Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-28-2004, 01:21
niom niom is offline
Friend
 
Join Date: Jul 2004
Posts: 21
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
niom Reputation: 0
SYSENTER hook

in 2k, i have a table of interupt handler pointers which can easily be modified, but what about xp and SYSENTER?

should i setup a new handlerproc through WRMSR and SYSENTER_CS, SYSENTER_ESP, ..?

does anybody have a codesnipped for this?

thxalot
Reply With Quote
  #2  
Old 07-29-2004, 23:27
bilbo bilbo is offline
Friend
 
Join Date: Jul 2004
Posts: 103
Rept. Given: 36
Rept. Rcvd 15 Times in 12 Posts
Thanks Given: 15
Thanks Rcvd at 17 Times in 11 Posts
bilbo Reputation: 15
hi, niom,

Quote:
should i setup a new handlerproc through WRMSR and SYSENTER_CS, SYSENTER_ESP, ..?
Yes! on a theorethical point of view you are right. In the same way one replaces INT 3 handler with a preamble (e.g. for tracing purposes) and then jumps to the old handler, the same guy on Windows XP must replace MSR register 176 (EIP) - which points currently at KiFastCallEntry - with some preamble and then jump to KiFastCallEntry.
You only need to write a kernel driver very similar to that which replace the INT 2E handler. Look for example at the code by sinister (http://www.xfocus.net/articles/200303/499.html).
Obviously you can always hook single system services.

But if you look more deeply at Windows XP architecture, you will find that:

(a) the fuc.ed SYSENTER is in userland (even if in read-only memory, and you cannot use WriteProtect on it to make it writeable because the address (0x7FFE0300) is outside the VadRoot of all the processes)

(b) on AMD processor there is no SYSENTER but INT 2E

So, we can replace SYSENTER with INT 2E and use the same tools we have for Windows 2K, don't we?

In fact after many reboots I finally manage to change on the fly the two ways to enter system services, from SYSENTER to INT 2E and vice versa, and all this without any driver involved!

It is as simple as replacing
Code:
7FFE0300: (physical 41300)      8BD4 mov edx, esp
                                0F34 sysenter
                                C3   ret
with
Code:
7FFE0300:      8D542408    lea edx, [esp+8]
               CD2E        int 2eh
               C3          ret
with some little trick to avoid system crash

Quote:
does anybody have a codesnipped for this?
Maybe a tutorial... but bilbo has a lot of things to write and maybe nobody is interested... who knows...

Best regards, bilbo
Reply With Quote
  #3  
Old 07-30-2004, 19:32
niom niom is offline
Friend
 
Join Date: Jul 2004
Posts: 21
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
niom Reputation: 0
Quote:
Originally Posted by bilbo
on a theorethical point of view you are right. In the same way one replaces INT 3 handler with a preamble (e.g. for tracing purposes) and then jumps to the old handler, the same guy on Windows XP must replace MSR register 176 (EIP) - which points currently at KiFastCallEntry - with some preamble and then jump to KiFastCallEntry.
k
thx


but i have a new question:

do you think, it is possible to "instrument" all ntoskrnl exports like detours does? (detours inserts a jump at the function entry, that points to a custom trampoline, which calls the old code: http://research.microsoft.com/~galenh/Publications/HuntUsenixNt99.pdf)

or do you know an easier way to intercept ring0->ring0 calls?
Reply With Quote
  #4  
Old 08-02-2004, 02:16
evaluator
 
Posts: n/a
just done driver to revert back to INT2E from SYSENTER..

i'm interesting about SP2 NTOSKRNL.EXE..
also code on 7FFE0300h on AMD machines..

at Woodmann.com posted..
Attached Files
File Type: zip BACK2INT.ZIP (7.4 KB, 26 views)
Reply With Quote
  #5  
Old 08-02-2004, 02:28
evaluator
 
Posts: n/a
to bilbo:

AMD very well has own "SYSENTER-SYSEXIT":
SYSCALL 0F05h
SYSRET 0F07h

exactly about this i'm interesting:
do someone see usage of these on AMD at 7FFE0300h?
Reply With Quote
  #6  
Old 08-02-2004, 16:40
bilbo bilbo is offline
Friend
 
Join Date: Jul 2004
Posts: 103
Rept. Given: 36
Rept. Rcvd 15 Times in 12 Posts
Thanks Given: 15
Thanks Rcvd at 17 Times in 11 Posts
bilbo Reputation: 15
Well done, evaluator!
The trick I told before is just avoiding to copy the INT 2E snippet on top of SYSENTER snippet: in this way you would fuck all the pending system calls!
You are copying it at a displacement of 16 bytes: good.
You have also done a lot of checks... even address FFDF0300 (which is the same physical memory as 7FFE0300), SYSEXIT(at KiSystemService), the code inside KiSystemService (which force you to detect eventually softice) and two times the SYSENTER snippet... but better sure than unsure...

I found also it is not necessary to patch KiSystemCallExitBranch from 7506 (jnz KiSystemCallExit2) to 7505 (jnz KiSystemCallExit).

Quote:
do someone see usage of these on AMD at 7FFE0300h?
No, my experiments were done on a rather old AMD K6 and there INT 2E was used.

niom: it looks like you are interested to ring0 detouring. This is for you: http://www.rootkit.com/newsread.php?newsid=152
It comes with nice code too

Regards, bilbo


Edited for evaluator...
Regarding ring0 detouring suggestion, it was for niom, as I wrote, not for you...
Regarding 9th post: look where I posted the answer, and look to my previous posts, please...
Regarding SYSEXIT patching... I have posted on WOODMANN a snippet which does not patch anything more than necessary...
Please don't be so aggressive... We are here to learn, not to flame each other
Best regards!

P.S. only 3 addresses for phys 41000? or 4? Do PHYS 41000 and you will know!!!

Last edited by bilbo; 08-02-2004 at 21:53.
Reply With Quote
  #7  
Old 08-02-2004, 20:48
evaluator
 
Posts: n/a
>>it looks like you are interested to ring0 detouring
nope.

>>I found also it is not necessary to patch KiSystemCallExitBranch
>>from 7506 (jnz KiSystemCallExit2) to 7505 (jnz KiSystemCallExit).

verry nessesary:) remember, why we are replaicing pair SYSENTER-SYSEXIT
by INT-IRET!?

(that will your 9th power post~:)

another Q: there is III virtual address for 41000, wich is!? :)
Reply With Quote
  #8  
Old 08-03-2004, 09:18
liaisons_
 
Posts: n/a
Hey guys, I've found some info about SYSENTER and int 2e at ElicZs website... here is the txt

http://www.anticracking.sk/elicz/infos/FastNTCALL.txt

Hopefully you guys can use this to gain some knowledge
Reply With Quote
  #9  
Old 08-03-2004, 10:28
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
Wow, and it was only written four years ago. Where has it been hiding? Oh yah. In plain sight.

Regards,
__________________
JMI
Reply With Quote
  #10  
Old 08-04-2004, 00:28
evaluator
 
Posts: n/a
common, bilbo, vhere you sow aggrressionn!?
we'r juZt fun creckerz~~:)

JMI, & in that time reversers was trying change to SYSENTER,
while we are triing BACK TO Fu..
Reply With Quote
  #11  
Old 08-04-2004, 17:59
Mkz Mkz is offline
Friend
 
Join Date: Jan 2002
Posts: 98
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 5
Thanks Rcvd at 25 Times in 17 Posts
Mkz Reputation: 2
AMD also uses SYSENTER

evaluator,

On an AMD this is what I get (XP SP1):

