wincheck rc8.56

download
mirror

changelog:

• add support of windows 10rtm, build 14279 & 14295
• add dumping of g_pAuditingFuncs
• add dumping of hal!InterruptController
• add dumping of PICO. Sample of output:
  PspPicoProviderRoutines at FFFFF803D2F42EA0:
 DispatchSystemCall: FFFFF803B997B4B0 \SystemRoot\system32\drivers\LXCORE.SYS
 ExitThread:         FFFFF803B997B4E0 \SystemRoot\system32\drivers\LXCORE.SYS
 ExitProcess:        FFFFF803B997B450 \SystemRoot\system32\drivers\LXCORE.SYS
 DispatchException:  FFFFF803B997B1E0 \SystemRoot\system32\drivers\LXCORE.SYS
 ProcessTerminate:   FFFFF803B997B480 \SystemRoot\system32\drivers\LXCORE.SYS
 WalkUserStack:      FFFFF803B997B630 \SystemRoot\system32\drivers\LXCORE.SYS
 ProtectedRanges:    FFFFF803B9930400 \SystemRoot\system32\drivers\LXCORE.SYS
 GetAllocatedProcessImageName: FFFFF803B997B650 \SystemRoot\system32\drivers\LXCORE.SYS
• fix wnf identifiers
• fix WFP callouts for w8.1 & w10
• lots of bugs were fixed

xxxSetAuditingInterface

Nice piece of code from lsasrv:
_GetCngAuditFunctions@4 proc near   ; CODE XREF: SrvPrepKeyIso(x)+33p
                                    ; LsapInitCNGAuditing()+Dp
  test  ecx, ecx
  jz    short loc_5095F661
  mov   dword ptr [ecx], offset _AuditFunctionTable
  xor   eax, eax
  retn

_AuditFunctionTable:
_AuditFunctionTable db    1
  db    0
  db    0
  db    0
  dd offset _CngAdtSelfTest@12              ; offset 4
  dd offset _CngAdtKeyFileOperation@32      ; offset 8
  dd offset _CngAdtKeyMigrationOperation@28 ; offset C
  dd offset _CngAdtVerificationFailure@24   ; offset 10
  dd offset _CngAdtCryptOperation@28        ; offset 14
  dd offset _CngAdtPrimitiveFailure@16      ; offset 18

This table used in SrvPrepKeyIso & LsapInitCNGAuditing functions:

CmControlVector from windows 10 build 14279

IoBlockLegacyFsFilters - wut ?

W32pServiceTable from windows 10 build 14279 64bit

W32pServiceLimit .eq. 0x47D

apisetschema.dll from windows 10 build 14279

Several new modules was added:

• onecoreuap-print-render
• onecoreuap-settingsync-status
• win-core-ums
• win-gdi-internal-uap
• net-eap-sim
• win-audiocore-coreaudiopolicymanager
• win-casting-shell
• win-com-psmregister
• win-desktopappx
• win-direct2d-desktop
• win-dx-ddraw
• win-gaming-xinput
• win-kernelbase-packagebreakaway
• win-media-avi
•  win-mf-vfw
• win-ntuser-private
• win-rtcore-ntuser-wmpointer
• win-security-shutdownext
• win-uwf-servicing-apis

lxcore syscall table

I can`t get symbols for lxcore.sys so I just write simple idc scipt. Each item in table has very simple structure:
PAGE:00000001C0046620   imul  r14, r12, 38h      ; size of item in syscall table
PAGE:00000001C0046624   mov   r15, rax
PAGE:00000001C0046627   lea   rax, lx_ssdt
PAGE:00000001C004662E   add   r14, rax
PAGE:00000001C0046631   cmp   r12, 136h          ; count of items in syscall table
PAGE:00000001C0046638   jnb   loc_1C00467AE

string with name of method and arguments located at offset 0x10
IDC script to dump syscall table from lxcore.sys:
#include <idc.idc>

static main(void)
{
  auto addr, name, fp, idx, s_addr;
  fp = fopen("lx.dmp", "w");
  if ( !fp )
  {
    return;
  }
  addr = 0x1C0008110;
  for ( idx = 0; idx < 0x136; idx = idx + 1, addr = addr + 0x38 )
  {
    s_addr = Qword(addr + 0x10);
    fprintf(fp, "%X\t", idx);
    if ( s_addr != 0 )
    {
      // dump string
      for ( ; ; s_addr = s_addr + 1 )
      {
        name = Byte(s_addr);
        if ( !name )
          break;
        fprintf(fp, "%c", name);
      }
    }
    fprintf(fp, "\n");
  }
  fclose(fp);
}
And table itself

CFG with LLVM

On holydays I read book "LLVM Cookbook" (not very good - lots of meaningless copy-pasted code blocks are annoying) and played a bit with fresh llvm-3.7.1 (was released 5 january)

So I decided to check whether it is possible to implement MS CFG in llvm. I have two news - good and bad, as usually

Good: yes, you can easy add instrumentation in llvm - just add some plugin for IR derived from FunctionPass and add call to your guard_check_icall before each VTBL call (or even on any ptr call). I think it will take one day for any CS-student

Bad: you need integration with MS linker and it seems that support of CFG in COFF files is totally undocumented. LLVM itself cannot make load_config and even more - their definition of coff_load_configuration in include\llvm\Object\COFF.h has no fields for CFG (like GuardCFCheckFunctionPointer and GuardCFFunctionTable)