Windows Internals

[ftvfatboy]

----[ 5.2 winkps.c
// code very messy but working
#include <stdio.h>
#include <windows.h>
#include "..\kmem.h"
// get this address from win2k symbols
#define PSADD 0x8046A180 // PsActiveProcessHead
// default base address for ntoskrnl.exe on win2k
#define BASEADD 0x7FFE0000 // MmGetPhysicalAddress
// max process, to prevent easy crashing
#define MAX_PROCESS 50
typedef struct _MY_CG {
PHYSICAL_ADDRESS pAddress;
PVOID MappedAddress;
PCALLGATE_DESCRIPTOR Desc;
WORD Segment;
WORD LastEntry;
} MY_CG, *PMY_CG;
ULONG Granularity;
PLIST_ENTRY PsActiveProcessHead = (PLIST_ENTRY) PSADD;
MY_CG GdtMap;
MAPPING CurMap;
PHYSICAL_ADDRESS (*MmGetPhysicalAddress) (PVOID BaseAddress);
void __declspec(naked) Ring0Func() {
_asm {
pushad
pushf
cli
mov esi, CurMap.vAddress
push esi
call MmGetPhysicalAddress
mov CurMap.pAddress, eax // save low part of LARGE_INTEGER
mov [CurMap+4], edx // save high part of LARGE_INTEGER
popf
popad
retf
}
}
// function which call the callgate
PHYSICAL_ADDRESS NewGetPhysicalAddress(PVOID vAddress) {
WORD farcall[3];
HANDLE Thread = GetCurrentThread();
farcall[2] = GdtMap.Segment;
if(!VirtualLock((PVOID) Ring0Func, 0x30)) {
printf("error: unable to lock function\n");
CurMap.pAddress.QuadPart = 1;
} else {
CurMap.vAddress = vAddress; // ugly way to pass argument
CurMap.Offset = (DWORD) vAddress % Granularity;
(DWORD) CurMap.vAddress -= CurMap.Offset;
SetThreadPriority(Thread, THREAD_PRIORITY_TIME_CRITICAL);
Sleep(0);
_asm call fword ptr [farcall]
SetThreadPriority(Thread,THREAD_PRIORITY_NORMAL);
VirtualUnlock((PVOID) Ring0Func, 0x30);
}
return(CurMap.pAddress);
}
PHYSICAL_ADDRESS GetPhysicalAddress(ULONG vAddress) {
PHYSICAL_ADDRESS add;
if (vAddress < 0x80000000L || vAddress >= 0xA0000000L) {
add.QuadPart = (ULONGLONG) vAddress & 0xFFFF000;
} else {
add.QuadPart = (ULONGLONG) vAddress & 0x1FFFF000;
}
return(add);
}
void UnmapMemory(PVOID MappedAddress) {
NtUnmapViewOfSection((HANDLE) -1, MappedAddress);
}
int InstallCallgate(HANDLE Section, DWORD Function) {
NTSTATUS ntS;
KGDTENTRY gGdt;
DWORD Size;
PCALLGATE_DESCRIPTOR CgDesc;
_asm sgdt gGdt;
printf("virtual address of GDT : 0x%.8x\n",
MAKE_DWORD(gGdt.BaseLow, gGdt.BaseHigh));
GdtMap.pAddress =
GetPhysicalAddress(MAKE_DWORD(gGdt.BaseLow, gGdt.BaseHigh));
printf("physical address of GDT: 0x%.16x\n", GdtMap.pAddress.QuadPart);
Size = gGdt.LimitLow;
ntS = NtMapViewOfSection(Section, (HANDLE) -1, &GdtMap.MappedAddress,
0L, Size, &GdtMap.pAddress, &Size, ViewShare,
0, PAGE_READWRITE);
if (ntS != STATUS_SUCCESS || !GdtMap.MappedAddress) {
printf("error: NtMapViewOfSection (code: %x)\n", ntS);
return(0);
}
GdtMap.LastEntry = gGdt.LimitLow & 0xFFF8; // offset to last entry
for(CgDesc = (PVOID) ((DWORD)GdtMap.MappedAddress+GdtMap.LastEntry),
GdtMap.Desc=NULL;
(DWORD) CgDesc > (DWORD) GdtMap.MappedAddress;
CgDesc--) {
//printf("present:%x, type:%x\n", CgDesc->present, CgDesc->type);
if(CgDesc->present == 0){
CgDesc->offset_0_15 = (WORD) (Function & 0xFFFF);
CgDesc->selector = 8;
CgDesc->param_count = 0; //1;
CgDesc->some_bits = 0;
CgDesc->type = 12; // 32-bits callgate junior :>
CgDesc->app_system = 0; // A system segment
CgDesc->dpl = 3; // Ring 3 code can call
CgDesc->present = 1;
CgDesc->offset_16_31 = (WORD) (Function >> 16);
GdtMap.Desc = CgDesc;
break;
}
}
if (GdtMap.Desc == NULL) {
printf("error: unable to find free entry for installing callgate\n");
printf(" not normal by the way .. your box is strange =]\n");
}
GdtMap.Segment =
((WORD) ((DWORD) CgDesc - (DWORD) GdtMap.MappedAddress))|3;
printf("Allocated segment : %x\n", GdtMap.Segment);
return(1);
}
int UninstallCallgate(HANDLE Section, DWORD Function) {
PCALLGATE_DESCRIPTOR CgDesc;
for(CgDesc = (PVOID) ((DWORD) GdtMap.MappedAddress+GdtMap.LastEntry);
(DWORD) CgDesc > (DWORD) GdtMap.MappedAddress;
CgDesc--) {
if((CgDesc->offset_0_15 == (WORD) (Function & 0xFFFF))
&& CgDesc->offset_16_31 == (WORD) (Function >> 16)){
memset(CgDesc, 0, sizeof(CALLGATE_DESCRIPTOR));
return(1);
}
}
NtUnmapViewOfSection((HANDLE) -1, GdtMap.MappedAddress);
return(0);
}
void UnmapVirtualMemory(PVOID vAddress) {
NtUnmapViewOfSection((HANDLE) -1, vAddress);
}
PVOID MapVirtualMemory(HANDLE Section, PVOID vAddress, DWORD Size) {
PHYSICAL_ADDRESS pAddress;
NTSTATUS ntS;
DWORD MappedSize;
PVOID MappedAddress=NULL;
//printf("* vAddress: 0x%.8x\n", vAddress);
pAddress = NewGetPhysicalAddress((PVOID) vAddress);
//printf("* vAddress: 0x%.8x (after rounding, offset: 0x%x)\n",
// CurMap.vAddress, CurMap.Offset);
//printf("* pAddress: 0x%.16x\n", pAddress);
// check for error (1= impossible value)
if (pAddress.QuadPart != 1) {
Size += CurMap.Offset; // adjust mapping view
MappedSize = Size;
ntS = NtMapViewOfSection(Section, (HANDLE) -1, &MappedAddress,
0L, Size, &pAddress, &MappedSize, ViewShare,
0, PAGE_READONLY);
if (ntS != STATUS_SUCCESS || !MappedSize) {
printf(" error: NtMapViewOfSection, mapping 0x%.8x (code: %x)\n",
vAddress, ntS);
return(NULL);
}
} else
MappedAddress = NULL;
printf("mapped 0x%x bytes @ 0x%.8x (init Size: 0x%x bytes)\n",
MappedSize, MappedAddress, Size);
return(MappedAddress);
}
void DisplayProcesses(HANDLE Section) {
int i = 0;
DWORD Padding;
PEPROCESS CurProcess, NextProcess;
PVOID vCurEntry, vOldEntry, NewMappedAddress;
PLIST_ENTRY PsCur;
// first we map PsActiveProcessHead to get first entry
vCurEntry = MapVirtualMemory(Section, PsActiveProcessHead, 4);
if (!vCurEntry)
return;
PsCur = (PLIST_ENTRY) ((DWORD) vCurEntry + CurMap.Offset);
// most of EPROCESS struct are located around 0xfc[e-f]00000
// so we map 0x100000 bytes (~ 1mb) to avoid heavy mem mapping
while (PsCur->Flink != PsActiveProcessHead && i<MAX_PROCESS) {
NextProcess = (PEPROCESS) TO_EPROCESS(PsCur->Flink);
//printf("==> Current process: %x\n", CurProcess);
// we map 0x100000 bytes view so we store offset to EPROCESS
Padding = TO_EPROCESS(PsCur->Flink) & 0xFFFFF;
// check if the next struct is already mapped in memory
if ((DWORD) vCurEntry<= (DWORD) NextProcess
&& (DWORD)NextProcess+sizeof(EPROCESS)<(DWORD)vCurEnt ry+0x100000){
// no need to remap
// no remapping so we need to calculate the new address
CurProcess = (PEPROCESS) ((DWORD) NewMappedAddress + Padding);
} else {
CurProcess = NextProcess;
// unmap old view and map a new one
// calculate next base address to map
vOldEntry = vCurEntry;
