Bug Hunter Diary

6.1 Vulnerability DiscoveryI used the following steps to find thevulnerability:• Step 1: Prepare a VMware guest for kerneldebugging.• Step 2: Generate a list of the drivers anddevice objects created by avast!• Step 3: Check the device security settings.← The vulnerabilitydescribed in thischapter affects allMicrosoft Windowsplatforms supportedby avast! Professional4.7. The platform thatI used throughout thischapter was the defaultinstallation of WindowsXP SP3 32-bit.• Step 4: List the IOCTLs.• Step 5: Find the user-controlled input values.• Step 6: Reverse engineer the IOCTL handler.Step 1: Prepare a VMware Guest for Kernel DebuggingFirst, I set up a Windows XP VMware 4 guest system that I configuredfor remote kernel debugging with WinDbg. 5 The necessary steps aredescribed in Section B.3.Step 2: Generate a List of the Drivers and Device Objects Createdby avast!After downloading and installing the latest version of avast! Professional6 in the VMware guest system, I used DriverView 7 to generate alist of the drivers that avast! loaded.One of the benefits of DriverView is that it makes identification ofthird-party drivers easy. As illustrated in Figure 6 -1, avast! loaded fourdrivers. I chose the first one on the list, called Aavmker4.sys, and usedIDA Pro 8 to generate a list of the device objects of that driver.NoteA driver can create device objects to represent devices, or aninterface to the driver, at any time by calling IoCreateDevice orIoCreateDeviceSecure. 9Figure 6-1: A list of the avast! drivers in DriverView88 Chapter 6