BATTLE OF SKM AND IUM
blackhat2015
blackhat2015
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
NORMAL MODE CALLS<br />
• Normal Mode Calls are the opposite of Secure Mode Calls – they are services provided by NTOS to SK<br />
• SK uses the SkCallNormalMode routine by passing the same structure that’s used for Secure Mode Calls<br />
• Four operations are possible<br />
• Normal Service Calls [0]<br />
• Normal System Calls from <strong>IUM</strong> (i.e.: Ring 3, Previous Mode == User) [2]<br />
• Normal System Calls from <strong>SKM</strong> (i.e.: Ring 0, Previous Mode == Kernel) [3]<br />
• Virtual Interrupt Assertions (VINA) [4]<br />
• This puts the CPU into VTL 0 and executes the handler for VTL return which will run in NTOS<br />
• VTL 1->0 Switch is done with VMCALL instruction, RCX == 0x12 (RCX is saved into RAX)<br />
• Finally, when secure mode ultimately returns back to normal mode, operation 1 is used (<strong>IUM</strong> Return)
Change language