Code:
7FFE0300   8BD4             MOV EDX,ESP
7FFE0302   0F34             SYSENTER
7FFE0304   C3               RETN ; ring0 returns to this line
This is the rest of the code, but it isn't called:
Code:
7FFE0305   9C               PUSHFD
7FFE0306   810C24 00010000  OR DWORD PTR SS:[ESP],100
7FFE030D   9D               POPFD
7FFE030E   C3               RETN
7FFE030F   8BD4             MOV EDX,ESP
7FFE0311   0F05             SYSCALL
7FFE0313   C3               RETN
7FFE0314   9C               PUSHFD
7FFE0315   810C24 00010000  OR DWORD PTR SS:[ESP],100
7FFE031C   9D               POPFD
7FFE031D   C3               RETN
7FFE031E   C2 0800          RETN 8
And here's a sample call
Code:
77D6E285   B8 41110000      MOV EAX,1141
77D6E28A   BA 0003FE7F      MOV EDX,7FFE0300
77D6E28F   FFD2             CALL EDX
77D6E291   C2 1000          RETN 10

Seems that the same instruction is used as in Intel, not the 0F05 variant...

Here's the cpu info before you say it's a pentium

Code:
[ WCPUID Version 3.0g  (c) 1996-2002  By H.Oda! ]

  Processor #1 : AMD Athlon (Model 4) / ...
      Platform : Socket A (Socket 462)
 Vendor String : AuthenticAMD
      CPU Type : Original OEM Processor (0)
        Family : 6  (7)
         Model : 4  (4)
   Stepping ID : 4  (4)
         Brand : ----
          APIC : ----
   Name String : AMD Athlon(tm) Processor

Internal Clock : 1399.32 MHz
    System Bus :  266.54 MHz DDR
  System Clock :  133.27 MHz
    Multiplier :   10.5  

    L1 I-Cache :   64K Byte
    L1 D-Cache :   64K Byte
    L1 T-Cache :  ----
    L1  Cache  :  ----
    L2  Cache  :  256K Byte
    L2  Speed  : 1399.32 MHz (Full)

    MMX   Unit : Supported
    SSE   Unit : Not Supported
   SSE2   Unit : Not Supported
   MMX2   Unit : Supported
  3DNow!  Unit : Supported
  3DNow!+ Unit : Supported
Reply With Quote
  #12  
Old 08-08-2004, 07:28
pigman
 
Posts: n/a
Strace

www.bindview.com/Support/RAZOR/ Utilities/Windows/strace_readme.cfm
Reply With Quote
  #13  
Old 08-11-2004, 19:18
Mkz Mkz is offline
Friend
 
Join Date: Jan 2002
Posts: 98
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 5
Thanks Rcvd at 25 Times in 17 Posts
Mkz Reputation: 2
"Official" FastCall disabling

While looking at "ntoskrnl.exe", I just found another way to disable the SYSCALL/SYSENTER stuff and revert to the old INT 2E.

Go to HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel and create an entry named "FastSystemCallDisable" with a DWORD value of 1.

This isn't an "on-the-fly" solution, you must reboot to make it active, so I guess the posted driver will be more handy if it works for you. Unless you don't mind having your machine permanently configured for INT 2E, that is.
Still this seems to be an officially supported flag, it shouldn't stop working when you apply an SP or hotfix.

To find the code in ntoskrnl, search for the unicode text "FastSystemCallDisable". It's referenced in a table of key names and memory locations. The loc associated with that variable is then referenced in the routine that checks the processor capabilities and sets up the ring3/ring0 transition. It will end up writing the chosen stub to the 0xFFDF0300 offset which seems to be the KM equivalent to 0x7FFE0300 in user mode.
Reply With Quote
  #14  
Old 08-12-2004, 02:50
homersux
 
Posts: n/a
Hi, instead of looking for ways to hook int 2E or sysenter/exit, you should consider hooking the function ptr table after this system service stub. Check the kernel api spy example published by Shreiber in his "Undocumented windows 2000" book.

The idea is to find out the KiServiceTable (exported by w2k and xp) and one of its member points to this function ptr table. You probably need a good kernel device driver to accomplish this task though.

Have fun
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Windows Hook user1 Source Code 0 04-24-2021 05:23
How can I hook DllMain ? ioannis General Discussion 12 07-29-2015 01:09


All times are GMT +8. The time now is 21:00.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )