Abusing the NT Kernel Shim Engine

Video in TIB AV-Portal: Abusing the NT Kernel Shim Engine

Formal Metadata

Abusing the NT Kernel Shim Engine
Title of Series
Part Number
Number of Parts
CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
The Kernel Shim Engine is the kernel’s analogue to the user-mode shim engine (ShimEng). Although the latter now has had some pretty good research done on it, the KSE remains a mystery. First introduced in Windows XP as merely a Plug-and-Play compatibility layer for custom registry flags, it morphed into a nearly-full blown Shim Engine implementation, with the ability to misuse it for both persistence and stealth hooks in the kernel. In this talk, you’ll learn how to use the KSE for hooking drivers (dispatch tables, IRPs, and entrypoints) as well as kernel APIs both legitimatelly and illegitimately. You’ll also see some WinDBG scripts & techniques for detecting and enumerating installed kernel shims for forensic purposes. Finally, a tool called DriverMon is planned for release at the conference, which uses the KSE to provide ProcMon for Drivers.
Slide rule Group action Computer animation Plotter Multiplication sign Template (C++)
Scripting language Windows Registry Addition Presentation of a group Functional (mathematics) Demo (music) Debugger Tracing (software) Symbol table Kernel (computing) Computer animation Chain Endliche Modelltheorie Extension (kinesiology)
User interface Kernel (computing) Computer animation Architecture Core dump 1 (number) Speech synthesis Right angle Endliche Modelltheorie Window Hand fan Reverse engineering
Connectivity (graph theory) Virtual machine Computer programming Theory Revision control Hooking Data structure Proxy server Partition (number theory) Exception handling User interface Default (computer science) Arm Demo (music) Electronic mailing list Bit Category of being Kernel (computing) Computer animation Internet service provider Figurate number Object (grammar) Quicksort Enterprise resource planning Window
Presentation of a group State of matter Multiplication sign Decimal Set (mathematics) Medical imaging Mathematics Hooking Semiconductor memory Different (Kate Ryan album) Formal verification Bus (computing) Flag Extension (kinesiology) Social class Physical system Rational number Block (periodic table) File format Structural load Binary code Data storage device Bit Connected space Type theory Category of being Digital rights management Data management Befehlsprozessor MiniDisc Right angle Quicksort Asynchronous Transfer Mode Point (geometry) Windows Registry Mobile app Functional (mathematics) Computer file Patch (Unix) Data recovery Virtual machine Process capability index Number Latent heat Term (mathematics) Computer-assisted translation Associative property Condition number User interface Information Database Directory service System call Kernel (computing) Computer animation Query language Personal digital assistant Device driver Table (information)
Computer virus Presentation of a group Group action Existential quantification Hoax Tap (transformer) Source code Tracing (software) Software bug Medical imaging Mechanism design Core dump Office suite Physical system Arm Structural load Electronic mailing list Sound effect Bit Data management Internet service provider Quicksort Point (geometry) Windows Registry Computer file Patch (Unix) Online help Drop (liquid) Event horizon Number Computer hardware Divergence Lie group Booting Address space Default (computer science) Matching (graph theory) Information Line (geometry) Cartesian coordinate system System call Word Radius Spring (hydrology) Query language Personal digital assistant Enumerated type Network topology Finite-state machine Table (information) Window NP-hard Building Euler angles Multiplication sign Sheaf (mathematics) Set (mathematics) Image registration Hooking Semiconductor memory Bus (computing) Flag Cuboid Data conversion Endliche Modelltheorie Scripting language Rational number File format Price index Flow separation Type theory Right angle Sinc function Asynchronous Transfer Mode Row (database) Mobile app Functional (mathematics) Service (economics) Level of measurement Adaptive behavior Virtual machine Power (physics) Revision control Quadratic equation Hardy space Absolute value User interface Addition Database Division (mathematics) Evolute Peer-to-peer Cache (computing) Kernel (computing) Computer animation Object (grammar) Enterprise resource planning
Slide rule Functional (mathematics) Identifiability Hoax Computer file Ripping Connectivity (graph theory) Image resolution Coroutine 1 (number) Sheaf (mathematics) Set (mathematics) Field (computer science) Number Goodness of fit Hooking Semiconductor memory Data structure Endliche Modelltheorie Address space Exception handling Physical system Addition Multiplication Touchscreen Structural load Closed set Sound effect Maxima and minima System call Flow separation Type theory Subject indexing Arithmetic mean Pointer (computer programming) Kernel (computing) Computer animation Personal digital assistant Video game Right angle Quicksort Window Reading (process)
Axiom of choice Point (geometry) Group action Functional (mathematics) Hoax Multiplication sign Image registration Crash (computing) Virtual memory Hooking Semiconductor memory Operator (mathematics) Data structure Booting Address space Email Information Structural load Counting Complete metric space System call Timestamp Connected space Message passing Pointer (computer programming) Process (computing) Kernel (computing) Computer animation Personal digital assistant Internet service provider Object (grammar) Enterprise resource planning Reading (process)
Greatest element Building Information overload Direction (geometry) 1 (number) Mereology Disk read-and-write head Dimensional analysis Hypermedia Different (Kate Ryan album) Core dump Flag Conservation law Endliche Modelltheorie Partition (number theory) God Social class Stability theory Physical system Arm Block (periodic table) Structural load Data storage device Shared memory Maxima and minima Demoscene Message passing Process (computing) Internet service provider Quicksort Asynchronous Transfer Mode Windows Registry Slide rule Mobile app Service (economics) Computer file Online help Number Product (business) Revision control Computer hardware User interface Addition Default (computer science) Key (cryptography) Information Database Division (mathematics) System call Kernel (computing) Computer animation Game theory Window Local ring Library (computing)
Slide rule Computer animation Kinematics Database Traffic reporting
Category of being Standard deviation Game controller Group action Functional (mathematics) Service (economics) Computer animation Hooking Query language Data storage device Database Complete metric space
Graphics tablet User interface Data storage device Set (mathematics) Mereology Symbol table Field (computer science) Element (mathematics) Type theory Word Arithmetic mean Computer animation Data structure Absolute value Address space Window Position operator
NP-hard Group action Building Run time (program lifecycle phase) State of matter Virtual machine Port scanner Image registration Revision control Goodness of fit Sign (mathematics) Computer configuration Videoconferencing Flag Electronic visual display Endliche Modelltheorie Data structure Address space Physical system Scripting language Mobile Web Arm Information Moment (mathematics) Electronic mailing list Line (geometry) Symbol table Kernel (computing) Computer animation Internet service provider Right angle Reverse engineering
Addition Curve Structural load Shared memory Electronic mailing list Virtual machine Complete metric space Symbol table Demoscene Computer animation Conservation law Office suite Data structure Modulo (jargon) Condition number
