mirror of
https://github.com/8damon/Blackbird-Platform
synced 2026-06-21 13:41:12 +00:00
dutchpsycho
3404 lines
141 KiB
C++
3404 lines
141 KiB
C++
#include "../controller_private.h"
|
|
#include "../injection/injection.h"
|
|
#include "ipc_internal.h"
|
|
#include <tlhelp32.h>
|
|
|
|
static constexpr UINT64 ControllerSr71WriteBlockedMarker = 0x5352373157424C4Bull; // SR71WBLK
|
|
static constexpr UINT64 ControllerSr71ProtectBlockedMarker = 0x5352373150424C4Bull; // SR71PBLK
|
|
|
|
enum
|
|
{
|
|
ControllerModuleOpLoadLibraryA = 0,
|
|
ControllerModuleOpLoadLibraryW = 1,
|
|
ControllerModuleOpLoadLibraryExA = 2,
|
|
ControllerModuleOpLoadLibraryExW = 3,
|
|
ControllerModuleOpLdrLoadDll = 4,
|
|
ControllerModuleOpRtlAddFunctionTable = 5,
|
|
ControllerModuleOpRtlInstallFunctionTableCallback = 6,
|
|
ControllerModuleOpRtlDeleteFunctionTable = 7,
|
|
ControllerModuleOpCoInitializeEx = 8,
|
|
ControllerModuleOpCoInitializeSecurity = 9,
|
|
ControllerModuleOpCoCreateInstance = 10,
|
|
ControllerModuleOpEventRegister = 11,
|
|
ControllerModuleOpEventUnregister = 12,
|
|
ControllerModuleOpStartTraceW = 13,
|
|
ControllerModuleOpEnableTraceEx2 = 14,
|
|
ControllerModuleOpCreateJobObjectW = 15,
|
|
ControllerModuleOpOpenJobObjectW = 16,
|
|
ControllerModuleOpAssignProcessToJobObject = 17,
|
|
ControllerModuleOpSetInformationJobObject = 18
|
|
};
|
|
|
|
enum CONTROLLER_IMAGE_TAMPER_KIND
|
|
{
|
|
ControllerImageTamperNone = 0,
|
|
ControllerImageTamperIat,
|
|
ControllerImageTamperEat,
|
|
ControllerImageTamperNtdll
|
|
};
|
|
|
|
struct CONTROLLER_IMAGE_TAMPER_CLASSIFICATION
|
|
{
|
|
CONTROLLER_IMAGE_TAMPER_KIND Kind;
|
|
WCHAR ModulePath[MAX_PATH];
|
|
CHAR ModuleName[MAX_PATH];
|
|
UINT64 ModuleBase;
|
|
UINT32 Rva;
|
|
UINT32 DirectoryRva;
|
|
UINT32 DirectorySize;
|
|
};
|
|
|
|
typedef struct _BK_CONTROLLER_ANALYSIS_TEARDOWN
|
|
{
|
|
BOOL HadState;
|
|
BOOL HadAnalysisLease;
|
|
BOOL LaunchOwned;
|
|
BOOL PendingLaunchArmed;
|
|
DWORD RootProcessId;
|
|
DWORD SubscriptionCount;
|
|
DWORD OwnedRangeCount;
|
|
ULONGLONG SessionId;
|
|
} BK_CONTROLLER_ANALYSIS_TEARDOWN, *PBK_CONTROLLER_ANALYSIS_TEARDOWN;
|
|
|
|
static volatile LONG64 g_ControllerAnalysisSessionSequence = 0;
|
|
|
|
static VOID ControllerClearDriverPendingLaunchBestEffort(_In_z_ PCSTR Reason);
|
|
|
|
static ULONGLONG ControllerNextAnalysisSessionId(VOID)
|
|
{
|
|
LONG64 value = InterlockedIncrement64(&g_ControllerAnalysisSessionSequence);
|
|
return (value > 0) ? (ULONGLONG)value : 1ull;
|
|
}
|
|
|
|
static ULONGLONG ControllerClientBeginAnalysisSessionLocked(_Inout_ BK_CONTROLLER_CLIENT *Client,
|
|
_In_ DWORD RootProcessId, _In_ BOOL LaunchOwned)
|
|
{
|
|
BOOL newSession;
|
|
|
|
if (Client == NULL || RootProcessId == 0)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
newSession =
|
|
(!Client->AnalysisActive || Client->AnalysisRootProcessId != RootProcessId || Client->AnalysisSessionId == 0);
|
|
if (newSession)
|
|
{
|
|
Client->AnalysisSessionId = ControllerNextAnalysisSessionId();
|
|
Client->AnalysisStartedTick = GetTickCount64();
|
|
Client->AnalysisLaunchOwned = FALSE;
|
|
}
|
|
|
|
Client->AnalysisRootProcessId = RootProcessId;
|
|
Client->AnalysisActive = TRUE;
|
|
if (LaunchOwned)
|
|
{
|
|
Client->AnalysisLaunchOwned = TRUE;
|
|
}
|
|
|
|
return Client->AnalysisSessionId;
|
|
}
|
|
|
|
static BOOL ControllerClientStopAnalysisLocked(_Inout_ BK_CONTROLLER_CLIENT *Client,
|
|
_Out_opt_ PBK_CONTROLLER_ANALYSIS_TEARDOWN Teardown)
|
|
{
|
|
BK_CONTROLLER_ANALYSIS_TEARDOWN local;
|
|
|
|
ZeroMemory(&local, sizeof(local));
|
|
if (Client == NULL)
|
|
{
|
|
if (Teardown != NULL)
|
|
{
|
|
ZeroMemory(Teardown, sizeof(*Teardown));
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
local.HadAnalysisLease =
|
|
(Client->AnalysisActive || Client->AnalysisRootProcessId != 0 || Client->AnalysisSessionId != 0 ||
|
|
Client->AnalysisLaunchOwned || Client->PendingLaunchArmed || Client->PendingLaunchPid != 0);
|
|
local.HadState = (local.HadAnalysisLease || Client->SubscriptionCount != 0 || Client->OwnedRangeCount != 0);
|
|
local.LaunchOwned = Client->AnalysisLaunchOwned;
|
|
local.PendingLaunchArmed = Client->PendingLaunchArmed;
|
|
local.RootProcessId =
|
|
(Client->AnalysisRootProcessId != 0) ? Client->AnalysisRootProcessId : Client->PendingLaunchPid;
|
|
local.SubscriptionCount = Client->SubscriptionCount;
|
|
local.OwnedRangeCount = Client->OwnedRangeCount;
|
|
local.SessionId = Client->AnalysisSessionId;
|
|
|
|
Client->SubscriptionCount = 0;
|
|
ZeroMemory(Client->Subscriptions, sizeof(Client->Subscriptions));
|
|
ControllerClientClearPendingLaunchLocked(Client);
|
|
Client->AnalysisSessionId = 0;
|
|
Client->AnalysisRootProcessId = 0;
|
|
Client->AnalysisLaunchOwned = FALSE;
|
|
Client->AnalysisActive = FALSE;
|
|
Client->AnalysisStartedTick = 0;
|
|
Client->OwnedRangeCount = 0;
|
|
ZeroMemory(Client->OwnedRanges, sizeof(Client->OwnedRanges));
|
|
InterlockedExchange(&Client->HookReadyMask, 0);
|
|
Client->HookReadyTick = 0;
|
|
|
|
if (local.HadAnalysisLease || local.SubscriptionCount != 0)
|
|
{
|
|
ControllerMarkDriverSubscriptionsDirty();
|
|
}
|
|
if (Teardown != NULL)
|
|
{
|
|
*Teardown = local;
|
|
}
|
|
return local.HadState;
|
|
}
|
|
|
|
static VOID ControllerCompleteAnalysisTeardown(_In_ const BK_CONTROLLER_CLIENT *Client,
|
|
_In_ const BK_CONTROLLER_ANALYSIS_TEARDOWN *Teardown,
|
|
_In_z_ PCSTR Reason)
|
|
{
|
|
PCSTR reason = (Reason != NULL && Reason[0] != '\0') ? Reason : "analysis-teardown";
|
|
|
|
if (Client == NULL || Teardown == NULL || !Teardown->HadState)
|
|
{
|
|
return;
|
|
}
|
|
|
|
if (Teardown->HadAnalysisLease)
|
|
{
|
|
ControllerLog("[IPC] analysis session stopped clientPid=%lu sessionId=%llu rootPid=%lu launchOwned=%u "
|
|
"subscriptions=%lu ranges=%lu reason=%s\n",
|
|
Client->ProcessId, (unsigned long long)Teardown->SessionId, Teardown->RootProcessId,
|
|
Teardown->LaunchOwned ? 1u : 0u, Teardown->SubscriptionCount, Teardown->OwnedRangeCount, reason);
|
|
}
|
|
else if (Teardown->SubscriptionCount != 0 || Teardown->OwnedRangeCount != 0)
|
|
{
|
|
ControllerLog("[IPC] client analysis state cleared clientPid=%lu subscriptions=%lu ranges=%lu reason=%s\n",
|
|
Client->ProcessId, Teardown->SubscriptionCount, Teardown->OwnedRangeCount, reason);
|
|
}
|
|
|
|
if (Teardown->PendingLaunchArmed)
|
|
{
|
|
ControllerClearDriverPendingLaunchBestEffort(reason);
|
|
}
|
|
}
|
|
|
|
static VOID ControllerTerminateLaunchOwnedTeardown(_In_ const BK_CONTROLLER_ANALYSIS_TEARDOWN *Teardown,
|
|
_In_z_ PCSTR Reason)
|
|
{
|
|
PCSTR reason = (Reason != NULL && Reason[0] != '\0') ? Reason : "analysis-teardown";
|
|
|
|
if (Teardown != NULL && Teardown->HadAnalysisLease && Teardown->LaunchOwned && Teardown->RootProcessId != 0)
|
|
{
|
|
ControllerInjectionTerminateProcessTreeBestEffort(Teardown->RootProcessId, reason);
|
|
}
|
|
}
|
|
|
|
static BOOL ControllerRangeOverlaps32(_In_ UINT32 Start, _In_ UINT32 Size, _In_ UINT32 OtherStart,
|
|
_In_ UINT32 OtherSize)
|
|
{
|
|
UINT64 end = (UINT64)Start + ((Size == 0u) ? 1u : Size);
|
|
UINT64 otherEnd = (UINT64)OtherStart + ((OtherSize == 0u) ? 1u : OtherSize);
|
|
return Start < otherEnd && OtherStart < end;
|
|
}
|
|
|
|
static PCSTR ControllerImageTamperDetectionName(_In_ CONTROLLER_IMAGE_TAMPER_KIND Kind)
|
|
{
|
|
switch (Kind)
|
|
{
|
|
case ControllerImageTamperIat:
|
|
return "IAT_TAMPER_SUSPECT";
|
|
case ControllerImageTamperEat:
|
|
return "EAT_TAMPER_SUSPECT";
|
|
case ControllerImageTamperNtdll:
|
|
return "NTDLL_IMAGE_TAMPER_SUSPECT";
|
|
default:
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
static PCWSTR ControllerImageTamperKindLabel(_In_ CONTROLLER_IMAGE_TAMPER_KIND Kind)
|
|
{
|
|
switch (Kind)
|
|
{
|
|
case ControllerImageTamperIat:
|
|
return L"IAT";
|
|
case ControllerImageTamperEat:
|
|
return L"EAT";
|
|
case ControllerImageTamperNtdll:
|
|
return L"ntdll image";
|
|
default:
|
|
return L"image";
|
|
}
|
|
}
|
|
|
|
static BOOL ControllerProtectAllowsWrite(_In_ UINT32 Protect)
|
|
{
|
|
UINT32 baseProtect = Protect & 0xFFu;
|
|
return baseProtect == PAGE_READWRITE || baseProtect == PAGE_WRITECOPY || baseProtect == PAGE_EXECUTE_READWRITE ||
|
|
baseProtect == PAGE_EXECUTE_WRITECOPY;
|
|
}
|
|
|
|
static BOOL ControllerProtectAllowsExecute(_In_ UINT32 Protect)
|
|
{
|
|
UINT32 baseProtect = Protect & 0xFFu;
|
|
return baseProtect == PAGE_EXECUTE || baseProtect == PAGE_EXECUTE_READ || baseProtect == PAGE_EXECUTE_READWRITE ||
|
|
baseProtect == PAGE_EXECUTE_WRITECOPY;
|
|
}
|
|
|
|
static PCWSTR ControllerBaseNameW(_In_opt_z_ PCWSTR Path)
|
|
{
|
|
PCWSTR slash;
|
|
PCWSTR altSlash;
|
|
|
|
if (Path == NULL)
|
|
{
|
|
return L"";
|
|
}
|
|
|
|
slash = wcsrchr(Path, L'\\');
|
|
altSlash = wcsrchr(Path, L'/');
|
|
if (altSlash != NULL && (slash == NULL || altSlash > slash))
|
|
{
|
|
slash = altSlash;
|
|
}
|
|
|
|
return (slash != NULL) ? slash + 1 : Path;
|
|
}
|
|
|
|
static BOOL ControllerPidImageNameEquals(_In_ DWORD ProcessId, _In_z_ PCWSTR ExpectedImageName)
|
|
{
|
|
HANDLE process;
|
|
WCHAR imagePath[MAX_PATH * 2];
|
|
DWORD imageChars;
|
|
HANDLE snapshot;
|
|
PROCESSENTRY32W entry;
|
|
|
|
if (ProcessId == 0 || ExpectedImageName == NULL || ExpectedImageName[0] == L'\0')
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
imageChars = RTL_NUMBER_OF(imagePath);
|
|
imagePath[0] = L'\0';
|
|
process = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, ProcessId);
|
|
if (process != NULL)
|
|
{
|
|
if (QueryFullProcessImageNameW(process, 0, imagePath, &imageChars) &&
|
|
_wcsicmp(ControllerBaseNameW(imagePath), ExpectedImageName) == 0)
|
|
{
|
|
CloseHandle(process);
|
|
return TRUE;
|
|
}
|
|
CloseHandle(process);
|
|
}
|
|
|
|
snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
|
if (snapshot == INVALID_HANDLE_VALUE)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
ZeroMemory(&entry, sizeof(entry));
|
|
entry.dwSize = sizeof(entry);
|
|
if (!Process32FirstW(snapshot, &entry))
|
|
{
|
|
CloseHandle(snapshot);
|
|
return FALSE;
|
|
}
|
|
|
|
do
|
|
{
|
|
if (entry.th32ProcessID == ProcessId && _wcsicmp(entry.szExeFile, ExpectedImageName) == 0)
|
|
{
|
|
CloseHandle(snapshot);
|
|
return TRUE;
|
|
}
|
|
} while (Process32NextW(snapshot, &entry));
|
|
|
|
CloseHandle(snapshot);
|
|
return FALSE;
|
|
}
|
|
|
|
static BOOL ControllerQueryProcessMemoryBasic(_In_ DWORD ProcessId, _In_ UINT64 Address,
|
|
_Out_ MEMORY_BASIC_INFORMATION *Mbi)
|
|
{
|
|
HANDLE process;
|
|
SIZE_T queried;
|
|
|
|
if (ProcessId == 0 || Address == 0 || Mbi == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, ProcessId);
|
|
if (process == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
ZeroMemory(Mbi, sizeof(*Mbi));
|
|
queried = VirtualQueryEx(process, (LPCVOID)(ULONG_PTR)Address, Mbi, sizeof(*Mbi));
|
|
CloseHandle(process);
|
|
return queried == sizeof(*Mbi);
|
|
}
|
|
|
|
static BOOL ControllerFunctionTableBaseLooksAbusive(_In_ DWORD ProcessId, _In_ UINT64 BaseAddress,
|
|
_Out_opt_ MEMORY_BASIC_INFORMATION *MbiOut,
|
|
_Out_writes_z_(ReasonChars) PWSTR Reason, _In_ size_t ReasonChars)
|
|
{
|
|
MEMORY_BASIC_INFORMATION mbi;
|
|
BOOL queried;
|
|
BOOL executable;
|
|
BOOL writable;
|
|
|
|
if (Reason != NULL && ReasonChars != 0)
|
|
{
|
|
Reason[0] = L'\0';
|
|
}
|
|
if (MbiOut != NULL)
|
|
{
|
|
ZeroMemory(MbiOut, sizeof(*MbiOut));
|
|
}
|
|
|
|
queried = ControllerQueryProcessMemoryBasic(ProcessId, BaseAddress, &mbi);
|
|
if (!queried)
|
|
{
|
|
if (Reason != NULL && ReasonChars != 0)
|
|
{
|
|
(void)StringCchCopyW(Reason, ReasonChars, L"unmapped function-table base");
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
if (MbiOut != NULL)
|
|
{
|
|
*MbiOut = mbi;
|
|
}
|
|
|
|
executable = ControllerProtectAllowsExecute((UINT32)mbi.Protect);
|
|
writable = ControllerProtectAllowsWrite((UINT32)mbi.Protect);
|
|
if (mbi.State != MEM_COMMIT)
|
|
{
|
|
if (Reason != NULL && ReasonChars != 0)
|
|
{
|
|
(void)StringCchPrintfW(Reason, ReasonChars, L"function-table base is not committed state=0x%lX",
|
|
(unsigned long)mbi.State);
|
|
}
|
|
return TRUE;
|
|
}
|
|
if (executable && writable)
|
|
{
|
|
if (Reason != NULL && ReasonChars != 0)
|
|
{
|
|
(void)StringCchPrintfW(Reason, ReasonChars, L"function-table base is writable executable protect=0x%lX",
|
|
(unsigned long)mbi.Protect);
|
|
}
|
|
return TRUE;
|
|
}
|
|
if (mbi.Type == MEM_PRIVATE && executable)
|
|
{
|
|
if (Reason != NULL && ReasonChars != 0)
|
|
{
|
|
(void)StringCchPrintfW(Reason, ReasonChars, L"function-table base is private executable protect=0x%lX",
|
|
(unsigned long)mbi.Protect);
|
|
}
|
|
return TRUE;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
static BOOL ControllerFindModuleForAddress(_In_ DWORD ProcessId, _In_ UINT64 Address, _Out_ MODULEENTRY32W *Module)
|
|
{
|
|
HANDLE snapshot;
|
|
MODULEENTRY32W entry;
|
|
|
|
if (ProcessId == 0 || Address == 0 || Module == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, ProcessId);
|
|
if (snapshot == INVALID_HANDLE_VALUE)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
ZeroMemory(&entry, sizeof(entry));
|
|
entry.dwSize = sizeof(entry);
|
|
if (!Module32FirstW(snapshot, &entry))
|
|
{
|
|
CloseHandle(snapshot);
|
|
return FALSE;
|
|
}
|
|
|
|
do
|
|
{
|
|
UINT64 base = (UINT64)(ULONG_PTR)entry.modBaseAddr;
|
|
UINT64 end = base + entry.modBaseSize;
|
|
if (Address >= base && Address < end)
|
|
{
|
|
*Module = entry;
|
|
CloseHandle(snapshot);
|
|
return TRUE;
|
|
}
|
|
} while (Module32NextW(snapshot, &entry));
|
|
|
|
CloseHandle(snapshot);
|
|
return FALSE;
|
|
}
|
|
|
|
static BOOL ControllerReadRemoteExact(_In_ HANDLE Process, _In_ UINT64 Address, _Out_writes_bytes_(Size) PVOID Buffer,
|
|
_In_ SIZE_T Size)
|
|
{
|
|
SIZE_T bytesRead = 0;
|
|
return Process != NULL && Process != INVALID_HANDLE_VALUE && Address != 0 && Buffer != NULL && Size != 0 &&
|
|
ReadProcessMemory(Process, (LPCVOID)(ULONG_PTR)Address, Buffer, Size, &bytesRead) && bytesRead == Size;
|
|
}
|
|
|
|
static BOOL ControllerClassifyImageTamperTarget(_In_ DWORD ProcessId, _In_ UINT64 Address, _In_ UINT64 Size,
|
|
_Out_ CONTROLLER_IMAGE_TAMPER_CLASSIFICATION *Out)
|
|
{
|
|
HANDLE process;
|
|
MODULEENTRY32W module;
|
|
IMAGE_DOS_HEADER dos;
|
|
DWORD signature = 0;
|
|
IMAGE_FILE_HEADER fileHeader;
|
|
WORD optionalMagic = 0;
|
|
IMAGE_DATA_DIRECTORY directories[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
|
UINT64 moduleBase;
|
|
UINT32 rva;
|
|
UINT32 span;
|
|
BOOL isNtdll;
|
|
|
|
if (Out == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
ZeroMemory(Out, sizeof(*Out));
|
|
Out->Kind = ControllerImageTamperNone;
|
|
|
|
if (ProcessId == 0 || Address == 0 || !ControllerFindModuleForAddress(ProcessId, Address, &module))
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
moduleBase = (UINT64)(ULONG_PTR)module.modBaseAddr;
|
|
if (Address < moduleBase || Address - moduleBase > 0xFFFFFFFFull)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
rva = (UINT32)(Address - moduleBase);
|
|
span = (Size == 0 || Size > 0xFFFFFFFFull) ? 1u : (UINT32)Size;
|
|
isNtdll = (_wcsicmp(module.szModule, L"ntdll.dll") == 0);
|
|
|
|
process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ, FALSE, ProcessId);
