpcpPortMapping	AlpcPortObjectType	20001	10001	0	1F0001
EtwpGenericMappingg	EtwpRealTimeConnectionObjectType	2000D	20062	20E90	20EFF
ExpCallbackMapping	ExCallbackObjectType	20000	20001	120000	1F0001
ExpCompositionSurfaceMapping	ExCompositionSurfaceObjectType	20000	20000	20000	F0000
ExpDesktopMapping	ExDesktopObjectType	20000	20000	20000	F0000
ExpEventMapping	ExEventObjectType	20001	20002	120000	1F0003
ExpEventPairMapping	ExEventPairObjectType	120000	120000	120000	1F0000
ExpMutantMapping	ExMutantObjectType	20001	20000	120000	1F0001
ExpProfileMapping	ExProfileObjectType	20001	20001	20001	F0001
ExpSemaphoreMapping	ExSemaphoreObjectType	20001	20002	120000	1F0003
ExpTimerMapping	ExTimerObjectType	20001	20002	120000	1F0003
ExpWindowStationMapping	ExWindowStationObjectType	20000	20000	20000	F0000
ExpWnfNotificationMapping		120001	2	1F0000	1F0013
ExpWorkerFactoryMapping	ExpWorkerFactoryObjectType	20008	20004	20003	F00FF
IopCompletionMapping	IoCompletionObjectType	20001	20002	120000	1F0003
IopFileMapping	IoFileObjectType	120089	120116	1200A0	1F01FF
IopWaitCompletionMapping	IopWaitCompletionPacketObjectType	20001	20001	20001	F0001
MiSectionMapping	MmSectionObjectType	20005	20002	20008	F001F
MiSessionMapping	MmSessionObjectType	20001	20002	120001	F0003
ObpDirectoryMapping	ObpDirectoryObjectType	20003	2000C	20003	F000F
ObpSymbolicLinkMapping	ObpSymbolicLinkObjectType	20001	20000	20001	F0001
ObpTypeMapping	ObpTypeObjectType	20000	20000	20000	F0001
PiAuLocalSystemSecurityMapping		20000	20000	20000	F0000
PiAuSecurityObjectMapping		20001	20042	20024	F00FF
PopPowerRequestMapping	PopPowerRequestObjectType	20000	20000	20000	1F0000
PspJobMapping	PsJobType	20004	2000B	120000	1F001F
PspMemReserveMapping		20001	20002	20000	F0003
PspProcessMapping	PsProcessType	20410	20BEA	121001	1FFFFF
PspThreadMapping	PsThreadType	20048	20437	120800	1FFFFF
SepTokenMapping	SeTokenObjectType	2001A	201E0	20005	F01FF
StandardBitMapping		20000	10D0000	100000	11F0000
SystemContextGenericMapping		20001	20000	20000	1F0001
WmipGenericMapping	WmipGuidObjectType	1	2	10	120FFF

new TRACE_INFORMATION_CLASS in w8

The official documentation for WmiQueryTraceInformation says that TRACE_INFORMATION_CLASS has only 10 values. Although build date of this documentation is 6/11/2012 in reality there are some more values

• 0xB - return address of EtwpDiskIoNotifyRoutines. TraceInformationLength eq sizeof(PVOID)
• 0xC - copy content of EtwpAllNotifyRoutines. TraceInformationLength eq 0xD * sizeof(PVOID) (on w8 consumer preview size must be 0xE * sizeof(PVOID))
• 0xD - return address of EtwpFltIoNotifyRoutines. TraceInformationLength eq sizeof(PVOID)
• 0xE - return address of EtwpTraceHypervisorStackwalk function. TraceInformationLength eq sizeof(PVOID)
• 0xF - copy address of EtwpWdfNotifyRoutines. TraceInformationLength eq sizeof(PVOID)

CmControlVector for w8

New table for windows8 dev preview, consumer preview & release preview

PsIsProtectedProcess on w8

Now code for PsIsProtectedProcess looks like:

  mov     edi, edi
  push    ebp
  mov     ebp, esp
  mov     eax, [ebp+arg_0] ; PEPROCESS
  movzx   eax, byte ptr [eax+2D0h] ; PEPROCESS.SignatureLevel
  and     eax, 1
  pop     ebp
  retn    4


So under w8 there is no more ProtectedProcess flag

w8 netio.sys exports

Explanation:

• w8.32dp - dev preview 32bit
• w8.64dp - dev preview 64bit
• w8.32cp - consumer preview 32bit
• w8.64cp - consumer preview 64bit 

w8 ntdll.dll exports

Explanation:

• w8.32dp - dev preview 32bit
• w8.64dp - dev preview 64bit
• w8.32cp - consumer preview 32bit
• w8.64cp - consumer preview 64bit 

w8 ntoskrnl.exe exports

Explanation:

• w8.32dp - dev preview 32bit
• w8.64dp - dev preview 64bit
• w8.32cp - consumer preview 32bit
• w8.64cp - consumer preview 64bit

w8 preview versions

Btw bcs dev preview differs in many aspects from consumer preview we now must recognize on which preview variant we are running
GetProductInfo returns 0x4A for both
But there is very simple way:

• dev preview has BuildNumber 8102
• consumer preview has BuildNumber 8250
• release preview has BuildNumber 8400
• rtm has BuildNumber 9200

w8 NDIS structs 64bit

для симметрии с

w8 KPRCB 64bit

subj

w8 KPRCB

subj

w8 DelayLoadFailureHookImplementation

а вот например я тут писал уже давеча про эту чудесную ф-цию
Намедни выяснилось что в windows 8 она живет в kernel32.dll и теоретически может вызываться из практически любого процесса
Под катом ужас и моральный террор (413 модулей !)