Windows Registry Point (geometry) NP-hard Trail Group action Game controller Computer file Direction (geometry) Connectivity (graph theory) Source code Virtual machine Set (mathematics) Mereology Event horizon Food energy Flag Endliche Modelltheorie Error message God Physical system Condition number Area Demo (music) Information Surface Debugger Electronic mailing list Shared memory Denial-of-service attack Maxima and minima Price index Sequence Message passing Word Arithmetic mean Kernel (computing) Computer animation Personal digital assistant Auditory masking Logic Internet service provider Arithmetic progression
Web page Functional (mathematics) Dependent and independent variables Email Arm Demo (music) Wrapper (data mining) Multiplication sign Software developer Twitter Subject indexing Sign (mathematics) Word Befehlsprozessor Computer animation Operator (mathematics) Buffer solution Right angle Freeware Form (programming)
User interface Type theory Graphical user interface Service (economics) Computer animation Semiconductor memory Operator (mathematics) Motion capture Menu (computing) Quicksort
Point (geometry) Filter <Stochastik> Multiplication sign Motion capture Online help Graphical user interface CAN bus Process (computing) Computer animation Hacker (term) Right angle Computer-assisted translation Arithmetic progression Physical system
Filter <Stochastik> Process (computing) Computer animation Hacker (term)
Process (computing) Computer animation Bit rate Hacker (term) Concentric Multiplication sign Gender Buffer solution Physical law God
Windows Registry Computer virus Slide rule Computer animation Cylinder (geometry) Right angle Endliche Modelltheorie
User interface Game controller Key (cryptography) Computer file Cellular automaton Maxima and minima Database Electronic signature Revision control Computer animation Quicksort Resource allocation Computer forensics Physical system
Windows Registry Arm Computer animation Computer file Causality Multiplication sign Single-precision floating-point format Chain Physical system
plot and the the name and the in a
I'd like to welcome someone who is participating in recording for the very 1st time is getting right Alex the Ministry of you back thank you yeah I think you're on on apologize for the transitions in the slides it is realize now that that company template has transitions which trying hate so sigh for the them anyway
so I'm going to be talking about the kernel should mentioned in this talk and you will brief introduction about myself and presentation there will look at what exactly
addition engineers are what it does how does a chain when look at how you can rotation driver or how existing should drivers and function and will take a look at a few examples of existing ctions that exist the up ring system navigation is in the kernel or undocumented does not any tools there's not any on debugger Extensions there's no symbols for actually understanding what's being shamed and who tioning 1 snitches and when back scripts on some registry keys in the event log of functionality that we can then use to figure out what chains are active so feeding IR the doing on in and Quinn protection and if you try understand what's going on on hopefully they'll you they'll be useful and leading a demo of a tool driver model which is built on top of the should mention I'm in which we plan to release and but if you accept little concluded and do some some synthetic so I look ourselves on the
chief architect across trade a right now before I worked on the Apple core I was deemed so I'm a big fan of OpenX internals on both Windows and Apple's so I'm a co-author of the ones internals books I have been doing reverse-engineering for about 15 16 years now the NT kernel far too long I wish you were just dieing but anyway it's still around and so the lack of a speaking about design issues in Windows or undocumented models in windows on things they're fun to poke at things that can give you on interesting levels of access or interesting kinds of persistence or hiding or things like that so this is in the same kind
around the on someone is not presenting today's running care and he is a fellow co-worker at prostrating he helped to the drama Montel immensely he actually read the whole gooey for it on someone we do talk with a government tool that's that's all really his works I had to give the driver an internals but I'm big thanks to drop in for doing that the so basically were in the
looking a stock adding another component in the kernel that's not very well known called K SC a kernel shame engine and he attended last year's recon I gave a talk on a non-binding instrumentation technologies and hooking so how from user no you can hook them binaries using xim engine using other technologies so no this is kind of follow up really figure will all those user-mode can you do some the stuff from Kermode as well the the so when talk about a way that you can now hook any Windows driver using legitimate introverts so without actually having to know Baturin ITN Teresa hope the driver object comes as a can you hook IT entries so imports schema you hook ERPs this can let you drown recalled acts and actually really nice interface program against this kind of Telit 41 Hoke and it does it all for you the trick of course it's undocumented so theory figure out those data structures there a bit but how to forensically look version providers so what's already on the machine was charming are the things that should not be there by default and well done but something interesting which is high connected cooked who G itself or hooking mission engine arm which has an interesting kind of bypass properties and also look at some built engine providers boats you can kind of know what sort of a machine version that's not that's not a machine it's interesting or few version that is on a machine but that's not the list of default tion's of the partition and you shipment from except that the 2 will be releasing arm and I'll talk about this ritual their own income how a driver can register with ocean mentioned almond out how contractive that well do a demo of the drama tool which I think will be pretty cool but yeah so let's add a little
but how the kernel should engine actually does its
work so basically on the whole point of the current tremendous to like 2 types of ships all at compact when restrictions we all saw what happened that behavior basically and there's defintions and drummer ships device user basically on ways to apply flags or specific policies to certain devices identified by the hard already so we have some particular use believe I some particular kind of PCI devices and different bus drivers like the shared bus drivers the USB bus driver and and also class drivers are be checking what flags are active for those devices and so for example if you have some sort of weird USB device that requires 1 1 ms of half a millisecond to re-initialize itself the hack flag basically says you know required but flight number 4 and its associated with this hard right the this way the driver sees so you've got a vise as flight number for active all that means that I have to wait a little bit longer when re-initializing device so this is the nurses Windows XP on under the guise back then this they had the right a manager which kind of the same thing and then the registry have sometimes flags skull yeah hack flags and things like that so it's really yet another way for device drivers the real to identify if there's some sort of your device and mission the 2nd condition revises driver ships and a dry is basically a file name a path to a driver