Hooking Nirvana

More documents

Recommendations

Info

API Set Redirection (Win 7) Windows 7 included about 35 redirected DLLs Format of ApiSetMap was documented in apiset.h (Version 2.0) typedef struct _API_SET_NAMESPACE_ARRAY_V2 { ULONG Version; ULONG Count; API_SET_NAMESPACE_ENTRY_V2 Array[ANYSIZE_ARRAY]; } API_SET_NAMESPACE_ARRAY_V2, *PAPI_SET_NAMESPACE_ARRAY_V2; typedef struct _API_SET_NAMESPACE_ENTRY_V2 { ULONG NameOffset; ULONG NameLength; ULONG DataOffset; } API_SET_NAMESPACE_ENTRY_V2, *PAPI_SET_NAMESPACE_ENTRY_V2; DLL names include API Set Name (api-ms-win) and Version (LX-X-X) 1/26/2016 COPYRIGHT 2015 ALEX IONESCU. ALL RIGHTS RESERVED. 12
API Set Redirection (Win 8) Windows 8 introduces 365 new redirected DLLs Includes concept of “Extension” Sets, not just “API” Sets Extensions are used by API Set libraries based on their presence (using ApiSetQueryApiSetPresence) and provide functionality that may exist only on certain operating systems ◦ New loader function: LdrpPreprocessDllName For example, Kernel Transaction Manager is now an extension in Windows 8, since Windows Phone 8 does not have it ◦ Base library: Tm.sys -> Extension Set: ext-ms-win-ntos-tm-L1-0-0.dll Now loaded at boot by Winload.exe inside OslLoadApiSetSchema ◦ Additional API Sets can be loaded, and merged into the final schema ◦ Schema written in LoaderBlock->Extension->ApiSetSchema(Size) ◦ MmMapApiSetView now uses SEC_NO_CHANGE 1/26/2016 COPYRIGHT 2015 ALEX IONESCU. ALL RIGHTS RESERVED. 13
Page 1 and 2: Hooking Nirvana STEALTHY INSTRUMENT
Page 3 and 4: WHAT THIS TALK IS ABOUT Five differ
Page 5 and 6: MORE PAST RESEARCH CFG has a Whitep
Page 7 and 8: OUTLINE MinWin Hooks Nirvana Hooks
Page 9 and 10: What is MinWin? MinWin is an intern
Page 11: API Set Redirection (Win 7) One sin
Page 15 and 16: API Set Redirection (Win 10) Window
Page 17 and 18: Parsing Windows 10 API Set peb = Nt
Page 19 and 20: Modifying the API Set Map First, de
Page 21 and 22: MinWin Hooking Demo 1/26/2016 COPYR
Page 23 and 24: Double MinWin Bonus While working o
Page 25 and 26: What Is Nirvana? 1/26/2016 COPYRIGH
Page 27 and 28: Instrumentation Callback (Win 7) In
Page 29 and 30: Instrumentation Callback (Win 10) I
Page 31 and 32: Nirvana Hook Demo 1/26/2016 COPYRIG
Page 33 and 34: What is CFG? 1/26/2016 COPYRIGHT 20
Page 35 and 36: Image Load Config Directory Special
Page 37 and 38: Writing a Guard CF Function title
Page 39 and 40: CFG Bonus CFG in Windows 10 covers
Page 41 and 42: What is Application Verifier 1/26/2
Page 43 and 44: Enabling Application Verifier The A
Page 45 and 46: Writing a Verifier Provider This ti
Page 47 and 48: Hooking APIs with Avrf static RTL_V
Page 49 and 50: Application Verifier Bonus Because
Page 51 and 52: What is the Shim Engine 1/26/2016 C
Page 53 and 54: Enabling the Shim Engine The Shim E
Page 55 and 56: Dynamic Shim Installation Shims can
Page 57: QUESTIONS? SEE YOU AT BLACKHAT 1/26

Hooking Nirvana

Create successful ePaper yourself

Delete template?

Save as template?