From ee13c6be5883aa64780ec6a774bf674949892591 Mon Sep 17 00:00:00 2001 From: nganhkhoa Date: Thu, 21 May 2020 17:36:06 +0700 Subject: [PATCH] Update non-paged pool range documentation --- nonpaged-pool-range.md | 511 ++--------------------------------------- 1 file changed, 16 insertions(+), 495 deletions(-) diff --git a/nonpaged-pool-range.md b/nonpaged-pool-range.md index 8c4fd03..9c7292f 100644 --- a/nonpaged-pool-range.md +++ b/nonpaged-pool-range.md @@ -10,518 +10,38 @@ In [Rekall source code](https://github.com/google/rekall/blob/c5d68e31705f4b5bd2 - Windows XP: `MmNonPagedPool{Start,End}` - Windows 7 and maybe 8: `MiNonPagedPoolStartAligned`, `MiNonPagedPoolEnd`, and `MiNonPagedPoolBitMap` -- Windows 10 below -In Windows 7, 8, another field was added to controll the allocation of `NonPagedPool`, which is why there is [this paper about pool tag quick scanning](https://www.sciencedirect.com/science/article/pii/S1742287616000062). +In Windows 7, 8, another field was added to controll the allocation of `NonPagedPool`, which is also mentioned in [this paper about pool tag quick scanning](https://www.sciencedirect.com/science/article/pii/S1742287616000062). However, from Windows 10, the whole game changed around when the global offset to those (similar) variables are gone. Instead Windows 10 introduced a new variable `MiState`. `MiState` offset is available and we can get those start/end variables by either: -- Windows 2015: `*((ntoskrnl.exe+MiState)->SystemNodeInformation->NonPagedPool{First,Last}Va)` -- Windows 2016: `*((ntoskrnl.exe+MiState)->Hardware.SystemNodeInformation->NonPagedPool{First,Last}Va)` +- Windows 2015: `(_MI_SYSTEM_INFORMATION*)(MiState)->SystemNodeInformation.NonPagedPool{First,Last}Va` +- Windows 2016: `(_MI_SYSTEM_INFORMATION*)(MiState)->Hardware.SystemNodeInformation.NonPagedPool{First,Last}Va` The `NonPagedBitMap` was still visible untill the May 2019 Update, here, take a look at these 2 consecutive update [`1809 Redstone 5 (October Update)`](https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1809%20Redstone%205%20(October%20Update)/\_MI\_SYSTEM\_NODE\_INFORMATION) and [`1903 19H1 (May 2019 Update)`](https://www.vergiliusproject.com/kernels/x64/Windows%2010%20%7C%202016/1903%2019H1%20(May%202019%20Update)/\_MI\_SYSTEM\_NODE\_INFORMATION). -Yeah, now `pool tag quick scanning` is useless (gah). Windows OS changes quite frequently right? Tell you more, I am using the Insider version of Windows in 2020, and guess what, I found out that they put another struct to point to those value. So now we need to go like this: +Windows OS changes quite frequently right? Tell you more, I am using the Insider version of Windows in 2020, and guess what, I found out that they put another struct to point to those value. So now we need to go like this: -- Windows 2020 Insider preview: `*((ntoskrnl.exe+MiState)->SystemNodeNonPagedPool->NonPagedPool{First,Last}Va)` +- Windows 2020 Insider preview: `*(_MI_SYSTEM_INFORMATION*)(MiState)->Hardware.SystemNodeNonPagedPool.NonPagedPool{First,Last}Va` > If you go with low-level, then you only care about the offset and formula to get those variables but knowing the structure is well benefit. Anyway, I create this project to help me with my thesis, following outdated structs online yields no result. Oh, yeah, a guy seems to be asking on [how to get `MmNonPagedPoolStart`](https://reverseengineering.stackexchange.com/q/6483) on `stackexchange`, too bad [the answer](https://reverseengineering.stackexchange.com/a/6487) is not so much helpful. -Take a look at my ntoskrnl.exe pdb file parsed. - -``` -PDB for Amd64, guid: 3c6978d6-66d9-c05a-53b6-a1e1561282c8, age: 1, - -Void(UNNOWN) PsActiveProcessHead 0xc1f970 23:129392 -Void(UNNOWN) MiState 0xc4f200 23:324096 -Void(UNNOWN) KeNumberNodes 0xcfc000 24:0 -Void(UNNOWN) PsLoadedModuleList 0xc2ba30 23:178736 -Void(UNNOWN) KdDebuggerDataBlock 0xc00a30 23:2608 - -beginstruct _LIST_ENTRY - 0x0 _LIST_ENTRY* Flink - 0x8 _LIST_ENTRY* Blink -endstruct - -beginstruct _RTL_BITMAP - 0x0 U32 SizeOfBitMap - 0x8 U32 Buffer -endstruct - -beginstruct _EPROCESS - 0x0 _KPROCESS Pcb - 0x438 _EX_PUSH_LOCK ProcessLock - 0x440 Void UniqueProcessId - 0x448 _LIST_ENTRY ActiveProcessLinks - 0x458 _EX_RUNDOWN_REF RundownProtect - 0x460 U32 Flags2 - 0x460 UNNOWN JobNotReallyActive - 0x460 UNNOWN AccountingFolded - 0x460 UNNOWN NewProcessReported - 0x460 UNNOWN ExitProcessReported - 0x460 UNNOWN ReportCommitChanges - 0x460 UNNOWN LastReportMemory - 0x460 UNNOWN ForceWakeCharge - 0x460 UNNOWN CrossSessionCreate - 0x460 UNNOWN NeedsHandleRundown - 0x460 UNNOWN RefTraceEnabled - 0x460 UNNOWN PicoCreated - 0x460 UNNOWN EmptyJobEvaluated - 0x460 UNNOWN DefaultPagePriority - 0x460 UNNOWN PrimaryTokenFrozen - 0x460 UNNOWN ProcessVerifierTarget - 0x460 UNNOWN RestrictSetThreadContext - 0x460 UNNOWN AffinityPermanent - 0x460 UNNOWN AffinityUpdateEnable - 0x460 UNNOWN PropagateNode - 0x460 UNNOWN ExplicitAffinity - 0x460 UNNOWN ProcessExecutionState - 0x460 UNNOWN EnableReadVmLogging - 0x460 UNNOWN EnableWriteVmLogging - 0x460 UNNOWN FatalAccessTerminationRequested - 0x460 UNNOWN DisableSystemAllowedCpuSet - 0x460 UNNOWN ProcessStateChangeRequest - 0x460 UNNOWN ProcessStateChangeInProgress - 0x460 UNNOWN InPrivate - 0x464 U32 Flags - 0x464 UNNOWN CreateReported - 0x464 UNNOWN NoDebugInherit - 0x464 UNNOWN ProcessExiting - 0x464 UNNOWN ProcessDelete - 0x464 UNNOWN ManageExecutableMemoryWrites - 0x464 UNNOWN VmDeleted - 0x464 UNNOWN OutswapEnabled - 0x464 UNNOWN Outswapped - 0x464 UNNOWN FailFastOnCommitFail - 0x464 UNNOWN Wow64VaSpace4Gb - 0x464 UNNOWN AddressSpaceInitialized - 0x464 UNNOWN SetTimerResolution - 0x464 UNNOWN BreakOnTermination - 0x464 UNNOWN DeprioritizeViews - 0x464 UNNOWN WriteWatch - 0x464 UNNOWN ProcessInSession - 0x464 UNNOWN OverrideAddressSpace - 0x464 UNNOWN HasAddressSpace - 0x464 UNNOWN LaunchPrefetched - 0x464 UNNOWN Background - 0x464 UNNOWN VmTopDown - 0x464 UNNOWN ImageNotifyDone - 0x464 UNNOWN PdeUpdateNeeded - 0x464 UNNOWN VdmAllowed - 0x464 UNNOWN ProcessRundown - 0x464 UNNOWN ProcessInserted - 0x464 UNNOWN DefaultIoPriority - 0x464 UNNOWN ProcessSelfDelete - 0x464 UNNOWN SetTimerResolutionLink - 0x468 _LARGE_INTEGER CreateTime - 0x470 U64[16] ProcessQuotaUsage - 0x480 U64[16] ProcessQuotaPeak - 0x490 U64 PeakVirtualSize - 0x498 U64 VirtualSize - 0x4a0 _LIST_ENTRY SessionProcessLinks - 0x4b0 Void ExceptionPortData - 0x4b0 U64 ExceptionPortValue - 0x4b0 UNNOWN ExceptionPortState - 0x4b8 _EX_FAST_REF Token - 0x4c0 U64 MmReserved - 0x4c8 _EX_PUSH_LOCK AddressCreationLock - 0x4d0 _EX_PUSH_LOCK PageTableCommitmentLock - 0x4d8 _ETHREAD* RotateInProgress - 0x4e0 _ETHREAD* ForkInProgress - 0x4e8 _EJOB* CommitChargeJob - 0x4f0 _RTL_AVL_TREE CloneRoot - 0x4f8 volatile U64 NumberOfPrivatePages - 0x500 volatile U64 NumberOfLockedPages - 0x508 Void Win32Process - 0x510 _EJOB* Job - 0x518 Void SectionObject - 0x520 Void SectionBaseAddress - 0x528 U32 Cookie - 0x530 _PAGEFAULT_HISTORY* WorkingSetWatch - 0x538 Void Win32WindowStation - 0x540 Void InheritedFromUniqueProcessId - 0x548 volatile U64 OwnerProcessId - 0x550 _PEB* Peb - 0x558 _MM_SESSION_SPACE* Session - 0x560 Void Spare1 - 0x568 _EPROCESS_QUOTA_BLOCK* QuotaBlock - 0x570 _HANDLE_TABLE* ObjectTable - 0x578 Void DebugPort - 0x580 _EWOW64PROCESS* WoW64Process - 0x588 Void DeviceMap - 0x590 Void EtwDataSource - 0x598 U64 PageDirectoryPte - 0x5a0 _FILE_OBJECT* ImageFilePointer - 0x5a8 UChar[15] ImageFileName - 0x5b7 UChar PriorityClass - 0x5b8 Void SecurityPort - 0x5c0 _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo - 0x5c8 _LIST_ENTRY JobLinks - 0x5d8 Void HighestUserAddress - 0x5e0 _LIST_ENTRY ThreadListHead - 0x5f0 volatile U32 ActiveThreads - 0x5f4 U32 ImagePathHash - 0x5f8 U32 DefaultHardErrorProcessing - 0x5fc I32 LastThreadExitStatus - 0x600 _EX_FAST_REF PrefetchTrace - 0x608 Void LockedPagesList - 0x610 _LARGE_INTEGER ReadOperationCount - 0x618 _LARGE_INTEGER WriteOperationCount - 0x620 _LARGE_INTEGER OtherOperationCount - 0x628 _LARGE_INTEGER ReadTransferCount - 0x630 _LARGE_INTEGER WriteTransferCount - 0x638 _LARGE_INTEGER OtherTransferCount - 0x640 U64 CommitChargeLimit - 0x648 volatile U64 CommitCharge - 0x650 volatile U64 CommitChargePeak - 0x680 _MMSUPPORT_FULL Vm - 0x7c0 _LIST_ENTRY MmProcessLinks - 0x7d0 U32 ModifiedPageCount - 0x7d4 I32 ExitStatus - 0x7d8 _RTL_AVL_TREE VadRoot - 0x7e0 Void VadHint - 0x7e8 U64 VadCount - 0x7f0 volatile U64 VadPhysicalPages - 0x7f8 U64 VadPhysicalPagesLimit - 0x800 _ALPC_PROCESS_CONTEXT AlpcContext - 0x820 _LIST_ENTRY TimerResolutionLink - 0x830 _PO_DIAG_STACK_RECORD* TimerResolutionStackRecord - 0x838 U32 RequestedTimerResolution - 0x83c U32 SmallestTimerResolution - 0x840 _LARGE_INTEGER ExitTime - 0x848 _INVERTED_FUNCTION_TABLE* InvertedFunctionTable - 0x850 _EX_PUSH_LOCK InvertedFunctionTableLock - 0x858 U32 ActiveThreadsHighWatermark - 0x85c U32 LargePrivateVadCount - 0x860 _EX_PUSH_LOCK ThreadListLock - 0x868 Void WnfContext - 0x870 _EJOB* ServerSilo - 0x878 UChar SignatureLevel - 0x879 UChar SectionSignatureLevel - 0x87a _PS_PROTECTION Protection - 0x87b UNNOWN HangCount - 0x87b UNNOWN GhostCount - 0x87b UNNOWN PrefilterException - 0x87c U32 Flags3 - 0x87c UNNOWN Minimal - 0x87c UNNOWN ReplacingPageRoot - 0x87c UNNOWN Crashed - 0x87c UNNOWN JobVadsAreTracked - 0x87c UNNOWN VadTrackingDisabled - 0x87c UNNOWN AuxiliaryProcess - 0x87c UNNOWN SubsystemProcess - 0x87c UNNOWN IndirectCpuSets - 0x87c UNNOWN RelinquishedCommit - 0x87c UNNOWN HighGraphicsPriority - 0x87c UNNOWN CommitFailLogged - 0x87c UNNOWN ReserveFailLogged - 0x87c UNNOWN SystemProcess - 0x87c UNNOWN HideImageBaseAddresses - 0x87c UNNOWN AddressPolicyFrozen - 0x87c UNNOWN ProcessFirstResume - 0x87c UNNOWN ForegroundExternal - 0x87c UNNOWN ForegroundSystem - 0x87c UNNOWN HighMemoryPriority - 0x87c UNNOWN EnableProcessSuspendResumeLogging - 0x87c UNNOWN EnableThreadSuspendResumeLogging - 0x87c UNNOWN SecurityDomainChanged - 0x87c UNNOWN SecurityFreezeComplete - 0x87c UNNOWN VmProcessorHost - 0x87c UNNOWN VmProcessorHostTransition - 0x87c UNNOWN AltSyscall - 0x87c UNNOWN TimerResolutionIgnore - 0x880 I32 DeviceAsid - 0x888 Void SvmData - 0x890 _EX_PUSH_LOCK SvmProcessLock - 0x898 U64 SvmLock - 0x8a0 _LIST_ENTRY SvmProcessDeviceListHead - 0x8b0 U64 LastFreezeInterruptTime - 0x8b8 _PROCESS_DISK_COUNTERS* DiskCounters - 0x8c0 Void PicoContext - 0x8c8 Void EnclaveTable - 0x8d0 U64 EnclaveNumber - 0x8d8 _EX_PUSH_LOCK EnclaveLock - 0x8e0 U32 HighPriorityFaultsAllowed - 0x8e8 _PO_PROCESS_ENERGY_CONTEXT* EnergyContext - 0x8f0 Void VmContext - 0x8f8 U64 SequenceNumber - 0x900 U64 CreateInterruptTime - 0x908 U64 CreateUnbiasedInterruptTime - 0x910 U64 TotalUnbiasedFrozenTime - 0x918 U64 LastAppStateUpdateTime - 0x920 UNNOWN LastAppStateUptime - 0x920 UNNOWN LastAppState - 0x928 volatile U64 SharedCommitCharge - 0x930 _EX_PUSH_LOCK SharedCommitLock - 0x938 _LIST_ENTRY SharedCommitLinks - 0x948 U64 AllowedCpuSets - 0x950 U64 DefaultCpuSets - 0x948 U64 AllowedCpuSetsIndirect - 0x950 U64 DefaultCpuSetsIndirect - 0x958 Void DiskIoAttribution - 0x960 Void DxgProcess - 0x968 U32 Win32KFilterSet - 0x970 volatile _PS_INTERLOCKED_TIMER_DELAY_VALUES ProcessTimerDelay - 0x978 volatile U32 KTimerSets - 0x97c volatile U32 KTimer2Sets - 0x980 volatile U32 ThreadTimerSets - 0x988 U64 VirtualTimerListLock - 0x990 _LIST_ENTRY VirtualTimerListHead - 0x9a0 _WNF_STATE_NAME WakeChannel - 0x9a0 _PS_PROCESS_WAKE_INFORMATION WakeInfo - 0x9d0 U32 MitigationFlags - 0x9d0 MitigationFlagsValues - 0x9d4 U32 MitigationFlags2 - 0x9d4 MitigationFlags2Values - 0x9d8 Void PartitionObject - 0x9e0 U64 SecurityDomain - 0x9e8 U64 ParentSecurityDomain - 0x9f0 Void CoverageSamplerContext - 0x9f8 Void MmHotPatchContext - 0xa00 _KE_IDEAL_PROCESSOR_ASSIGNMENT_BLOCK IdealProcessorAssignmentBlock - 0xab8 _RTL_AVL_TREE DynamicEHContinuationTargetsTree - 0xac0 _EX_PUSH_LOCK DynamicEHContinuationTargetsLock -endstruct - -beginstruct _RTL_BITMAP_EX - 0x0 U64 SizeOfBitMap - 0x8 U64 Buffer -endstruct - -beginstruct _MI_SYSTEM_INFORMATION - 0x0 _MI_POOL_STATE Pools - 0xc0 _MI_SECTION_STATE Sections - 0x400 _MI_SYSTEM_IMAGE_STATE SystemImages - 0x4a8 _MI_SESSION_STATE Sessions - 0x1530 _MI_PROCESS_STATE Processes - 0x1580 _MI_HARDWARE_STATE Hardware - 0x1740 _MI_SYSTEM_VA_STATE SystemVa - 0x1c00 _MI_COMBINE_STATE PageCombines - 0x1c20 _MI_PAGELIST_STATE PageLists - 0x1cc0 _MI_PARTITION_STATE Partitions - 0x1d80 _MI_SHUTDOWN_STATE Shutdowns - 0x1df8 _MI_ERROR_STATE Errors - 0x1f00 _MI_ACCESS_LOG_STATE AccessLog - 0x1f80 _MI_DEBUGGER_STATE Debugger - 0x20a0 _MI_STANDBY_STATE Standby - 0x2140 _MI_SYSTEM_PTE_STATE SystemPtes - 0x2340 _MI_IO_PAGE_STATE IoPages - 0x2400 _MI_PAGING_IO_STATE PagingIo - 0x24b0 _MI_COMMON_PAGE_STATE CommonPages - 0x2580 _MI_SYSTEM_TRIM_STATE Trims - 0x25c0 _MI_SYSTEM_ZEROING Zeroing - 0x25e0 _MI_ENCLAVE_STATE Enclaves - 0x2628 U64 Cookie - 0x2630 Void** BootRegistryRuns - 0x2638 volatile I32 ZeroingDisabled - 0x263c UChar FullyInitialized - 0x263d UChar SafeBooted - 0x2640 const _tlgProvider_t* TraceLogging - 0x2680 _MI_VISIBLE_STATE Vs -endstruct - -beginstruct _PEB - 0x0 UChar InheritedAddressSpace - 0x1 UChar ReadImageFileExecOptions - 0x2 UChar BeingDebugged - 0x3 UChar BitField - 0x3 UNNOWN ImageUsesLargePages - 0x3 UNNOWN IsProtectedProcess - 0x3 UNNOWN IsImageDynamicallyRelocated - 0x3 UNNOWN SkipPatchingUser32Forwarders - 0x3 UNNOWN IsPackagedProcess - 0x3 UNNOWN IsAppContainer - 0x3 UNNOWN IsProtectedProcessLight - 0x3 UNNOWN IsLongPathAwareProcess - 0x4 UChar[4] Padding0 - 0x8 Void Mutant - 0x10 Void ImageBaseAddress - 0x18 _PEB_LDR_DATA* Ldr - 0x20 _RTL_USER_PROCESS_PARAMETERS* ProcessParameters - 0x28 Void SubSystemData - 0x30 Void ProcessHeap - 0x38 _RTL_CRITICAL_SECTION* FastPebLock - 0x40 _SLIST_HEADER* AtlThunkSListPtr - 0x48 Void IFEOKey - 0x50 U32 CrossProcessFlags - 0x50 UNNOWN ProcessInJob - 0x50 UNNOWN ProcessInitializing - 0x50 UNNOWN ProcessUsingVEH - 0x50 UNNOWN ProcessUsingVCH - 0x50 UNNOWN ProcessUsingFTH - 0x50 UNNOWN ProcessPreviouslyThrottled - 0x50 UNNOWN ProcessCurrentlyThrottled - 0x50 UNNOWN ProcessImagesHotPatched - 0x50 UNNOWN ReservedBits0 - 0x54 UChar[4] Padding1 - 0x58 Void KernelCallbackTable - 0x58 Void UserSharedInfoPtr - 0x60 U32 SystemReserved - 0x64 U32 AtlThunkSListPtr32 - 0x68 Void ApiSetMap - 0x70 U32 TlsExpansionCounter - 0x74 UChar[4] Padding2 - 0x78 Void TlsBitmap - 0x80 U32[8] TlsBitmapBits - 0x88 Void ReadOnlySharedMemoryBase - 0x90 Void SharedData - 0x98 Void* ReadOnlyStaticServerData - 0xa0 Void AnsiCodePageData - 0xa8 Void OemCodePageData - 0xb0 Void UnicodeCaseTableData - 0xb8 U32 NumberOfProcessors - 0xbc U32 NtGlobalFlag - 0xc0 _LARGE_INTEGER CriticalSectionTimeout - 0xc8 U64 HeapSegmentReserve - 0xd0 U64 HeapSegmentCommit - 0xd8 U64 HeapDeCommitTotalFreeThreshold - 0xe0 U64 HeapDeCommitFreeBlockThreshold - 0xe8 U32 NumberOfHeaps - 0xec U32 MaximumNumberOfHeaps - 0xf0 Void* ProcessHeaps - 0xf8 Void GdiSharedHandleTable - 0x100 Void ProcessStarterHelper - 0x108 U32 GdiDCAttributeList - 0x10c UChar[4] Padding3 - 0x110 _RTL_CRITICAL_SECTION* LoaderLock - 0x118 U32 OSMajorVersion - 0x11c U32 OSMinorVersion - 0x120 U16 OSBuildNumber - 0x122 U16 OSCSDVersion - 0x124 U32 OSPlatformId - 0x128 U32 ImageSubsystem - 0x12c U32 ImageSubsystemMajorVersion - 0x130 U32 ImageSubsystemMinorVersion - 0x134 UChar[4] Padding4 - 0x138 U64 ActiveProcessAffinityMask - 0x140 U32[240] GdiHandleBuffer - 0x230 Void(UNNOWN)* PostProcessInitRoutine - 0x238 Void TlsExpansionBitmap - 0x240 U32[128] TlsExpansionBitmapBits - 0x2c0 U32 SessionId - 0x2c4 UChar[4] Padding5 - 0x2c8 _ULARGE_INTEGER AppCompatFlags - 0x2d0 _ULARGE_INTEGER AppCompatFlagsUser - 0x2d8 Void pShimData - 0x2e0 Void AppCompatInfo - 0x2e8 _UNICODE_STRING CSDVersion - 0x2f8 const _ACTIVATION_CONTEXT_DATA* ActivationContextData - 0x300 _ASSEMBLY_STORAGE_MAP* ProcessAssemblyStorageMap - 0x308 const _ACTIVATION_CONTEXT_DATA* SystemDefaultActivationContextData - 0x310 _ASSEMBLY_STORAGE_MAP* SystemAssemblyStorageMap - 0x318 U64 MinimumStackCommit - 0x320 Void[32] SparePointers - 0x340 U32[20] SpareUlongs - 0x358 Void WerRegistrationData - 0x360 Void WerShipAssertPtr - 0x368 Void pUnused - 0x370 Void pImageHeaderHash - 0x378 U32 TracingFlags - 0x378 UNNOWN HeapTracingEnabled - 0x378 UNNOWN CritSecTracingEnabled - 0x378 UNNOWN LibLoaderTracingEnabled - 0x378 UNNOWN SpareTracingBits - 0x37c UChar[4] Padding6 - 0x380 U64 CsrServerReadOnlySharedMemoryBase - 0x388 U64 TppWorkerpListLock - 0x390 _LIST_ENTRY TppWorkerpList - 0x3a0 Void[1024] WaitOnAddressHashTable - 0x7a0 Void TelemetryCoverageHeader - 0x7a8 U32 CloudFileFlags - 0x7ac U32 CloudFileDiagFlags - 0x7b0 RChar PlaceholderCompatibilityMode - 0x7b1 RChar[7] PlaceholderCompatibilityModeReserved - 0x7b8 _LEAP_SECOND_DATA* LeapSecondData - 0x7c0 U32 LeapSecondFlags - 0x7c0 UNNOWN SixtySecondEnabled - 0x7c0 UNNOWN Reserved - 0x7c4 U32 NtGlobalFlag2 -endstruct - -beginstruct _MI_DYNAMIC_BITMAP - 0x0 _RTL_BITMAP_EX Bitmap - 0x10 U64 MaximumSize - 0x18 U64 Hint - 0x20 Void BaseVa - 0x28 U64 SizeTopDown - 0x30 U64 HintTopDown - 0x38 Void BaseVaTopDown - 0x40 U64 SpinLock -endstruct - -beginstruct _MI_HARDWARE_STATE - 0x0 U32 NodeMask - 0x4 U32 NumaHintIndex - 0x8 U32 NumaLastRangeIndexInclusive - 0xc UChar NodeShift - 0xd UChar ChannelShift - 0x10 U32 ChannelHintIndex - 0x14 U32 ChannelLastRangeIndexInclusive - 0x18 _MI_NODE_NUMBER_ZERO_BASED* NodeGraph - 0x20 _MI_SYSTEM_NODE_NONPAGED_POOL* SystemNodeNonPagedPool - 0x28 _HAL_NODE_RANGE[32] TemporaryNumaRanges - 0x48 _HAL_NODE_RANGE* NumaMemoryRanges - 0x50 _HAL_CHANNEL_MEMORY_RANGES* ChannelMemoryRanges - 0x58 U32 SecondLevelCacheSize - 0x5c U32 FirstLevelCacheSize - 0x60 U32 PhysicalAddressBits - 0x64 U32 PfnDatabasePageBits - 0x68 U32 LogicalProcessorsPerCore - 0x6c UChar ProcessorCachesFlushedOnPowerLoss - 0x70 U64 TotalPagesAllowed - 0x78 U32 SecondaryColorMask - 0x7c U32 SecondaryColors - 0x80 U32 FlushTbForAttributeChange - 0x84 U32 FlushCacheForAttributeChange - 0x88 U32 FlushCacheForPageAttributeChange - 0x8c U32 CacheFlushPromoteThreshold - 0x90 _LARGE_INTEGER PerformanceCounterFrequency - 0xc0 U64 InvalidPteMask - 0x100 U32[12] LargePageColors - 0x110 U64 FlushTbThreshold - 0x118 _MI_PFN_CACHE_ATTRIBUTE[16][64] OptimalZeroingAttribute - 0x158 UChar AttributeChangeRequiresReZero - 0x160 _MI_ZERO_COST_COUNTS[32] ZeroCostCounts - 0x180 U64 HighestPossiblePhysicalPage - 0x188 U64 VsmKernelPageCount -endstruct - -beginstruct _MI_SYSTEM_NODE_NONPAGED_POOL - 0x0 _MI_DYNAMIC_BITMAP DynamicBitMapNonPagedPool - 0x48 U64 CachedNonPagedPoolCount - 0x50 U64 NonPagedPoolSpinLock - 0x58 _MMPFN* CachedNonPagedPool - 0x60 Void NonPagedPoolFirstVa - 0x68 Void NonPagedPoolLastVa - 0x70 _MI_SYSTEM_NODE_INFORMATION* SystemNodeInformation -endstruct - -beginstruct _MI_SYSTEM_NODE_INFORMATION - 0x0 _CACHED_KSTACK_LIST[64] CachedKernelStacks - 0x40 _GROUP_AFFINITY GroupAffinity - 0x50 U16 ProcessorCount - 0x58 Void BootZeroPageTimesPerProcessor - 0x60 U64 CyclesToZeroOneLargePage - 0x68 U64 ScaledCyclesToZeroOneLargePage - 0x70 _MI_WRITE_CALIBRATION WriteCalibration - 0xc0 volatile I32 IoPfnLock -endstruct - -``` - ---- -Global variables offset are parsed and can be queried by `nt!` in Windbg. In a kernel driver, we need to get the kernel base address (which is `nt!`). Kernel base address is the loaded address of `ntoskrnl.exe`. There is a shellcode to get the address [here](https://gist.github.com/Barakat/34e9924217ed81fd78c9c92d746ec9c6), using IDT table. But when I use the shellcode with the Windows Insider preview 2020, the address is wrong (it still a loaded PE though). Other ways to get the address are listed [here](https://m0uk4.gitbook.io/notebooks/mouka/windowsinternal/find-kernel-module-address-todo). And hereby I present another way to get the kernel base address. +Global variables offset are parsed from the PDB file and can be queried by `nt!` in Windbg. In a kernel driver, we need to get the kernel base address (which is `nt!`). Kernel base address is the loaded address of `ntoskrnl.exe`. There is a shellcode to get the address [here](https://gist.github.com/Barakat/34e9924217ed81fd78c9c92d746ec9c6), using IDT table. But when I use the shellcode with the Windows Insider preview 2020, the address is wrong (it still a loaded PE though). Other ways to get the address are listed [here](https://m0uk4.gitbook.io/notebooks/mouka/windowsinternal/find-kernel-module-address-todo). And hereby I present another way to get the kernel base address. -A device driver can get a pointer to a `EPROCESS` through the use of `PEPROCESS IoGetCurrentProcess`. And as we know, `EPROCESS` has pointer to other `EPROCESS` as a doubly linked list. If we dump them all out, we can notice a few things: +A device driver can get a pointer to an `_EPROCESS` through the use of `PEPROCESS IoGetCurrentProcess`. And as we know, `_EPROCESS` has pointer to other `_EPROCESS` as a circular doubly linked list. If we dump them all out, we can notice a few things: -- The image name returned by calling `IoGetCurrentProcess` is `System` -- The `EPROCESS` before `System` is somehow empty +- The image name returned by calling `IoGetCurrentProcess` in `DriverEntry` is `System` +- The `_EPROCESS` before `System` is somehow empty ```cpp +// in DriverEntry PVOID eprocess = (PVOID)IoGetCurrentProcess(); + +// somewhere after offsets are setup DbgPrint("eprocess : 0x%p, [%15s]\n", eprocess, (char*)((ULONG64)eprocess + ImageBaseNameOffset)); for (int i = 0; i < 100; i++) { eprocess = (PVOID)(*(ULONG64*)((ULONG64)eprocess + ActiveProcessLinksOffset) - ActiveProcessLinksOffset); @@ -542,10 +62,13 @@ eprocess : 0xFFFF840F64187140, [ csrss.exe] eprocess : 0xFFFF840F641CD080, [ services.exe] ``` -And if we debug and compare the address of that `Empty EPROCESS+ActiveProcessLinksOffset` with `nt!PsActiveProcessHead`, it is just the same. And with the given offset parsed from the PDB file, we can get kernel base address. +And if we debug and compare the address of that `Empty _EPROCESS+ActiveProcessLinksOffset` with `nt!PsActiveProcessHead`, it is just the same. And with the given offset parsed from the PDB file, we can get kernel base address. ```cpp +// In DriverEntry PVOID eprocess = (PVOID)IoGetCurrentProcess(); + +// somwhere after offsets are setup DbgPrint("eprocess : 0x%p, [%15s]\n", eprocess, (char*)((ULONG64)eprocess + ImageBaseNameOffset)); PVOID processHead = (PVOID)(*(ULONG64*)((ULONG64)eprocess + ActiveProcessLinksOffset + BLinkOffset)); DbgPrint("PsActiveProcessHead : 0x%p\n", processHead); @@ -555,5 +78,3 @@ DbgPrint("ntoskrnl.exe : 0x%p\n", ntosbase); From now we have successfully get the kernel base address to index into other global variables. -(In this way we use `PsActiveProcessHead`, but a better way maybe traversing `PsLoadedModuleList` which could get the correct address of `ntoskrnl.exe` but I do not know) -