admin/8damon-Blackbird-Platform
1
0
Fork 0
mirror of https://github.com/8damon/Blackbird-Platform synced 2026-06-21 13:41:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dev
8damon-Blackbird-Platform/UserMode/controller/core/runtime/runtime.cpp
T
dutchpsycho 14123cc20a controller/runtime: split service runtime and symbols
2026-05-06 09:11:08 +10:00

2171 lines
82 KiB
C++
Raw Permalink Blame History

#include "../controller_private.h"
#include "ns/ns_launcher.h"
struct ClientConstruct
{
BK_CONTROLLER_CLIENT *ptr = nullptr;
ClientConstruct() noexcept = default;
~ClientConstruct() noexcept
{
Free();
}
ClientConstruct(const ClientConstruct &) = delete;
ClientConstruct &operator=(const ClientConstruct &) = delete;
void Free() noexcept
{
if (!ptr)
{
return;
}
if (ptr->IoctlQueueDataEvent)
{
CloseHandle(ptr->IoctlQueueDataEvent);
}
if (ptr->EtwQueueDataEvent)
{
CloseHandle(ptr->EtwQueueDataEvent);
}
if (ptr->DispatchIdleEvent)
{
CloseHandle(ptr->DispatchIdleEvent);
}
DeleteCriticalSection(&ptr->Lock);
if (ptr->IoctlNodeSlab)
{
free(ptr->IoctlNodeSlab);
}
if (ptr->EtwNodeSlab)
{
free(ptr->EtwNodeSlab);
}
if (ptr->Pipe != NULL && ptr->Pipe != INVALID_HANDLE_VALUE)
{
CloseHandle(ptr->Pipe);
ptr->Pipe = INVALID_HANDLE_VALUE;
}
free(ptr);
ptr = nullptr;
}
BK_CONTROLLER_CLIENT *release() noexcept
{
auto *p = ptr;
ptr = nullptr;
return p;
}
};
struct ClientWorkItem
{
BK_CONTROLLER_CLIENT *Client;
PTP_WORK Work;
};
static VOID CALLBACK ControllerClientWorkCallback(_Inout_ PTP_CALLBACK_INSTANCE Instance, _Inout_opt_ PVOID Context,
_Inout_ PTP_WORK Work)
{
ClientWorkItem *item = static_cast<ClientWorkItem *>(Context);
UNREFERENCED_PARAMETER(Work);
CallbackMayRunLong(Instance);
if (item != nullptr)
{
(void)ControllerClientThreadProc(item->Client);
if (item->Work != nullptr)
{
CloseThreadpoolWork(item->Work);
}
free(item);
}
}
static HANDLE g_ServerAcceptThreads[BK_CONTROLLER_SERVER_ACCEPT_THREADS] = {0};
static HANDLE g_HookAcceptThreads[BK_CONTROLLER_HOOK_ACCEPT_THREADS] = {0};
typedef struct _BK_SERVER_ENDPOINT_CONTEXT
{
PCWSTR PipeName;
DWORD ClientRole;
} BK_SERVER_ENDPOINT_CONTEXT, *PBK_SERVER_ENDPOINT_CONTEXT;
static const BK_SERVER_ENDPOINT_CONTEXT g_ControlEndpointContext = {BKIPC_PIPE_NAME, BkctlrClientRoleControl};
static const BK_SERVER_ENDPOINT_CONTEXT g_HookEndpointContext = {BKIPC_HOOK_PIPE_NAME, BkctlrClientRoleHook};
static volatile LONG g_ControllerProtectionReady = 0;
static volatile LONG g_ControllerProtectionArmed = 0;
VOID ControllerTryMarkProtectedReady(_In_ HANDLE DriverHandle, _In_ BOOL LogFailure)
{
if (DriverHandle == NULL || DriverHandle == INVALID_HANDLE_VALUE)
{
return;
}
if (InterlockedCompareExchange(&g_ControllerProtectionReady, 0, 0) == 0 ||
InterlockedCompareExchange(&g_ControllerProtectionArmed, 0, 0) != 0)
{
return;
}
if (BkscMarkControllerReady(DriverHandle, GetCurrentProcessId()))
{
if (InterlockedExchange(&g_ControllerProtectionArmed, 1) == 0)
{
ControllerLog("[DRIVER] controller protection readiness acknowledged\n");
}
}
else if (LogFailure)
{
ControllerLog("[DRIVER][WARN] controller protection readiness failed (%lu)\n", GetLastError());
}
}
static BOOL ControllerDriverPumpReadErrorIsRecoverable(_In_ DWORD ErrorCode)
{
switch (ErrorCode)
{
case ERROR_OPERATION_ABORTED:
case ERROR_NOT_READY:
case ERROR_DEVICE_NOT_CONNECTED:
case ERROR_BROKEN_PIPE:
case ERROR_INVALID_HANDLE:
case ERROR_GEN_FAILURE:
case ERROR_SEM_TIMEOUT:
return TRUE;
default:
return FALSE;
}
}
static DWORD ControllerDriverPumpBackoffMs(_In_ DWORD Failures)
{
DWORD cappedFailures = (Failures < 20u) ? Failures : 20u;
DWORD scaled = 50 + cappedFailures * 25;
return (scaled < 750u) ? scaled : 750u;
}
static BOOL ControllerDropDriverHandleIfCurrent(_In_ HANDLE LocalHandle, _In_z_ PCSTR Reason, _In_ DWORD ErrorCode)
{
BOOL dropped = FALSE;
EnterCriticalSection(g_DriverLock.get());
if (g_DriverHandle == LocalHandle)
{
CloseHandle(g_DriverHandle);
g_DriverHandle = INVALID_HANDLE_VALUE;
InterlockedExchange(&g_ControllerProtectionArmed, 0);
dropped = TRUE;
}
LeaveCriticalSection(g_DriverLock.get());
if (dropped)
{
ControllerMarkDriverSubscriptionsDirty();
ControllerLog("[DRIVER][WARN] dropped driver handle reason=%s err=%lu; controller and NetSvc remain online\n",
Reason, ErrorCode);
}
return dropped;
}
static DWORD WINAPI ControllerServerThreadProc(_In_ LPVOID Context)
{
SECURITY_ATTRIBUTES sa;
PSECURITY_DESCRIPTOR sd = NULL;
DWORD pipeCreateFailures = 0;
const BK_SERVER_ENDPOINT_CONTEXT *endpoint = (const BK_SERVER_ENDPOINT_CONTEXT *)Context;
PCWSTR pipeName = BKIPC_PIPE_NAME;
DWORD clientRole = BkctlrClientRoleControl;
if (endpoint != NULL)
{
if (endpoint->PipeName != NULL && endpoint->PipeName[0] != L'\0')
{
pipeName = endpoint->PipeName;
}
if (endpoint->ClientRole != BkctlrClientRoleUnknown)
{
clientRole = endpoint->ClientRole;
}
}
UniqueLocalPtr<SECURITY_DESCRIPTOR> sdOwner;
if (!ControllerCreatePipeSecurity(clientRole, &sa, &sd))
{
ControllerLog("[-] BlackbirdController: failed to create pipe security role=%lu (%lu)\n", clientRole,
GetLastError());
return 1;
}
sdOwner.reset(static_cast<SECURITY_DESCRIPTOR *>(sd));
while (!ControllerShouldStop())
{
HANDLE pipe;
BOOL connected;
DWORD mode = PIPE_READMODE_MESSAGE;
ClientWorkItem *workItem;
DWORD slotIndex;
ClientConstruct guard;
pipe = CreateNamedPipeW(pipeName, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_WAIT,
PIPE_UNLIMITED_INSTANCES, sizeof(BKIPC_PACKET), sizeof(BKIPC_PACKET), 3000, &sa);
if (pipe == INVALID_HANDLE_VALUE)
{
pipeCreateFailures += 1;
if (pipeCreateFailures == 1 || (pipeCreateFailures % 50) == 0)
{
ControllerLog("[WARN] BlackbirdController: CreateNamedPipe failed (%lu), retries=%lu\n", GetLastError(),
pipeCreateFailures);
}
Sleep(250);
continue;
}
pipeCreateFailures = 0;
connected = ConnectNamedPipe(pipe, NULL) ? TRUE : (GetLastError() == ERROR_PIPE_CONNECTED);
if (!connected)
{
ControllerLog("[WARN] BlackbirdController: ConnectNamedPipe failed (%lu)\n", GetLastError());
CloseHandle(pipe);
continue;
}
(void)SetNamedPipeHandleState(pipe, &mode, NULL, NULL);
guard.ptr = (BK_CONTROLLER_CLIENT *)calloc(1, sizeof(*guard.ptr));
if (guard.ptr == NULL)
{
CloseHandle(pipe);
continue;
}
guard.ptr->Pipe = pipe;
guard.ptr->Role = clientRole;
guard.ptr->QueueHead = NULL;
guard.ptr->QueueTail = NULL;
guard.ptr->QueueDepth = 0;
guard.ptr->DroppedEvents = 0;
guard.ptr->SubscriptionCount = 0;
guard.ptr->SlotIndex = BK_CONTROLLER_INVALID_SLOT;
guard.ptr->DispatchRefCount = 0;
guard.ptr->Detached = 0;
InitializeCriticalSection(&guard.ptr->Lock);
guard.ptr->IoctlQueueDataEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
guard.ptr->EtwQueueDataEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
guard.ptr->DispatchIdleEvent = CreateEventW(NULL, TRUE, TRUE, NULL);
if (guard.ptr->IoctlQueueDataEvent == NULL || guard.ptr->EtwQueueDataEvent == NULL ||
guard.ptr->DispatchIdleEvent == NULL)
{
continue;
}
guard.ptr->IoctlNodeSlab =
(PBK_CONTROLLER_EVENT_NODE)calloc(BK_CONTROLLER_MAX_CLIENT_QUEUE_DEPTH, sizeof(BK_CONTROLLER_EVENT_NODE));
if (guard.ptr->IoctlNodeSlab != NULL)
{
for (DWORD i = 0; i < BK_CONTROLLER_MAX_CLIENT_QUEUE_DEPTH - 1; i++)
{
guard.ptr->IoctlNodeSlab[i].Next = &guard.ptr->IoctlNodeSlab[i + 1];
}
guard.ptr->IoctlNodeSlab[BK_CONTROLLER_MAX_CLIENT_QUEUE_DEPTH - 1].Next = NULL;
guard.ptr->IoctlNodeFreeHead = &guard.ptr->IoctlNodeSlab[0];
}
guard.ptr->EtwNodeSlab = (PBK_CONTROLLER_ETW_EVENT_NODE)calloc(BK_CONTROLLER_MAX_CLIENT_ETW_QUEUE_DEPTH,
sizeof(BK_CONTROLLER_ETW_EVENT_NODE));
if (guard.ptr->EtwNodeSlab != NULL)
{
for (DWORD i = 0; i < BK_CONTROLLER_MAX_CLIENT_ETW_QUEUE_DEPTH - 1; i++)
{
guard.ptr->EtwNodeSlab[i].Next = &guard.ptr->EtwNodeSlab[i + 1];
}
guard.ptr->EtwNodeSlab[BK_CONTROLLER_MAX_CLIENT_ETW_QUEUE_DEPTH - 1].Next = NULL;
guard.ptr->EtwNodeFreeHead = &guard.ptr->EtwNodeSlab[0];
}
if (!GetNamedPipeClientProcessId(pipe, &guard.ptr->ProcessId))
{
guard.ptr->ProcessId = 0;
}
if (!ProcessIdToSessionId(guard.ptr->ProcessId, &guard.ptr->SessionId))
{
guard.ptr->SessionId = 0;
}
ControllerLog("[IPC] client connected role=%lu pid=%lu session=%lu pipe=%ls\n", guard.ptr->Role,
guard.ptr->ProcessId, guard.ptr->SessionId, pipeName);
EnterCriticalSection(g_ClientListLock.get());
if (g_ClientCount >= BK_CONTROLLER_MAX_CLIENTS)
{
LeaveCriticalSection(g_ClientListLock.get());
continue;
}
slotIndex = ControllerAllocateClientSlotLocked();
if (slotIndex == BK_CONTROLLER_INVALID_SLOT)
{
LeaveCriticalSection(g_ClientListLock.get());