that you'd like to hook it's imports callbacks or if it's a handlers so does both ravishing and device basically during the image's tialization this thing initialize the cat 2 phases of as a function called k kc initialize it styles that and it passes the same STB database on that you might already have heard about in terms AP passions and I'm ideations and other presentation of done so the exact same format it's used for use emotions are and mess itions also use for kernel tion's as well now KC will not initialized if you'd say they won't initialize drought verifiers enabled it 1 initialize the database like you deleted off this anyone initialize if you bring in when speaking so it can recovery mode the war munitions like this shown database on called driver may not as the being and it's located in the same app patch directories everything else Ahmed appeared next 9 Annex B again there's no kernel shrimp engine but there was this acrobat engine where you could have sort of flax and what changes and when state for the condition engine is the ability to have dry rations well so this is loaded very early on by window . xt which or body if i which is year 1 does with motor it looks and system 32 steps see windows from that patched giving me that is the B and a loads that and that also the right manage I have file but 1 on top of the of the magic it and stores the loaded from block extension the Bayes a solution there is and the size of the sponsor loaded in memory and all case he has to do is now just pass a from memory and look up all those on the stretchers it and we have used emotions you can tag um you can socialism issue with particular binary with school in the kernel xim engineers in association with a party up Patrzykat have a device so you can say if you at this time the CPI table any of this type of bias in the set of farm CPU then dition applies to a decimal that look up not in there as well so defintions erased expose the 3 guys scarcity query by state k secretive eyes that it lists case equidae rise flags and device flags of basically subsidy by state of the XP flags that always existed the XP flax became a subtype of the device they that is devised a category from user mode so those functions are kernel functions but call and decrease of information which is a well known windows on document API forgetting also interesting things the system on you can pass in this information classes and that's going to give you some the device there for a particular device and device that again it's flags policies things that make this device interesting or unusual compared to other devices so that is driver can basically on reactor those differences that the device might have the other place device data can I come from is the registry so device that together come from the SDB these wise load up to disk or a connection company registers Amen and registry-based we have this already registry
machine windows whoops um
system cockatrices control compatibility device and you take a harder our hardware already which is like in USB ampersand some number slash % some number and you replace all the slashes with banks and it is anything in there then uses device data for that device back for a hybrid but if it's not registered again to look up the cache is all this device information is cached and if it's not the cash and they're gonna look in the SEB and the STB basically here are not familiar with the with the as the format which is now documented and there's lots of tools to dump it on effort by tag attack or sponsored if 2 given type says a tag 7 0 1 3 which is a flag which is read by a red meat K flagged as another flat called K data which contains just arbitrary value of value pair data so OK flagged as a few of those in the years the be file an office and dumps on KDD I haven't found anything in my Windows 10 dry remain so it's implemented by haven't seen any data other flags that is at least in in box as the B that's got so who actually reads and devise their device like of Bluetooth driver for driver enumerator on the audio driver the bus driver the on you to take driver the generic a driver and this which then integral windows on the effects synopsis and you X which not those 2 I think it's another type of from Bluetooth type stuff and then use the hub which is the is the drug so all those basically that means all those drivers on recognizer some devices that we manage our strange and device flags if the match particular hits from money machine these tribes lacked differently so by the fixing Arados were working around a harbor about termites Casey also implements a harder ID cash from not have essentially this is used for but basically time a driver on a them plug-and-play discovers the device going to capture the whole hard radial arm and then adds at another cash database and then there's an app health function and T ap help caching for you can call from user mode which is used by the application helper service and this basically query that you the hard right that's a very simple way of knowing what is this harder present on your machine is all the plug and play harder is enumerated in any this sketch and then the application help the army newsman just call and say don't need all the harder it is or tell me this hard radius press can a weird because applying plementary nose and the ABS for doing that but know this is Windows is always at 10 different ways of doing something in 15 different things are stored as information so and that's another thing you can from user node Biscay all Hardy's on ship the other sub this does then is driver and there's some built in dry versions that you have passed in this case the initializes it 1 of them is called drivers scope so gyroscope Isabel tuition and hooks all driver callbacks it hooks on by Octel's it excreting close ERPs it cooks powerups tenderhooks playing a ops the in hopes I device on bureaucrats power XL could pool pull and basically when the active all it does is work all those things and just prints out over DTW to Event Tracing for Windows which is kind of witnesses internal trees mechanism I intend that happens so just kind of pokes those things and tell you that happened as the name suggests driver scope collect the scope for drivers and what is the driver scope is never acted on anything by default but this thing is activated during the hurricane activation on you get some etw that's the then there's another bout 3 solutions Windows 7 version line Windows 8 version lie in Windows 8 . 1 version line missing from imagine you can hook on RTL divergent peers conversion and each particular Hoke and will return a different version so just like in use the can enable in xt compatibility motor with a 7 apparently mode and this lasted driver makes the driver think were running out different operate system on and there's another 1 called skip driver unload which kind of worries me I will basically that hoax you driver unload function and is doesn't call anymore to spring added to w yeah I'm not going to bother calling the unload for the striker that is not active on anything by default but note so it's an interesting 1 so how do loaders get shipped whenever driver gets loaded which others can happen by IP initialized of the driver on my contact service table or am I drive a load succeeded case driver image rights this will then due to thinks it's going to get ditions for particular driver and that's going to apply for the drive once the driver has been shown you get even treasonous you how you can look that an event log and there is a variable in the kernel arena see that basically point celastrol aggression and you get some flags as well that Ilyushin is active so when we look at introspection later with some currently bug scripts and you were in a indices side effects of basically that that being enabled the about
point from whenever a models now being shipped its adaptation driver list and the function called k set K set is model shared and this amazing recorder load aversive every drop of mission and the number of sessions that this drivers currently on that been applied to this driver and an array of all the shins that have been applied so if you're not already shown and then we're going to search the registry to see if there's any applicable Shin screwdriver partnering to see how the registry-based allows addition driver so happens with cases and indigenous registry in case of registry quadratic ships now if the registry says that you have a shingle foo bar register for the driver we're gonna look in the as the being in the database is there a shame called for bars so the base address define all possible sense harm motion that has shame descriptor collocation which basic tells us the name of the show them and the good edition and the model that should be providing the ship so the driver it's actually in the on doing that another possibility there's nothing in the registration and there's nothing in the Red Sea the as the the file itself can have what are what are called cation references and can basically identify this driver and that driver and his driver need division by the Chairman and mission is defined using these what so I can other shimmer driver by putting them the registry or Commissioner dryer by putting that on the US and each 1 is described the commission by doing a name a command line and also source you can know with distribution and because the registry or was it Russians because it wasn't yes the beef up which again is useful and want to go and and done these things in memory now once which identified edition is active and correctly defined for a driver were gonna be resolving the ships so go see is possession for sort of register because version to be registered as a provider ran the provided should provide a register shipments as I provide Schinkel bar with the do it yourself the now it's possible evolution provider hasn't yet loaded another region loading the driver before you actually ordination that will go church this this sham the delays provided attitude Layla provider Russia gonna go and lowered to provide a name manually on by discussing what's your name and w low driver and loading the driver once the provider has been loaded word and dump all the restrictions again and at this point we should expect to find action ended in a driverless unless something's wrong basically means that army of this model for the reason not providing motion that it's post if it is the next happens again down all those models because nothing sessions can do is cook biting entries of any driver so that don't all the drugs that exist and see this year Shen book any of the drivers that this trial might import rest of 1 driver is basically the food out since it's importing from bar dances and ution drivers base is saying Bart answers this function has to be cooked service is the bodices load if there is a barred answers loaded it doesn't have the function you trying to hook and a function neutron hook exists and bots is loaded and then we're going to go ahead and apply additional a bit later were not yet applying machine would basically just checking musicians actually resolved anything because of there's no viruses or this version of boxes is is not export that API will Ilyushin can cook anything so we basically can bypass is not give drivers not ready to be shipped In other words we have vanishing that's valid we have found on all the things in 1 session and all the exports exist so we're ready to proceed to the next stage which is gonna be applying a dry rations so happens of a separate function case that apply actions to driver and this is undergoing case of patch driver imports stable which calls case a patch import table entry which then calls and replace for entry so the manager has a whole bunch of functionality now to basically safely incorrectly patch IT entries thicker section objects and all that at that point you should provide a gets a call and education which and talk about later biscuit tells you OK your notion in this but the already mentioned so far are functions t entries and there's 2 or a 3 taps distinctions can take care of you cation the exported functions of a driver but you can also shown the call said sees and right now we have a 9 called is always done it is loaded your driver we haven't initialize so once you drive a actually initializes which is done by P. Loh driver were IOP initialize building driver that we call a key Ossetian drier I O callbacks this will now call case case at kitchen callbacks for driver and skin hooker driver callbacks private and a driver load on start I O at device and then it's gonna hook all you're paddlers based on whatever Meishan describes 2 2 stages here 1st stage hook the imports passes driver loads second-stage hope the callbacks and the Arabs OSes drivers initialized and then the is fully act so let's see how we can write a
on driver to basically make such engine do all the stuff for us so the 1st thing we need to
use the finer Casey ship Ganeshan is a component that compatibility effects and compatibility fixes a set of functions we have to Hook and callbacks we have to hope that the problem with to hook and I hope you all those things aviators is were providing were fixing working around some sort of blood in the strike so the structures not documented Space Command definition of it offer these reversibly screen of the size of K. C. Shen good and the name not the name of the show
them the you registering and the good of the shimmy registering must match 1
additions and the the files and this is the fi has you should name in Enugu it so you can register and you can register an arbitration but nothing will use it because he has to be filed actually match up to the they get some callback routines socio those useful and then you get to notifications 1 when you driver has been targeted so we've actually loaded on now use I when 1 of the drives itioning has been loaded and another 1 when 1 of the drivers itioning has been unloaded and the past in an array of Hoke collections what's a whole collection what the whole collection is basically a type of hooked entity and there's 2 entities you can hook functions or driver callbacks and functions can either come from the they can come from the how or the income from an arbitrary driver so 0 1 and you are used for function hooks if you said that the coming from an arbitrary driver then have to pass in the name of the drive you otherwise it's an anti hook or how hook well we all know the name of those things are so you have model that otherwise type 3 is a call back in the call that means you hooking either driver callback or a under paddler and now you define a collection of folks you have to go and actually find the hopes that make up this collection the so that's Self another structure n tended repeatedly that function has its own that does searches on type 1 for function or 2 for call and this is a function we have to give it the function name that you're looking if this is a herb callback you give it a callback ID and we assume the Kullback ideas match up to you then pass in on the address of your function of the hooking nothing so the hook function there that he avoided is appointed to you're Hoke and in all original function you get a pointer back to and original function I got hooked the idea being that if you do wanna hold the original function you call original function and then life goes on but that is