UserAccess.h File Reference

Access and parse user-mode components of binaries. More...

Go to the source code of this file.

Classes
struct	_PEB_LDR_DATA
	PEB LDR Data. More...
struct	_RTL_USER_PROCESS_PARAMETERS
	User process params. More...
struct	_PEB
	PEB 64-bit. More...
struct	_PEB32
	PEB 32-bit. More...
struct	_PEB_LDR_DATA32
	LDR Data 32-bit. More...
struct	_LDR_DATA_TABLE_ENTRY32
	LDR Data Table 32-bit. More...
struct	_LDR_DATA_TABLE_ENTRY
	LDR Data Table 64-bit. More...

Typedefs
typedef struct _PEB_LDR_DATA	PEB_LDR_DATA
	PEB LDR Data.
typedef struct _PEB_LDR_DATA *	PPEB_LDR_DATA
typedef struct _RTL_USER_PROCESS_PARAMETERS	RTL_USER_PROCESS_PARAMETERS
	User process params.
typedef struct _RTL_USER_PROCESS_PARAMETERS *	PRTL_USER_PROCESS_PARAMETERS
typedef void(__stdcall *	PPS_POST_PROCESS_INIT_ROUTINE) (void)
	Random windows type.
typedef struct _PEB	PEB
	PEB 64-bit.
typedef struct _PEB *	PPEB
typedef struct _PEB32	PEB32
	PEB 32-bit.
typedef struct _PEB32 *	PPEB32
typedef struct _PEB_LDR_DATA32	PEB_LDR_DATA32
	LDR Data 32-bit.
typedef struct _PEB_LDR_DATA32 *	PPEB_LDR_DATA32
typedef struct _LDR_DATA_TABLE_ENTRY32	LDR_DATA_TABLE_ENTRY32
	LDR Data Table 32-bit.
typedef struct _LDR_DATA_TABLE_ENTRY32 *	PLDR_DATA_TABLE_ENTRY32
typedef struct _LDR_DATA_TABLE_ENTRY	LDR_DATA_TABLE_ENTRY
	LDR Data Table 64-bit.
typedef struct _LDR_DATA_TABLE_ENTRY *	PLDR_DATA_TABLE_ENTRY
typedef NTSTATUS(*	ZwQueryInformationProcess) (__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __out_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength, __out_opt PULONG ReturnLength)
typedef PPEB(NTAPI *	PsGetProcessPeb) (PEPROCESS Process)
typedef PPEB32(NTAPI *	PsGetProcessWow64Process) (PEPROCESS Process)

Functions
BOOLEAN	UserAccessAllocateAndGetImagePathFromProcessId (HANDLE ProcessId, PUNICODE_STRING ProcessImageName, UINT32 SizeOfImageNameToBeAllocated)
	Get the image path from process Id.
BOOLEAN	UserAccessGetLoadedModules (PUSERMODE_LOADED_MODULE_DETAILS ProcessLoadedModuleRequest, UINT32 BufferSize)
	Get details about loaded modules.
BOOLEAN	UserAccessIsWow64Process (HANDLE ProcessId, PBOOLEAN Is32Bit)
	Detects whether process is 32-bit or 64-bit.
BOOLEAN	UserAccessIsWow64ProcessByEprocess (PEPROCESS SourceProcess, PBOOLEAN Is32Bit)
	Detects whether process is 32-bit or 64-bit by using EPROCESS pointer.
BOOLEAN	UserAccessCheckForLoadedModuleDetails (UINT32 CoreId)
	Checks whether the loaded module is available or not.
BOOLEAN	UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot (PPEB PebAddress, BOOLEAN Is32Bit, PUINT64 BaseAddress, PUINT64 Entrypoint)
	If the target process's main module is loaded, it fills the Entrypoint and the BaseAddress.

Variables
ZwQueryInformationProcess	g_ZwQueryInformationProcess
	Address of ZwQueryInformationProcess.
PsGetProcessPeb	g_PsGetProcessPeb
	Address of PsGetProcessPeb.
PsGetProcessWow64Process	g_PsGetProcessWow64Process
	Address of PsGetProcessWow64Process.

Detailed Description

Access and parse user-mode components of binaries.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Access to Portable Executables

Version

0.1

Date

2021-12-24

Copyright

This project is released under the GNU Public License v3.

Typedef Documentation

LDR_DATA_TABLE_ENTRY

typedef struct _LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY

LDR Data Table 64-bit.

LDR_DATA_TABLE_ENTRY32

typedef struct _LDR_DATA_TABLE_ENTRY32 LDR_DATA_TABLE_ENTRY32

LDR Data Table 32-bit.

PEB

typedef struct _PEB PEB

PEB 64-bit.

PEB32

typedef struct _PEB32 PEB32

PEB 32-bit.

PEB_LDR_DATA

typedef struct _PEB_LDR_DATA PEB_LDR_DATA

PEB LDR Data.

PEB_LDR_DATA32

typedef struct _PEB_LDR_DATA32 PEB_LDR_DATA32

LDR Data 32-bit.

PLDR_DATA_TABLE_ENTRY

typedef struct _LDR_DATA_TABLE_ENTRY * PLDR_DATA_TABLE_ENTRY

PLDR_DATA_TABLE_ENTRY32

typedef struct _LDR_DATA_TABLE_ENTRY32 * PLDR_DATA_TABLE_ENTRY32

PPEB

typedef struct _PEB * PPEB

PPEB32

typedef struct _PEB32 * PPEB32

PPEB_LDR_DATA

typedef struct _PEB_LDR_DATA * PPEB_LDR_DATA

PPEB_LDR_DATA32

typedef struct _PEB_LDR_DATA32 * PPEB_LDR_DATA32

PPS_POST_PROCESS_INIT_ROUTINE

typedef void(__stdcall * PPS_POST_PROCESS_INIT_ROUTINE) (void)

Random windows type.

PRTL_USER_PROCESS_PARAMETERS

typedef struct _RTL_USER_PROCESS_PARAMETERS * PRTL_USER_PROCESS_PARAMETERS

PsGetProcessPeb

typedef PPEB(NTAPI * PsGetProcessPeb) (PEPROCESS Process)

PsGetProcessWow64Process

typedef PPEB32(NTAPI * PsGetProcessWow64Process) (PEPROCESS Process)

RTL_USER_PROCESS_PARAMETERS

typedef struct _RTL_USER_PROCESS_PARAMETERS RTL_USER_PROCESS_PARAMETERS

User process params.

ZwQueryInformationProcess

typedef NTSTATUS(* ZwQueryInformationProcess) (__in HANDLE ProcessHandle, __in PROCESSINFOCLASS ProcessInformationClass, __out_bcount(ProcessInformationLength) PVOID ProcessInformation, __in ULONG ProcessInformationLength, __out_opt PULONG ReturnLength)

Function Documentation

UserAccessAllocateAndGetImagePathFromProcessId()

BOOLEAN UserAccessAllocateAndGetImagePathFromProcessId	(	HANDLE	ProcessId,
		PUNICODE_STRING	ProcessImageName,
		UINT32	SizeOfImageNameToBeAllocated )

Get the image path from process Id.

This function should be called in vmx non-root for size 512 is enough, if the size is not enough it returns FALSE it's up to the user to deallocate ProcessImageName.Buffer

Parameters

ProcessId
ProcessImageName
SizeOfImageNameToBeAllocated

Returns

BOOLEAN

{
    NTSTATUS        Status;
    ULONG           ReturnedLength;
    ULONG           BufferLength;
    HANDLE          ProcessHandle;
    PVOID           Buffer;
    PEPROCESS       EProcess;
    PUNICODE_STRING ImageName;
 
    //
    // This eliminates the possibility of the IDLE Thread/Process
    //
    PAGED_CODE();
 
    Status = PsLookupProcessByProcessId(ProcessId, &EProcess);
 
    if (NT_SUCCESS(Status))
    {
        Status = ObOpenObjectByPointer(EProcess, 0, NULL, 0, 0, KernelMode, &ProcessHandle);
 
        if (!NT_SUCCESS(Status))
        {
            LogError("Err, cannot get the process object (%08x)", Status);
            return FALSE;
        }
 