|
|
if (process == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
ZeroMemory(directories, sizeof(directories));
|
|
if (!ControllerReadRemoteExact(process, moduleBase, &dos, sizeof(dos)) || dos.e_magic != IMAGE_DOS_SIGNATURE ||
|
|
dos.e_lfanew <= 0 || dos.e_lfanew > 0x100000)
|
|
{
|
|
CloseHandle(process);
|
|
return FALSE;
|
|
}
|
|
|
|
UINT64 ntBase = moduleBase + (UINT64)dos.e_lfanew;
|
|
if (!ControllerReadRemoteExact(process, ntBase, &signature, sizeof(signature)) || signature != IMAGE_NT_SIGNATURE ||
|
|
!ControllerReadRemoteExact(process, ntBase + sizeof(signature), &fileHeader, sizeof(fileHeader)) ||
|
|
!ControllerReadRemoteExact(process, ntBase + sizeof(signature) + sizeof(fileHeader), &optionalMagic,
|
|
sizeof(optionalMagic)))
|
|
{
|
|
CloseHandle(process);
|
|
return FALSE;
|
|
}
|
|
|
|
UINT64 optionalBase = ntBase + sizeof(signature) + sizeof(fileHeader);
|
|
if (optionalMagic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
|
|
{
|
|
IMAGE_OPTIONAL_HEADER64 optionalHeader;
|
|
if (!ControllerReadRemoteExact(process, optionalBase, &optionalHeader, sizeof(optionalHeader)))
|
|
{
|
|
CloseHandle(process);
|
|
return FALSE;
|
|
}
|
|
CopyMemory(directories, optionalHeader.DataDirectory, sizeof(directories));
|
|
}
|
|
else if (optionalMagic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)
|
|
{
|
|
IMAGE_OPTIONAL_HEADER32 optionalHeader;
|
|
if (!ControllerReadRemoteExact(process, optionalBase, &optionalHeader, sizeof(optionalHeader)))
|
|
{
|
|
CloseHandle(process);
|
|
return FALSE;
|
|
}
|
|
CopyMemory(directories, optionalHeader.DataDirectory, sizeof(directories));
|
|
}
|
|
else
|
|
{
|
|
CloseHandle(process);
|
|
return FALSE;
|
|
}
|
|
|
|
CloseHandle(process);
|
|
|
|
Out->ModuleBase = moduleBase;
|
|
Out->Rva = rva;
|
|
(void)StringCchCopyW(Out->ModulePath, RTL_NUMBER_OF(Out->ModulePath), module.szExePath);
|
|
WideCharToMultiByte(CP_ACP, 0, module.szModule, -1, Out->ModuleName, RTL_NUMBER_OF(Out->ModuleName), NULL, NULL);
|
|
|
|
const IMAGE_DATA_DIRECTORY &iat = directories[IMAGE_DIRECTORY_ENTRY_IAT];
|
|
if (iat.VirtualAddress != 0 && iat.Size != 0 && ControllerRangeOverlaps32(rva, span, iat.VirtualAddress, iat.Size))
|
|
{
|
|
Out->Kind = ControllerImageTamperIat;
|
|
Out->DirectoryRva = iat.VirtualAddress;
|
|
Out->DirectorySize = iat.Size;
|
|
return TRUE;
|
|
}
|
|
|
|
const IMAGE_DATA_DIRECTORY &exports = directories[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
|
if (exports.VirtualAddress != 0 && exports.Size != 0 &&
|
|
ControllerRangeOverlaps32(rva, span, exports.VirtualAddress, exports.Size))
|
|
{
|
|
Out->Kind = ControllerImageTamperEat;
|
|
Out->DirectoryRva = exports.VirtualAddress;
|
|
Out->DirectorySize = exports.Size;
|
|
return TRUE;
|
|
}
|
|
|
|
if (isNtdll)
|
|
{
|
|
Out->Kind = ControllerImageTamperNtdll;
|
|
return TRUE;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
static BOOL ControllerApplyImageTamperDetection(_Inout_ BKIPC_ETW_EVENT *Mapped,
|
|
_In_ const CONTROLLER_IMAGE_TAMPER_CLASSIFICATION *Classification,
|
|
_In_z_ PCWSTR Action, _In_ UINT64 Address, _In_ UINT64 Size)
|
|
{
|
|
PCSTR detectionName;
|
|
|
|
if (Mapped == NULL || Classification == NULL || Classification->Kind == ControllerImageTamperNone)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
detectionName = ControllerImageTamperDetectionName(Classification->Kind);
|
|
if (detectionName == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
(void)StringCchCopyA(Mapped->DetectionName, RTL_NUMBER_OF(Mapped->DetectionName), detectionName);
|
|
Mapped->Severity = (Classification->Kind == ControllerImageTamperNtdll) ? 7u : 8u;
|
|
(void)StringCchPrintfW(
|
|
Mapped->Reason, RTL_NUMBER_OF(Mapped->Reason),
|
|
L"%ws tamper action=%ws module=%S base=0x%llX rva=0x%X size=0x%llX dirRva=0x%X dirSize=0x%X path=%ws",
|
|
ControllerImageTamperKindLabel(Classification->Kind), Action,
|
|
Classification->ModuleName[0] != '\0' ? Classification->ModuleName : "<unknown>", (unsigned long long)Address,
|
|
Classification->Rva, (unsigned long long)Size, Classification->DirectoryRva, Classification->DirectorySize,
|
|
Classification->ModulePath[0] != L'\0' ? Classification->ModulePath : L"<unknown>");
|
|
return TRUE;
|
|
}
|
|
|
|
static BOOL ControllerValidatePacket(_In_ const BKIPC_PACKET *Packet, _In_ UINT16 ExpectedType)
|
|
{
|
|
if (Packet == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
if (Packet->Magic != BKIPC_MAGIC)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
if (Packet->Version != BKIPC_VERSION)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
if (Packet->PacketType != ExpectedType)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
static VOID ControllerPrepareResponse(_In_ const BKIPC_PACKET *Request, _Out_ BKIPC_PACKET *Response)
|
|
{
|
|
ZeroMemory(Response, sizeof(*Response));
|
|
Response->Magic = BKIPC_MAGIC;
|
|
Response->Version = BKIPC_VERSION;
|
|
Response->PacketType = BlackbirdIpcPacketResponse;
|
|
Response->Command = Request->Command;
|
|
Response->Sequence = Request->Sequence;
|
|
Response->Status = ERROR_SUCCESS;
|
|
}
|
|
|
|
static BOOL ControllerCommandAllowedForRole(_In_ DWORD ClientRole, _In_ UINT32 Command)
|
|
{
|
|
switch (ClientRole)
|
|
{
|
|
case BkctlrClientRoleHook:
|
|
return (Command == BlackbirdIpcCommandHandshake || Command == BlackbirdIpcCommandPublishHookEvent ||
|
|
Command == BlackbirdIpcCommandNotifyHookReady ||
|
|
Command == BlackbirdIpcCommandRegisterInstrumentationRange ||
|
|
Command == BlackbirdIpcCommandRegisterHookPatch);
|
|
case BkctlrClientRoleControl:
|
|
return (Command != BlackbirdIpcCommandPublishHookEvent && Command != BlackbirdIpcCommandNotifyHookReady &&
|
|
Command != BlackbirdIpcCommandRegisterInstrumentationRange &&
|
|
Command != BlackbirdIpcCommandRegisterHookPatch);
|
|
default:
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
_Success_(return) static BOOL
|
|
ControllerQueryProcessTokenUser(_In_ DWORD ProcessId,
|
|
_Outptr_result_bytebuffer_(*TokenBytesOut) PTOKEN_USER *TokenUserOut,
|
|
_Out_ DWORD *TokenBytesOut)
|
|
{
|
|
HANDLE process = NULL;
|
|
HANDLE token = NULL;
|
|
DWORD tokenBytes = 0;
|
|
PTOKEN_USER tokenUser = NULL;
|
|
|
|
if (ProcessId == 0 || TokenUserOut == NULL || TokenBytesOut == NULL)
|
|
{
|
|
SetLastError(ERROR_INVALID_PARAMETER);
|
|
return FALSE;
|
|
}
|
|
|
|
*TokenUserOut = NULL;
|
|
*TokenBytesOut = 0;
|
|
process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, ProcessId);
|
|
if (process == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
if (!OpenProcessToken(process, TOKEN_QUERY, &token))
|
|
{
|
|
DWORD err = GetLastError();
|
|
CloseHandle(process);
|
|
SetLastError(err);
|
|
return FALSE;
|
|
}
|
|
|
|
(void)GetTokenInformation(token, TokenUser, NULL, 0, &tokenBytes);
|
|
if (tokenBytes == 0 || GetLastError() != ERROR_INSUFFICIENT_BUFFER)
|
|
{
|
|
DWORD err = GetLastError();
|
|
CloseHandle(token);
|
|
CloseHandle(process);
|
|
SetLastError(err == ERROR_SUCCESS ? ERROR_BAD_LENGTH : err);
|
|
return FALSE;
|
|
}
|
|
|
|
tokenUser = (PTOKEN_USER)calloc(1, tokenBytes);
|
|
if (tokenUser == NULL)
|
|
{
|
|
CloseHandle(token);
|
|
CloseHandle(process);
|
|
SetLastError(ERROR_OUTOFMEMORY);
|
|
return FALSE;
|
|
}
|
|
|
|
if (!GetTokenInformation(token, TokenUser, tokenUser, tokenBytes, &tokenBytes))
|
|
{
|
|
DWORD err = GetLastError();
|
|
free(tokenUser);
|
|
CloseHandle(token);
|
|
CloseHandle(process);
|
|
SetLastError(err);
|
|
return FALSE;
|
|
}
|
|
|
|
CloseHandle(token);
|
|
CloseHandle(process);
|
|
*TokenUserOut = tokenUser;
|
|
*TokenBytesOut = tokenBytes;
|
|
return TRUE;
|
|
}
|
|
|
|
_Success_(return) static BOOL
|
|
ControllerProcessesShareOwnerSid(_In_ DWORD ProcessIdA, _In_ DWORD ProcessIdB, _Out_ BOOL *SameOwner)
|
|
{
|
|
PTOKEN_USER tokenUserA = NULL;
|
|
PTOKEN_USER tokenUserB = NULL;
|
|
DWORD tokenUserABytes = 0;
|
|
DWORD tokenUserBBytes = 0;
|
|
|
|
if (SameOwner == NULL || ProcessIdA == 0 || ProcessIdB == 0)
|
|
{
|
|
SetLastError(ERROR_INVALID_PARAMETER);
|
|
return FALSE;
|
|
}
|
|
|
|
*SameOwner = FALSE;
|
|
if (!ControllerQueryProcessTokenUser(ProcessIdA, &tokenUserA, &tokenUserABytes))
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
if (!ControllerQueryProcessTokenUser(ProcessIdB, &tokenUserB, &tokenUserBBytes))
|
|
{
|
|
DWORD err = GetLastError();
|
|
free(tokenUserA);
|
|
SetLastError(err);
|
|
return FALSE;
|
|
}
|
|
|
|
*SameOwner = EqualSid(tokenUserA->User.Sid, tokenUserB->User.Sid) ? TRUE : FALSE;
|
|
free(tokenUserA);
|
|
free(tokenUserB);
|
|
return TRUE;
|
|
}
|
|
|
|
static BOOL ControllerClientCanMonitorPid(_In_ const BK_CONTROLLER_CLIENT *Client, _In_ DWORD TargetPid,
|
|
_Inout_opt_ BOOL *PrivilegeResolved, _Inout_opt_ BOOL *IsPrivileged)
|
|
{
|
|
BOOL privileged = FALSE;
|
|
DWORD targetSessionId = 0;
|
|
BOOL sameOwner = FALSE;
|
|
|
|
if (Client == NULL || TargetPid == 0 || Client->ProcessId == 0)
|
|
{
|
|
SetLastError(ERROR_INVALID_PARAMETER);
|
|
return FALSE;
|
|
}
|
|
|
|
if (TargetPid == Client->ProcessId)
|
|
{
|
|
return TRUE;
|
|
}
|
|
|
|
if (PrivilegeResolved != NULL && IsPrivileged != NULL && *PrivilegeResolved)
|
|
{
|
|
privileged = *IsPrivileged;
|
|
}
|
|
else
|
|
{
|
|
if (!ControllerClientIsPrivileged(Client, &privileged))
|
|
{
|
|
DWORD err = GetLastError();
|
|
if (err == ERROR_NO_IMPERSONATION_TOKEN)
|
|
{
|
|
privileged = TRUE;
|
|
}
|
|
else
|
|
{
|
|
return FALSE;
|
|
}
|
|
}
|
|
if (PrivilegeResolved != NULL)
|
|
{
|
|
*PrivilegeResolved = TRUE;
|
|
}
|
|
if (IsPrivileged != NULL)
|
|
{
|
|
*IsPrivileged = privileged;
|
|
}
|
|
}
|
|
|
|
if (privileged)
|
|
{
|
|
return TRUE;
|
|
}
|
|
|
|
if (!ProcessIdToSessionId(TargetPid, &targetSessionId))
|
|
{
|
|
return FALSE;
|
|
}
|
|
if (targetSessionId != Client->SessionId)
|
|
{
|
|
SetLastError(ERROR_ACCESS_DENIED);
|
|
return FALSE;
|
|
}
|
|
|
|
if (!ControllerProcessesShareOwnerSid(Client->ProcessId, TargetPid, &sameOwner))
|
|
{
|
|
return FALSE;
|
|
}
|
|
if (!sameOwner)
|
|
{
|
|
SetLastError(ERROR_ACCESS_DENIED);
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
static DWORD ControllerClientSubscribe(_Inout_ BK_CONTROLLER_CLIENT *Client, _In_ const BK_SUBSCRIBE_REQUEST *Request)
|
|
{
|
|
DWORD i;
|
|
|
|
if (Client == NULL || Request == NULL || Request->ProcessId == 0 ||
|
|
!ControllerIsValidStreamMask(Request->StreamMask))
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
if (!ControllerClientCanMonitorPid(Client, Request->ProcessId, NULL, NULL))
|
|
{
|
|
DWORD err = GetLastError();
|
|
return (err == ERROR_SUCCESS) ? ERROR_ACCESS_DENIED : err;
|
|
}
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
for (i = 0; i < Client->SubscriptionCount; ++i)
|
|
{
|
|
if (Client->Subscriptions[i].ProcessId == Request->ProcessId)
|
|
{
|
|
Client->Subscriptions[i].StreamMask |= Request->StreamMask;
|
|
if (Client->Subscriptions[i].Dynamic)
|
|
{
|
|
Client->Subscriptions[i].Dynamic = FALSE;
|
|
Client->Subscriptions[i].SourceProcessId = 0;
|
|
Client->Subscriptions[i].Depth = 0;
|
|
Client->Subscriptions[i].LastSeenTick = 0;
|
|
}
|
|
LeaveCriticalSection(&Client->Lock);
|
|
ControllerLog("[IPC] subscribe update clientPid=%lu targetPid=%lu streamMask=0x%08lX\n", Client->ProcessId,
|
|
Request->ProcessId, Request->StreamMask);
|
|
if (!ControllerRequestDriverSubscriptionApply(TRUE, BK_CONTROLLER_SUBSCRIPTION_APPLY_SYNC_TIMEOUT_MS))
|
|
{
|
|
return GetLastError();
|
|
}
|
|
return ERROR_SUCCESS;
|
|
}
|
|
}
|
|
|
|
if (Client->SubscriptionCount >= BK_CONTROLLER_MAX_CLIENT_SUBSCRIPTIONS)
|
|
{
|
|
LeaveCriticalSection(&Client->Lock);
|
|
return ERROR_INSUFFICIENT_BUFFER;
|
|
}
|
|
|
|
Client->Subscriptions[Client->SubscriptionCount].ProcessId = Request->ProcessId;
|
|
Client->Subscriptions[Client->SubscriptionCount].StreamMask = Request->StreamMask;
|
|
Client->Subscriptions[Client->SubscriptionCount].Dynamic = FALSE;
|
|
Client->Subscriptions[Client->SubscriptionCount].SourceProcessId = 0;
|
|
Client->Subscriptions[Client->SubscriptionCount].Depth = 0;
|
|
Client->Subscriptions[Client->SubscriptionCount].LastSeenTick = 0;
|
|
Client->SubscriptionCount += 1;
|
|
LeaveCriticalSection(&Client->Lock);
|
|
ControllerLog("[IPC] subscribe add clientPid=%lu targetPid=%lu streamMask=0x%08lX\n", Client->ProcessId,
|
|
Request->ProcessId, Request->StreamMask);
|
|
|
|
if (!ControllerRequestDriverSubscriptionApply(TRUE, BK_CONTROLLER_SUBSCRIPTION_APPLY_SYNC_TIMEOUT_MS))
|
|
{
|
|
return GetLastError();
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
static DWORD ControllerClientUnsubscribe(_Inout_ BK_CONTROLLER_CLIENT *Client,
|
|
_In_ const BK_UNSUBSCRIBE_REQUEST *Request)
|
|
{
|
|
DWORD i;
|
|
DWORD removedPid = 0;
|
|
BOOL changed = FALSE;
|
|
|
|
if (Client == NULL || Request == NULL || Request->ProcessId == 0)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
for (i = 0; i < Client->SubscriptionCount; ++i)
|
|
{
|
|
if (Client->Subscriptions[i].ProcessId == Request->ProcessId)
|
|
{
|
|
removedPid = Client->Subscriptions[i].ProcessId;
|
|
ControllerRemoveSubscriptionAtLocked(Client, i);
|
|
changed = TRUE;
|
|
if (removedPid != 0)
|
|
{
|
|
changed |= ControllerDropDynamicDescendantsLocked(Client, removedPid);
|
|
}
|
|
LeaveCriticalSection(&Client->Lock);
|
|
ControllerLog("[IPC] unsubscribe clientPid=%lu targetPid=%lu\n", Client->ProcessId, Request->ProcessId);
|
|
if (changed)
|
|
{
|
|
(void)ControllerRequestDriverSubscriptionApply(FALSE, 0);
|
|
}
|
|
return ERROR_SUCCESS;
|
|
}
|
|
}
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
return ERROR_NOT_FOUND;
|
|
}
|
|
|
|
static DWORD ControllerClientSetPids(_Inout_ BK_CONTROLLER_CLIENT *Client, _In_ const BK_SET_PIDS_REQUEST *Request)
|
|
{
|
|
DWORD i;
|
|
DWORD primaryPid = 0;
|
|
DWORD appliedCount = 0;
|
|
DWORD replacedLaunchOwnedRootPid = 0;
|
|
ULONGLONG sessionId = 0;
|
|
BOOL privilegeResolved = FALSE;
|
|
BOOL isPrivileged = FALSE;
|
|
BK_CONTROLLER_ANALYSIS_TEARDOWN teardown;
|
|
|
|
if (Client == NULL || Request == NULL || Request->ProcessCount > BK_MAX_PID_LIST ||
|
|
!ControllerIsValidStreamMask(Request->StreamMask))
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
if (Request->ProcessCount == 0)
|
|
{
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientStopAnalysisLocked(Client, &teardown);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
ControllerCompleteAnalysisTeardown(Client, &teardown, "set-pids-empty");
|
|
if (teardown.HadAnalysisLease || teardown.SubscriptionCount != 0)
|
|
{
|
|
(void)ControllerRequestDriverSubscriptionApply(FALSE, 0);
|
|
}
|
|
ControllerTerminateLaunchOwnedTeardown(&teardown, "set-pids-empty");
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
for (i = 0; i < Request->ProcessCount; ++i)
|
|
{
|
|
DWORD pid = Request->ProcessIds[i];
|
|
if (pid == 0)
|
|
{
|
|
continue;
|
|
}
|
|
if (primaryPid == 0)
|
|
{
|
|
primaryPid = pid;
|
|
}
|
|
|
|
if (!ControllerClientCanMonitorPid(Client, pid, &privilegeResolved, &isPrivileged))
|
|
{
|
|
DWORD err = GetLastError();
|
|
return (err == ERROR_SUCCESS) ? ERROR_ACCESS_DENIED : err;
|
|
}
|
|
}
|
|
|
|
if (primaryPid == 0)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