only filled out if this is a function of this is callback cook that act that actually using it feel that so we have a problem when you see a deal that so how do you have a function altogether again fairly easy you look at what you're trying to on what exports thing index exports and thus kernel you create collection 5 0 if the export is held the allow you create a collection of type 1 and it is a custom driver you create a collection of type 2 you put driving so they have a very simple example here on if you on a hook xl keep all tidy say 0 because x Alcatel tags and Intel's kernel you put the name XL people tag and they give a pointer to Europe cloak but he allocable in all that's where you going to receive the original XL people tap you hook function you do whatever you wanted you could cooking XL could pull and then you return hoax 0 original function may skew called the original function that's there or maybe you'll just side note I'm not in allocating memory for you which would probably be that and 1 of things and I wanna know means several hook is some hooking multiple drivers distinction would drivers actually calling XL could pull so there's no kind of built in way of knowing on that but you know you've got interesting ambitious you call underscore return address and they'll give you the return address of what called you so that we can tell what you're actually is cooking UK sticky accepted pool so the wonderful trust drivers only you can do that obvious if you only tioning 1 driver then you don't need to worry about that so what about looking complex so there's 4 combat you can hook you can hook driver in its driver unload Drivers start I and you can have a device or you can look every ERP which are I O request Packets is that Windows actually does you know I 0 so this I use for create for close for read for right and there's not too I a PNG maximum function cops it interestingly um you can hook any of these things except actually driver in it because you go back a few towns FIL make a few slides we said that we hoped all the functions caesura loads and we hope all the callback systems driver initializes so you can specify a driver in ad-hoc but it won't actually be called because you could only get applied after driver and runs but it's a kind of a design fallacy there you can see again that the pseudocode we call driver in it and then we apply the hooks and driving it never gets called again so when you're in a call you hoped driving in it whoops so we said that if you've function and you can you get the original ideas known hooker callback you actually get the original address will that is there which is supposed to do use this to call this other function K get I callbacks in case you get 0 callbacks returns to you the original call back so can weird for functions you get the address for callbacks you have to ask it where the address this and you can ask and 1 4 D rejoinders to it to forgo restore like so 3 4 driver load for for driver at device and for cops presence on number that resemble higher PNG created 0 I P and J. breeders for 3 API into closest to so what you do is you at to that number suggest hundred to engage RIP injure close and if you ask for a hundred then get API J. create I'm so 1 4 those hard good ones and then 100 plus the ERP identifier or the error handlers and medical Casey get I O callbacks for that section out export function well go back for a 2nd year in a definition of a K. C. Shen those is field here called Casey callback routines of resolution could and I
am the Casey callback routines that's reaction a pointer back to case again callback so it gives you the function that you need that need to call so that's I find physically and then you can call the original function now the thing with ERPs is that Uncle unlike function calls which returns immediately ERPs can either be complete return immediately but by the time they returned to the ERP is that should been completed meaning that the other side has reduced see the answer and the IRB structure which contains the answer may have already been deallocated were freed the other possibility is that the function cannot return immediately others is an asynchronous I O so the herbal be completed later so you generate from there there's no answer yet to connect up to bad choices read from their perennial crash was your best on of depression of the operation succeeded or read from the Europe and get useless data that is Europe has complete it such actions to do is register a hoax for the completion of the and again case user function for that case he said completion Hoke and you can say for this er out like to hookers result so connection or what happened with that and again Casey said completion hook is about export function it's another call by the you see your ship so ution structure because they give back the aversive and Casey get O completion callbacks we know what to call when you're done NKC said completion hook if you like to request a hook for Europe which is nice because is means you can have treat operate Pre looks before the budget it's process by the driver you can have both looks after the year has been processed by the driver the the example for you right in your free you can see what the user meant Apastron trying write in your post you can see the right actually work and if so how many bytes of in red for a read well when you see the reading free all you get is someone wants to read something in your post then you have to get the sea and what was actually rat the the other thing I mention you get is to arm callbacks the Shin targeting callbacks and so whenever a driver's actually should by you you get investigation from Casey saying you notion in driver and you get the name of the driver shimming it slowed address its size its timestamp and its checksum and when a guy was unloaded you get the same information back telling you this driver that you were showing for on is now gone the and so what's interesting as of this information you can be scandal yourself like a memory map of OK from here to here I have my this drivers here from here here this other drivers there from here you have another driver and then a new function looks into the return address you can scan is the return hour is the return address in 1 of these memory blobs that I know about OK then this is this driver trying me and you have its name is checksum from year targeting back from Arab well I never gets a device object device subject points to the driver object the driver object points to the start of the driver so again you can match up the start address of the driver sent air with the content that's handling the Europe with 1 of the drivers you're targeting and that way you can know exactly on what drivers is is like art critic cooking in the middle of you're on the middle of the year of functions so once you define all the structures highly then register for action provided what little Meisel expiry PI recalled K SC register shimmy X and you base pass in that case the shame structure which ution you Gouid your name the collections of books and the actual hooks and you your driver object the that means that case will not the coreference I'm driver and she actually tried on low you driver while you still shimming things what actually you'll notice is gonna run the driver load but it's going keep the resident in memory united handling a new kind of Ohio's but anything of shame and will still go through you on policy on registration and that thing then goes away as well so this allows you to basically reference counting and making sure that you don't end up with a shame driver and unloading while this active shims which obviously will now call a deal no pointer or something worse so this things if you unloaded and restitution but drivers are still active you remain resident memory similarly there would also means if you load your provider after the drivers already are loaded you can't Shimin existing running driver so you have to reboot the machine engine and boot or unload the driver and reload because of the driver here and you would never registered so those nothing there's nothing to hold to begin so it's a good a