vCurEntry = (PVOID) (TO_EPROCESS(PsCur->Flink) & 0xFFF00000);
//printf("link: %x, process: %x, to_map: %x, padding: %x\n",
// PsCur->Flink, TO_EPROCESS(PsCur->Flink),
// vCurEntry, Padding);
// unmap old view
UnmapVirtualMemory(vOldEntry);
vOldEntry = vCurEntry;
// map new view
vCurEntry = MapVirtualMemory(Section, vCurEntry, 0x100000);
if (!vCurEntry)
break;
// adjust EPROCESS structure pointer
CurProcess =
(PEPROCESS) ((DWORD) vCurEntry + CurMap.Offset + Padding);
// save mapped address
NewMappedAddress = vCurEntry;
// restore pointer from mapped addresses space 0x4**** to
// the real virtual address 0xf*******
vCurEntry = vOldEntry;
}
// reajust pointer to LIST_ENTRY struct
PsCur = &CurProcess->ActiveProcessLinks;
printf(" + %lu\t %s\n", CurProcess->UniqueProcessId,
CurProcess->ImageFileName[0] ?
CurProcess->ImageFileName : "[system]");
i++;
}
UnmapVirtualMemory(vCurEntry);
}
int main(int argc, char **argv) {
SYSTEM_INFO SysInfo;
OBJECT_ATTRIBUTES ObAttributes;
NTSTATUS ntS;
HANDLE Section;
HMODULE hDll;
INIT_UNICODE(ObString, L"\\Device\\PhysicalMemory");
printf(" *** win2k process lister ***\n\n");
GetSystemInfo(&SysInfo);
Granularity = SysInfo.dwAllocationGranularity;
printf("Allocation granularity: %lu bytes\n", Granularity);
InitializeObjectAttributes(&ObAttributes,
&ObString,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
hDll = LoadLibrary("ntoskrnl.exe");
if (hDll) {
MmGetPhysicalAddress = (PVOID) ((DWORD) BASEADD +
(DWORD) GetProcAddress(hDll, "MmGetPhysicalAddress"));
printf("MmGetPhysicalAddress : 0x%.8x\n", MmGetPhysicalAddress);
FreeLibrary(hDll);
}
ntS = NtOpenSection(&Section, SECTION_MAP_READ|SECTION_MAP_WRITE,
&ObAttributes);
if (ntS != STATUS_SUCCESS) {
if (ntS == STATUS_ACCESS_DENIED)
printf("error: access denied to open
\\Device\\PhysicalMemory for r/w\n");
else
printf("error: NtOpenSection (code: %x)\n", ntS);
goto cleanup;
}
if (!InstallCallgate(Section, (DWORD) Ring0Func))
goto cleanup;
memset(&CurMap, 0, sizeof(MAPPING));
__try {
DisplayProcesses(Section);
} __except(UninstallCallgate(Section, (DWORD) Ring0Func), 1) {
printf("exception: trying to clean callgate...\n");
goto cleanup;
}
if (!UninstallCallgate(Section, (DWORD) Ring0Func))
goto cleanup;
cleanup:
if (Section)
NtClose(Section);
return(0);
}
----[ 5.4 fun_with_ipd.c
#include <stdio.h>
#include <conio.h>
#include <windows.h>
#include "..\kmem.h"
int main() {
NTSTATUS ntS;
HANDLE SymLink, Section;
OBJECT_ATTRIBUTES ObAttributes;
INIT_UNICODE(ObName, L"\\Device\\PhysicalMemory");
INIT_UNICODE(ObNewName, L"\\??\\hack_da_ipd");
InitializeObjectAttributes(&ObAttributes,
&ObNewName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
NULL);
ntS = NtCreateSymbolicLinkObject(&SymLink, SYMBOLIC_LINK_ALL_ACCESS,
&ObAttributes, &ObName);
if (ntS != STATUS_SUCCESS) {
printf("error: NtCreateSymbolicLinkObject (code: %x)\n", ntS);
return(0);
}
ntS = NtOpenSection(&Section, SECTION_MAP_READ, &ObAttributes);
if (ntS != STATUS_SUCCESS)
printf("error: NtOpenSection (code: %x)\n", ntS);
else {
printf("\\Device\\PhysicalMemory opened !!!\n");
NtClose(Section);
}
// now you can do what you want
getch();
NtClose(SymLink);
return(0);
}