if (Client->AnalysisActive && Client->AnalysisLaunchOwned && Client->AnalysisRootProcessId != 0 &&
|
|
Client->AnalysisRootProcessId != primaryPid)
|
|
{
|
|
replacedLaunchOwnedRootPid = Client->AnalysisRootProcessId;
|
|
}
|
|
Client->SubscriptionCount = 0;
|
|
ZeroMemory(Client->Subscriptions, sizeof(Client->Subscriptions));
|
|
for (i = 0; i < Request->ProcessCount; ++i)
|
|
{
|
|
DWORD pid = Request->ProcessIds[i];
|
|
DWORD j;
|
|
BOOL seen = FALSE;
|
|
|
|
if (pid == 0)
|
|
{
|
|
continue;
|
|
}
|
|
|
|
for (j = 0; j < Client->SubscriptionCount; ++j)
|
|
{
|
|
if (Client->Subscriptions[j].ProcessId == pid)
|
|
{
|
|
Client->Subscriptions[j].StreamMask |= Request->StreamMask;
|
|
Client->Subscriptions[j].Dynamic = FALSE;
|
|
Client->Subscriptions[j].SourceProcessId = 0;
|
|
Client->Subscriptions[j].Depth = 0;
|
|
Client->Subscriptions[j].LastSeenTick = 0;
|
|
seen = TRUE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!seen && Client->SubscriptionCount < BK_CONTROLLER_MAX_CLIENT_SUBSCRIPTIONS)
|
|
{
|
|
Client->Subscriptions[Client->SubscriptionCount].ProcessId = pid;
|
|
Client->Subscriptions[Client->SubscriptionCount].StreamMask = Request->StreamMask;
|
|
Client->Subscriptions[Client->SubscriptionCount].Dynamic = FALSE;
|
|
Client->Subscriptions[Client->SubscriptionCount].SourceProcessId = 0;
|
|
Client->Subscriptions[Client->SubscriptionCount].Depth = 0;
|
|
Client->Subscriptions[Client->SubscriptionCount].LastSeenTick = 0;
|
|
Client->SubscriptionCount += 1;
|
|
}
|
|
}
|
|
appliedCount = Client->SubscriptionCount;
|
|
if (appliedCount != 0 &&
|
|
(Client->AnalysisActive || Client->AnalysisRootProcessId != 0 || Client->AnalysisSessionId != 0 ||
|
|
Client->AnalysisLaunchOwned || Client->PendingLaunchPid != 0))
|
|
{
|
|
sessionId = ControllerClientBeginAnalysisSessionLocked(Client, primaryPid, FALSE);
|
|
}
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
if (appliedCount == 0)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
ControllerLog("[IPC] set-pids clientPid=%lu sessionId=%llu rootPid=%lu count=%lu streamMask=0x%08lX\n",
|
|
Client->ProcessId, (unsigned long long)sessionId, primaryPid, appliedCount, Request->StreamMask);
|
|
|
|
if (!ControllerRequestDriverSubscriptionApply(TRUE, BK_CONTROLLER_SUBSCRIPTION_APPLY_SYNC_TIMEOUT_MS))
|
|
{
|
|
DWORD applyErr = GetLastError();
|
|
if (replacedLaunchOwnedRootPid != 0)
|
|
{
|
|
ControllerInjectionTerminateProcessTreeBestEffort(replacedLaunchOwnedRootPid, "analysis-replaced");
|
|
}
|
|
return applyErr;
|
|
}
|
|
if (replacedLaunchOwnedRootPid != 0)
|
|
{
|
|
ControllerInjectionTerminateProcessTreeBestEffort(replacedLaunchOwnedRootPid, "analysis-replaced");
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
static DWORD ControllerClientGetEvent(_Inout_ BK_CONTROLLER_CLIENT *Client, _In_ DWORD TimeoutMs,
|
|
_Out_ BK_EVENT_RECORD *Record)
|
|
{
|
|
ULONGLONG startTick;
|
|
|
|
if (Client == NULL || Record == NULL)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
startTick = GetTickCount64();
|
|
for (;;)
|
|
{
|
|
BOOL dequeued = FALSE;
|
|
HANDLE dataEvent = NULL;
|
|
HANDLE waitHandles[2];
|
|
DWORD waitCount = 0;
|
|
DWORD waitMs = INFINITE;
|
|
DWORD waitResult;
|
|
ULONGLONG elapsed = 0;
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
if (Client->SharedRingEnabled && Client->IoctlSharedDataEvent != NULL &&
|
|
Client->IoctlSharedDataEvent != INVALID_HANDLE_VALUE)
|
|
{
|
|
dataEvent = Client->IoctlSharedDataEvent;
|
|
}
|
|
else
|
|
{
|
|
dataEvent = Client->IoctlQueueDataEvent;
|
|
}
|
|
dequeued = ControllerClientDequeueRecordLocked(Client, Record);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
if (dequeued)
|
|
{
|
|
return ERROR_SUCCESS;
|
|
}
|
|
if (ControllerShouldStop())
|
|
{
|
|
return ERROR_OPERATION_ABORTED;
|
|
}
|
|
if (TimeoutMs != INFINITE)
|
|
{
|
|
elapsed = GetTickCount64() - startTick;
|
|
if (elapsed >= TimeoutMs)
|
|
{
|
|
return ERROR_NO_MORE_ITEMS;
|
|
}
|
|
waitMs = (DWORD)((ULONGLONG)TimeoutMs - elapsed);
|
|
}
|
|
|
|
if (g_StopEvent != NULL)
|
|
{
|
|
waitHandles[waitCount++] = g_StopEvent;
|
|
}
|
|
if (dataEvent != NULL && dataEvent != INVALID_HANDLE_VALUE)
|
|
{
|
|
waitHandles[waitCount++] = dataEvent;
|
|
}
|
|
if (waitCount == 0)
|
|
{
|
|
if (waitMs == 0)
|
|
{
|
|
return ERROR_NO_MORE_ITEMS;
|
|
}
|
|
Sleep((waitMs == INFINITE || waitMs > 2u) ? 2u : waitMs);
|
|
continue;
|
|
}
|
|
|
|
waitResult = WaitForMultipleObjects(waitCount, waitHandles, FALSE, waitMs);
|
|
if (waitResult == WAIT_OBJECT_0 && g_StopEvent != NULL)
|
|
{
|
|
return ERROR_OPERATION_ABORTED;
|
|
}
|
|
if (waitResult == WAIT_TIMEOUT)
|
|
{
|
|
if (TimeoutMs != INFINITE)
|
|
{
|
|
return ERROR_NO_MORE_ITEMS;
|
|
}
|
|
continue;
|
|
}
|
|
if (waitResult == WAIT_FAILED)
|
|
{
|
|
DWORD err = GetLastError();
|
|
return (err == ERROR_SUCCESS) ? ERROR_GEN_FAILURE : err;
|
|
}
|
|
}
|
|
}
|
|
|
|
static DWORD ControllerClientGetEtwEvent(_Inout_ BK_CONTROLLER_CLIENT *Client, _In_ DWORD TimeoutMs,
|
|
_Out_ BKIPC_ETW_EVENT *Event)
|
|
{
|
|
ULONGLONG startTick;
|
|
|
|
if (Client == NULL || Event == NULL)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
startTick = GetTickCount64();
|
|
for (;;)
|
|
{
|
|
BOOL dequeued = FALSE;
|
|
HANDLE dataEvent = NULL;
|
|
HANDLE waitHandles[2];
|
|
DWORD waitCount = 0;
|
|
DWORD waitMs = INFINITE;
|
|
DWORD waitResult;
|
|
ULONGLONG elapsed = 0;
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
if (Client->SharedRingEnabled && Client->EtwSharedDataEvent != NULL &&
|
|
Client->EtwSharedDataEvent != INVALID_HANDLE_VALUE)
|
|
{
|
|
dataEvent = Client->EtwSharedDataEvent;
|
|
}
|
|
else
|
|
{
|
|
dataEvent = Client->EtwQueueDataEvent;
|
|
}
|
|
dequeued = ControllerClientDequeueEtwEventLocked(Client, Event);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
if (dequeued)
|
|
{
|
|
return ERROR_SUCCESS;
|
|
}
|
|
if (ControllerShouldStop())
|
|
{
|
|
return ERROR_OPERATION_ABORTED;
|
|
}
|
|
if (TimeoutMs != INFINITE)
|
|
{
|
|
elapsed = GetTickCount64() - startTick;
|
|
if (elapsed >= TimeoutMs)
|
|
{
|
|
return ERROR_NO_MORE_ITEMS;
|
|
}
|
|
waitMs = (DWORD)((ULONGLONG)TimeoutMs - elapsed);
|
|
}
|
|
|
|
if (g_StopEvent != NULL)
|
|
{
|
|
waitHandles[waitCount++] = g_StopEvent;
|
|
}
|
|
if (dataEvent != NULL && dataEvent != INVALID_HANDLE_VALUE)
|
|
{
|
|
waitHandles[waitCount++] = dataEvent;
|
|
}
|
|
if (waitCount == 0)
|
|
{
|
|
if (waitMs == 0)
|
|
{
|
|
return ERROR_NO_MORE_ITEMS;
|
|
}
|
|
Sleep((waitMs == INFINITE || waitMs > 2u) ? 2u : waitMs);
|
|
continue;
|
|
}
|
|
|
|
waitResult = WaitForMultipleObjects(waitCount, waitHandles, FALSE, waitMs);
|
|
if (waitResult == WAIT_OBJECT_0 && g_StopEvent != NULL)
|
|
{
|
|
return ERROR_OPERATION_ABORTED;
|
|
}
|
|
if (waitResult == WAIT_TIMEOUT)
|
|
{
|
|
if (TimeoutMs != INFINITE)
|
|
{
|
|
return ERROR_NO_MORE_ITEMS;
|
|
}
|
|
continue;
|
|
}
|
|
if (waitResult == WAIT_FAILED)
|
|
{
|
|
DWORD err = GetLastError();
|
|
return (err == ERROR_SUCCESS) ? ERROR_GEN_FAILURE : err;
|
|
}
|
|
}
|
|
}
|
|
|
|
static DWORD ControllerClientPublishHookEvent(_Inout_ BK_CONTROLLER_CLIENT *Client,
|
|
_In_ const BKIPC_HOOK_EVENT *HookEvent)
|
|
{
|
|
BKIPC_ETW_EVENT mapped;
|
|
DWORD eventPid = 0;
|
|
DWORD threadId = 0;
|
|
CHAR apiName[BKIPC_MAX_HOOK_API_NAME];
|
|
CHAR moduleName[BKIPC_MAX_HOOK_MODULE_NAME];
|
|
PCSTR kindName;
|
|
int wideChars;
|
|
UINT32 argCount;
|
|
UINT32 sampleSize;
|
|
BOOL integrityTampered = FALSE;
|
|
BOOL integrityAmsiPatch = FALSE;
|
|
BOOL integrityEtwPatch = FALSE;
|
|
BOOL memoryEvent = FALSE;
|
|
BOOL specializedEvent = FALSE;
|
|
|
|
if (Client == NULL || HookEvent == NULL)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
if (HookEvent->Kind == BlackbirdIpcHookEventUnknown || HookEvent->Kind > BlackbirdIpcHookEventModule)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
eventPid = (HookEvent->ProcessId != 0) ? HookEvent->ProcessId : Client->ProcessId;
|
|
if (eventPid == 0)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
if (eventPid != Client->ProcessId)
|
|
{
|
|
return ERROR_ACCESS_DENIED;
|
|
}
|
|
|
|
threadId = HookEvent->ThreadId;
|
|
|
|
ControllerSanitizeAnsiLabel(HookEvent->ApiName, apiName, RTL_NUMBER_OF(apiName));
|
|
ControllerSanitizeAnsiLabel(HookEvent->ModuleName, moduleName, RTL_NUMBER_OF(moduleName));
|
|
kindName = ControllerHookEventKindName(HookEvent->Kind);
|
|
argCount =
|
|
(HookEvent->ArgCount > RTL_NUMBER_OF(HookEvent->Args)) ? RTL_NUMBER_OF(HookEvent->Args) : HookEvent->ArgCount;
|
|
sampleSize = (HookEvent->DataSize > RTL_NUMBER_OF(HookEvent->DataSample)) ? RTL_NUMBER_OF(HookEvent->DataSample)
|
|
: HookEvent->DataSize;
|
|
|
|
ZeroMemory(&mapped, sizeof(mapped));
|
|
mapped.Source = BlackbirdIpcEtwSourceUserHook;
|
|
mapped.Family = BlackbirdIpcEtwFamilyUserHook;
|
|
mapped.EventId = (UINT16)(HookEvent->Operation & 0xFFFFu);
|
|
mapped.Opcode = (UINT16)(HookEvent->Kind & 0xFFFFu);
|
|
mapped.Task = 0;
|
|
mapped.EventProcessId = eventPid;
|
|
mapped.EventThreadId = threadId;
|
|
mapped.Severity = 1;
|
|
mapped.Flags = 0;
|
|
mapped.ProcessId = eventPid;
|
|
mapped.ThreadId = threadId;
|
|
mapped.CallerPid = eventPid;
|
|
mapped.TargetPid = (HookEvent->Context0 <= 0xFFFFFFFFull) ? HookEvent->Context0 : 0;
|
|
|
|
if (HookEvent->Kind == BlackbirdIpcHookEventIntegrity)
|
|
{
|
|
integrityAmsiPatch = (HookEvent->Operation == BK_HOOK_EVENT_OP_AMSI_PATCH);
|
|
integrityEtwPatch = (HookEvent->Operation == BK_HOOK_EVENT_OP_ETW_PATCH);
|
|
if (HookEvent->Operation == BK_HOOK_EVENT_OP_LAUNCH_GATE_ENTRY ||
|
|
HookEvent->Operation == BK_HOOK_EVENT_OP_LAUNCH_GATE_TLS_CALLBACK)
|
|
{
|
|
integrityTampered = FALSE;
|
|
mapped.Severity = 1u;
|
|
}
|
|
else if (integrityAmsiPatch || integrityEtwPatch)
|
|
{
|
|
integrityTampered = (HookEvent->Context0 != 0ull);
|
|
mapped.Severity = integrityTampered ? 8u : 1u;
|
|
}
|
|
else
|
|
{
|
|
integrityTampered = (HookEvent->Context0 != 0ull || HookEvent->Operation != 0u);
|
|
mapped.Severity = integrityTampered ? 7u : 1u;
|
|
}
|
|
mapped.TargetPid = eventPid;
|
|
}
|
|
|
|
if (moduleName[0] != '\0')
|
|
{
|
|
(void)StringCchCopyA(mapped.ClassName, RTL_NUMBER_OF(mapped.ClassName), moduleName);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchCopyA(mapped.ClassName, RTL_NUMBER_OF(mapped.ClassName), kindName);
|
|
}
|
|
|
|
if (apiName[0] != '\0')
|
|
{
|
|
(void)StringCchCopyA(mapped.Operation, RTL_NUMBER_OF(mapped.Operation), apiName);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchPrintfA(mapped.Operation, RTL_NUMBER_OF(mapped.Operation), "%sOp%lu", kindName,
|
|
(unsigned long)HookEvent->Operation);
|
|
}
|
|
|
|
wideChars = MultiByteToWideChar(CP_ACP, 0, (apiName[0] != '\0') ? apiName : mapped.Operation, -1, mapped.EventName,
|
|
RTL_NUMBER_OF(mapped.EventName));
|
|
if (wideChars <= 0)
|
|
{
|
|
(void)StringCchPrintfW(mapped.EventName, RTL_NUMBER_OF(mapped.EventName), L"%S", mapped.Operation);
|
|
}
|
|
|
|
if (HookEvent->Kind == BlackbirdIpcHookEventIntegrity)
|
|
{
|
|
if (HookEvent->Operation == BK_HOOK_EVENT_OP_LAUNCH_GATE_ENTRY ||
|
|
HookEvent->Operation == BK_HOOK_EVENT_OP_LAUNCH_GATE_TLS_CALLBACK)
|
|
{
|
|
BOOL tlsTrap = HookEvent->Operation == BK_HOOK_EVENT_OP_LAUNCH_GATE_TLS_CALLBACK;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
tlsTrap ? "BK_TLS_CALLBACK_TRAP" : "BK_LAUNCH_GATE_TRAP");
|
|
(void)StringCchCopyA(mapped.Operation, RTL_NUMBER_OF(mapped.Operation),
|
|
tlsTrap ? "TlsCallbackTrap" : "LaunchGateEntryTrap");
|
|
(void)StringCchPrintfW(mapped.EventName, RTL_NUMBER_OF(mapped.EventName), L"%S", mapped.Operation);
|
|
(void)StringCchCopyA(mapped.ClassName, RTL_NUMBER_OF(mapped.ClassName), "BK Instrument");
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"BK launch gate trapped %ws before target user code continued address=0x%llX page=0x%llX index=%llu",
|
|
tlsTrap ? L"TLS callback" : L"entry point", (unsigned long long)HookEvent->Context0,
|
|
(unsigned long long)HookEvent->Context1, (unsigned long long)HookEvent->Context3);
|
|
}
|
|
else if (integrityAmsiPatch || integrityEtwPatch)
|
|
{
|
|
PCSTR detectionName = integrityAmsiPatch ? "AMSI_PATCH_TAMPERED" : "ETW_PATCH_TAMPERED";
|
|
PCSTR okDetectionName = integrityAmsiPatch ? "AMSI_PATCH_OK" : "ETW_PATCH_OK";
|
|
PCSTR eventLabel = integrityAmsiPatch ? "AmsiPatchTamper" : "EtwPatchTamper";
|
|
PCSTR okEventLabel = integrityAmsiPatch ? "AmsiPatchOk" : "EtwPatchOk";
|
|
PCWSTR reasonLabel = integrityAmsiPatch ? L"amsi" : L"etw";
|
|
|
|
if (integrityTampered)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), detectionName);
|
|
(void)StringCchCopyA(mapped.Operation, RTL_NUMBER_OF(mapped.Operation), eventLabel);
|
|
(void)StringCchPrintfW(mapped.EventName, RTL_NUMBER_OF(mapped.EventName), L"%S", eventLabel);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), okDetectionName);
|
|
(void)StringCchCopyA(mapped.Operation, RTL_NUMBER_OF(mapped.Operation), okEventLabel);
|
|
(void)StringCchPrintfW(mapped.EventName, RTL_NUMBER_OF(mapped.EventName), L"%S", okEventLabel);
|
|
}
|
|
|
|
if (moduleName[0] != '\0')
|
|
{
|
|
(void)StringCchCopyA(mapped.ClassName, RTL_NUMBER_OF(mapped.ClassName), moduleName);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchCopyA(mapped.ClassName, RTL_NUMBER_OF(mapped.ClassName),
|
|
integrityAmsiPatch ? "amsi" : "ntdll");
|
|
}
|
|
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"%ws tamper=%u suspiciousPrologue=%llu imageMismatch=%llu checkCount=%llu",
|
|
reasonLabel, integrityTampered ? 1u : 0u, (unsigned long long)HookEvent->Context1,
|
|
(unsigned long long)HookEvent->Context2, (unsigned long long)HookEvent->Context3);
|
|
}
|
|
else
|
|
{
|
|
if (integrityTampered)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_HOOK_TAMPERED");
|
|
(void)StringCchCopyA(mapped.Operation, RTL_NUMBER_OF(mapped.Operation), "HookIntegrityTamper");
|
|
(void)StringCchCopyW(mapped.EventName, RTL_NUMBER_OF(mapped.EventName), L"HookIntegrityTamper");
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_HOOK_INTEGRITY_OK");
|
|
(void)StringCchCopyA(mapped.Operation, RTL_NUMBER_OF(mapped.Operation), "HookIntegrityOk");
|
|
(void)StringCchCopyW(mapped.EventName, RTL_NUMBER_OF(mapped.EventName), L"HookIntegrityOk");
|
|
}
|
|
|
|
(void)StringCchCopyA(mapped.ClassName, RTL_NUMBER_OF(mapped.ClassName), "SR71");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"hookIntegrity tampered=%u mask=0x%llX winsock=%llu nt=%llu ki=%llu module=%llu",
|
|
integrityTampered ? 1u : 0u, (unsigned long long)HookEvent->Context0,
|
|
(unsigned long long)HookEvent->Context1, (unsigned long long)HookEvent->Context2,
|
|
(unsigned long long)HookEvent->Context3,
|
|
(unsigned long long)((argCount > 2u) ? HookEvent->Args[2] : 0ull));
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if (HookEvent->Kind == BlackbirdIpcHookEventNt && (lstrcmpiA(apiName, "NtAllocateVirtualMemory") == 0 ||
|
|
lstrcmpiA(apiName, "NtAllocateVirtualMemoryEx") == 0))
|
|
{
|
|
BOOL isAllocateEx = lstrcmpiA(apiName, "NtAllocateVirtualMemoryEx") == 0;
|
|
/* NtAllocateVirtualMemory:
|
|
* Args[0]=ProcessHandle, Args[1]=*BaseAddress, Args[2]=ZeroBits,
|
|
* Args[3]=*RegionSize,
|
|
* Args[4]=AllocationType, Args[5]=Protect, Args[6]=TargetPid.