few examples are 1 example of a built in our March of built on but it in Bochum so basically not a third-party driver but inbox driver that's not the kernel that registers on basically by looking at this and that's how I can understand how oceans work so in
the building databases and there's a number of interesting things in there and you can dump the database with found as to be explored great tool on the z works has something they call tion's which also listed emission database than Microsoft actually has something gulshan to XML or as B to XML such you don't come mission database as an XML files and that addition the division in C ap help entries which basically say this driver is not something we wanna loads so is block it and that's done in user mode actually so that's 1 partition not done by the kernel is then in user noted our trust install itself you know part of this is is a is not compatible Windows but we have k device entries are will give you these but you used by the device compatibility stuff so any flags and they need to be applied or any device data and that's key device and drivers used by actual dryer ships so the directions from are in there and then K. Shim or watching providers are actually register and again every provider has to be has to be you can kind of make up your provided without any definition for it so you look at a few examples of God both from the XML dump from wanted tools and the axonal them from the other 2 will so arm there's 1 here that is he says this is a key Vice-Chairman so this is a device shown and the main identify some sort of hardware so far I have something from the vendor 1 B 21 product 1 0 the 0 arm which looks like it's an AS media vendor so some sort of use B 3 vise made by is media on it's going to apply the flag 4 thousand 96 I am with the name USB and the implication here would be that the USB class driver with call Casey get device flags passing in the device ID over here and should database would say yeah I know this device it's got flag 4 thousand 96 and then 4 thousand 96 to the use the class driver means something like again you know this device this a longer times initialized so you should take longer as well I'm an example of a dry version is the bottom and this is
basically saying on that T S S safe dances 8 q q came from and I love it when games local drivers makes me feel really safe and this pops up a message that says the driver is installed that causes the stability problems with your system no surprise arm and then it basically has all the product version of socially with us as an example app help on shame that basically says yeah were not eligible this driver it's it's back and then later after a tumultuous other examples again these are just from the dump of the has to be the babies don't with as the to XML arm which is the max of tools so what are the built on Windows Shinzon provided if you look at the database while this Scopus Skiba overload Cambridge online which are built in then there's 2 interesting ones called k m model fail and auto fail which are meant to be registered by came off of us is an on-field answers but those are actually exist then store port device addition and conservation are register by StoreBoard out which is the window storage driver USB shown is registered by USB deed answers which is the head of a generic library that all use USB devices use an end is get version 6 4 0 a shame as Russia by and as such that the driver larger restrict check which version of and the on some guessing just like the version this allows in this light driver and say no no not and the 6 . 6 AM and this scene of 6 . 4 then in the registers dimensions so drivers can be target so by default on like a clean windows that isolation on if you go to the the key there and registry that compatibility key there is a sub he called driver and under that subkey there's different driver names and In might see this fish others a few there that I've added but the 1 that's there by default only a store HCI dances which is the age irony of sadder story Trevor it has the exhibition applied so this 1 every load store a chair answers it's going to be shamed by SRB Sherman which on the previous slide we saw that the solution is registered by on store ports to stop process will be shimming store HCI that's but that's only the registry remember that the as B can itself have other share information so just a few examples years bution books WSR enough this edges services were answers EC F-DCB 64 ounces so those dryer vendors doing something wrong and USB has to come in and can fix them up on and is given a 6 4 shares in Realtek drivers in there and k we need 1 version why something called the fried FSS there enters all versions which are again on glued by shown by other things so you know if I open up here the from the
database that I've got this to be text
obsessed underwriting it's to be that the text
and anything that this has cation ref
in there i is something as can be hooked so come thing from kinetic USB this was seen there is 1 in heaven slide for example there's some reporters at it frankly then the evolution of and properly there's a Franklin
values 600 driver and it has been shown by k and win 7 verse and lie on so this driver needs to be told I 1 when 7 so again just on the database and you can see all these examples of for your
safest and when update can obviously of the this is the the database and can add additional devices and their as an additional tion's as they needed so that no examples scuzzy port registers a shame on tutions actually as starvation and device ideation both of those only should have 1 who collection that's a callback election and there's a single hook for the callback election which is the hope for I P and the device control so any i Octel's sent to stop or or through sigh through store HCI which stopwords hooking will be hooked parliament as a function device ideation hokey was controlled folks but I apples 40 device edition and there's SRB tional rice control which works on the atolls that extradition Asoka so as exhibition what is it then doing is visible for any i octal that I octal storage query property and he feared querying standard property and property idea storage adapter property and expecting 32 bytes or more that's get target the service to right this group is interesting so I wanna Ritzer completion callback or completion Hough so the ERP completes then I would be notified In the completion of of what is it do well obviously checks on again DUE you did we return 32 bytes or more mn ended which ran successfully and if so we're going to go in and went to edit the actual mind when entered the the actual
SRB type and address by field and this set is 0 so we to override this legitimate validated that we received with zeros just out of interesting why are we doing this to force for HCI says why are we clearing out these bottom 2 fields from Dad you know where religion and so actually them as the end because he tells you that SRB type was added in Windows 8 at address type was added the Windows a meaning that an older driver that's tracking store HCI would necessarily about those fields but that was the problem like why would they have passed the size that is to buy some more because the size of the structure with others to come element to be counted should be 3 bytes so the data is asking for 3 bytes shouldn't get this field why would a driver that doesn't about those fields pass 432 bytes while the absolute destruction Ida turns out the because of alignment because you got an existing word at the the structure and structures of 4 byte aligned you have 2 bytes of alignment at the end so the actual size of the windows 7 structure is 32 bytes and the bottom 2 by 2 just padding and so you might now is that a patent owners 8 get actually data that's there so they 0 that they tend no no that's still padding this year Windows 7 driver you should know about those fields so either that's because someone was you know expect expecting padding were part you know reading the previous field incorrectly before the reason they're playing it safe missing know that driver will still see that when the suspect so things abolition on how these position was a really good example you know haiku right my notions and after that the and all this was used to analyze would be symbols that are an item so that's
how in boxing works on a show you how you can actually see the show on Intraspect
ominous ways you can introspect shimmered not because you actually know symbols is very hard allies at runtime what's actually going on but if you currently butter and you have no some scripts and the right knowledge in Uganda reverse-engineering looking pretty good overview of everything that the shipment is actually doing so measure fusion steerable their work on shown that other US which is kind of a scan displays information Leshem engine on my machine Shimada WS is down on any models that being shown to should red which is going down any I should have been registered engine cash which can down Shing of cash so either the harder right the cash or device that catch so that them the scripts and to now a clean them up common libidinal tally among did have later next week so you can actually use the scripts and learn from them on Indian introspection as well so basically all rely on this structure called Casey engine which is a global on the kernel again not documented on but this is kind would be able to reverse from it so the some flags since the information there is a list of all the XIM providers there is a list of all the doors that mentioned and then there's the arm catch you eyes cash the harbor cash and then there's the last rather change and so the little script that will display the state
of the casing engine if those for that action that the BDS this is basically saying the engine is ready on dry versions have not been disabled device shows have not been disabled these are the address the to the callback routines that drivers can call this is where device is therefore for the harder occassion is here is the list of registered shows here is the list of options drivers and the laughter of the Gaussian is a the that's that's essentially saying that on my on my system a of dealership the and then there's some state flags arm which are indicated for example that no group policy was it was found oceans have not been disabled or enable by Group Policy that's not configured and active driver shame which is indicating that something is shown on and there's no good sign of that which is that they're the so is kind of mobile state about on what's going on this 1 I can for example take the registrations and the moment you don't build bang lists and run a little script that should hopefully show what those drivers are also Shen bragged other videos and ch so K. C. D. S. Shen has been registered death driver scope but there are no active drivers scope is active when 7 original ition as a registered but it's not active when a version line register
but no active shares we need 1 registered no active Shannon's skewed driver
unload registered no activations store-bought conservation also active device addition not active condition not active and have will
ever modulo load complete but symbols could not be loaded for blahblahblah shimmered office that's my stuff which has 2 active Shannon's so shimmer exactly actuation 2 things and then this is CS shimmers a driving so without all about then he was bution so basically you can clearly see this curve that something actually sharing the machine answers strange shimmer driver all the built-in Shinzo scene and the National and anything at all and so if we go back to the Casey that structure that would just dump was the list of registered drivers or shimmers now we can see
what's actually being shipped so that's of different was there so straight that 1 this is a shame God the status of that list crossed fingers and 2 things are being shown empty so actually I am solution model here that's about there are no not 6 billion actions but X 1 and DFS is being shouldn't and there is 1 thing showing its and there's gonna be array of all the things that assuming it and that array you're gonna find shimmer and then a of these being shipped and again that's because a special thing of Low German demo and so I can see all the shit providers and how many things are showing solution things and what sector showing them so that should be pretty useful I'm Magadan Shin cash but a basically a
bunch of hard readies at that point so turn this thing off by the waterways again you cannot have a track with this as a registry key compatibility we can disable device sharing or you can disable driver shining and you go to the Group Policy energy be added you can actually go been was components device compatibility and you can turn off device compatibility which means no device since no finds or you can our turn of driver compatibly settings amino directions then a secondary register king which incorrect control sequential compatibility which for your system you can use flags and they will flags 1 means you're disabling progressions this your flags to means you disabling device Shenzhen both them together in a K 3 means you your and undeserving both conditions now from the bugger there's a variable called case 70 but flag if you set case of the bad floods to map to a mask you can see all errors or warnings are many information from the debugger of the kernel debugger that the kernel ssion engines because Casey heavy but Prince everywhere it even has an array called case of history areas which contains an array of all the errors and you get the file name and the model I D and the status the Word error happened then in the value on but actually is 8 kernel compatible kernel compatibility and logic and you can see for example event log entries when a device should has been applied and soldiers source so the example my machine there actually is a USB device which has a flag applied to it and it's as applied to compatibility that it's so they have to be some online surface is actually applied a device ship there's another even what stably which has 1 shame was applied to driver a the it's apply to the registry that's the shown that much of a demo that's part of the drama so naive and you're ready for the actually see on this operational messages that an indicator you definitions active on pseudo max and this is a half User divided am he gets information the mother's lots of the vulgar you get to see the driver pursue always has this this is doing it Hashim David E. but what is that do it
so basically this ability to then on being able to share in any driver I cannot be created a so
called on shimmer as very ugly volatility reminiscent of like Paul on for for most form on and Bayes data showed you on you driver at time 0 which CPU which appeared in which the the something and as a demo ibisc ashamed of all the URPs nd allocate and free Paul functions so what should the school because of that Robin I hate he built
eventual called driver remark and right among basically was meant to kind of would not replace the be like Proc not so developers matter the ability search filter and highlight operations to do nondestructive filtering with are going to be all to export to see is the deal to decoded from out those and so on so I work out to honest per time and we basically have 1 0 release that's almost ready risk after wrapper BYD you all of the bill signing and all that and it should be on the community Tools page arms of you from overcrowding spectrogram response aunts can be on the unseen data managed to avoid not having get could be called crowd something thankfully and and we've got a mailing was and be set to drive a monochrome strike Wikinews richer than in Twitter once it's all comes out if you have any kind of questions were a feature requests things like that so basically this is what it looks like that actually be demoing it on but this is the pretty picture accuse them of fails because know in all on so this is kind of showing you all know and PFS I set of search indexer the right on it row 14 bytes now we'll show you yet what those 14 bytes word but you know it's obviously wanted this search allocated from the pool of a buffer
the and then it from a pipe obj 13 her by also because this is PFS these are implying that these are kept type operations but I'll show you some
maybe dances which would imply that the user from that of operations so actually
run driver among about things fail OK
some scanning hit that capture and starting to give us a sense of a V which is the windows when sort driver so can see that service and said that Apple then a the alligator freed some memory and then we got creates and then we allocated some but you fire like Explorer yeah well little the more the from services can start menu of whole bunch a stuff happening click on start now school so I'm PFS scanner bravery busy and that's what happens when we run Chrome with the fun actually monochrome users and
named pipes for its so except the so edges crossing around doing nothing yeah but giving access was a lot time in improving the name pipeful system of course can stop the capture which will stop at some point the U I only really have wanted to i'm because this is just like starving the AP non-stop of stuff I close chronically ill help things all of that in year so this'll this'll stop at
some point knowledge is basically going over everything from dead and I can kill your schooling which it up a little bit on and I just keep on going going going receiving at and so this is just like progress I can record on Chrome for example and say alright thank you for letting me know that I did that um exclude process chromatic see who just excluded from so I can see everything else except from Encino I was the principles of user right click thank you includes full as the and I see just what's policies in smaller this include a the only hand now CAT so just like the normal filters you probably missed you with found with with proper than a can of course I clear all custom filters so everything should be coming back now I can also say you know some process hacker for example it blows driver talking clear listen saying the
let's go process hacker which I think is k process hacker 2 . is and say OK capturing that's going to get rid of a the the
anger of NPs 1st answers so books like her it by the other 1 back OK can have to work on that and so surprises hacker the yes the caring
and then the autoscroll but and
clear manner through so the filters
the as doing anything process
hacker for him renamed itself the process hackers 3 this is actually what I'm afraid of concentration check that file I landscape process secretary so an interest rate 1 more time k process hackers 3 dancers and then actually
next as the stuff k process hackers 3 could it run process
hacker and make a sacrifice to the
gods see that actually works
notions of all gender more everything so it would normally work when we figure out of a strong this thing so all that's idea and obvious applies to make a lot more and no less buggy and to be able to actually see those buffers are and decode the tools and so on so forth but it gives idea kind of went law for 4 here so the skin the bonuses
um but you know you see some slide basically you can hope to look engine and which is why I found out a candle the last minute and so those the
slides but you have online and cylinders conclude some concluding thoughts
so basically what questions my have is how is the shura tool able to shame arbitrary virus because we said the fishermen's applied to the registry and it has to match a shaman he has to be and I haven't modified my is the biggest say that there is now a new show called shimmer with really quality has to be predefined some non extinctions solution called came all of failed the do it now came model failed doesn't actually exist so nothing that comes up and says i and k model failures might do it so all we have to use right on driver and like the 1 I just did which makes as I'm came out fail and is known as OK cool I know OK model fillers and according here's the BK model fail as legitimate shimmer so your legitimate and then I can just go in the registry and basically all the tools doing is going to be
out they have the dancers and PFS dancers in these systems Greg control said control compatibility key that we talked about and is basically just saying 0 8 of the dancers has a sham and it seems called came out of the cell and now I'm came on availability rest users do it an allocation that so much as get
desired behavior that even that wasn't this the fact that no on even if you couldn't do that trick murder as the be files are assigned so if you know how to build and as the B file you can just edit DRV may not as a B and defining ution in there so this was a trick that allowed me to avoid having to do that but even if the triggering work you could always added Gary may not as because no signature that so feuding forensics after obviously 1 make sure that those red keys don't contain we're entries that we don't have drama the Phoenicians being chained and he also we'll be good to have like a check or some sort of database of the during the ICT hashes this is not science is very hard to know do you have the original max of giving me not as the B or a modified militias the every minute as the B C 1 of up Ki get a check some of it when all windows 10 versions should have the same there remain as a b a lesson someone can add the stuff and so that's pretty much it we have this ability
to cook anything we want arm we have an API lets us do that and we can build tools to rely on that and make sure you I
use those driver debuggers gives an release make sure I have which ends look at the registry Mischa's chains in there and then look at years to be filed make sure that is the file matches which should so thank you very much for listening it it and I probably have time for questions I'm guessing were reading committee wanted to question this 1 over there and so on so I aiding other unfucking Napoleon drivers well I have seen the ad helps them being used on something quite surprising I the so I'm going the wrong way so if you have a single problem on that's this natural makes that I all right Microsoft as a dry resist all the causes the Billy followed your system so these are the most of our but not as a natural shame by just gonna blocking is and I haven't seen any have built emissions that don't abandon worker-run OEM issues so but I will all be around if giving you the questions all of the next speaker come up and thank you again and the danger the rest recon that you