continue;
}
guard.ptr->SlotIndex = slotIndex;
g_ClientSlots[slotIndex] = guard.ptr;
guard.ptr->Next = g_ClientList;
g_ClientList = guard.ptr;
g_ClientCount += 1;
ControllerLog("[IPC] active clients=%lu\n", g_ClientCount);
LeaveCriticalSection(g_ClientListLock.get());
workItem = (ClientWorkItem *)calloc(1, sizeof(*workItem));
if (workItem == NULL)
{
ControllerLog("[WARN] BlackbirdController: failed to allocate client work item for pid=%lu\n",
guard.ptr->ProcessId);
ControllerDetachClient(guard.ptr);
continue;
}
workItem->Client = guard.ptr;
workItem->Work = CreateThreadpoolWork(ControllerClientWorkCallback, workItem, NULL);
if (workItem->Work == NULL)
{
ControllerLog("[WARN] BlackbirdController: failed to queue client work for pid=%lu (%lu)\n",
guard.ptr->ProcessId, GetLastError());
free(workItem);
ControllerDetachClient(guard.ptr);
continue;
}
(void)guard.release();
SubmitThreadpoolWork(workItem->Work);
}
return 0;
}
static DWORD WINAPI ControllerDriverPumpThreadProc(_In_ LPVOID Context)
{
UNREFERENCED_PARAMETER(Context);
DWORD driverOpenFailures = 0;
DWORD recoverableReadFailures = 0;
while (!ControllerShouldStop())
{
BK_EVENT_RECORD record;
DWORD bytes = 0;
BOOL ok;
HANDLE localHandle;
EnterCriticalSection(g_DriverLock.get());
if (g_DriverHandle == INVALID_HANDLE_VALUE)
{
g_DriverHandle = BkscOpenControlDevice();
localHandle = g_DriverHandle;
LeaveCriticalSection(g_DriverLock.get());
if (localHandle != INVALID_HANDLE_VALUE)
{
BK_STATS_RESPONSE stats;
DWORD statsBytes = 0;
ControllerTryMarkProtectedReady(localHandle, TRUE);
ControllerMarkDriverSubscriptionsDirty();
(void)ControllerApplyDriverSubscriptionsIfDirty();
ControllerRefreshNetSvcDriverHandle(localHandle, "driver-open");
driverOpenFailures = 0;
recoverableReadFailures = 0;
ZeroMemory(&stats, sizeof(stats));
if (BkscGetStats(localHandle, &stats, &statsBytes))
{
ControllerLog("[DRIVER] connected and verified. subscriptions=%lu queueDepth=%lu dropped=%lu\n",
stats.SubscriptionCount, stats.QueueDepth, stats.DroppedEvents);
}
else
{
ControllerLog("[DRIVER][WARN] connected, but stats query failed (%lu)\n", GetLastError());
}
}
else
{
driverOpenFailures += 1;
if (driverOpenFailures == 1 || (driverOpenFailures % 40) == 0)
{
ControllerLog("[DRIVER][WARN] open failed (%lu), retries=%lu\n", GetLastError(),
driverOpenFailures);
}
}
Sleep(250);
continue;
}
localHandle = g_DriverHandle;
LeaveCriticalSection(g_DriverLock.get());
(void)ControllerApplyDriverSubscriptionsIfDirty();
ok = BkscGetEvent(localHandle, &record, &bytes);
if (!ok)
{
DWORD err = GetLastError();
if (err == ERROR_NO_MORE_ITEMS)
{
recoverableReadFailures = 0;
Sleep(20);
continue;
}
if (ControllerShouldStop())
{
break;
}
if (ControllerDriverPumpReadErrorIsRecoverable(err))
{
recoverableReadFailures += 1;
if (recoverableReadFailures == 1 || (recoverableReadFailures % 20u) == 0)
{
ControllerLog(
"[DRIVER][WARN] event read failed (%lu), recoverableFailures=%lu; reopening driver path without stopping NetSvc\n",
err, recoverableReadFailures);
}
(void)ControllerDropDriverHandleIfCurrent(localHandle, "event-read-recoverable", err);
Sleep(ControllerDriverPumpBackoffMs(recoverableReadFailures));
continue;
}
ControllerLog(
"[DRIVER][WARN] event read failed (%lu); unrecoverable driver path failure, stopping controller and NetSvc\n",
err);
(void)ControllerDropDriverHandleIfCurrent(localHandle, "event-read-unrecoverable", err);
if (g_StopEvent != NULL)
{
(void)SetEvent(g_StopEvent);
}
break;
}
if (bytes >= sizeof(record))
{
recoverableReadFailures = 0;
ControllerDispatchDriverRecord(&record);
}
}
return 0;
}
#ifndef BK_INTENT_PROCESS_MEMORY
#define BK_INTENT_PROCESS_MEMORY 0x00000001u
#endif
#ifndef BK_INTENT_THREAD_CONTEXT
#define BK_INTENT_THREAD_CONTEXT 0x00000002u
#endif
#ifndef BK_INTENT_DUP_HANDLE
#define BK_INTENT_DUP_HANDLE 0x00000004u
#endif
static BOOL ControllerIsInterestingHandleAccessMask(_In_ ULONG DesiredAccess)
{
return ((DesiredAccess & PROCESS_VM_OPERATION) != 0) || ((DesiredAccess & PROCESS_VM_WRITE) != 0) ||
((DesiredAccess & PROCESS_CREATE_THREAD) != 0) ||
((DesiredAccess & PROCESS_ALL_ACCESS) == PROCESS_ALL_ACCESS) ||
((DesiredAccess & THREAD_SET_CONTEXT) != 0) || ((DesiredAccess & THREAD_SUSPEND_RESUME) != 0) ||