|
|
|
|
* * NtAllocateVirtualMemoryEx:
|
|
* Args[0]=ProcessHandle, Args[1]=*BaseAddress,
|
|
* Args[2]=*RegionSize,
|
|
* Args[3]=AllocationType, Args[4]=Protect,
|
|
* Args[5]=ExtendedParameters,
|
|
* Args[6]=ExtendedParameterCount, Args[7]=TargetPid.
|
|
*/
|
|
UINT32 allocType = (argCount > (isAllocateEx ? 3u : 4u))
|
|
? (UINT32)(HookEvent->Args[isAllocateEx ? 3u : 4u] & 0xFFFFFFFFull)
|
|
: 0u;
|
|
UINT32 protect = (argCount > (isAllocateEx ? 4u : 5u))
|
|
? (UINT32)(HookEvent->Args[isAllocateEx ? 4u : 5u] & 0xFFFFFFFFull)
|
|
: 0u;
|
|
UINT32 targetPid =
|
|
(argCount > (isAllocateEx ? 7u : 6u) && HookEvent->Args[isAllocateEx ? 7u : 6u] <= 0xFFFFFFFFull)
|
|
? (UINT32)HookEvent->Args[isAllocateEx ? 7u : 6u]
|
|
: 0u;
|
|
BOOL remoteAlloc = (targetPid != 0 && targetPid != eventPid);
|
|
if (targetPid == 0)
|
|
{
|
|
remoteAlloc = (HookEvent->Args[0] != (UINT64)(ULONG_PTR)-1) && (HookEvent->Args[0] != 0u);
|
|
}
|
|
BOOL rwxAlloc = (protect & 0x40u) != 0 || (protect & 0x80u) != 0;
|
|
memoryEvent = TRUE;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
if (remoteAlloc && rwxAlloc)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"SUSPICIOUS_RWX_ALLOCATION");
|
|
mapped.Severity = 6u;
|
|
}
|
|
else if (rwxAlloc)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"SUSPICIOUS_RWX_ALLOCATION");
|
|
mapped.Severity = 5u;
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_MEMORY_ACTIVITY");
|
|
mapped.Severity = 2u;
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"memory.alloc base=0x%llX size=0x%llX allocType=0x%X allocTypeName=%S protect=0x%X protectName=%S remote=%u targetPid=%lu",
|
|
(unsigned long long)HookEvent->Args[1], (unsigned long long)HookEvent->Args[isAllocateEx ? 2u : 3u],
|
|
allocType, ControllerMemoryAllocTypeName(allocType), protect, ControllerMemoryProtectName(protect),
|
|
(unsigned int)remoteAlloc, (unsigned long)targetPid);
|
|
/* Injection chain stage 2 */
|
|
if (remoteAlloc)
|
|
{
|
|
ControllerInjectionChainObserve((DWORD)eventPid, targetPid, BK_CHAIN_STAGE_ALLOC);
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt && lstrcmpiA(apiName, "NtProtectVirtualMemory") == 0)
|
|
{
|
|
UINT32 newProtect = (UINT32)(HookEvent->Context2 & 0xFFFFFFFFull);
|
|
UINT32 oldProtect = (UINT32)(HookEvent->Context3 & 0xFFFFFFFFull);
|
|
BOOL hasSyscallStubOutsideNtdll = (HookEvent->Args[5] != 0ull);
|
|
BOOL sr71ProtectBlocked = (HookEvent->Args[6] == ControllerSr71ProtectBlockedMarker);
|
|
UINT32 targetPid = (argCount > 7u && HookEvent->Args[7] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[7] : 0u;
|
|
BOOL remoteProtect = (targetPid != 0 && targetPid != eventPid);
|
|
CONTROLLER_IMAGE_TAMPER_CLASSIFICATION imageTamper;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
ZeroMemory(&imageTamper, sizeof(imageTamper));
|
|
if (sr71ProtectBlocked)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"SR71_HOOK_PROTECT_BLOCKED");
|
|
mapped.Severity = 8u;
|
|
specializedEvent = TRUE;
|
|
}
|
|
else if (ControllerProtectAllowsWrite(newProtect) &&
|
|
ControllerClassifyImageTamperTarget((targetPid != 0) ? targetPid : eventPid, HookEvent->Context0,
|
|
HookEvent->Context1, &imageTamper) &&
|
|
ControllerApplyImageTamperDetection(&mapped, &imageTamper, L"protect-write-enable",
|
|
HookEvent->Context0, HookEvent->Context1))
|
|
{
|
|
specializedEvent = TRUE;
|
|
}
|
|
else if (hasSyscallStubOutsideNtdll)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_SUSPICIOUS_SYSCALL_STUB");
|
|
mapped.Severity = 7u;
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_MEMORY_ACTIVITY");
|
|
mapped.Severity = (remoteProtect && (newProtect & 0xF0u) != 0u) ? 5u : 3u;
|
|
}
|
|
memoryEvent = TRUE;
|
|
if (sr71ProtectBlocked)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"blocked SR71 hook protection change base=0x%llX size=0x%llX oldProtect=0x%X newProtect=0x%X targetPid=%lu",
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1, oldProtect,
|
|
newProtect, (unsigned long)targetPid);
|
|
}
|
|
else if (imageTamper.Kind == ControllerImageTamperNone)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"memory.protect base=0x%llX size=0x%llX oldProtect=0x%X oldProtectName=%S newProtect=0x%X newProtectName=%S remote=%u syscallStubOutsideNtdll=%u sampleBytes=%lu sampleBase=0x%llX targetPid=%lu",
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1, oldProtect,
|
|
ControllerMemoryProtectName(oldProtect), newProtect, ControllerMemoryProtectName(newProtect),
|
|
(unsigned int)remoteProtect, (unsigned int)hasSyscallStubOutsideNtdll, (unsigned long)sampleSize,
|
|
(unsigned long long)HookEvent->Args[6], (unsigned long)targetPid);
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt && lstrcmpiA(apiName, "NtWriteVirtualMemory") == 0)
|
|
{
|
|
UINT32 targetPid = (argCount > 5u && HookEvent->Args[5] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[5] : 0u;
|
|
BOOL remoteWrite = (targetPid != 0 && targetPid != eventPid);
|
|
BOOL mzHeader =
|
|
(sampleSize >= 2u && HookEvent->DataSample[0] == 0x4Du && HookEvent->DataSample[1] == 0x5Au);
|
|
BOOL sr71WriteBlocked = (HookEvent->Args[6] == ControllerSr71WriteBlockedMarker);
|
|
double entropy = (HookEvent->Args[7] != 0ull)
|
|
? ((double)HookEvent->Args[7] / 1000.0)
|
|
: ControllerComputeSampleEntropy(HookEvent->DataSample, sampleSize);
|
|
CONTROLLER_IMAGE_TAMPER_CLASSIFICATION imageTamper;
|
|
ZeroMemory(&imageTamper, sizeof(imageTamper));
|
|
if (sr71WriteBlocked)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"SR71_HOOK_WRITE_BLOCKED");
|
|
mapped.Severity = 8u;
|
|
specializedEvent = TRUE;
|
|
}
|
|
else if (ControllerClassifyImageTamperTarget((targetPid != 0) ? targetPid : eventPid, HookEvent->Context0,
|
|
HookEvent->Context1, &imageTamper) &&
|
|
ControllerApplyImageTamperDetection(&mapped, &imageTamper, L"write", HookEvent->Context0,
|
|
HookEvent->Context1))
|
|
{
|
|
specializedEvent = TRUE;
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_MEMORY_ACTIVITY");
|
|
mapped.Severity = (remoteWrite && mzHeader) ? 7u : (remoteWrite ? 4u : 3u);
|
|
}
|
|
memoryEvent = TRUE;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
if (sr71WriteBlocked)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"blocked SR71 hook write base=0x%llX size=0x%llX remote=%u sampleBytes=%lu targetPid=%lu",
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1,
|
|
(unsigned int)remoteWrite, (unsigned long)sampleSize, (unsigned long)targetPid);
|
|
}
|
|
else if (imageTamper.Kind == ControllerImageTamperNone)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"memory.write base=0x%llX size=0x%llX entropy=%.2f remote=%u mzHeader=%u sampleBytes=%lu targetPid=%lu",
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1, entropy,
|
|
(unsigned int)remoteWrite, (unsigned int)mzHeader, (unsigned long)sampleSize,
|
|
(unsigned long)targetPid);
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt && lstrcmpiA(apiName, "NtOpenProcess") == 0)
|
|
{
|
|
ULONG desiredAccess = (ULONG)HookEvent->Context1;
|
|
UINT32 targetPid = (UINT32)(HookEvent->Context2 & 0xFFFFFFFFull);
|
|
if (ControllerHookIsInterestingProcessAccess(desiredAccess))
|
|
{
|
|
BOOL credentialAccess = targetPid != 0 && targetPid != eventPid &&
|
|
((desiredAccess & PROCESS_VM_READ) != 0 ||
|
|
(desiredAccess & PROCESS_ALL_ACCESS) == PROCESS_ALL_ACCESS) &&
|
|
ControllerPidImageNameEquals(targetPid, L"lsass.exe");
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
credentialAccess ? "CREDENTIAL_ACCESS_LSASS_OPEN"
|
|
: "USERMODE_PROCESS_HANDLE_ACTIVITY");
|
|
mapped.Severity = credentialAccess ? 7u : ControllerHookSeverityForProcessAccess(desiredAccess);
|
|
mapped.TargetPid = targetPid;
|
|
specializedEvent = TRUE;
|
|
if (credentialAccess)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"credential-access process.open target=lsass.exe targetPid=%lu desiredAccess=0x%X",
|
|
(unsigned long)targetPid, (unsigned int)desiredAccess);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"process.open targetPid=%lu desiredAccess=0x%X", (unsigned long)targetPid,
|
|
(unsigned int)desiredAccess);
|
|
}
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt && lstrcmpiA(apiName, "NtTerminateProcess") == 0)
|
|
{
|
|
UINT32 targetPid = (UINT32)(HookEvent->Context2 & 0xFFFFFFFFull);
|
|
NTSTATUS exitStatus = (NTSTATUS)(HookEvent->Context1 & 0xFFFFFFFFull);
|
|
BOOL currentProcessTarget = HookEvent->Context0 == 0 || HookEvent->Context0 == (UINT64)(ULONG_PTR)-1 ||
|
|
targetPid == 0 || targetPid == eventPid;
|
|
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_PROCESS_TERMINATE_BREAKPOINT");
|
|
mapped.Severity = currentProcessTarget ? 8u : 6u;
|
|
mapped.TargetPid = targetPid != 0 ? targetPid : eventPid;
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"process.terminate breakpoint=pre-call targetPid=%lu currentProcess=%u processHandle=0x%llX exitStatus=0x%08X frames=%lu",
|
|
(unsigned long)mapped.TargetPid, (unsigned int)currentProcessTarget,
|
|
(unsigned long long)HookEvent->Context0, (unsigned int)exitStatus,
|
|
(unsigned long)HookEvent->StackCount);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt && lstrcmpiA(apiName, "NtOpenThread") == 0)
|
|
{
|
|
ULONG desiredAccess = (ULONG)HookEvent->Context1;
|
|
UINT32 targetPid = (UINT32)(HookEvent->Context2 & 0xFFFFFFFFull);
|
|
UINT32 targetTid = (UINT32)(HookEvent->Context3 & 0xFFFFFFFFull);
|
|
if (ControllerHookIsInterestingThreadAccess(desiredAccess))
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_THREAD_HANDLE_ACTIVITY");
|
|
mapped.Severity = ControllerHookSeverityForThreadAccess(desiredAccess);
|
|
mapped.TargetPid = targetPid;
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"thread.open targetPid=%lu targetTid=%lu desiredAccess=0x%X",
|
|
(unsigned long)targetPid, (unsigned long)targetTid, (unsigned int)desiredAccess);
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt && lstrcmpiA(apiName, "NtDuplicateObject") == 0)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_DUP_HANDLE_ACTIVITY");
|
|
mapped.Severity =
|
|
((HookEvent->Args[4] & (PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_CREATE_THREAD)) != 0) ? 6u
|
|
: 3u;
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"handle.duplicate srcProcess=0x%llX srcHandle=0x%llX dstProcess=0x%llX desiredAccess=0x%llX options=0x%llX",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1],
|
|
(unsigned long long)HookEvent->Args[2], (unsigned long long)HookEvent->Args[4],
|
|
(unsigned long long)HookEvent->Args[6]);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtQueryInformationProcess") == 0 ||
|
|
lstrcmpiA(apiName, "NtQueryVirtualMemory") == 0 || lstrcmpiA(apiName, "NtReadVirtualMemory") == 0 ||
|
|
lstrcmpiA(apiName, "NtQuerySystemInformation") == 0))
|
|
{
|
|
BOOL lsassRead = FALSE;
|
|
UINT32 targetPid = 0;
|
|
if (lstrcmpiA(apiName, "NtReadVirtualMemory") == 0)
|
|
{
|
|
targetPid = (argCount > 7u && HookEvent->Args[7] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[7] : 0u;
|
|
lsassRead = targetPid != 0 && targetPid != eventPid && HookEvent->Context3 != 0 &&
|
|
ControllerPidImageNameEquals(targetPid, L"lsass.exe");
|
|
}
|
|
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
lsassRead ? "CREDENTIAL_ACCESS_LSASS_READ" : "USERMODE_PROCESS_RECON");
|
|
mapped.Severity = lsassRead ? 8u : 3u;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
specializedEvent = TRUE;
|
|
if (lsassRead)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"credential-access memory.read target=lsass.exe targetPid=%lu base=0x%llX size=0x%llX",
|
|
(unsigned long)targetPid, (unsigned long long)HookEvent->Context1,
|
|
(unsigned long long)HookEvent->Context3);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"process.recon api=%S c0=0x%llX c1=0x%llX c2=0x%llX", apiName,
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1,
|
|
(unsigned long long)HookEvent->Context2);
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtSetContextThread") == 0 || lstrcmpiA(apiName, "NtGetContextThread") == 0 ||
|
|
lstrcmpiA(apiName, "NtSuspendThread") == 0 || lstrcmpiA(apiName, "NtResumeThread") == 0))
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_THREAD_CONTEXT_ACTIVITY");
|
|
mapped.Severity = (lstrcmpiA(apiName, "NtGetContextThread") == 0) ? 4u : 6u;
|
|
specializedEvent = TRUE;
|
|
if (lstrcmpiA(apiName, "NtSetContextThread") == 0 || lstrcmpiA(apiName, "NtGetContextThread") == 0)
|
|
{
|
|
UINT32 targetTid =
|
|
(argCount > 5u && HookEvent->Args[5] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[5] : 0u;
|
|
UINT32 targetPid =
|
|
(argCount > 6u && HookEvent->Args[6] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[6] : 0u;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"thread.control api=%S targetPid=%lu targetTid=%lu threadHandle=0x%llX ip=0x%llX sp=0x%llX flags=0x%llX",
|
|
apiName, (unsigned long)targetPid, (unsigned long)targetTid,
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1,
|
|
(unsigned long long)HookEvent->Context2, (unsigned long long)HookEvent->Context3);
|
|
}
|
|
else
|
|
{
|
|
UINT32 targetTid = (HookEvent->Context2 <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Context2 : 0u;
|
|
UINT32 targetPid = (HookEvent->Context3 <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Context3 : 0u;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"thread.control api=%S targetPid=%lu targetTid=%lu threadHandle=0x%llX suspendCount=%llu", apiName,
|
|
(unsigned long)targetPid, (unsigned long)targetTid, (unsigned long long)HookEvent->Context0,
|
|
(unsigned long long)HookEvent->Context1);
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt && lstrcmpiA(apiName, "NtQueueApcThread") == 0)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_APC_QUEUE_ACTIVITY");
|
|
mapped.Severity = 1u;
|
|
specializedEvent = TRUE;
|
|
if (argCount > 6u && HookEvent->Args[6] <= 0xFFFFFFFFull && (UINT32)HookEvent->Args[6] != eventPid)
|
|
{
|
|
mapped.TargetPid = (UINT32)HookEvent->Args[6];
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"thread.apc targetPid=%lu targetTid=%lu threadHandle=0x%llX routine=0x%llX arg1=0x%llX arg2=0x%llX arg3=0x%llX",
|
|
(unsigned long)mapped.TargetPid,
|
|
(unsigned long)((argCount > 5u && HookEvent->Args[5] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[5]
|
|
: 0u),
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1,
|
|
(unsigned long long)HookEvent->Context2, (unsigned long long)HookEvent->Context3,
|
|