--[ 6 - Conclusion

I hope this article helped you to understand the base of Windows kernel
objects manipulation. As far as i know you can do as much things as you can
with linux's /dev/kmem so there is no restriction except your imagination
.
I also hope that this article will be readen by Linux dudes.



--[ 7 - References

[1] Sysinternals - www.sysinternals.com
[2] Microsoft DDK - www.microsoft.com/DDK/
[3] unofficial ntifs.h - www.insidewindows.info
[4] www.chapeaux-noirs.org/win/
[5] Intel IA-32 Software Developper manual - developer.intel.com
[6] Pedestal Software - www.pedestalsoftware.com
[7] BindView's RAZOR - razor.bindview.com
[8] Open Systems Resources - www.osr.com
[9] MSDN - msdn.microsoft.com

books:
* Undocumented Windows 2000 Secrets, A Programmer's Cookbook
(http://www.orgon.com/w2k_internals/)
* Inside Microsoft Windows 2000, Third Edition
(http://www.microsoft.com/mspress/books/4354.asp)
* Windows NT/2000 Native API Reference

[ftvfatboy]

I don't know why, but I have a feeling that some of us here have misunderstood the term hacking. Not that it is their fault, Hollywood has misused this word so much that it does have a long lasting impression on many.

A few days back Nonte posted a thread on Hacking, I don't know what the contents of that thread was, it has been locked off by the Moderator.

Well admins, do you think that Hacking is always bad? I don't. Hacking essentially means knowing more about your system than many others do. Doesn't necesseraly mean that you are doing malicious stuff.

There is another term, cracking, that is actually doing malicious things with hacked knowledge. That is bad. Not hacking. I am a hacker, though I have never ever wacked any ones PC. I know Virus architecture, but never ever needed to build one. Infact, I use the knowledge to help other people know more about their systems, so that they cannot be hacked or rather cracked!

In fact in this thread, most of the material is in a way related to Hacking. YES, it Is. I admit. But till date no one has banned it, may be the stuff described here is too complicated to even review, but believe me all that is told here is good resource to hack. But you need MORE to hack htan just these articles.

I have given you knowledge, whether you use it the wrong way or the right way is up to you.

But I do believe, that you cannot hack by readi8ng these, I tell you why, because I have left out one link missing in this all....how to inject yourself in the system. Yes, if you can figure that out, all this material will get you far far beyond the defences of the machine, but I leave that on you.....if you are worth your salt, then may be you will figure out one day....

THe bottom line is, peopl who want to post material on hacking should be allowed to do it, but hten they should be careful as not to divulge the way to inject malicious code. Knowing how the I love U virus works, looking at it's code can do you a lot of good in knowing the anatomy of a virus, and may be you can better defend yourself from the threats of the future.

[ftvfatboy]

Windows NT defines a comprehensive set of object types. Each object type has appropriate methods (or functions) associated it

to allow kernel mode components to access and modify. Some object types include:-
- adapter object
- controller object
- process object
- thread object
- driver object
- device object
- file object
- timer object

One such special object is directory object. This is a controller object hat controls other objects of other types also. Each

object may have an optional name associated to it. This facilitates the sharing of objects across processes, sicne more than

one process can potentially open the same named obejct of a particular type.

Object manager manages a single global name space for a node running WinNT. Object manager has a hierarchical namespace &

presents a tree structure to the system. There is a root directory called \ for this global name space.

All named objects can be located by specifying an absolute pathname for the object, starting at root of object manager name space. Object manager allows creation of named object directories contained within directory objects. Thus it is a multilevel tree hierarchy. WinNT object manager also supports a special object called a symbolic link object type. This object, is an alias to another object.

In the diagram below, I show a typical WinNT system Object Manager tree.




Object Manager defines objects when requested by other NT components. Certain object types are predefined by the WinNT object

manager. Whenever the WInNT Executive component requests a new type of object, it provides pointers to the Parse( ), Close( ) and Delete( ) callback functions to be associated with all object instances of that particular type.

When an user process tried to open an Object, it must suply an absolute pathname to the object manager. Object manager begins parsing the name, one token at a time. Whenever the Object manager encounters an object that has a parsing callback function associated with it, the object manager suspends it's own pasring of the name and invokes the parsing function supplied for the object, passing it the remainder of the user supplied pathname ( the portion that has not yet been parsed ).

An Example:-

Lets say the process requests for C:\abcd\def.txt

The open request is submitted to Win32 subsystem, which translates C: to \DosDevices\C: before forwarding the request to WinNT executive.So the complete filename sent to the Kernel is \DosDevices\C:\abcd\def.txt

All open requests are directed to Object Manager which begins parsing the filename. It notices that \DOsDevices\C: is a symbolic link, the name now becomes \DosDevices\HardDisk0\Partition1\abcd\def.txt [Ths is implementation specific, NT 4.0 is slightly different ]

Once object manager, has perfored name replacement, it begins parsing once again from the begining ( \ ). Now object manager traverses teh name till it encountes Partition1 Device Object. The I/O Manager supplies a parsing routine when creating this device object type!!! Therefore object manager stops parsing of the pathname & instead forwards the open request to I/O manger parsing routine, the string passed is the portion not yet parsed, i.e \abcd\def.txt When invoking the parsing routine, the object manager also passes a pointer to the partition1 device object to the I/O Manager.

I/O Manager then performs open (very complicated) on behalf of the caller. Step include, identifying the FS driver that is managing the mounted logical volume for the physical disk represented by Partition1, the named device object. Once it has found the FSD, the O/O manager will simply forward the open request to the FS drivers Create/Open dispatch routine [ Yes, I am talking aboout the IRP_MJ_CREATE dispatch handler here ].

Now it is the responsibility of the FSD to process the user request.

Thus, this is how user open requests end up in the FSD.

[ftvfatboy]