((DesiredAccess & THREAD_ALL_ACCESS) == THREAD_ALL_ACCESS);
}
#ifndef BK_SOCKET_OPCODE_SEND
#define BK_SOCKET_OPCODE_SEND 10u
#define BK_SOCKET_OPCODE_RECV 11u
#define BK_SOCKET_OPCODE_CONNECT 12u
#define BK_SOCKET_OPCODE_DISCONNECT 13u
#define BK_SOCKET_OPCODE_ACCEPT 15u
#define BK_SOCKET_OPCODE_RECONNECT 16u
#define BK_SOCKET_OPCODE_SENDUDP 42u
#define BK_SOCKET_OPCODE_RECVUDP 43u
#define BK_SOCKET_OPCODE_FAILUDP 49u
#endif
static BOOL ControllerIsInterestingSocketOpcode(_In_ UCHAR Opcode)
{
switch (Opcode)
{
case BK_SOCKET_OPCODE_SEND:
case BK_SOCKET_OPCODE_RECV:
case BK_SOCKET_OPCODE_CONNECT:
case BK_SOCKET_OPCODE_DISCONNECT:
case BK_SOCKET_OPCODE_ACCEPT:
case BK_SOCKET_OPCODE_RECONNECT:
case BK_SOCKET_OPCODE_SENDUDP:
case BK_SOCKET_OPCODE_RECVUDP:
case BK_SOCKET_OPCODE_FAILUDP:
return TRUE;
default:
return FALSE;
}
}
static PCSTR ControllerSocketOperationFromOpcode(_In_ UCHAR Opcode)
{
switch (Opcode)
{
case BK_SOCKET_OPCODE_SEND:
return "SEND";
case BK_SOCKET_OPCODE_RECV:
return "RECV";
case BK_SOCKET_OPCODE_CONNECT:
return "CONNECT";
case BK_SOCKET_OPCODE_DISCONNECT:
return "DISCONNECT";
case BK_SOCKET_OPCODE_ACCEPT:
return "ACCEPT";
case BK_SOCKET_OPCODE_RECONNECT:
return "RECONNECT";
case BK_SOCKET_OPCODE_SENDUDP:
return "SEND_UDP";
case BK_SOCKET_OPCODE_RECVUDP:
return "RECV_UDP";
case BK_SOCKET_OPCODE_FAILUDP:
return "FAIL_UDP";
default:
return "SOCKET";
}
}
static BOOL ControllerShouldForwardEtwRecord(_In_ PEVENT_RECORD Record, _In_opt_z_ PCWSTR EventName,
_In_ const BKIPC_ETW_EVENT *Event)
{
ULONG desiredAccess = 0;
ULONG correlationFlags = 0;
ULONG severity = 0;
ULONGLONG processId = 0;
ULONGLONG creatorPid = 0;
ULONGLONG targetPid = 0;
CHAR className[64];
CHAR detectionName[RTL_NUMBER_OF(Event->DetectionName)];
BOOL selfTarget = FALSE;
BOOL handleNoiseDetection = FALSE;
BOOL lowSignalDetection = FALSE;
BOOL strongDetection = FALSE;
if (Record == NULL || Event == NULL)
{
return FALSE;
}
if (EventName == NULL || EventName[0] == L'\0')
{
if (Event->Source == BlackbirdIpcEtwSourceKernelNetwork)
{
return ControllerIsInterestingSocketOpcode((UCHAR)Event->Opcode);
}
return FALSE;
}
if (wcscmp(EventName, L"DetectionTelemetry") == 0)
{
ZeroMemory(detectionName, sizeof(detectionName));
if (Event->DetectionName[0] != '\0')
{
(void)StringCchCopyA(detectionName, RTL_NUMBER_OF(detectionName), Event->DetectionName);
}
else
{
(void)ControllerEtwGetAnsiProperty(Record, L"detectionName", detectionName, RTL_NUMBER_OF(detectionName));
}
(void)_strupr_s(detectionName, sizeof(detectionName));
severity = Event->Severity;
targetPid = Event->TargetPid;
processId = (Event->ProcessId != 0) ? Event->ProcessId : Event->EventProcessId;
selfTarget = (processId != 0 && targetPid != 0 && processId == targetPid);
correlationFlags = Event->CorrelationFlags;
selfTarget = (processId != 0 && targetPid != 0 && processId == targetPid);
if (correlationFlags == 0)
{
(void)ControllerEtwGetU32Property(Record, L"correlationFlags", &correlationFlags);
}
BOOL directSyscallHandleDetection =
(strstr(detectionName, "DIRECT_SYSCALL") != NULL) || (strstr(detectionName, "DIRECT-SYSCALL") != NULL);
handleNoiseDetection = directSyscallHandleDetection ||
(strstr(detectionName, "STACK_INTEGRITY_ANOMALY_ON_HANDLE_OP") != NULL) ||
(strstr(detectionName, "SUSPECT_HANDLE_OPERATION") != NULL) ||
(strstr(detectionName, "ANOMALY_ON_HANDLE_OP") != NULL);
if (!handleNoiseDetection && ((strstr(detectionName, "USPECT_HANDLE_OPERATION") != NULL) ||
(strstr(detectionName, "NOMALY_ON_HANDLE_OP") != NULL)))
{
handleNoiseDetection = TRUE;
}
lowSignalDetection = (strstr(detectionName, "REMOTE_THREAD_WITH_RECENT_HANDLE_INTENT") != NULL) ||
(strstr(detectionName, "THREAD_ACTIVITY_WITH_THREAD_CONTEXT_INTENT") != NULL) ||
(strstr(detectionName, "REMOTE_THREAD_OUTSIDE_MAIN_IMAGE") != NULL);
strongDetection =
(strstr(detectionName, "PROCESS_HOLLOWING") != NULL) || (strstr(detectionName, "INJECTION") != NULL) ||
(strstr(detectionName, "THREAD_HIJACK") != NULL) || (strstr(detectionName, "REMOTE_APC") != NULL) ||
(strstr(detectionName, "NON_IMAGE_EXECUTABLE_REGION") != NULL) ||
(strstr(detectionName, "CREDENTIAL_ACCESS_LSASS_HANDLE") != NULL) ||
(strstr(detectionName, "REGISTRY_LSA_PACKAGE_WRITE") != NULL) ||
(strstr(detectionName, "AGGREGATE_THREAT_SIGNAL") != NULL) ||
(strstr(detectionName, "SHELLCODE_STAGE_PATTERN") != NULL) ||
(strstr(detectionName, "PROCESS_IMAGE_TAMPER") != NULL) ||
(strstr(detectionName, "PROCESS_IMAGE_GHOSTING") != NULL);
if (handleNoiseDetection)
{
if (directSyscallHandleDetection)
{
return (severity >= 5);
}
if (selfTarget)
{
return FALSE;
}
if (severity < 7)
{
return FALSE;
}
if ((correlationFlags & (BK_INTENT_PROCESS_MEMORY | BK_INTENT_THREAD_CONTEXT | BK_INTENT_DUP_HANDLE)) == 0)
{
return FALSE;
}
return TRUE;
}
if (lowSignalDetection)
{
return FALSE;
}
if (strongDetection)
{
return (severity >= 5);
}
return (severity >= 6);
}
if (Event->Source == BlackbirdIpcEtwSourceThreatIntel)
{
return (Event->Task == 1 || Event->Task == 2 || Event->Task == 7);
}
if (Event->Source == BlackbirdIpcEtwSourceKernelNetwork)
{
return ControllerIsInterestingSocketOpcode((UCHAR)Event->Opcode);
}
if (wcscmp(EventName, L"HandleTelemetry") == 0)
{
ZeroMemory(className, sizeof(className));
if (Event->ClassName[0] != '\0')
{
(void)StringCchCopyA(className, RTL_NUMBER_OF(className), Event->ClassName);
}
else
{
(void)ControllerEtwGetAnsiProperty(Record, L"class", className, RTL_NUMBER_OF(className));
}
desiredAccess = Event->DesiredAccess;
if (desiredAccess == 0)
{
(void)ControllerEtwGetU32Property(Record, L"desiredAccess", &desiredAccess);
}
if (_stricmp(className, "DIRECT-SYSCALL-SUSPECT") == 0 || _stricmp(className, "UNKNOWN-ORIGIN") == 0)
{
return TRUE;
}
return ControllerIsInterestingHandleAccessMask(desiredAccess);
}
if (wcscmp(EventName, L"ApcTelemetry") == 0)
{
desiredAccess = Event->DesiredAccess;
processId = Event->ProcessId;
targetPid = Event->TargetPid;
if (desiredAccess == 0)
{
(void)ControllerEtwGetU32Property(Record, L"desiredAccess", &desiredAccess);
}
if (processId == 0)
{
(void)ControllerEtwGetU64Property(Record, L"processId", &processId);
}
if (targetPid == 0)
{
(void)ControllerEtwGetU64Property(Record, L"targetPid", &targetPid);
}
if (targetPid == 0)
{
targetPid = Event->TargetPid;
}
if (processId == 0)
{
processId = Event->ProcessId;
}
if (processId != 0 && targetPid != 0 && processId == targetPid)
{
return FALSE;
}
return ((desiredAccess & (THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME)) != 0);
}
if (wcscmp(EventName, L"ThreadTelemetry") == 0)
{
correlationFlags = Event->CorrelationFlags;
targetPid = Event->TargetPid;
processId = Event->ProcessId;
creatorPid = Event->CreatorProcessId;
if (correlationFlags == 0)
{
(void)ControllerEtwGetU32Property(Record, L"correlationFlags", &correlationFlags);
}
if (targetPid == 0)
{
(void)ControllerEtwGetU64Property(Record, L"targetPid", &targetPid);
}
if (processId == 0)
{
(void)ControllerEtwGetU64Property(Record, L"processId", &processId);
}
if (creatorPid == 0)
{
(void)ControllerEtwGetU64Property(Record, L"creatorPid", &creatorPid);
}
if (creatorPid == 0)
{
creatorPid = Event->CreatorProcessId;
}
if (processId == 0)
{
processId = Event->ProcessId;
}
if (targetPid == 0)
{
targetPid = Event->TargetPid != 0 ? Event->TargetPid : processId;
}
if ((targetPid != 0 && creatorPid != 0 && targetPid == creatorPid) ||
(processId != 0 && creatorPid != 0 && processId == creatorPid))
{
return ((correlationFlags & BK_INTENT_PROCESS_MEMORY) != 0);
}
if ((correlationFlags & (BK_INTENT_PROCESS_MEMORY | BK_INTENT_THREAD_CONTEXT | BK_INTENT_DUP_HANDLE)) != 0)
{
return TRUE;
}
if (processId != 0 && creatorPid != 0 && processId != creatorPid)
{
return TRUE;
}
return FALSE;
}
if (wcscmp(EventName, L"ProcessTelemetry") == 0)
{
if ((Event->Flags & BKIPC_ETW_FLAG_PROCESS_IS_CREATE) != 0u)
{
return TRUE;
}
return FALSE;
}
if (wcscmp(EventName, L"ImageTelemetry") == 0)
{
return ((Event->Flags & BKIPC_ETW_FLAG_IMAGE_SYSTEM_MODE) == 0u);
}
if (wcscmp(EventName, L"RegistryTelemetry") == 0)
{
return FALSE;
}
if (wcscmp(EventName, L"NtApiTelemetry") == 0)
{
return TRUE;
}
if (wcscmp(EventName, L"SystemInformationTelemetry") == 0)
{
return TRUE;
}
if (wcscmp(EventName, L"QpcTimingTelemetry") == 0)
{
return TRUE;
}
return FALSE;
}
static VOID WINAPI ControllerEtwCallback(_In_ PEVENT_RECORD Record, _In_opt_z_ PCWSTR EventName, _In_opt_ PVOID Context)
{
static const PCWSTR stackPropertyNames[BKIPC_MAX_ETW_STACK_FRAMES] = {
L"stack0", L"stack1", L"stack2", L"stack3", L"stack4", L"stack5", L"stack6", L"stack7",
L"stack8", L"stack9", L"stack10", L"stack11", L"stack12", L"stack13", L"stack14", L"stack15"};
BKIPC_ETW_EVENT event;
ULONGLONG processId = 0;
ULONGLONG threadId = 0;
ULONGLONG callerPid = 0;
ULONGLONG targetPid = 0;
ULONGLONG callerTid = 0;
ULONGLONG parentProcessId = 0;
ULONGLONG creatorProcessId = 0;
ULONGLONG creatorThreadId = 0;
ULONGLONG processStartKey = 0;
ULONGLONG arg0 = 0;
ULONGLONG arg1 = 0;
ULONGLONG arg2 = 0;
ULONGLONG arg3 = 0;
ULONGLONG arg4 = 0;
ULONGLONG arg5 = 0;
ULONGLONG arg6 = 0;
ULONGLONG arg7 = 0;
ULONGLONG rawCounter = 0;
ULONGLONG virtualCounter = 0;
ULONGLONG rawDelta = 0;
ULONGLONG virtualDelta = 0;
ULONGLONG correctionTicks = 0;
ULONGLONG autoBiasTicks = 0;
ULONGLONG originAddress = 0;
ULONGLONG deepAllocationBase = 0;
ULONGLONG deepRegionSize = 0;
ULONGLONG startAddress = 0;
ULONGLONG imageBase = 0;
ULONGLONG imageSize = 0;
ULONG severity = 0;
ULONG correlationFlags = 0;
ULONG correlationAccessMask = 0;
ULONG correlationAgeMs = 0;
ULONG desiredAccess = 0;
ULONG originProtect = 0;
ULONG frameCount = 0;
ULONG deepRegionProtect = 0;
ULONG deepRegionState = 0;
ULONG deepRegionType = 0;
ULONG deepSampleSize = 0;
ULONG startRegionProtect = 0;
ULONG startRegionState = 0;
ULONG startRegionType = 0;
ULONG sessionId = 0;
ULONG notifyClass = 0;
ULONG dataType = 0;
ULONG dataSize = 0;
ULONG systemInformationClass = 0;
ULONG systemInformationLength = 0;
ULONG returnLength = 0;
ULONG execFlags = 0;
ULONG sourceFlags = 0;
LONG statusOpenProcess = 0;
LONG statusBasicInfo = 0;
LONG statusSectionName = 0;
LONG startRegionStatus = 0;
LONG createStatus = 0;
LONG callStatus = 0;
LONG queryStatus = 0;
BOOL boolValue = FALSE;
BOOL traitsComputed = FALSE;
UCHAR signatureLevel = 0;
UCHAR signatureType = 0;
CHAR apiName[96];
DWORD i;
UNREFERENCED_PARAMETER(Context);
if (Record == NULL)
{
return;
}
if (IsEqualGUID(Record->EventHeader.ProviderId, BKSC_PROVIDER_GUID_TI))
{
return;
}
ZeroMemory(&event, sizeof(event));
ZeroMemory(apiName, sizeof(apiName));
event.EventId = Record->EventHeader.EventDescriptor.Id;
event.Opcode = Record->EventHeader.EventDescriptor.Opcode;
event.Task = Record->EventHeader.EventDescriptor.Task;
event.EventProcessId = Record->EventHeader.ProcessId;
event.EventThreadId = Record->EventHeader.ThreadId;
if (EventName != NULL && EventName[0] != L'\0')
{
(void)StringCchCopyW(event.EventName, RTL_NUMBER_OF(event.EventName), EventName);
}
if (IsEqualGUID(Record->EventHeader.ProviderId, BKSC_PROVIDER_GUID_BLACKBIRD))
{
event.Source = BlackbirdIpcEtwSourceBlackbird;
}
else if (IsEqualGUID(Record->EventHeader.ProviderId, BKSC_PROVIDER_GUID_KERNEL_NETWORK))
{
event.Source = BlackbirdIpcEtwSourceKernelNetwork;
event.Family = BlackbirdIpcEtwFamilySocket;
}
else
{
return;
}
(void)ControllerEtwGetU32Property(Record, L"severity", &severity);
event.Severity = severity;
(void)ControllerEtwGetU32Property(Record, L"correlationFlags", &correlationFlags);
(void)ControllerEtwGetU32Property(Record, L"correlationAccessMask", &correlationAccessMask);
(void)ControllerEtwGetU32Property(Record, L"correlationAgeMs", &correlationAgeMs);
event.CorrelationFlags = (UINT32)correlationFlags;
event.CorrelationAccessMask = (UINT32)correlationAccessMask;
event.CorrelationAgeMs = (UINT32)correlationAgeMs;
(void)ControllerEtwGetU64Property(Record, L"processId", &processId);
if (processId == 0 && event.Source == BlackbirdIpcEtwSourceKernelNetwork)
{
(void)ControllerEtwGetU64Property(Record, L"PID", &processId);
if (processId == 0)
{
(void)ControllerEtwGetU64Property(Record, L"ProcessId", &processId);
}
}
(void)ControllerEtwGetU64Property(Record, L"threadId", &threadId);
(void)ControllerEtwGetU64Property(Record, L"callerPid", &callerPid);
(void)ControllerEtwGetU64Property(Record, L"callerTid", &callerTid);
(void)ControllerEtwGetU64Property(Record, L"targetPid", &targetPid);
(void)ControllerEtwGetU64Property(Record, L"parentProcessId", &parentProcessId);
(void)ControllerEtwGetU64Property(Record, L"creatorProcessId", &creatorProcessId);
if (creatorProcessId == 0)
{
(void)ControllerEtwGetU64Property(Record, L"creatorPid", &creatorProcessId);
}
(void)ControllerEtwGetU64Property(Record, L"creatorThreadId", &creatorThreadId);
(void)ControllerEtwGetU64Property(Record, L"processStartKey", &processStartKey);
if (processId == 0 && callerPid != 0)
{
processId = callerPid;
}
if (processId == 0)
{
processId = Record->EventHeader.ProcessId;
}
event.ProcessId = processId;
event.ThreadId = threadId;
event.CallerPid = callerPid;
event.TargetPid = targetPid;
event.ParentProcessId = parentProcessId;
event.CreatorProcessId = creatorProcessId;
event.CreatorThreadId = creatorThreadId;
event.ProcessStartKey = processStartKey;
if (event.Source == BlackbirdIpcEtwSourceKernelNetwork)
{
int converted = 0;
ULONG daddrNbo = 0;
ULONG saddrNbo = 0;
ULONG dport = 0;
ULONG sport = 0;
ULONG pktSize = 0;
CHAR ipDst[48] = {'\0'};
CHAR ipSrc[48] = {'\0'};
event.Family = BlackbirdIpcEtwFamilySocket;
(void)StringCchCopyA(event.Operation, RTL_NUMBER_OF(event.Operation),
ControllerSocketOperationFromOpcode((UCHAR)event.Opcode));
if (event.EventName[0] == L'\0' && event.Operation[0] != '\0')
{
converted = MultiByteToWideChar(CP_ACP, 0, event.Operation, -1, event.EventName,
(int)RTL_NUMBER_OF(event.EventName));
if (converted <= 0)
{
event.EventName[0] = L'\0';
}
}
if (event.Severity == 0)
{
event.Severity = ControllerIsInterestingSocketOpcode((UCHAR)event.Opcode) ? 2u : 1u;
}
(void)ControllerEtwGetU32Property(Record, L"daddr", &daddrNbo);
(void)ControllerEtwGetU32Property(Record, L"saddr", &saddrNbo);
(void)ControllerEtwGetU32Property(Record, L"dport", &dport);
(void)ControllerEtwGetU32Property(Record, L"sport", &sport);
(void)ControllerEtwGetU32Property(Record, L"size", &pktSize);
if (daddrNbo != 0)
{
UINT8 *a = (UINT8 *)&daddrNbo;
(void)StringCchPrintfA(ipDst, sizeof(ipDst), "%u.%u.%u.%u", (unsigned)a[0], (unsigned)a[1], (unsigned)a[2],
(unsigned)a[3]);
}
if (saddrNbo != 0)
{
UINT8 *a = (UINT8 *)&saddrNbo;
(void)StringCchPrintfA(ipSrc, sizeof(ipSrc), "%u.%u.%u.%u", (unsigned)a[0], (unsigned)a[1], (unsigned)a[2],
(unsigned)a[3]);
}
if (ipDst[0] != '\0' && ipSrc[0] != '\0')
{
(void)StringCchPrintfW(event.Reason, RTL_NUMBER_OF(event.Reason),
L"kernel.net op=%S src=%S:%lu dst=%S:%lu bytes=%lu", event.Operation, ipSrc,
(unsigned long)sport, ipDst, (unsigned long)dport, (unsigned long)pktSize);
}
else if (ipDst[0] != '\0')
{
(void)StringCchPrintfW(event.Reason, RTL_NUMBER_OF(event.Reason), L"kernel.net op=%S dst=%S:%lu bytes=%lu",
event.Operation, ipDst, (unsigned long)dport, (unsigned long)pktSize);
}
else
{
(void)StringCchPrintfW(event.Reason, RTL_NUMBER_OF(event.Reason), L"kernel.net op=%S bytes=%lu",
event.Operation, (unsigned long)pktSize);
}
if (ipDst[0] != '\0')
{
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "KERNEL_NETWORK_CONNECT");
}
else
{
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "KERNEL_NETWORK_IO");
}
}
else if (EventName != NULL && wcscmp(EventName, L"HandleTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyHandle;
(void)ControllerEtwGetAnsiProperty(Record, L"class", event.ClassName, RTL_NUMBER_OF(event.ClassName));
(void)ControllerEtwGetU32Property(Record, L"desiredAccess", &desiredAccess);
(void)ControllerEtwGetU64Property(Record, L"originAddress", &originAddress);
(void)ControllerEtwGetU32Property(Record, L"originProtect", &originProtect);
(void)ControllerEtwGetWideProperty(Record, L"originPath", event.OriginPath, RTL_NUMBER_OF(event.OriginPath));
(void)ControllerEtwGetI32Property(Record, L"statusOpenProcess", &statusOpenProcess);
(void)ControllerEtwGetI32Property(Record, L"statusBasicInfo", &statusBasicInfo);
(void)ControllerEtwGetI32Property(Record, L"statusSectionName", &statusSectionName);
(void)ControllerEtwGetU64Property(Record, L"deepAllocationBase", &deepAllocationBase);
(void)ControllerEtwGetU64Property(Record, L"deepRegionSize", &deepRegionSize);
(void)ControllerEtwGetU32Property(Record, L"deepRegionProtect", &deepRegionProtect);
(void)ControllerEtwGetU32Property(Record, L"deepRegionState", &deepRegionState);
(void)ControllerEtwGetU32Property(Record, L"deepRegionType", &deepRegionType);
(void)ControllerEtwGetU32Property(Record, L"deepSampleSize", &deepSampleSize);
(void)ControllerEtwCopyBinaryProperty(Record, L"deepSample", event.DeepSample, RTL_NUMBER_OF(event.DeepSample),
&event.DeepSampleSize);