(unsigned long long)HookEvent->Args[4]);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtCreateThread") == 0 || lstrcmpiA(apiName, "NtCreateThreadEx") == 0))
|
|
{
|
|
BOOL oldCreateThread = lstrcmpiA(apiName, "NtCreateThread") == 0;
|
|
UINT64 processHandle = oldCreateThread ? HookEvent->Args[3] : HookEvent->Context0;
|
|
UINT64 startRoutine = oldCreateThread ? 0ull : HookEvent->Context1;
|
|
UINT32 createFlags = oldCreateThread ? 0u : (UINT32)(HookEvent->Context2 & 0xFFFFFFFFull);
|
|
UINT32 targetPid =
|
|
oldCreateThread
|
|
? ((argCount > 6u && HookEvent->Args[6] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[6] : 0u)
|
|
: ((argCount > 6u && HookEvent->Args[6] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[6] : 0u);
|
|
BOOL remoteThread = (targetPid != 0 && targetPid != eventPid);
|
|
BOOL createSuspended =
|
|
oldCreateThread ? (argCount > 7u && HookEvent->Args[7] != 0u) : ((createFlags & 0x1u) != 0);
|
|
BOOL hiddenThread = !oldCreateThread && ((createFlags & 0x4u) != 0);
|
|
if (targetPid == 0)
|
|
{
|
|
remoteThread = ((processHandle != (UINT64)(ULONG_PTR)-1) && (processHandle != 0));
|
|
}
|
|
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_THREAD_CREATE_ACTIVITY");
|
|
mapped.Severity = remoteThread ? ((hiddenThread || createSuspended) ? 3u : 2u)
|
|
: ((hiddenThread || createSuspended) ? 2u : 1u);
|
|
specializedEvent = TRUE;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"thread.create api=%S targetPid=%lu processHandle=0x%llX startRoutine=0x%llX argument=0x%llX createFlags=0x%X remote=%u createSuspended=%u hideFromDebugger=%u",
|
|
apiName, (unsigned long)targetPid, (unsigned long long)processHandle, (unsigned long long)startRoutine,
|
|
(unsigned long long)HookEvent->Context3, (unsigned int)createFlags, (unsigned int)remoteThread,
|
|
(unsigned int)createSuspended, (unsigned int)hiddenThread);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtQueueApcThreadEx") == 0 || lstrcmpiA(apiName, "NtQueueApcThreadEx2") == 0))
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_APC_QUEUE_ACTIVITY");
|
|
mapped.Severity = 1u;
|
|
specializedEvent = TRUE;
|
|
if (argCount > 7u && HookEvent->Args[7] <= 0xFFFFFFFFull && (UINT32)HookEvent->Args[7] != eventPid)
|
|
{
|
|
mapped.TargetPid = (UINT32)HookEvent->Args[7];
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"thread.apcEx targetPid=%lu targetTid=%lu threadHandle=0x%llX routine=0x%llX arg1=0x%llX arg2=0x%llX reserve=0x%llX",
|
|
(unsigned long)mapped.TargetPid,
|
|
(unsigned long)((argCount > 6u && HookEvent->Args[6] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[6]
|
|
: 0u),
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1,
|
|
(unsigned long long)HookEvent->Context2, (unsigned long long)HookEvent->Context3,
|
|
(unsigned long long)((argCount > 1u) ? HookEvent->Args[1] : 0ull));
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtCreateSection") == 0 || lstrcmpiA(apiName, "NtCreateSectionEx") == 0))
|
|
{
|
|
UINT32 sectionPageProtect = (UINT32)(HookEvent->Context1 & 0xFFFFFFFFull);
|
|
UINT32 allocAttribs = (UINT32)(HookEvent->Context2 & 0xFFFFFFFFull);
|
|
BOOL isImage = (allocAttribs & 0x1000000u) != 0;
|
|
BOOL isExec = (sectionPageProtect & 0xF0u) != 0;
|
|
UINT32 sev = isImage ? 5u : (isExec ? 4u : 3u);
|
|
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_IMAGE_SECTION_ACTIVITY");
|
|
mapped.Severity = sev;
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"section.create sectionPageProtect=0x%X allocAttribs=0x%X isImage=%u isExec=%u fileHandle=0x%llX",
|
|
(unsigned int)sectionPageProtect, (unsigned int)allocAttribs, (unsigned int)isImage,
|
|
(unsigned int)isExec, (unsigned long long)HookEvent->Context3);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtMapViewOfSection") == 0 || lstrcmpiA(apiName, "NtMapViewOfSectionEx") == 0))
|
|
{
|
|
UINT64 processHandle = HookEvent->Context1;
|
|
UINT32 win32Protect = (argCount > 6u) ? (UINT32)(HookEvent->Args[6] & 0xFFFFFFFFull) : 0u;
|
|
UINT32 targetPid = (argCount > 7u && HookEvent->Args[7] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[7] : 0u;
|
|
BOOL remoteMap = (targetPid != 0 && targetPid != eventPid);
|
|
if (targetPid == 0)
|
|
{
|
|
remoteMap = (processHandle != (UINT64)(ULONG_PTR)-1) && (processHandle != 0);
|
|
}
|
|
BOOL execMap = (win32Protect & 0xF0u) != 0;
|
|
UINT32 sev;
|
|
|
|
if (remoteMap && execMap)
|
|
sev = 3u;
|
|
else if (remoteMap)
|
|
sev = 2u;
|
|
else if (execMap)
|
|
sev = 2u;
|
|
else
|
|
sev = 1u;
|
|
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_SECTION_MAP_ACTIVITY");
|
|
mapped.Severity = sev;
|
|
if (targetPid != 0 && targetPid != eventPid)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"section.map sectionHandle=0x%llX processHandle=0x%llX baseAddress=0x%llX viewSize=0x%llX win32Protect=0x%X remote=%u exec=%u targetPid=%lu",
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)processHandle,
|
|
(unsigned long long)HookEvent->Context2, (unsigned long long)HookEvent->Context3,
|
|
(unsigned int)win32Protect, (unsigned int)remoteMap, (unsigned int)execMap, (unsigned long)targetPid);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtUnmapViewOfSection") == 0 || lstrcmpiA(apiName, "NtUnmapViewOfSectionEx") == 0))
|
|
{
|
|
UINT32 targetPid = (argCount > 2u && HookEvent->Args[2] <= 0xFFFFFFFFull) ? (UINT32)HookEvent->Args[2] : 0u;
|
|
BOOL remoteUnmap = targetPid != 0 && targetPid != eventPid;
|
|
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_SECTION_UNMAP_ACTIVITY");
|
|
mapped.Severity = remoteUnmap ? 6u : 3u;
|
|
if (remoteUnmap)
|
|
{
|
|
mapped.TargetPid = targetPid;
|
|
}
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"section.unmap api=%S processHandle=0x%llX baseAddress=0x%llX targetPid=%lu flags=0x%llX remote=%u",
|
|
apiName, (unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1],
|
|
(unsigned long)targetPid, (unsigned long long)((argCount > 3u) ? HookEvent->Args[3] : 0ull),
|
|
(unsigned int)remoteUnmap);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventNt &&
|
|
(lstrcmpiA(apiName, "NtCreateUserProcess") == 0 || lstrcmpiA(apiName, "NtCreateProcessEx") == 0))
|
|
{
|
|
UINT32 createFlags = (UINT32)(HookEvent->Context2 & 0xFFFFFFFFull);
|
|
BOOL suspended = (createFlags & 0x1u) != 0;
|
|
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_PROCESS_CREATE_ACTIVITY");
|
|
mapped.Severity = suspended ? 4u : 2u;
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"process.create processHandle=0x%llX flags=0x%X suspended=%u",
|
|
(unsigned long long)HookEvent->Context0, (unsigned int)createFlags,
|
|
(unsigned int)suspended);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventWinsock &&
|
|
(lstrcmpiA(apiName, "connect") == 0 || lstrcmpiA(apiName, "WSAConnect") == 0))
|
|
{
|
|
UINT16 family = 0;
|
|
UINT16 port = 0;
|
|
CHAR ipBuf[48] = {'\0'};
|
|
(void)ControllerHookDecodeSockaddr(HookEvent->DataSample, sampleSize, &family, &port, ipBuf, sizeof(ipBuf));
|
|
mapped.Family = BlackbirdIpcEtwFamilySocket;
|
|
mapped.TargetPid = 0;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), "USERMODE_NETWORK_CONNECT");
|
|
mapped.Severity = 2u;
|
|
specializedEvent = TRUE;
|
|
if (ipBuf[0] != '\0')
|
|
{
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"socket.connect ip=%S port=%u family=%u socket=0x%llX api=%S", ipBuf,
|
|
(unsigned int)port, (unsigned int)family,
|
|
(unsigned long long)HookEvent->Context0, apiName);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"socket.connect port=%u family=%u socket=0x%llX api=%S", (unsigned int)port,
|
|
(unsigned int)family, (unsigned long long)HookEvent->Context0, apiName);
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventWinsock && lstrcmpiA(apiName, "GetAddrInfoW") == 0)
|
|
{
|
|
mapped.Family = BlackbirdIpcEtwFamilySocket;
|
|
mapped.TargetPid = 0;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_DOMAIN_RESOLUTION");
|
|
mapped.Severity = 1u;
|
|
specializedEvent = TRUE;
|
|
ControllerHookCopyWideSampleToReason(mapped.Reason, RTL_NUMBER_OF(mapped.Reason), HookEvent->DataSample,
|
|
sampleSize);
|
|
if (mapped.Reason[0] == L'\0')
|
|
{
|
|
(void)StringCchCopyW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason), L"domain.resolve");
|
|
}
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventWinsock &&
|
|
(lstrcmpiA(apiName, "WSASend") == 0 || lstrcmpiA(apiName, "WSARecv") == 0 ||
|
|
lstrcmpiA(apiName, "send") == 0 || lstrcmpiA(apiName, "recv") == 0))
|
|
{
|
|
mapped.Family = BlackbirdIpcEtwFamilySocket;
|
|
mapped.TargetPid = 0;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), "USERMODE_NETWORK_IO");
|
|
mapped.Severity = 1u;
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"socket.io api=%S bytes=%lu socket=0x%llX", apiName, (unsigned long)sampleSize,
|
|
(unsigned long long)HookEvent->Context0);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventKi)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), "USERMODE_KI_ACTIVITY");
|
|
mapped.Severity = 3u;
|
|
mapped.TargetPid = eventPid;
|
|
specializedEvent = TRUE;
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"ki.dispatch stub=%S caller=0x%llX stack=0x%llX", apiName,
|
|
(unsigned long long)HookEvent->Caller, (unsigned long long)HookEvent->Context0);
|
|
}
|
|
else if (HookEvent->Kind == BlackbirdIpcHookEventModule)
|
|
{
|
|
WCHAR nameBuffer[BKIPC_MAX_ETW_REASON] = {0};
|
|
ULONGLONG moduleHandle = HookEvent->Context0;
|
|
ULONGLONG frontFlags = HookEvent->Context1;
|
|
ULONGLONG auxValue = HookEvent->Context2;
|
|
ULONGLONG thirdValue = HookEvent->Context3;
|
|
UINT32 moduleOp = (UINT32)HookEvent->Operation;
|
|
BOOL wmiLocator = FALSE;
|
|
|
|
mapped.TargetPid = eventPid;
|
|
specializedEvent = TRUE;
|
|
|
|
switch (moduleOp)
|
|
{
|
|
case ControllerModuleOpRtlAddFunctionTable:
|
|
{
|
|
MEMORY_BASIC_INFORMATION mbi;
|
|
WCHAR abuseReason[128];
|
|
BOOL abusive = ControllerFunctionTableBaseLooksAbusive(eventPid, HookEvent->Args[2], &mbi, abuseReason,
|
|
RTL_NUMBER_OF(abuseReason));
|
|
mapped.Severity = abusive ? 6u : 5u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
abusive ? "DYNAMIC_FUNCTION_TABLE_ABUSE" : "USERMODE_FUNCTION_TABLE_ACTIVITY");
|
|
if (abusive)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"functionTable.abuse table=0x%llX entryCount=0x%llX baseAddress=0x%llX reason=%ws state=0x%lX protect=0x%lX type=0x%lX",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1],
|
|
(unsigned long long)HookEvent->Args[2],
|
|
(abuseReason[0] != L'\0') ? abuseReason : L"suspicious function-table base",
|
|
(unsigned long)mbi.State, (unsigned long)mbi.Protect, (unsigned long)mbi.Type);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"functionTable.add table=0x%llX entryCount=0x%llX baseAddress=0x%llX",
|
|
(unsigned long long)HookEvent->Args[0],
|
|
(unsigned long long)HookEvent->Args[1],
|
|
(unsigned long long)HookEvent->Args[2]);
|
|
}
|
|
break;
|
|
}
|
|
|
|
case ControllerModuleOpRtlInstallFunctionTableCallback:
|
|
{
|
|
MEMORY_BASIC_INFORMATION mbi;
|
|
WCHAR abuseReason[128];
|
|
BOOL abusive = ControllerFunctionTableBaseLooksAbusive(eventPid, HookEvent->Args[1], &mbi, abuseReason,
|
|
RTL_NUMBER_OF(abuseReason));
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = abusive ? 6u : 5u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
abusive ? "DYNAMIC_FUNCTION_TABLE_ABUSE" : "USERMODE_FUNCTION_TABLE_ACTIVITY");
|
|
if (abusive)
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"functionTable.callback.abuse tableId=0x%llX baseAddress=0x%llX length=0x%llX callback=0x%llX reason=%ws outOfProc=%ws state=0x%lX protect=0x%lX type=0x%lX",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1],
|
|
(unsigned long long)HookEvent->Args[2], (unsigned long long)HookEvent->Args[3],
|
|
(abuseReason[0] != L'\0') ? abuseReason : L"suspicious function-table base",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"<none>", (unsigned long)mbi.State,
|
|
(unsigned long)mbi.Protect, (unsigned long)mbi.Type);
|
|
}
|
|
else
|
|
{
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"functionTable.callback tableId=0x%llX baseAddress=0x%llX length=0x%llX callback=0x%llX outOfProc=%ws",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1],
|
|
(unsigned long long)HookEvent->Args[2], (unsigned long long)HookEvent->Args[3],
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"<none>");
|
|
}
|
|
break;
|
|
}
|
|
|
|
case ControllerModuleOpRtlDeleteFunctionTable:
|
|
mapped.Severity = 2u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_FUNCTION_TABLE_ACTIVITY");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"functionTable.delete table=0x%llX", (unsigned long long)HookEvent->Args[0]);
|
|
break;
|
|
|
|
case ControllerModuleOpCoInitializeEx:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = 1u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), "USERMODE_COM_INIT");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"com.init mode=%ws coinit=0x%llX hr=0x%08llX",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"COM",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1]);
|
|
break;
|
|
|
|
case ControllerModuleOpCoInitializeSecurity:
|
|
mapped.Severity = 2u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_COM_SECURITY_INIT");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"com.security authSvc=%lld authn=%llu imp=%llu caps=0x%llX",
|
|
(long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1],
|
|
(unsigned long long)HookEvent->Args[2], (unsigned long long)HookEvent->Args[3]);
|
|
break;
|
|
|
|
case ControllerModuleOpCoCreateInstance:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
wmiLocator = (_wcsicmp(nameBuffer, L"WMI:WbemLocator") == 0);
|
|
mapped.Severity = wmiLocator ? 3u : 1u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
wmiLocator ? "USERMODE_WMI_ACTIVITY" : "USERMODE_COM_INSTANCE_CREATE");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"com.instance class=%ws clsctx=0x%llX hr=0x%08llX",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"COMClass",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[3]);
|
|
break;
|
|
|
|
case ControllerModuleOpEventRegister:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = 2u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_ETW_PROVIDER_REGISTER");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"etw.provider.register provider=%ws reg=0x%llX status=0x%08llX",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"ETWProvider",