        ObDereferenceObject(EProcess);
    }
    else
    {
        //
        // Probably, the process id is wrong!
        //
        return FALSE;
    }
 
    if (g_ZwQueryInformationProcess == NULL)
    {
        return FALSE;
    }
 
    //
    // Query the actual size of the process path
    //
    Status = g_ZwQueryInformationProcess(ProcessHandle,
                                         ProcessImageFileName,
                                         NULL, // Buffer
                                         0,    // Buffer size
                                         &ReturnedLength);
 
    if (Status != STATUS_INFO_LENGTH_MISMATCH)
    {
        //
        // ZwQueryInformationProcess failed
        //
        return FALSE;
    }
 
    //
    // Check there is enough space to store the actual process path when it is found
    // If not return FALSE
    //
    BufferLength = ReturnedLength - sizeof(UNICODE_STRING);
 
    if (SizeOfImageNameToBeAllocated < BufferLength)
    {
        return FALSE;
    }
 
    //
    // Allocate a temporary buffer to store the path name
    //
    Buffer = PlatformMemAllocateZeroedNonPagedPool(ReturnedLength);
 
    if (Buffer == NULL)
    {
        return FALSE;
    }
 
    //
    // Retrieve the process path from the handle to the process
    //
    Status = g_ZwQueryInformationProcess(ProcessHandle,
                                         ProcessImageFileName,
                                         Buffer,
                                         ReturnedLength,
                                         &ReturnedLength);
 
    if (NT_SUCCESS(Status))
    {
        //
        // Copy the path name
        //
        ImageName = (PUNICODE_STRING)Buffer;
 
        //
        // Allocate UNICODE_STRING
        //
        ProcessImageName->Length        = 0;
        ProcessImageName->MaximumLength = (USHORT)SizeOfImageNameToBeAllocated;
        ProcessImageName->Buffer        = (PWSTR)PlatformMemAllocateZeroedNonPagedPool(SizeOfImageNameToBeAllocated);
 
        if (ProcessImageName->Buffer == NULL)
        {
            return FALSE;
        }
 
        RtlZeroMemory(ProcessImageName->Buffer, SizeOfImageNameToBeAllocated);
 
        //
        // Copy path to the buffer
        //
        RtlCopyUnicodeString(ProcessImageName, ImageName);
 
        //
        // Free the temp buffer which stored the path
        //
        PlatformMemFreePool(Buffer);
 
        return TRUE;
    }
    else
    {
        //
        // There was an error in ZwQueryInformationProcess
        // Free the temp buffer which stored the path
        //
        PlatformMemFreePool(Buffer);
        return FALSE;
    }
}

UserAccessCheckForLoadedModuleDetails()

BOOLEAN UserAccessCheckForLoadedModuleDetails

(

UINT32

CoreId

)

Checks whether the loaded module is available or not.

Parameters

CoreId

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
    UINT64                              BaseAddress = (UINT64)NULL;
    UINT64                              Entrypoint  = (UINT64)NULL;
    PROCESSOR_DEBUGGING_STATE *         DbgState    = &g_DbgState[CoreId];
 
    //
    // Check if the callback needs to be handled or not
    //
    if (!g_IsWaitingForUserModeProcessEntryToBeCalled)
    {
        return FALSE;
    }
 
    //
    // Find the thread debugging detail structure
    //
    ProcessDebuggingDetail =
        AttachingFindProcessDebuggingDetailsByProcessId(HANDLE_TO_UINT32(PsGetCurrentProcessId()));
 
    //
    // Check if we find the debugging detail of the thread or not
    //
    if (ProcessDebuggingDetail == NULL)
    {
        return FALSE;
    }
 
    if (ProcessDebuggingDetail->EntrypointOfMainModule == (UINT64)NULL &&
        ProcessDebuggingDetail->PebAddressToMonitor != (PVOID)NULL &&
        CheckAccessValidityAndSafety((UINT64)ProcessDebuggingDetail->PebAddressToMonitor, sizeof(CHAR)) &&
        UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot(ProcessDebuggingDetail->PebAddressToMonitor,
                                                                    ProcessDebuggingDetail->Is32Bit,
                                                                    &BaseAddress,
                                                                    &Entrypoint))
    {
        if (Entrypoint != (UINT64)NULL)
        {
            ProcessDebuggingDetail->BaseAddressOfMainModule = BaseAddress;
            ProcessDebuggingDetail->EntrypointOfMainModule  = Entrypoint;
 
