using CFG on more old windows

As you may know support for CodeFlow Guard exists only since windows 10. But it seems that you still can gain some profit from CFG on more old versions of windows (for example in fuzzers/honeypots)

1) you need inject your code in target process
2) you must check if CFG presents in your target module. It seems that MS linker has a bug - DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].Size eq 0x40. but IMAGE_LOAD_CONFIG_DIRECTORY.Size contains right value
3) you must just patch pointer in *(IMAGE_LOAD_CONFIG_DIRECTORY.GuardCFCheckFunctionPointer) to your handler. Prototype of handler:
void __fastcall my_check_icall(PBYTE addr)
4) now you can check addr parameter. One possible check - just see if this addr located in some loaded module, so you can traverse on PEB_LDR_DATA

Have fun !

iertutil.dll unnamed exports

Perl script to make such files (must be run after applying appropriate .pdb):

#!perl -w
use strict;
use warnings;
use IDA;

my $with_addr = 0;

my $exp_cnt = GetEntryPointQty();
my $dparm = GetLongPrm(INF_SHORT_DN);
my($fh, $name, $mang, $i, $ord, $addr);
if ( $exp_cnt )
{
  open($fh, '>', "exp") or die("Cannot open file exp, error $!\n");
  for ( $i = 0; $i < $exp_cnt; $i++ )
  {
    $ord = GetEntryOrdinal($i);
    $name = GetEntryName($ord);
    $addr = GetEntryPoint($ord);
    next if ( $addr == BADADDR );
    next if ( $name !~ /_\d+$/i );
    $mang = GetTrueNameEx(BADADDR, $addr);
    $name = Demangle($mang, $dparm);
    $name =~ s/\(.*\)//g;
    if ( $name ne '' )
    {
      if ( $with_addr )
      {
        printf($fh "%d %X %s ; %s\n", $ord, $addr, $name, $mang);
      } else {
        printf($fh "%d %s ; %s\n", $ord, $name, $mang);
      }
    } else {
      if ( $with_addr )
      {
        printf($fh "%d %X %s\n", $ord, $addr, $mang);
      } else {
        printf($fh "%d %s\n", $ord, $mang);
      }
    }
  }
  close $fh;
}

urlmon unnamed exports

It seems that ordinal 470 (RegisterProtocolMonitor) used in networkinspection.dll
This info was ripped from ida pro with simple perl script

pdbdump for vs2015 pdbs

It seems that sourceforge finally came out of the coma so I commited today patches to my version of pdbdump for some support of vs2015 pdb files
Also I added support of DIA SDK from Microsoft Visual Studio 12.0 (patch 67)

apisetschema.dll from windows 10 build 10162

almost nothing new

KiServiceTable from windows 10 build 10130

KiServiceLimit .eq. 1BF

is vtguard slow ?

Saw some strange code in fresh mshtml.dll (version 11.00.9600.17842) after jun 2015 security update:

.text:635F4700 ?ReleaseInterface@@YGXPAUIUnknown@@@Z proc near
.text:635F4700   mov   edi, edi
.text:635F4702   push  esi
.text:635F4703   push  edi
.text:635F4704   test  ecx, ecx
.text:635F4706   jnz   short loc_635F470B
.text:635F4708 loc_635F4708:
.text:635F4708   pop   edi
.text:635F4709   pop   esi
.text:635F470A   retn
.text:635F470B loc_635F470B:
.text:635F470B   mov   eax, [ecx]
.text:635F470D   mov   edi, [eax+8]
.text:635F4710   cmp   edi, offset ?PrivateRelease@CElement@@UAGKXZ ; CElement::PrivateRelease(void)
.text:635F4716   jz    loc_6362BE29
.text:635F471C   cmp   edi, offset ?PlainRelease@@YGKPAUTEAROFF_THUNK@@@Z ; PlainRelease(TEAROFF_THUNK *)
.text:635F4722   jz    loc_6362B928
.text:635F4728   mov   esi, esp
.text:635F472A   push  ecx
.text:635F472B   mov   ecx, edi
.text:635F472D   call  ds:___guard_check_icall_fptr
.text:635F4733   call  edi
.text:635F4735   cmp   esi, esp
.text:635F4737   jz    short loc_635F4708
.text:635F4739   jmp   loc_63CA3FDD
.text:635F4739 ?ReleaseInterface@@YGXPAUIUnknown@@@Z endp

.text:6362BE29 loc_6362BE29:
.text:6362BE29   push  ecx
.text:6362BE2A   call  ?PrivateRelease@CElement@@UAGKXZ ; CElement::PrivateRelease(void)
.text:6362BE2F   jmp   loc_635F4708

.text:6362B928 loc_6362B928:
.text:6362B928   push  ecx                             ; struct TEAROFF_THUNK *
.text:6362B929   call  ?PlainRelease@@YGKPAUTEAROFF_THUNK@@@Z ; PlainRelease(TEAROFF_THUNK *)
.text:6362B92E   jmp   loc_635F4708
It seems that compiler added checking for some (most frequently called) methods and calls them directly with no vtguard. I wonder why may be needed such optimization ?