|
|
(unsigned long long)HookEvent->Args[2], (unsigned long long)HookEvent->Args[3]);
|
|
break;
|
|
|
|
case ControllerModuleOpEventUnregister:
|
|
mapped.Severity = 1u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_ETW_PROVIDER_UNREGISTER");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"etw.provider.unregister reg=0x%llX status=0x%08llX",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1]);
|
|
break;
|
|
|
|
case ControllerModuleOpStartTraceW:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = 3u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_ETW_SESSION_CONTROL");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"etw.session.start name=%ws handle=0x%llX status=0x%08llX",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"<unnamed>",
|
|
(unsigned long long)HookEvent->Args[1], (unsigned long long)HookEvent->Args[3]);
|
|
break;
|
|
|
|
case ControllerModuleOpEnableTraceEx2:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = 3u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_ETW_SUBSCRIPTION");
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"etw.subscribe provider=%ws trace=0x%llX control=%llu level=%llu status=0x%08llX",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"ETWControl", (unsigned long long)HookEvent->Args[0],
|
|
(unsigned long long)HookEvent->Args[1], (unsigned long long)HookEvent->Args[2],
|
|
(unsigned long long)HookEvent->Args[3]);
|
|
break;
|
|
|
|
case ControllerModuleOpCreateJobObjectW:
|
|
case ControllerModuleOpOpenJobObjectW:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = 2u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_JOB_OBJECT_ACTIVITY");
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason), L"job.object api=%S name=%ws handle=0x%llX", apiName,
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"<unnamed>",
|
|
(unsigned long long)((moduleOp == ControllerModuleOpOpenJobObjectW) ? HookEvent->Args[2]
|
|
: HookEvent->Args[0]));
|
|
break;
|
|
|
|
case ControllerModuleOpAssignProcessToJobObject:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = 3u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_JOB_OBJECT_ACTIVITY");
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"job.assign job=0x%llX process=0x%llX ok=%llu",
|
|
(unsigned long long)HookEvent->Args[0], (unsigned long long)HookEvent->Args[1],
|
|
(unsigned long long)HookEvent->Args[2]);
|
|
break;
|
|
|
|
case ControllerModuleOpSetInformationJobObject:
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
mapped.Severity = 3u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"USERMODE_JOB_OBJECT_ACTIVITY");
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason), L"job.config class=%ws job=0x%llX size=0x%llX ok=%llu",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"JobInfo", (unsigned long long)HookEvent->Args[0],
|
|
(unsigned long long)HookEvent->Args[2], (unsigned long long)HookEvent->Args[3]);
|
|
break;
|
|
|
|
default:
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), "USERMODE_MODULE_LOAD");
|
|
|
|
if (moduleOp == ControllerModuleOpLoadLibraryA || moduleOp == ControllerModuleOpLoadLibraryExA)
|
|
{
|
|
ControllerHookCopyAnsiSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
}
|
|
else
|
|
{
|
|
ControllerHookCopyWideSampleToReason(nameBuffer, RTL_NUMBER_OF(nameBuffer), HookEvent->DataSample,
|
|
sampleSize);
|
|
}
|
|
|
|
if (nameBuffer[0] != L'\0')
|
|
{
|
|
(void)StringCchCopyW(mapped.ImagePath, RTL_NUMBER_OF(mapped.ImagePath), nameBuffer);
|
|
BOOL heuristicFired = FALSE;
|
|
PCWSTR baseName = nameBuffer;
|
|
|
|
for (PCWSTR p = nameBuffer; *p != L'\0'; ++p)
|
|
{
|
|
if (*p == L'\\' || *p == L'/')
|
|
{
|
|
baseName = p + 1;
|
|
}
|
|
}
|
|
|
|
if (_wcsicmp(baseName, L"jscript.dll") == 0 || _wcsicmp(baseName, L"jscript9.dll") == 0 ||
|
|
_wcsicmp(baseName, L"vbscript.dll") == 0 || _wcsicmp(baseName, L"scrobj.dll") == 0)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"SCRIPT_ENGINE_LOAD");
|
|
mapped.Severity = 3u;
|
|
heuristicFired = TRUE;
|
|
}
|
|
else if (ControllerHookWidePathContainsI(nameBuffer, L"\\") &&
|
|
!ControllerHookWidePathContainsI(nameBuffer, L"\\Windows\\System32\\") &&
|
|
!ControllerHookWidePathContainsI(nameBuffer, L"\\Windows\\SysWOW64\\") &&
|
|
!ControllerHookWidePathContainsI(nameBuffer, L"\\Windows\\WinSxS\\") &&
|
|
(_wcsicmp(baseName, L"version.dll") == 0 || _wcsicmp(baseName, L"winmm.dll") == 0 ||
|
|
_wcsicmp(baseName, L"wtsapi32.dll") == 0 || _wcsicmp(baseName, L"cryptsp.dll") == 0 ||
|
|
_wcsicmp(baseName, L"dwrite.dll") == 0 || _wcsicmp(baseName, L"dwmapi.dll") == 0 ||
|
|
_wcsicmp(baseName, L"propsys.dll") == 0 || _wcsicmp(baseName, L"cryptbase.dll") == 0 ||
|
|
_wcsicmp(baseName, L"uxtheme.dll") == 0 || _wcsicmp(baseName, L"msasn1.dll") == 0))
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"DLL_SEARCH_ORDER_HIJACK_USERMODE");
|
|
mapped.Severity = 6u;
|
|
heuristicFired = TRUE;
|
|
}
|
|
else if (ControllerHookWidePathContainsI(nameBuffer, L"\\Temp\\") ||
|
|
ControllerHookWidePathContainsI(nameBuffer, L"\\AppData\\") ||
|
|
ControllerHookWidePathContainsI(nameBuffer, L"\\Downloads\\") ||
|
|
ControllerHookWidePathContainsI(nameBuffer, L"\\Desktop\\") ||
|
|
ControllerHookWidePathContainsI(nameBuffer, L"\\Public\\"))
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName),
|
|
"SUSPICIOUS_DLL_LOAD_PATH");
|
|
mapped.Severity = 4u;
|
|
heuristicFired = TRUE;
|
|
}
|
|
|
|
if (!heuristicFired)
|
|
{
|
|
mapped.Severity = 1u;
|
|
}
|
|
}
|
|
|
|
if (lstrcmpiA(apiName, "LdrLoadDll") == 0)
|
|
{
|
|
if (lstrcmpiA(mapped.DetectionName, "USERMODE_MODULE_LOAD") == 0)
|
|
{
|
|
mapped.Severity = (((NTSTATUS)auxValue) < 0) ? 1u : 3u;
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"module.ldr name=%ws handle=0x%llX flags=0x%llX status=0x%08llX searchPath=0x%llX caller=0x%llX",
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"<unknown>", (unsigned long long)moduleHandle,
|
|
(unsigned long long)frontFlags, (unsigned long long)auxValue, (unsigned long long)thirdValue,
|
|
(unsigned long long)HookEvent->Caller);
|
|
}
|
|
else if (lstrcmpiA(apiName, "LoadLibraryExA") == 0 || lstrcmpiA(apiName, "LoadLibraryExW") == 0)
|
|
{
|
|
if (lstrcmpiA(mapped.DetectionName, "USERMODE_MODULE_LOAD") == 0)
|
|
{
|
|
mapped.Severity = 1u;
|
|
}
|
|
(void)StringCchPrintfW(
|
|
mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"module.frontend api=%S name=%ws handle=0x%llX flags=0x%llX hFile=0x%llX caller=0x%llX",
|
|
apiName, (nameBuffer[0] != L'\0') ? nameBuffer : L"<unknown>", (unsigned long long)moduleHandle,
|
|
(unsigned long long)frontFlags, (unsigned long long)auxValue,
|
|
(unsigned long long)HookEvent->Caller);
|
|
}
|
|
else
|
|
{
|
|
if (lstrcmpiA(mapped.DetectionName, "USERMODE_MODULE_LOAD") == 0)
|
|
{
|
|
mapped.Severity = 1u;
|
|
}
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"module.frontend api=%S name=%ws handle=0x%llX caller=0x%llX", apiName,
|
|
(nameBuffer[0] != L'\0') ? nameBuffer : L"<unknown>",
|
|
(unsigned long long)moduleHandle, (unsigned long long)HookEvent->Caller);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!memoryEvent && !specializedEvent)
|
|
{
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), "USERMODE_HOOK_API_CALL");
|
|
|
|
(void)StringCchPrintfW(mapped.Reason, RTL_NUMBER_OF(mapped.Reason),
|
|
L"kind=%S op=%lu caller=0x%llX c0=0x%llX c1=0x%llX c2=0x%llX c3=0x%llX", kindName,
|
|
(unsigned long)HookEvent->Operation, (unsigned long long)HookEvent->Caller,
|
|
(unsigned long long)HookEvent->Context0, (unsigned long long)HookEvent->Context1,
|
|
(unsigned long long)HookEvent->Context2, (unsigned long long)HookEvent->Context3);
|
|
}
|
|
}
|
|
|
|
ControllerHookAppendArgsToReason(mapped.Reason, RTL_NUMBER_OF(mapped.Reason), HookEvent->Args, argCount);
|
|
|
|
mapped.OriginAddress = HookEvent->Caller;
|
|
mapped.StackCount = HookEvent->StackCount;
|
|
if (mapped.StackCount > RTL_NUMBER_OF(mapped.Stack))
|
|
{
|
|
mapped.StackCount = RTL_NUMBER_OF(mapped.Stack);
|
|
}
|
|
if (mapped.StackCount > RTL_NUMBER_OF(HookEvent->Stack))
|
|
{
|
|
mapped.StackCount = RTL_NUMBER_OF(HookEvent->Stack);
|
|
}
|
|
if (mapped.StackCount != 0)
|
|
{
|
|
CopyMemory(mapped.Stack, HookEvent->Stack, mapped.StackCount * sizeof(mapped.Stack[0]));
|
|
}
|
|
mapped.NotifyClass = HookEvent->Kind;
|
|
mapped.DataType = HookEvent->Operation;
|
|
ControllerHookCopyArgs(mapped.HookArgs, &mapped.HookArgCount, HookEvent->Args, argCount);
|
|
ControllerPrimeHookArgumentSymbols(eventPid, apiName, mapped.HookArgs, mapped.HookArgCount);
|
|
|
|
{
|
|
UINT32 cf = HookEvent->CallerFlags;
|
|
if (cf & BK_HOOK_CALLER_FLAG_ALL_SYSTEM)
|
|
mapped.Flags |= BKIPC_ETW_FLAG_HOOK_CALLER_ALL_SYSTEM;
|
|
if (cf & BK_HOOK_CALLER_FLAG_HAS_UNMAPPED)
|
|
mapped.Flags |= BKIPC_ETW_FLAG_HOOK_CALLER_HAS_UNMAPPED;
|
|
if (cf & BK_HOOK_CALLER_FLAG_HAS_PROCESS_IMAGE)
|
|
mapped.Flags |= BKIPC_ETW_FLAG_HOOK_CALLER_HAS_PROCESS_IMAGE;
|
|
if (cf & BK_HOOK_CALLER_FLAG_HAS_NONSYSTEM_DLL)
|
|
mapped.Flags |= BKIPC_ETW_FLAG_HOOK_CALLER_HAS_NONSYSTEM_DLL;
|
|
if (cf & BK_HOOK_CALLER_FLAG_HAS_OWN_MODULE)
|
|
mapped.Flags |= BKIPC_ETW_FLAG_HOOK_CALLER_HAS_OWN_MODULE;
|
|
mapped.Flags |= (cf & (BK_HOOK_CALLER_IMMED_MASK | BK_HOOK_CALLER_DEEP_MASK));
|
|
mapped.Flags |= ((cf & BK_HOOK_CALLER_COMPONENT_MASK) << 12u);
|
|
}
|
|
mapped.DataSize = sampleSize;
|
|
mapped.DeepSampleSize = sampleSize;
|
|
if (sampleSize != 0)
|
|
{
|
|
CopyMemory(mapped.DeepSample, HookEvent->DataSample, sampleSize);
|
|
}
|
|
|
|
{
|
|
BOOL blackbirdOwned = FALSE;
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
blackbirdOwned = ControllerIsBlackbirdOwnedAddress(Client, HookEvent->Caller);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
if (blackbirdOwned)
|
|
{
|
|
mapped.Reserved2 = ControllerComputeEtwDetectionTraits(mapped) | BKIPC_ETW_TRAIT_BLACKBIRD_OWN;
|
|
mapped.Severity = 1u;
|
|
(void)StringCchCopyA(mapped.DetectionName, RTL_NUMBER_OF(mapped.DetectionName), "BK_INSTRUMENTATION");
|
|
ControllerDispatchEtwEvent(&mapped);
|
|
return ERROR_SUCCESS;
|
|
}
|
|
}
|
|
|
|
if (HookEvent->Kind != BlackbirdIpcHookEventIntegrity && mapped.Severity >= 2u && mapped.ProcessId != 0u)
|
|
{
|
|
mapped.Reserved2 = ControllerComputeEtwDetectionTraits(mapped);
|
|
UINT32 heurFlags = ControllerHeurFlagsFromDetectionTraits(mapped.Reserved2);
|
|
if (heurFlags != 0u)
|
|
{
|
|
ControllerHeuristicsObserveEvent((DWORD)mapped.ProcessId, mapped.Severity, heurFlags);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
mapped.Reserved2 = ControllerComputeEtwDetectionTraits(mapped);
|
|
}
|
|
|
|
if (HookEvent->Kind != BlackbirdIpcHookEventIntegrity && mapped.Severity > 0u && mapped.Severity < 8u)
|
|
{
|
|
UINT32 boost = ControllerCallerOriginSeverityBoost(HookEvent->CallerFlags);
|
|
mapped.Severity = (mapped.Severity + boost > 8u) ? 8u : (mapped.Severity + boost);
|
|
}
|
|
|
|
mapped.Reserved2 = ControllerComputeEtwDetectionTraits(mapped);
|
|
|
|
ControllerObserveUserHookHollowEvent(&mapped);
|
|
ControllerDispatchEtwEvent(&mapped);
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
static DWORD ControllerClientNotifyHookReady(_Inout_ BK_CONTROLLER_CLIENT *Client,
|
|
_In_ const BKIPC_NOTIFY_HOOK_READY_REQUEST *Request,
|
|
_Out_ BKIPC_NOTIFY_HOOK_READY_RESPONSE *Response)
|
|
{
|
|
DWORD observedMask;
|
|
DWORD processId;
|
|
|
|
if (Client == NULL || Request == NULL || Response == NULL)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
ZeroMemory(Response, sizeof(*Response));
|
|
if (Request->ReadyMask == 0)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
processId = (Request->ProcessId != 0) ? Request->ProcessId : Client->ProcessId;
|
|
if (processId == 0 || processId != Client->ProcessId)
|
|
{
|
|
return ERROR_ACCESS_DENIED;
|
|
}
|
|
|
|
observedMask = (DWORD)InterlockedOr(&Client->HookReadyMask, (LONG)Request->ReadyMask) | Request->ReadyMask;
|
|
Client->HookReadyTick = GetTickCount64();
|
|
|
|
ZeroMemory(Response, sizeof(*Response));
|
|
Response->ProcessId = processId;
|
|
Response->ObservedMask = observedMask;
|
|
Response->RequiredMask = BK_CONTROLLER_HOOK_READY_REQUIRED_MASK;
|
|
|
|
/* If the controller has flagged this client for inline Winsock hook upgrade, deliver
|
|
the command in the PendingCommand back-channel and clear the flag atomically. */
|
|
if (InterlockedCompareExchange(&Client->WinsockInlineUpgradePending, 0, 1) == 1)
|
|
{
|
|
Response->PendingCommand = BlackbirdIpcCommandUpgradeWinsockHooks;
|
|
ControllerLog("[IPC] winsock-inline-upgrade delivered pid=%lu\n", processId);
|
|
}
|
|
|
|
if ((observedMask & BK_CONTROLLER_HOOK_READY_REQUIRED_MASK) == BK_CONTROLLER_HOOK_READY_REQUIRED_MASK)
|
|
{
|
|
ControllerLog("[IPC] hook-ready notify pid=%lu mask=0x%08lX (ready)\n", processId, observedMask);
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
static VOID ControllerClearDriverPendingLaunchBestEffort(_In_z_ PCSTR Reason)
|
|
{
|
|
BK_ARM_PENDING_LAUNCH_REQUEST request;
|
|
BOOL ok = FALSE;
|
|
DWORD err = ERROR_SUCCESS;
|
|
|
|
ZeroMemory(&request, sizeof(request));
|
|
request.Flags = BK_PENDING_LAUNCH_FLAG_CLEAR;
|
|
|
|
ok = ControllerProxyArmPendingLaunch(&request);
|
|
err = ok ? ERROR_SUCCESS : GetLastError();
|
|
|
|
if (!ok)
|
|
{
|
|
ControllerLog("[IPC][WARN] driver pending-launch clear failed reason=%s err=%lu\n", Reason, err);
|
|
return;
|
|
}
|
|
|
|
ControllerLog("[IPC] driver pending-launch cleared reason=%s\n", Reason);
|
|
}
|
|
|
|
static BOOL ControllerClientDropLaunchSubscriptionsLocked(_Inout_ BK_CONTROLLER_CLIENT *Client,
|
|
_In_ DWORD RootProcessId)
|
|
{
|
|
BOOL changed = FALSE;
|
|
DWORD i = 0;
|
|
|
|
if (Client == NULL || RootProcessId == 0)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
changed |= ControllerDropDynamicDescendantsLocked(Client, RootProcessId);
|
|
while (i < Client->SubscriptionCount)
|
|
{
|
|
if (Client->Subscriptions[i].ProcessId == RootProcessId)
|
|
{
|
|
ControllerRemoveSubscriptionAtLocked(Client, i);
|
|
changed = TRUE;
|
|
ControllerLog("[IPC] launch failure subscription removed clientPid=%lu targetPid=%lu\n", Client->ProcessId,
|
|
RootProcessId);
|
|
continue;
|
|
}
|
|
i += 1;
|
|
}
|
|
|
|
if (changed)
|
|
{
|
|
ControllerMarkDriverSubscriptionsDirty();
|
|
}
|
|
return changed;
|
|
}
|
|
|
|
static VOID ControllerRecoverRuntimeAfterLaunchFailure(_In_ DWORD LaunchError, _In_ DWORD RootProcessId)
|
|
{
|
|
