Bug Hunter Diary

Directly after the call of the memcpy() function, the kernel functionKeSetEvent() is called:[..].text:00010E10 add esi, 4 ; source address.text:00010E13 mov ecx, 21Ah ; length.text:00010E18 mov edi, [eax+18h] ; destination address.text:00010E1B rep movsd ; memcpy().text:00010E1D dec PendingCount2.text:00010E23 inc dword ptr [eax+20h].text:00010E26 push edx ; Wait.text:00010E27 push edx ; Increment.text:00010E28 add eax, 8.text:00010E2B push eax ; Parameter of KeSetEvent.text:00010E2B; (eax = IOCTL input data).text:00010E2C call ds:KeSetEvent ; KeSetEvent is called.text:00010E32 xor edi, edi[..]Since the user-derived data pointed to by EAX is used as a parameterfor this function (see .text:00010E2B), the data buffer needs tobe filled with valid pointers in order to prevent an access violation.I filled the whole buffer with its own valid user space address (seeline 97). Then in lines 100 and 103, the two expected patterns arecopied into the data buffer (see .text:00010DEF and .text:00010DF7),and in line 106, the destination address for the memcpy() function iscopied into the data buffer (.text:00010E18 mov edi, [eax+18h]). Thedevice of the driver is then opened for reading and writing (seeline 110), and the malicious IOCTL request is sent to the vulnerablekernel driver (see line 122).After I developed that POC code, I started the Windows XPVMware guest system and attached WinDbg to the kernel (see SectionB.2 for a description of the following debugger commands):kd> .sympath SRV*c:\WinDBGSymbols*http://msdl.microsoft.com/download/symbolskd> .reload[..]kd> gBreak instruction exception - code 80000003 (first chance)******************************************************************************** ** You are seeing this message because you pressed either ** CTRL+C (if you run kd.exe) or, ** CTRL+BREAK (if you run WinDBG), ** on your debugger machine's keyboard. ** ** THIS IS NOT A BUG OR A SYSTEM CRASH ** ** If you did not intend to break into the debugger, press the "g" key, then ** press the "Enter" key now. This message might immediately reappear. If it ** does, press "g" and "Enter" again. ** ********************************************************************************One Kernel to Rule Them All 107