bugs in mbedtls DH client/server

1) altough always used constant MBEDTLS_MD_SHA256 parameters are signed with sha1 and then we have MBEDTLS_ERR_RSA_VERIFY_FAILED in library\rsa.c on line 1435
2) in dh_server.c when receiving client's public value length of buffer must be dhm.len

Nice cryptolibrary, totally ready to work in kernel mode I think
patch:

how to build mbedtls-2.3.0 with wdk7

Lets say that you want to have some Diffie-Hellman-Merkle algorithm & hmac inside your driver. I found plain C library mbedtls which is very suitable for this, but has one minor problem - it does not support wdk7. So I just made port for it

ida 6.95 has been released

changelog
useful changes:

• PE: added detection of entry point from incremental linking by Visual Studio 
• FLIRT: added signatures for Windows Driver Kits 7-10
• FLIRT: added detection of GsDriverEntry for Windows Drivers 

but still no support of apisetschema in PE imports, yeah

apisetschema.dll from windows 10 build 14388

nothing new - only api-ms-win-core-ums was added

FilterConnectionPorts

Under windows 10 there are some very strange objects in root directory

They are created by Filter Manager (fltmgr.sys) and is used for communication between user-mode applications and filesystem minifilters. Lets see how we can enumerate and dump this

tcpip port pools in fresh windows 10 builds

It seems that old good TcpPortPool & UdpPortPool were removed since est. build 14251 and were replaced with more complex structure stored in TcpCompartmentSet & UdpCompartmentSet

Lets see how we can get access to port pools
from InetCreatePortPool:
  push  50506E49h                       ; Tag
  push  26A8h                           ; NumberOfBytes
  mov   edi, ecx
  mov   esi, edx
  push  200h                            ; PoolType
  mov   [ebp+var_4], edi
  call  ds:__imp__ExAllocatePoolWithTag@12

some memory was alloced with tag InPP. Time for windbg

apisetschema.dll from windows 10 build 14352

nothing new - only ext-ms-net-vpn-soh-l1-1-0 was added