            // LogInfo("Base: %016llx \t EntryPoint: %016llx", BaseAddress, Entrypoint);
 
            //
            // Handle entrypoint interception
            //
            AttachingHandleEntrypointInterception(DbgState);
 
            return TRUE;
        }
    }
 
    //
    // Not available
    //
    return FALSE;
}

UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot()

BOOLEAN UserAccessGetBaseAndEntrypointOfMainModuleIfLoadedInVmxRoot	(	PPEB	PebAddress,
		BOOLEAN	Is32Bit,
		PUINT64	BaseAddress,
		PUINT64	Entrypoint )

If the target process's main module is loaded, it fills the Entrypoint and the BaseAddress.

This function is safe to be called in vmx non-root

Parameters

PebAddress
Is32Bit
BaseAddress
Entrypoint

Returns

BOOLEAN

{
    if (Is32Bit)
    {
        PEB_LDR_DATA32  Ldr32        = {0};
        PEB32           Peb32        = {0};
        PPEB_LDR_DATA32 LdrAddress32 = NULL;
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)PebAddress, &Peb32, sizeof(PEB32));
 
        LdrAddress32 = (PPEB_LDR_DATA32)Peb32.Ldr;
 
        if (!LdrAddress32)
        {
            return FALSE;
        }
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)LdrAddress32, &Ldr32, sizeof(PEB_LDR_DATA32));
 
        PLIST_ENTRY32 List = (PLIST_ENTRY32)Ldr32.InLoadOrderModuleList.Flink;
 
        PLDR_DATA_TABLE_ENTRY32 EntryAddress = CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY32, InLoadOrderLinks);
        LDR_DATA_TABLE_ENTRY32  Entry        = {0};
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)EntryAddress, &Entry, sizeof(LDR_DATA_TABLE_ENTRY32));
 
        if (Entry.DllBase == NULL_ZERO || Entry.EntryPoint == NULL_ZERO)
        {
            return FALSE;
        }
        else
        {
            *BaseAddress = Entry.DllBase;
            *Entrypoint  = Entry.EntryPoint;
 
            return TRUE;
        }
    }
    else
    {
        PPEB_LDR_DATA LdrAddress = NULL;
        PEB_LDR_DATA  Ldr        = {0};
 
        PEB Peb = {0};
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)PebAddress, &Peb, sizeof(PEB));
 
        LdrAddress = (PPEB_LDR_DATA)Peb.Ldr;
 
        if (!LdrAddress)
        {
            return FALSE;
        }
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)LdrAddress, &Ldr, sizeof(PEB_LDR_DATA));
 
        PLIST_ENTRY List = (PLIST_ENTRY)Ldr.ModuleListLoadOrder.Flink;
 
        PLDR_DATA_TABLE_ENTRY EntryAddress = CONTAINING_RECORD(List, LDR_DATA_TABLE_ENTRY, InLoadOrderModuleList);
        LDR_DATA_TABLE_ENTRY  Entry        = {0};
 
        MemoryMapperReadMemorySafeOnTargetProcess((UINT64)EntryAddress, &Entry, sizeof(LDR_DATA_TABLE_ENTRY));
 
        // LogInfo("base: %llx | entry: %llx", Entry.DllBase, Entry.EntryPoint);
 
        if (Entry.DllBase == NULL || Entry.EntryPoint == NULL)
        {
            return FALSE;
        }
        else
        {
            *BaseAddress = (UINT64)Entry.DllBase;
            *Entrypoint  = (UINT64)Entry.EntryPoint;
 
            return TRUE;
        }
    }
}

UserAccessGetLoadedModules()

BOOLEAN UserAccessGetLoadedModules	(	PUSERMODE_LOADED_MODULE_DETAILS	ProcessLoadedModuleRequest,
		UINT32	BufferSize )

Get details about loaded modules.

