OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Tuesday, July 4 2006 03:48.32 CDT

Printer Friendly ...

Working? with protected processes in NT 6

Author: EliCZ

# Views: 4370

Even if you have debug privilege enabled you cannot do much with those processes. But they can be patched in a controlled manner. Enable loaddriver and debug privilege, open target process (most known protected process is audiodg.exe)
for allowed access (e.g. PROCESS_QUERY_LIMITED_INFORMATION; MAXIMUM_ALLOWED doesn't work) prepare valid SYSTEM_HOTPATCH_CODE_INFORMATION.InjectionInfo and call SystemHotpatchInformation with (your) dll. LdrHotpatchRoutine thread is created (even if the process handle doesn't grant create_thread access) in protected process and dll is about to be loaded. But there's no simple image mapping, here comes Code Integrity 'subsystem' represented by CI.dll that is km dll with few exports and that will calculate image hash and compare it with value(s) stored in 'catalogs'. If there isn't match, it returns with {// The hash for image %hs cannot be found in the system catalogs. The image is likely corrupt or the victim of tampering.
//
#define STATUS_INVALID_IMAGE_HASH ((NTSTATUS)0xC0000428L) }.
CI.dll is quite interesting piece of code even such exported function as CiGetPEInformation does sidt and mov eax,dr7 (x86) in its prologue.
All in all, the patching dll's hash must be in catalogs. If it is not, it is not mapped into protected process.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit