last day (15 days later) » 

17:23
1
A: How to exactly modify the Local Descriptor table on 64 bits Windows?

RbMmon x86-based windos possible (tested on xp and win 8.1 x86) set several descriptors in LDT table and use this. this can be done via NtSetInformationProcess with ProcessLdtInformation (undocumented) or, if we need set only 1 or 2 selectors - more easy use undocumented api: EXTERN_C __declspec(dll...

Local Descriptor Table is a feature of the ᴍᴍᴜ not Windows. So it’s supported. What might not be supported is modifying it from userland.
@user2284570, not this is not supported by x64 windows, no matter from user or kernel mode. at begin in GDT must be selector for LDT, but here no such selector, and you can not modify GDT yourself
It needs to be set by Kernel code. It’s supported the same way as ᴘᴀᴇ on 32 bits : third party code including drivers can’t access it.
@user2284570 - again, this supported by cpu, but no api for this (from user or kernel mode) for this in windows. if you try do this yourself - will be conflict with op system. as result nothing happens or will be system crash. say off paging also supported by cpu. but you can not do this in windows
@user2284570 - but question about windows, not reactOS. you can not do this in x64 windos not because this is not supported by cpu, but because you conflict here with operation system. and you not win in this conflict. are in reactos - i dont know
@user2284570 - dont know, are you can implement this in reactos. in ms windowsx64 - no
Ok… It’s not supported in ReactOS whatever the architecture. I noticed ʟᴅᴛ related functions are only present in 32 bits Dlls (see the last edit)… Which brings me to a specific point if you didn’t performed the system call directly (a similar problem exists in Linux) : did you tried this from a 32 bits or 64 bits process ?
17:23
@user2284570 - in x86 windows not exist 64bit processes. this code will be work only in x86 windows
@RbMm On Linux all binaries which uses the ʟᴅᴛ for 16 bits are 32 bits programs even on a 64 bits kernel… So did you used a 64 bits program or a 32 bits program under WoW64 for STATUS_NOT_IMPLEMENTED ?
of course on x64 i use 64bit native code
this is easy look in kernel
this is code from x64 kernel (win 10) - i.imgur.com/zuZgGie.png c0000002 - STATUS_NOT_IMPLEMENTED
but look like i mistake - alex-ionescu.com/?m=201708
 
1 hour later…
18:54
@RbMm that the point, on Linux with a 64 bits kernel, you need to use a 32 bits binary (again with a 64 bits kernel). And with a quick look at debugging symbols of Windows, it’s likely the situation is the same.
19:18
@user2284570 no, not the same. no any difference here use you 32bit (wow64) or 64bit binary in x64 windows - in both case you got status not implemented error
@RbMm And NtSetLdtEntries() or ZwSetLdtEntries() functions can’t be used for that purpose ?
yes, can not. may be my bad english, but i already many time say - this 2 api work on x86 windows only. in x64 - both always, unconditionally return error
Conclusion: Windows 10 Anniversary Update Mitigations
In Windows 10 Anniversary Update (“Redstone 1”), a number of changes make these exploit techniques impossible to use:

All of the LDT-related fields and code in the kernel is removed. There is now no way of having an LDT through any Windows-supported mechanism.
PatchGuard now checks the LDTR register. If it’s non-zero, it crashes the system.
@RbMm Or at least the code which use them in addressing. Because Ldt is still saved and restored at many points. The following come ntoskrnl.exe in Windows 10 :
KiGetLdtr proc near
sldt ax
retn
KiGetLdtr endp
KiSaveInitialProcessorControlState proc near
mov rax, cr0
mov [rcx], rax
mov rax, cr2
mov [rcx+8], rax
mov rax, cr3
mov [rcx+10h], rax
mov rax, cr4
mov [rcx+18h], rax
mov rax, cr8
mov [rcx+0A0h], rax
sgdt fword ptr [rcx+56h]
sidt fword ptr [rcx+66h]
str word ptr [rcx+70h]
sldt word ptr [rcx+72h]
stmxcsr dword ptr [rcx+74h]
retn
KiSaveInitialProcessorControlState endp
The code of those functions seems to be consistent with their names.
and so what ?
19:34
@RbMm The ʟᴅᴛ isn’t totally ignored. At least it’s handled like no‑op register.
not supported x64 in general ldt, if you read article - partially it can be used in UMS thread. in resent versions - PatchGuard now checks the LDTR register. If it’s non-zero, it crashes the system - so use it impossible
@RbMm And above you have code that read in the Local Data register in the kernel of Windows 10 after anniversary update (sltdt instruction) ! I just disassembled the ntoskrnl.exe on my system.
but what concrete you try got ? in what your question ?
@RbMm As result I’m unsure NtSetInformationProcess is the only way to performs what I’m looking for.
100% sure that this is only way at first, at second - again - x64 not support ldt in general
19:43
KiRestoreProcessorControlState as guessed writes back to the ʟᴅᴛ.
and so what ??
same as previously
you can not do this on x64 windows. all. KiRestoreProcessorControlState and dissamle any names - nothing give to you
19:59
@RbMm Yes they aren't accessible through a System call or Internal Driver API. But there's still code for the LDT.
but are you understand that system can not allocate selector in gdt for ldt ? or at all special do crash, if detect not - ldt register ?
system can not reload ldt , when swap process context, etc
simply no support on os level. or even check and crash
20:15
public NtSetLdtEntries
NtSetLdtEntries proc near
mov r10, rcx ; NtSetLdtEntries
mov eax, 1A1h
syscall ; $!
retn
@RbMm what’s the function being called here ? More Generally, what’s the calling convention on Win64 ?
Of course, I already know most of the parameters of NtSetLdtEntries .
20:35
Ok… It calls a stub
20:46
@user2284570 but i paste you already actual code in kernel - i.imgur.com/zuZgGie.png
@RbMm For All the functions above, I was talking about 64 bits kernel (and those functions in your image aren’t present in 64 bits Ntoskrnl.exe). NtSetLdtEntries being dissassmbled here is as you can guess a function of 64 bits version of NtDll.dll.
I don’t know the exact function name being called through the system call since it can’t be NtSetLdtEntries which doesn’t exists but according to Reactᴏꜱ developers it’s a stub.
i paste you actual code of x64 kerenel. the NtSetLdtEntries exist - and i paste you it code. the ProcessLdtInformation - call internal PspSetLdtInformation - again it actual code also in this screehshot
i know this better than according to Reactᴏꜱ developers ^)
@RbMm do they come from the supposed cleaned ntoskrnl.exe (the one after anniversary update) ?
oooo... this from ANY ntoskrnl, begin from win2003 up to latest win10, from ANY how else say you this ?
@RbMm Because I run latest Windows 10 Insider, and I don’t have those functions. Not even in debug symbols.
20:57
in x64 windows kernel - ALL, ANY x64 windows kernel - the NtSetLdtEntries and ProcessLdtInformation always exist and always simply return STATUS_NOT_IMPLEMENTED
Because I run latest Windows 10 Insider, and I don’t have those functions. Not even in debug symbols. - YOU MISTAKE
@RbMm maybe we can share a file ? I doubled checked and they aren’t there… included as data.
yes, share, upload your ntoskrnl
or, if i can run self debugger in this system, can look/show where it
simply upload your ntos to sendspace.com
Ok there’s ZwSetLdtEntries but that’s all.
you MISTAKE
@RbMm More exactly, it’s ntkrnlmp
21:06
upload your file to sendspace.com
no matter how it named
simply share it
And KieGetldr which I brought the code before (but isn’t exported).
After’s it’s currently the matter of waiting at 10Kb/s for 17Mb.
you can upload file ?
@RbMm as stated in the previous comment at available ɪꜱᴘ speed.
i for example upload self ntoskrnl (8.5Mb) to sendspace at 2 seconds - sendspace.com/file/gitku6
why so low spead you have ?
@RbMm mayor promised everyone would get fiber to home before 2017 in order to overcome this situation… We’re still waiting…
@RbMm anyway here’s the files : filebin.net/bq0oh702yl6kg7et
21:15
pdb was not need for me - i can get it youself
as i and say - you bad look. nothing changed
this is from your ntoskrnl.exe
i load it at 00007FF6F6670000 base address
@RbMm Which tool ?
my debugger
so RVA is 00007FF6F6A14410-00007FF6F6670000 = 3A4410
@RbMm Which tool name ?
dont know how you look
Which tool name ? - it have no name. it my tool, in sense i wrote it
@RbMm With official Microsoft depends.exe, I have base address 0x140000000. The functions you have on screen also can’t be seen through grep or findstr.
21:23
so RVA is 3A4410, file offset is 2ede10
what you actually want ?
0x10 bytes higer exist in your file exported entry
https://i.imgur.com/TRJXQLa.png
KdGetDebugDevice
simply look at RVA is 3A4410 if loaded as image or simply at file offset is 2ede10
but anyway all this unrelated to your problem - can belive or not - but you not create ldt yourself in x64 windows
@RbMm I strongly believe there’s no ᴀᴘɪ.
not simply no api. no support
This what I’m getting with depends.exe from Latest Microsoft ꜱᴅᴋ i.sstatic.net/S8uIi.png
Are you sure you’re using the right Debug Symbol file ?
@RbMm I mean does your tool automatically redownload debug symbol ?
21:39
of course. i do all correct and you wrong
my tool do all correct
depends.exe is useless here at all, because thay show only exported symbols. what you try todo ? you can not use ldt in x64. no way
And in ɪᴅᴀ (with debug Symbol loaded) the result is the same : i.sstatic.net/AC4Qi.png
@RbMm guess the stub function being called by NtSetLdtEntries.
again, what you want ??? stub this is Zw. actual function this is Nt. i show you actual code. how some ida here related ?
@RbMm What’s the supposed base address of PspSetLdtInformation ?
but i show you code.. several functions (including 2 exported - CcTestControl SkIsSecureKernel) share the same address
22:01
@RbMm Ok… So even functions from symbols share that address ?
@user2284570 i dont understand what you say. how many time i can repat again and again - no support for LDT in x64 ? this 2 api simply return status not implemented in ALL x64 systems, including your

last day (15 days later) »