This function should be called in vmx non-root

Parameters

ProcessLoadedModuleRequest
BufferSize

Returns

BOOLEAN

{
    PEPROCESS SourceProcess;
    BOOLEAN   Is32Bit;
 
    if (PsLookupProcessByProcessId((HANDLE)ProcessLoadedModuleRequest->ProcessId, &SourceProcess) != STATUS_SUCCESS)
    {
        //
        // if the process not found
        //
        ProcessLoadedModuleRequest->Result = DEBUGGER_ERROR_INVALID_PROCESS_ID;
        return FALSE;
    }
 
    ObDereferenceObject(SourceProcess);
 
    //
    // check whether the target process is 32-bit or 64-bit
    //
    if (!UserAccessIsWow64Process((HANDLE)ProcessLoadedModuleRequest->ProcessId, &Is32Bit))
    {
        //
        // Unable to detect whether it's 32-bit or 64-bit
        //
        ProcessLoadedModuleRequest->Result = DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS;
        return FALSE;
    }
 
    //
    // Indicate that the process is x86
    //
    ProcessLoadedModuleRequest->Is32Bit = Is32Bit;
 
    if (Is32Bit)
    {
        //
        // x86 process, walk x86 module list
        //
        if (UserAccessPrintLoadedModulesX86(SourceProcess,
                                            ProcessLoadedModuleRequest->OnlyCountModules,
                                            &ProcessLoadedModuleRequest->ModulesCount,
                                            (USERMODE_LOADED_MODULE_SYMBOLS *)((UINT64)ProcessLoadedModuleRequest + sizeof(USERMODE_LOADED_MODULE_DETAILS)),
                                            BufferSize - sizeof(USERMODE_LOADED_MODULE_DETAILS)))
        {
            ProcessLoadedModuleRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            return TRUE;
        }
    }
    else
    {
        //
        // x64 process, walk x64 module list
        //
        if (UserAccessPrintLoadedModulesX64(SourceProcess,
                                            ProcessLoadedModuleRequest->OnlyCountModules,
                                            &ProcessLoadedModuleRequest->ModulesCount,
                                            (USERMODE_LOADED_MODULE_SYMBOLS *)((UINT64)ProcessLoadedModuleRequest + sizeof(USERMODE_LOADED_MODULE_DETAILS)),
                                            BufferSize - sizeof(USERMODE_LOADED_MODULE_DETAILS)))
        {
            ProcessLoadedModuleRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            return TRUE;
        }
    }
 
    ProcessLoadedModuleRequest->Result = DEBUGGER_ERROR_UNABLE_TO_GET_MODULES_OF_THE_PROCESS;
    return FALSE;
}

UserAccessIsWow64Process()

BOOLEAN UserAccessIsWow64Process	(	HANDLE	ProcessId,
		PBOOLEAN	Is32Bit )

Detects whether process is 32-bit or 64-bit.

This function should be called in vmx non-root

Parameters

ProcessId
Is32Bit

Returns

BOOLEAN

{
    PEPROCESS SourceProcess;
 
    if (PsLookupProcessByProcessId(ProcessId, &SourceProcess) != STATUS_SUCCESS)
    {
        //
        // if the process not found
        //
        return FALSE;
    }
 
    ObDereferenceObject(SourceProcess);
 
    return UserAccessIsWow64ProcessByEprocess(SourceProcess, Is32Bit);
}

UserAccessIsWow64ProcessByEprocess()

BOOLEAN UserAccessIsWow64ProcessByEprocess	(	PEPROCESS	SourceProcess,
		PBOOLEAN	Is32Bit )

Detects whether process is 32-bit or 64-bit by using EPROCESS pointer.

This function should be called in vmx non-root

Parameters

SourceProcess
Is32Bit

Returns

BOOLEAN

{
    if (g_PsGetProcessWow64Process == NULL || g_PsGetProcessPeb == NULL)
    {
        return FALSE;
    }
 
    if (g_PsGetProcessWow64Process(SourceProcess))
    {
        //
        // x86 process, walk x86 module list
        //
 
        *Is32Bit = TRUE;
 
        return TRUE;
    }
    else if (g_PsGetProcessPeb(SourceProcess))
    {
        //
        // x64 process, walk x64 module list
        //
        *Is32Bit = FALSE;
 
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

Variable Documentation

g_PsGetProcessPeb

PsGetProcessPeb g_PsGetProcessPeb

Address of PsGetProcessPeb.

g_PsGetProcessWow64Process

PsGetProcessWow64Process g_PsGetProcessWow64Process

Address of PsGetProcessWow64Process.

g_ZwQueryInformationProcess

ZwQueryInformationProcess g_ZwQueryInformationProcess

Address of ZwQueryInformationProcess.