static const DWORD recoveryMask = BK_RUNTIME_FLAG_ANTI_VIRTUALIZATION | BK_RUNTIME_FLAG_SELF_HIDE |
|
|
BK_RUNTIME_FLAG_INTERFACE_PROTECTED_ACCESS |
|
|
BK_RUNTIME_FLAG_CONTROLLER_PROTECTED_ACCESS |
|
|
BK_RUNTIME_FLAG_NTAPI_HOOKS_DISARMED | BK_RUNTIME_FLAG_QPC_TIMING_DISABLED;
|
|
static const DWORD recoveryFlags = BK_RUNTIME_FLAG_NTAPI_HOOKS_DISARMED | BK_RUNTIME_FLAG_QPC_TIMING_DISABLED;
|
|
|
|
if (!ControllerProxySetRuntimeConfig(recoveryFlags, recoveryMask))
|
|
{
|
|
ControllerLog("[IPC][WARN] launch failure runtime recovery failed pid=%lu launchErr=%lu err=%lu\n",
|
|
RootProcessId, LaunchError, GetLastError());
|
|
return;
|
|
}
|
|
|
|
ControllerLog(
|
|
"[IPC][WARN] launch failure runtime recovery disarmed hooks/protection pid=%lu launchErr=%lu flags=0x%08lX mask=0x%08lX\n",
|
|
RootProcessId, LaunchError, recoveryFlags, recoveryMask);
|
|
}
|
|
|
|
static DWORD ControllerClientSetUserHookTarget(_Inout_ BK_CONTROLLER_CLIENT *Client,
|
|
_In_ const BKIPC_SET_USER_HOOK_TARGET_REQUEST *Request,
|
|
_Out_ BKIPC_SET_USER_HOOK_TARGET_RESPONSE *Response)
|
|
{
|
|
WCHAR hookDllPath[BK_MAX_IMAGE_PATH_CHARS];
|
|
BK_QUERY_PROCESS_IMAGE_RESPONSE kernelImage;
|
|
WIN32_FILE_ATTRIBUTE_DATA hookAttrs;
|
|
BOOL hookPathVisible = FALSE;
|
|
ULONGLONG hookSize = 0;
|
|
DWORD err = ERROR_SUCCESS;
|
|
DWORD targetPid = 0;
|
|
BOOL kernelAssured = FALSE;
|
|
BOOL pendingLaunchArmed = FALSE;
|
|
ULONGLONG analysisSessionId = 0;
|
|
BK_ARM_PENDING_LAUNCH_REQUEST pendingLaunchRequest;
|
|
|
|
if (Client == NULL || Request == NULL || Response == NULL)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
ZeroMemory(Response, sizeof(*Response));
|
|
ZeroMemory(hookDllPath, sizeof(hookDllPath));
|
|
ZeroMemory(&kernelImage, sizeof(kernelImage));
|
|
|
|
if (!ControllerInjectionResolveHookDllPath(Request, hookDllPath, RTL_NUMBER_OF(hookDllPath)))
|
|
{
|
|
return GetLastError();
|
|
}
|
|
|
|
ControllerLog(
|
|
"[IPC] set-user-hook-target mode=%lu flags=0x%08lX pid=%lu image=%ws subjectKind=%lu subject=%ws argsChars=%llu\n",
|
|
Request->Mode, Request->Flags, Request->ProcessId, Request->ImagePath, Request->AnalysisSubjectKind,
|
|
Request->AnalysisSubjectPath,
|
|
Request->CommandLineArguments[0] != L'\0' ? (unsigned long long)wcslen(Request->CommandLineArguments) : 0ull);
|
|
|
|
ZeroMemory(&hookAttrs, sizeof(hookAttrs));
|
|
hookPathVisible = GetFileAttributesExW(hookDllPath, GetFileExInfoStandard, &hookAttrs);
|
|
if (hookPathVisible)
|
|
{
|
|
hookSize = (((ULONGLONG)hookAttrs.nFileSizeHigh) << 32) | (ULONGLONG)hookAttrs.nFileSizeLow;
|
|
}
|
|
ControllerLog("[IPC] userhook resolved hook path=%ws visible=%u size=%llu\n", hookDllPath,
|
|
hookPathVisible ? 1u : 0u, (unsigned long long)hookSize);
|
|
if (!hookPathVisible)
|
|
{
|
|
return ERROR_FILE_NOT_FOUND;
|
|
}
|
|
|
|
switch (Request->Mode)
|
|
{
|
|
case BlackbirdIpcUserHookTargetAttach:
|
|
if (Request->AnalysisSubjectKind != BlackbirdAnalysisSubjectProcess || Request->AnalysisSubjectPath[0] != L'\0')
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientClearPendingLaunchLocked(Client);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
if (Request->ProcessId == 0)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
if (!ControllerClientCanMonitorPid(Client, Request->ProcessId, NULL, NULL))
|
|
{
|
|
err = GetLastError();
|
|
return err == ERROR_SUCCESS ? ERROR_ACCESS_DENIED : err;
|
|
}
|
|
|
|
err = ControllerInjectionAttachAndVerify(Request->ProcessId, hookDllPath,
|
|
BK_CONTROLLER_INJECTION_VERIFY_TIMEOUT_MS);
|
|
if (err != ERROR_SUCCESS)
|
|
{
|
|
return err;
|
|
}
|
|
|
|
targetPid = Request->ProcessId;
|
|
ControllerLog("[IPC] attach target verified clientPid=%lu rootPid=%lu\n", Client->ProcessId, targetPid);
|
|
break;
|
|
|
|
case BlackbirdIpcUserHookTargetLaunch:
|
|
if (Request->ImagePath[0] == L'\0' || !ControllerInjectionPathPointsToFile(Request->ImagePath))
|
|
{
|
|
return ERROR_FILE_NOT_FOUND;
|
|
}
|
|
if (Request->AnalysisSubjectKind != BlackbirdAnalysisSubjectProcess &&
|
|
Request->AnalysisSubjectKind != BlackbirdAnalysisSubjectDll)
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
if (Request->AnalysisSubjectKind == BlackbirdAnalysisSubjectDll && Request->AnalysisSubjectPath[0] == L'\0')
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
if (Request->AnalysisSubjectKind == BlackbirdAnalysisSubjectProcess && Request->AnalysisSubjectPath[0] != L'\0')
|
|
{
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
if (Request->AnalysisSubjectKind == BlackbirdAnalysisSubjectDll &&
|
|
!ControllerInjectionPathPointsToFile(Request->AnalysisSubjectPath))
|
|
{
|
|
return ERROR_FILE_NOT_FOUND;
|
|
}
|
|
err = ControllerEnsureCaptureReadyForLaunch();
|
|
if (err != ERROR_SUCCESS)
|
|
{
|
|
return err;
|
|
}
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientArmPendingLaunchLocked(Client, Request->ImagePath, Request->AnalysisSubjectKind,
|
|
Request->AnalysisSubjectPath);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
if (!ControllerBuildPendingLaunchRequest(Request->ImagePath, Request->AnalysisSubjectKind,
|
|
Request->AnalysisSubjectPath, BK_CONTROLLER_DRIVER_STREAM_MASK,
|
|
&pendingLaunchRequest))
|
|
{
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientClearPendingLaunchLocked(Client);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
if (ControllerProxyArmPendingLaunch(&pendingLaunchRequest))
|
|
{
|
|
pendingLaunchArmed = TRUE;
|
|
}
|
|
else
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
if (!pendingLaunchArmed)
|
|
{
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientClearPendingLaunchLocked(Client);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
return err == ERROR_SUCCESS ? ERROR_DEVICE_NOT_CONNECTED : err;
|
|
}
|
|
|
|
err = ControllerInjectionLaunchAndVerify(Client->Pipe, Request, hookDllPath,
|
|
BK_CONTROLLER_INJECTION_VERIFY_TIMEOUT_MS, &targetPid);
|
|
if (err != ERROR_SUCCESS)
|
|
{
|
|
BOOL subscriptionsChanged = FALSE;
|
|
|
|
if (pendingLaunchArmed)
|
|
{
|
|
ControllerClearDriverPendingLaunchBestEffort("userhook-launch-failed");
|
|
}
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientClearPendingLaunchLocked(Client);
|
|
if (targetPid != 0)
|
|
{
|
|
subscriptionsChanged = ControllerClientDropLaunchSubscriptionsLocked(Client, targetPid);
|
|
}
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
if (subscriptionsChanged)
|
|
{
|
|
(void)ControllerApplyDriverSubscriptionsIfDirty();
|
|
}
|
|
if (targetPid != 0)
|
|
{
|
|
ControllerRecoverRuntimeAfterLaunchFailure(err, targetPid);
|
|
}
|
|
return err;
|
|
}
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientPrimePendingLaunchPidLocked(Client, targetPid);
|
|
analysisSessionId = ControllerClientBeginAnalysisSessionLocked(Client, targetPid, TRUE);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
ControllerLog("[IPC] analysis session started clientPid=%lu sessionId=%llu rootPid=%lu launchOwned=1 "
|
|
"mode=launch\n",
|
|
Client->ProcessId, (unsigned long long)analysisSessionId, targetPid);
|
|
(void)ControllerApplyDriverSubscriptionsIfDirty();
|
|
break;
|
|
|
|
default:
|
|
return ERROR_INVALID_PARAMETER;
|
|
}
|
|
|
|
if (targetPid != 0 && ControllerProxyQueryProcessImage(targetPid, &kernelImage))
|
|
{
|
|
kernelAssured = TRUE;
|
|
(void)StringCchCopyW(Response->ImagePath, RTL_NUMBER_OF(Response->ImagePath), kernelImage.ImagePath);
|
|
}
|
|
else if (targetPid != 0)
|
|
{
|
|
BOOL driverConnected = FALSE;
|
|
DWORD kernelErr = GetLastError();
|
|
DWORD normalizedKernelErr = kernelErr;
|
|
|
|
driverConnected = ControllerProxyDriverConnected();
|
|
if (driverConnected)
|
|
{
|
|
if (normalizedKernelErr == ERROR_SUCCESS || normalizedKernelErr == ERROR_NO_MORE_FILES ||
|
|
normalizedKernelErr == ERROR_BAD_LENGTH || normalizedKernelErr == ERROR_PARTIAL_COPY)
|
|
{
|
|
normalizedKernelErr = ERROR_NOT_FOUND;
|
|
}
|
|
|
|
if (Request->Mode == BlackbirdIpcUserHookTargetLaunch)
|
|
{
|
|
ControllerLog("[IPC][WARN] userhook kernel image probe failed pid=%lu err=%lu; continuing unassured\n",
|
|
targetPid, normalizedKernelErr);
|
|
}
|
|
else
|
|
{
|
|
ControllerLog(
|
|
"[IPC] userhook kernel image probe missed pid=%lu err=%lu (attach, pre-existing process)\n",
|
|
targetPid, normalizedKernelErr);
|
|
}
|
|
}
|
|
}
|
|
|
|
Response->ProcessId = targetPid;
|
|
Response->Status = kernelAssured ? 1 : 0;
|
|
Response->AnalysisSubjectKind = Request->AnalysisSubjectKind;
|
|
if (!kernelAssured && Request->Mode == BlackbirdIpcUserHookTargetLaunch && Request->ImagePath[0] != L'\0')
|
|
{
|
|
(void)StringCchCopyW(Response->ImagePath, RTL_NUMBER_OF(Response->ImagePath), Request->ImagePath);
|
|
}
|
|
else if (!kernelAssured && targetPid != 0)
|
|
{
|
|
HANDLE queryHandle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, targetPid);
|
|
if (queryHandle != NULL)
|
|
{
|
|
DWORD imageChars = (DWORD)RTL_NUMBER_OF(Response->ImagePath);
|
|
if (!QueryFullProcessImageNameW(queryHandle, 0, Response->ImagePath, &imageChars))
|
|
{
|
|
Response->ImagePath[0] = L'\0';
|
|
}
|
|
CloseHandle(queryHandle);
|
|
}
|
|
}
|
|
|
|
if (Request->AnalysisSubjectKind == BlackbirdAnalysisSubjectDll && Request->AnalysisSubjectPath[0] != L'\0')
|
|
{
|
|
(void)StringCchCopyW(Response->AnalysisSubjectPath, RTL_NUMBER_OF(Response->AnalysisSubjectPath),
|
|
Request->AnalysisSubjectPath);
|
|
}
|
|
|
|
return ERROR_SUCCESS;
|
|
}
|
|
|
|
static PCSTR ControllerCommandName(_In_ UINT32 Command)
|
|
{
|
|
switch (Command)
|
|
{
|
|
case BlackbirdIpcCommandHandshake:
|
|
return "handshake";
|
|
case BlackbirdIpcCommandSubscribe:
|
|
return "subscribe";
|
|
case BlackbirdIpcCommandUnsubscribe:
|
|
return "unsubscribe";
|
|
case BlackbirdIpcCommandSetPids:
|
|
return "set-pids";
|
|
case BlackbirdIpcCommandGetEvent:
|
|
return "get-event";
|
|
case BlackbirdIpcCommandGetStats:
|
|
return "get-stats";
|
|
case BlackbirdIpcCommandQueryProcessImage:
|
|
return "query-process-image";
|
|
case BlackbirdIpcCommandSetShutdownMode:
|
|
return "set-shutdown-mode";
|
|
case BlackbirdIpcCommandGetEtwEvent:
|
|
return "get-etw-event";
|
|
case BlackbirdIpcCommandOpenSharedRing:
|
|
return "open-shared-ring";
|
|
case BlackbirdIpcCommandPublishHookEvent:
|
|
return "publish-hook-event";
|
|
case BlackbirdIpcCommandSetUserHookTarget:
|
|
return "set-user-hook-target";
|
|
case BlackbirdIpcCommandNotifyHookReady:
|
|
return "notify-hook-ready";
|
|
case BlackbirdIpcCommandControlProcessExecution:
|
|
return "control-process-execution";
|
|
case BlackbirdIpcCommandSetRuntimeConfig:
|
|
return "set-runtime-config";
|
|
case BlackbirdIpcCommandGetRuntimeConfig:
|
|
return "get-runtime-config";
|
|
case BlackbirdIpcCommandGetHealth:
|
|
return "get-health";
|
|
case BlackbirdIpcCommandGetDiagnostics:
|
|
return "get-diagnostics";
|
|
case BlackbirdIpcCommandSetQpcTimingConfig:
|
|
return "set-qpc-timing-config";
|
|
case BlackbirdIpcCommandGetQpcTimingState:
|
|
return "get-qpc-timing-state";
|
|
case BlackbirdIpcCommandQueryProcessMemory:
|
|
return "query-process-memory";
|
|
case BlackbirdIpcCommandRegisterInstrumentationRange:
|
|
return "register-instrumentation-range";
|
|
case BlackbirdIpcCommandRegisterHookPatch:
|
|
return "register-hook-patch";
|
|
default:
|
|
return "unknown";
|
|
}
|
|
}
|
|
|
|
static BOOL ControllerCommandLogsBegin(_In_ UINT32 Command)
|
|
{
|
|
switch (Command)
|
|
{
|
|
case BlackbirdIpcCommandSetRuntimeConfig:
|
|
case BlackbirdIpcCommandGetRuntimeConfig:
|
|
case BlackbirdIpcCommandSetUserHookTarget:
|
|
case BlackbirdIpcCommandControlProcessExecution:
|
|
case BlackbirdIpcCommandQueryProcessImage:
|
|
case BlackbirdIpcCommandQueryProcessMemory:
|
|
return TRUE;
|
|
default:
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
static DWORD ControllerHandleClientCommand(_Inout_ BK_CONTROLLER_CLIENT *Client, _In_ const BKIPC_PACKET *Request,
|
|
_Out_ BKIPC_PACKET *Response)
|
|
{
|
|
DWORD err = ERROR_SUCCESS;
|
|
|
|
ControllerPrepareResponse(Request, Response);
|
|
|
|
if (!ControllerCommandAllowedForRole(Client->Role, Request->Command))
|
|
{
|
|
err = ERROR_ACCESS_DENIED;
|
|
goto Complete;
|
|
}
|
|
|
|
switch (Request->Command)
|
|
{
|
|
case BlackbirdIpcCommandHandshake:
|
|
if (Client->Role == BkctlrClientRoleHook)
|
|
{
|
|
(void)InterlockedOr(&Client->HookReadyMask, (LONG)BKIPC_HOOK_READY_FLAG_IPC_CONNECTED);
|
|
Client->HookReadyTick = GetTickCount64();
|
|
}
|
|
Response->Payload.HandshakeResponse.NegotiatedVersion = BKIPC_VERSION;
|
|
Response->Payload.HandshakeResponse.Capabilities = BKIPC_CAP_DRIVER_PROXY | BKIPC_CAP_SHARED_RING |
|
|
BKIPC_CAP_USER_HOOK_INGEST | BKIPC_CAP_USER_HOOK_READY |
|
|
BKIPC_CAP_DRIVER_DIAGNOSTICS | BKIPC_CAP_QPC_TIMING;
|
|
Response->Payload.HandshakeResponse.ThreatIntelEnabled = 0u;
|
|
Response->Payload.HandshakeResponse.Reserved = 0u;
|
|
break;
|
|
case BlackbirdIpcCommandSubscribe:
|
|
err = ControllerClientSubscribe(Client, &Request->Payload.SubscribeRequest);
|
|
break;
|
|
case BlackbirdIpcCommandUnsubscribe:
|
|
err = ControllerClientUnsubscribe(Client, &Request->Payload.UnsubscribeRequest);
|
|
break;
|
|
case BlackbirdIpcCommandSetPids:
|
|
err = ControllerClientSetPids(Client, &Request->Payload.SetPidsRequest);
|
|
break;
|
|
case BlackbirdIpcCommandGetEvent:
|
|
err = ControllerClientGetEvent(Client, Request->Payload.GetEventRequest.TimeoutMs,
|
|
&Response->Payload.EventRecord);
|
|
break;
|
|
case BlackbirdIpcCommandGetStats:
|
|
err = ControllerClientGetStats(Client, &Response->Payload.StatsResponse);
|
|
break;
|
|
case BlackbirdIpcCommandQueryProcessImage:
|
|
if (Request->Payload.QueryProcessImageRequest.ProcessId == 0)
|
|
{
|
|
err = ERROR_INVALID_PARAMETER;
|
|
break;
|
|
}
|
|
if (!ControllerClientCanMonitorPid(Client, Request->Payload.QueryProcessImageRequest.ProcessId, NULL, NULL))
|
|
{
|
|
err = GetLastError();
|
|
if (err == ERROR_SUCCESS)
|
|
{
|
|
err = ERROR_ACCESS_DENIED;
|
|
}
|
|
break;
|
|
}
|
|
if (!ControllerProxyQueryProcessImage(Request->Payload.QueryProcessImageRequest.ProcessId,
|
|
&Response->Payload.QueryProcessImageResponse))
|
|
{
|
|
err = GetLastError();
|
|
if (err == ERROR_SUCCESS)
|
|
{
|
|
err = ERROR_NOT_FOUND;
|
|
}
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandSetShutdownMode:
|
|
if (!ControllerProxySetShutdownMode())
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandControlProcessExecution:
|
|
if (Request->Payload.ControlProcessExecutionRequest.ProcessId == 0)
|
|
{
|
|
err = ERROR_INVALID_PARAMETER;
|
|
break;
|
|
}
|
|
if (!ControllerProxyControlProcessExecution(Request->Payload.ControlProcessExecutionRequest.ProcessId,
|
|
Request->Payload.ControlProcessExecutionRequest.Suspend != 0))
|
|
{
|
|
err = GetLastError();
|
|
if (err == ERROR_SUCCESS)
|
|
{
|
|
err = ERROR_GEN_FAILURE;
|
|
}
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandSetRuntimeConfig:
|
|
if (!ControllerProxySetRuntimeConfig(Request->Payload.SetRuntimeConfigRequest.Flags,
|
|
Request->Payload.SetRuntimeConfigRequest.Mask))
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandGetRuntimeConfig:
|
|
if (!ControllerProxyGetRuntimeConfig(&Response->Payload.RuntimeConfigResponse))
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandSetQpcTimingConfig:
|
|
if (!ControllerProxySetQpcTimingConfig(&Request->Payload.QpcTimingConfig))
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandGetQpcTimingState:
|
|
if (!ControllerProxyGetQpcTimingState(&Response->Payload.QpcTimingState))
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandGetHealth:
|
|
if (!ControllerProxyGetHealth(&Response->Payload.HealthResponse))
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandGetDiagnostics:
|
|
if (!ControllerProxyGetDiagnostics(&Response->Payload.DiagnosticsResponse))
|
|
{
|
|
err = GetLastError();
|
|
}
|
|
break;
|
|
case BlackbirdIpcCommandGetEtwEvent:
|
|
err = ControllerClientGetEtwEvent(Client, Request->Payload.GetEventRequest.TimeoutMs,
|
|
&Response->Payload.EtwEvent);
|
|
break;
|
|
case BlackbirdIpcCommandOpenSharedRing:
|
|
err = ControllerClientOpenSharedRing(Client, &Request->Payload.OpenSharedRingRequest,
|
|
&Response->Payload.OpenSharedRingResponse);
|
|
break;
|
|
case BlackbirdIpcCommandPublishHookEvent:
|
|
err = ControllerClientPublishHookEvent(Client, &Request->Payload.HookEvent);
|
|
break;
|
|
case BlackbirdIpcCommandSetUserHookTarget:
|
|
err = ControllerClientSetUserHookTarget(Client, &Request->Payload.SetUserHookTargetRequest,
|
|
&Response->Payload.SetUserHookTargetResponse);
|
|
break;
|
|
case BlackbirdIpcCommandNotifyHookReady:
|
|
err = ControllerClientNotifyHookReady(Client, &Request->Payload.NotifyHookReadyRequest,
|
|
&Response->Payload.NotifyHookReadyResponse);
|
|
break;
|
|
case BlackbirdIpcCommandRegisterInstrumentationRange:
|
|
{
|
|
const BKIPC_REGISTER_INSTRUMENTATION_RANGE_REQUEST *range =
|
|
&Request->Payload.RegisterInstrumentationRangeRequest;
|
|
|
|
if (range->BaseAddress == 0 || range->RegionSize == 0)
|
|
{
|
|
err = ERROR_INVALID_PARAMETER;
|
|
break;
|
|
}
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
if (Client->OwnedRangeCount < BK_CONTROLLER_MAX_OWNED_RANGES)
|
|
{
|
|
BK_CONTROLLER_OWNED_RANGE *slot = &Client->OwnedRanges[Client->OwnedRangeCount];
|
|
slot->BaseAddress = range->BaseAddress;
|
|
slot->RegionSize = range->RegionSize;
|
|
slot->Flags = range->Flags;
|
|
(void)StringCchCopyA(slot->Tag, RTL_NUMBER_OF(slot->Tag), range->Tag);
|
|
Client->OwnedRangeCount += 1;
|
|
err = ERROR_SUCCESS;
|
|
}
|
|
else
|
|
{
|
|
err = ERROR_INSUFFICIENT_BUFFER;
|
|
}
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
if (err == ERROR_SUCCESS)
|
|
{
|
|
if (!ControllerProxyRegisterInstrumentationRange(Client->ProcessId, range->BaseAddress, range->RegionSize,
|
|
range->Flags, range->Tag))
|
|
{
|
|
DWORD kernelErr = GetLastError();
|
|
ControllerLog(
|
|
"[IPC] instrumentation-range kernel registration failed pid=%lu base=0x%llX size=0x%llX win32=%lu\n",
|
|
Client->ProcessId, (unsigned long long)range->BaseAddress, (unsigned long long)range->RegionSize,
|
|
kernelErr);
|
|
}
|
|
ControllerLog("[IPC] instrumentation-range registered pid=%lu base=0x%llX size=0x%llX flags=0x%X tag=%s\n",
|
|
Client->ProcessId, (unsigned long long)range->BaseAddress,
|
|
(unsigned long long)range->RegionSize, (unsigned int)range->Flags,
|
|
range->Tag[0] != '\0' ? range->Tag : "<untagged>");
|
|
}
|
|
break;
|
|
}
|
|
case BlackbirdIpcCommandQueryProcessMemory:
|
|
{
|
|
HANDLE hClientProc;
|
|
HANDLE hDupSection = NULL;
|
|
DWORD bytesRead = 0;
|
|
|
|
if (Request->Payload.QueryMemoryRequest.ProcessId == 0 ||
|
|
Request->Payload.QueryMemoryRequest.RequestedSize == 0)
|
|
{
|
|
err = ERROR_INVALID_PARAMETER;
|
|
break;
|
|
}
|
|
if (!ControllerClientCanMonitorPid(Client, Request->Payload.QueryMemoryRequest.ProcessId, NULL, NULL))
|
|
{
|
|
err = GetLastError();
|
|
if (err == ERROR_SUCCESS)
|
|
{
|
|
err = ERROR_ACCESS_DENIED;
|
|
}
|
|
break;
|
|
}
|
|
hClientProc = OpenProcess(PROCESS_DUP_HANDLE, FALSE, Client->ProcessId);
|
|
if (hClientProc == NULL)
|
|
{
|
|
err = GetLastError();
|
|
break;
|
|
}
|
|
if (!ControllerProxyReadProcessMemory(
|
|
Request->Payload.QueryMemoryRequest.ProcessId, Request->Payload.QueryMemoryRequest.BaseAddress,
|
|
Request->Payload.QueryMemoryRequest.RequestedSize, hClientProc, &hDupSection, &bytesRead))
|
|
{
|
|
err = GetLastError();
|
|
if (err == ERROR_SUCCESS)
|
|
{
|
|
err = ERROR_GEN_FAILURE;
|
|
}
|
|
CloseHandle(hClientProc);
|
|
break;
|
|
}
|
|
CloseHandle(hClientProc);
|
|
Response->Payload.QueryMemoryResponse.Status = 0;
|
|
Response->Payload.QueryMemoryResponse.BytesRead = bytesRead;
|
|
Response->Payload.QueryMemoryResponse.SectionHandle = (UINT64)(ULONG_PTR)hDupSection;
|
|
break;
|
|
}
|
|
case BlackbirdIpcCommandRegisterHookPatch:
|
|
{
|
|
const BKIPC_REGISTER_HOOK_PATCH_REQUEST *patch = &Request->Payload.RegisterHookPatchRequest;
|
|
if (patch->PatchAddress == 0 || patch->PatchSize == 0 || patch->OriginalSize == 0 ||
|
|
patch->PatchSize > BK_MAX_HOOK_PATCH_BYTES || patch->OriginalSize > BK_MAX_HOOK_PATCH_BYTES)
|
|
{
|
|
err = ERROR_INVALID_PARAMETER;
|
|
break;
|
|
}
|
|
|
|
if (!ControllerProxyRegisterHookPatch(Client->ProcessId, patch->PatchAddress, patch->PatchSize,
|
|
patch->OriginalBytes, patch->OriginalSize, patch->Flags, patch->Tag))
|
|
{
|
|
err = GetLastError();
|
|
if (err == ERROR_SUCCESS)
|
|
{
|
|
err = ERROR_GEN_FAILURE;
|
|
}
|
|
ControllerLog("[IPC] hook-patch kernel registration failed pid=%lu address=0x%llX size=%lu win32=%lu\n",
|
|
Client->ProcessId, (unsigned long long)patch->PatchAddress, (unsigned long)patch->PatchSize,
|
|
err);
|
|
break;
|
|
}
|
|
|
|
ControllerLog("[IPC] hook-patch registered pid=%lu address=0x%llX size=%lu tag=%s\n", Client->ProcessId,
|
|
(unsigned long long)patch->PatchAddress, (unsigned long)patch->PatchSize,
|
|
patch->Tag[0] != '\0' ? patch->Tag : "<untagged>");
|
|
break;
|
|
}
|
|
default:
|
|
err = ERROR_INVALID_FUNCTION;
|
|
break;
|
|
}
|
|
|
|
Complete:
|
|
Response->Status = err;
|
|
if (Request->Command != BlackbirdIpcCommandGetEvent && Request->Command != BlackbirdIpcCommandGetEtwEvent &&
|
|
Request->Command != BlackbirdIpcCommandPublishHookEvent && Request->Command != BlackbirdIpcCommandGetStats &&
|
|
Request->Command != BlackbirdIpcCommandGetHealth && Request->Command != BlackbirdIpcCommandGetDiagnostics &&
|
|
Request->Command != BlackbirdIpcCommandGetQpcTimingState)
|
|
{
|
|
ControllerLog("[IPC] cmd=%s seq=%lu role=%lu clientPid=%lu session=%lu status=%lu\n",
|
|
ControllerCommandName(Request->Command), Request->Sequence, Client->Role, Client->ProcessId,
|
|
Client->SessionId, err);
|
|
}
|
|
else if (err != ERROR_SUCCESS && err != ERROR_NO_MORE_ITEMS)
|
|
{
|
|
ControllerLog("[IPC][WARN] cmd=%s seq=%lu role=%lu clientPid=%lu session=%lu status=%lu\n",
|
|
ControllerCommandName(Request->Command), Request->Sequence, Client->Role, Client->ProcessId,
|
|
Client->SessionId, err);
|
|
}
|
|
return err;
|
|
}
|
|
VOID ControllerDetachClient(_Inout_ BK_CONTROLLER_CLIENT *Client)
|
|
{
|
|
PBK_CONTROLLER_CLIENT *pp;
|
|
BK_CONTROLLER_ANALYSIS_TEARDOWN teardown;
|
|
|
|
if (Client == NULL)
|
|
{
|
|
return;
|
|
}
|
|
|
|
ZeroMemory(&teardown, sizeof(teardown));
|
|
|
|
EnterCriticalSection(g_ClientListLock.get());
|
|
pp = &g_ClientList;
|
|
while (*pp != NULL)
|
|
{
|
|
if (*pp == Client)
|
|
{
|
|
Client->Detached = 1;
|
|
*pp = Client->Next;
|
|
if (Client->SlotIndex != BK_CONTROLLER_INVALID_SLOT)
|
|
{
|
|
ControllerReleaseClientSlotLocked(Client->SlotIndex);
|
|
Client->SlotIndex = BK_CONTROLLER_INVALID_SLOT;
|
|
}
|
|
if (g_ClientCount > 0)
|
|
{
|
|
g_ClientCount -= 1;
|
|
}
|
|
ControllerLog("[IPC] active clients=%lu\n", g_ClientCount);
|
|
break;
|
|
}
|
|
pp = &(*pp)->Next;
|
|
}
|
|
ControllerRebuildPidIndexLocked(NULL);
|
|
LeaveCriticalSection(g_ClientListLock.get());
|
|
|
|
(void)ControllerRequestDriverSubscriptionApply(FALSE, 0);
|
|
|
|
EnterCriticalSection(&Client->Lock);
|
|
ControllerClientStopAnalysisLocked(Client, &teardown);
|
|
LeaveCriticalSection(&Client->Lock);
|
|
|
|
ControllerCompleteAnalysisTeardown(Client, &teardown, "client-disconnect");
|
|
if (teardown.HadState)
|
|
{
|
|
if (teardown.HadAnalysisLease || teardown.SubscriptionCount != 0)
|
|
{
|
|
(void)ControllerRequestDriverSubscriptionApply(FALSE, 0);
|
|
}
|
|
ControllerTerminateLaunchOwnedTeardown(&teardown, "client-disconnect");
|
|
}
|
|
}
|
|
DWORD WINAPI ControllerClientThreadProc(_In_ LPVOID Context)
|
|
{
|
|
BK_CONTROLLER_CLIENT *client = (BK_CONTROLLER_CLIENT *)Context;
|
|
BKIPC_PACKET *request = NULL;
|
|
BKIPC_PACKET *response = NULL;
|
|
DWORD disconnectErr = ERROR_SUCCESS;
|
|
|
|
if (client == NULL)
|
|
{
|
|
return 1;
|
|
}
|
|
|
|
request = (BKIPC_PACKET *)calloc(1, sizeof(*request));
|
|
response = (BKIPC_PACKET *)calloc(1, sizeof(*response));
|
|
if (request == NULL || response == NULL)
|
|
{
|
|
free(request);
|
|
free(response);
|
|
return ERROR_OUTOFMEMORY;
|
|
}
|
|
|
|
for (;;)
|
|
{
|
|
DWORD bytesRead = 0;
|
|
DWORD bytesWritten = 0;
|
|
BOOL ok;
|
|
|
|
if (ControllerShouldStop())
|
|
{
|
|
break;
|
|
}
|
|
|
|
ZeroMemory(request, sizeof(*request));
|
|
ok = ReadFile(client->Pipe, request, sizeof(*request), &bytesRead, NULL);
|
|
if (!ok || bytesRead != sizeof(*request))
|
|
{
|
|
disconnectErr = GetLastError();
|
|
break;
|
|
}
|
|
if (!ControllerValidatePacket(request, BlackbirdIpcPacketRequest))
|
|
{
|
|
disconnectErr = ERROR_BAD_FORMAT;
|
|
break;
|
|
}
|
|
|
|
{
|
|
DWORD commandErr;
|
|
ULONGLONG commandStartTick = GetTickCount64();
|
|
|
|
if (ControllerCommandLogsBegin(request->Command))
|
|
{
|
|
ControllerLog("[IPC] cmd-begin=%s seq=%lu role=%lu clientPid=%lu session=%lu\n",
|
|
ControllerCommandName(request->Command), request->Sequence, client->Role,
|
|
client->ProcessId, client->SessionId);
|
|
}
|
|
|
|
commandErr = ControllerHandleClientCommand(client, request, response);
|
|
if ((GetTickCount64() - commandStartTick) >= 1000)
|
|
{
|
|
ControllerLog("[IPC][WARN] cmd-slow=%s seq=%lu role=%lu clientPid=%lu session=%lu elapsedMs=%llu "
|
|
"status=%lu\n",
|
|
ControllerCommandName(request->Command), request->Sequence, client->Role,
|
|
client->ProcessId, client->SessionId,
|
|
(unsigned long long)(GetTickCount64() - commandStartTick), commandErr);
|
|
}
|
|
}
|
|
ok = WriteFile(client->Pipe, response, sizeof(*response), &bytesWritten, NULL);
|
|
if (!ok || bytesWritten != sizeof(*response))
|
|
{
|
|
disconnectErr = GetLastError();
|
|
break;
|
|
}
|
|
}
|
|
|
|
ControllerDetachClient(client);
|
|
if (client->Pipe != INVALID_HANDLE_VALUE)
|
|
{
|
|
(void)DisconnectNamedPipe(client->Pipe);
|
|
CloseHandle(client->Pipe);
|
|
client->Pipe = INVALID_HANDLE_VALUE;
|
|
}
|
|
if (client->DispatchIdleEvent != NULL)
|
|
{
|
|
DWORD dispatchWait = WaitForSingleObject(client->DispatchIdleEvent, 3000);
|
|
if (dispatchWait != WAIT_OBJECT_0)
|
|
{
|
|
LONG refs = InterlockedCompareExchange(&client->DispatchRefCount, 0, 0);
|
|
ControllerLog("[IPC][WARN] client quarantine pid=%lu session=%lu dispatchRefs=%ld wait=%lu; "
|
|
"detached object left alive to avoid dispatch use-after-free\n",
|
|
client->ProcessId, client->SessionId, refs, dispatchWait);
|
|
free(request);
|
|
free(response);
|
|
return 0;
|
|
}
|
|
}
|
|
free(request);
|
|
free(response);
|
|
EnterCriticalSection(&client->Lock);
|
|
ControllerLog("[IPC] client disconnected pid=%lu session=%lu subscriptions=%lu queueDepth=%lu dropped=%lu "
|
|
"etwQueueDepth=%lu etwDropped=%lu lastErr=%lu\n",
|
|
client->ProcessId, client->SessionId, client->SubscriptionCount, client->QueueDepth,
|
|
client->DroppedEvents, client->EtwQueueDepth, client->EtwDroppedEvents, disconnectErr);
|
|
client->SubscriptionCount = 0;
|
|
ControllerClientDestroySharedRingsLocked(client);
|
|
ControllerClientFreeQueueLocked(client);
|
|
ControllerClientFreeEtwQueueLocked(client);
|
|
LeaveCriticalSection(&client->Lock);
|
|
if (client->IoctlQueueDataEvent != NULL)
|
|
{
|
|
(void)CloseHandle(client->IoctlQueueDataEvent);
|
|
client->IoctlQueueDataEvent = NULL;
|
|
}
|
|
if (client->EtwQueueDataEvent != NULL)
|
|
{
|
|
(void)CloseHandle(client->EtwQueueDataEvent);
|
|
client->EtwQueueDataEvent = NULL;
|
|
}
|
|
if (client->DispatchIdleEvent != NULL)
|
|
{
|
|
(void)CloseHandle(client->DispatchIdleEvent);
|
|
client->DispatchIdleEvent = NULL;
|
|
}
|
|
DeleteCriticalSection(&client->Lock);
|
|
if (client->IoctlNodeSlab != NULL)
|
|
{
|
|
free(client->IoctlNodeSlab);
|
|
client->IoctlNodeSlab = NULL;
|
|
client->IoctlNodeFreeHead = NULL;
|
|
}
|
|
if (client->EtwNodeSlab != NULL)
|
|
{
|
|
free(client->EtwNodeSlab);
|
|
client->EtwNodeSlab = NULL;
|
|
client->EtwNodeFreeHead = NULL;
|
|
}
|
|
free(client);
|
|
return 0;
|
|
}
|
|
BOOL ControllerCreatePipeSecurity(_In_ DWORD ClientRole, _Out_ PSECURITY_ATTRIBUTES SecurityAttributes,
|
|
_Outptr_ PSECURITY_DESCRIPTOR *SecurityDescriptor)
|
|
{
|
|
BOOL ok;
|
|
PCWSTR sddl = NULL;
|
|
|
|
if (SecurityAttributes == NULL || SecurityDescriptor == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
*SecurityDescriptor = NULL;
|
|
ZeroMemory(SecurityAttributes, sizeof(*SecurityAttributes));
|
|
|
|
switch (ClientRole)
|
|
{
|
|
case BkctlrClientRoleHook:
|
|
sddl = L"D:P(A;;GA;;;SY)(A;;GRGW;;;IU)";
|
|
break;
|
|
case BkctlrClientRoleControl:
|
|
sddl = L"D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
|
|
break;
|
|
default:
|
|
sddl = L"D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
|
|
break;
|
|
}
|
|
|
|
ok = ConvertStringSecurityDescriptorToSecurityDescriptorW(sddl, SDDL_REVISION_1, SecurityDescriptor, NULL);
|
|
if (!ok || *SecurityDescriptor == NULL)
|
|
{
|
|
return FALSE;
|
|
}
|
|
|
|
SecurityAttributes->nLength = sizeof(*SecurityAttributes);
|
|
SecurityAttributes->lpSecurityDescriptor = *SecurityDescriptor;
|
|
SecurityAttributes->bInheritHandle = FALSE;
|
|
return TRUE;
|
|
}
|