if (event.DeepSampleSize == 0 && deepSampleSize != 0)
{
event.DeepSampleSize =
(deepSampleSize > RTL_NUMBER_OF(event.DeepSample)) ? RTL_NUMBER_OF(event.DeepSample) : deepSampleSize;
}
(void)ControllerEtwGetU32Property(Record, L"frameCount", &frameCount);
event.StackCount = (frameCount > BKIPC_MAX_ETW_STACK_FRAMES) ? BKIPC_MAX_ETW_STACK_FRAMES : frameCount;
for (i = 0; i < RTL_NUMBER_OF(stackPropertyNames); ++i)
{
(void)ControllerEtwGetU64Property(Record, stackPropertyNames[i], &event.Stack[i]);
}
if (ControllerEtwGetBoolProperty(Record, L"execProtect", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_HANDLE_EXEC_PROTECT;
}
if (ControllerEtwGetBoolProperty(Record, L"fromNtdll", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_HANDLE_FROM_NTDLL;
}
if (ControllerEtwGetBoolProperty(Record, L"fromExe", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_HANDLE_FROM_EXE;
}
{
ULONG handleFlags = 0;
if (ControllerEtwGetU32Property(Record, L"handleFlags", &handleFlags))
{
event.Flags |=
handleFlags & (BKIPC_ETW_FLAG_SYSCALL_EXPORT_MATCH | BKIPC_ETW_FLAG_SYSCALL_EXPORT_MISMATCH |
BKIPC_ETW_FLAG_MODULE_CHAIN_SANE | BKIPC_ETW_FLAG_UNWIND_METADATA_VALID |
BKIPC_ETW_FLAG_TEB_STACK_BOUNDS_VALID | BKIPC_ETW_FLAG_FRAMES_OUTSIDE_TEB_STACK);
}
}
event.DesiredAccess = desiredAccess;
event.OriginAddress = originAddress;
event.OriginProtect = originProtect;
event.StatusOpenProcess = statusOpenProcess;
event.StatusBasicInfo = statusBasicInfo;
event.StatusSectionName = statusSectionName;
event.DeepAllocationBase = deepAllocationBase;
event.DeepRegionSize = deepRegionSize;
event.DeepRegionProtect = deepRegionProtect;
event.DeepRegionState = deepRegionState;
event.DeepRegionType = deepRegionType;
}
else if (EventName != NULL && wcscmp(EventName, L"ThreadTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyThread;
(void)ControllerEtwGetU64Property(Record, L"startAddress", &startAddress);
(void)ControllerEtwGetU64Property(Record, L"imageBase", &imageBase);
(void)ControllerEtwGetU64Property(Record, L"imageSize", &imageSize);
(void)ControllerEtwGetU32Property(Record, L"startRegionProtect", &startRegionProtect);
(void)ControllerEtwGetU32Property(Record, L"startRegionState", &startRegionState);
(void)ControllerEtwGetU32Property(Record, L"startRegionType", &startRegionType);
(void)ControllerEtwGetI32Property(Record, L"startRegionStatus", &startRegionStatus);
(void)ControllerEtwGetU32Property(Record, L"workerFrameCount", &frameCount);
event.StackCount = (frameCount > BKIPC_MAX_ETW_STACK_FRAMES) ? BKIPC_MAX_ETW_STACK_FRAMES : frameCount;
for (i = 0; i < RTL_NUMBER_OF(stackPropertyNames); ++i)
{
(void)ControllerEtwGetU64Property(Record, stackPropertyNames[i], &event.Stack[i]);
}
if (ControllerEtwGetBoolProperty(Record, L"gotStart", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_THREAD_GOT_START;
}
if (ControllerEtwGetBoolProperty(Record, L"gotRange", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_THREAD_GOT_RANGE;
}
if (ControllerEtwGetBoolProperty(Record, L"isRemoteCreator", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_THREAD_REMOTE_CREATOR;
}
if (ControllerEtwGetBoolProperty(Record, L"outsideMainImage", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_THREAD_OUTSIDE_MAIN_IMAGE;
}
event.StartAddress = startAddress;
event.ImageBase = imageBase;
event.ImageSize = imageSize;
event.StartRegionProtect = startRegionProtect;
event.StartRegionState = startRegionState;
event.StartRegionType = startRegionType;
event.StartRegionStatus = startRegionStatus;
}
else if (EventName != NULL && wcscmp(EventName, L"ProcessTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyProcess;
(void)ControllerEtwGetU32Property(Record, L"sessionId", &sessionId);
(void)ControllerEtwGetI32Property(Record, L"createStatus", &createStatus);
(void)ControllerEtwGetWideProperty(Record, L"imagePath", event.ImagePath, RTL_NUMBER_OF(event.ImagePath));
(void)ControllerEtwGetWideProperty(Record, L"commandLine", event.CommandLine, RTL_NUMBER_OF(event.CommandLine));
if (ControllerEtwGetBoolProperty(Record, L"isCreate", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_PROCESS_IS_CREATE;
}
event.SessionId = sessionId;
event.CreateStatus = createStatus;
}
else if (EventName != NULL && wcscmp(EventName, L"ImageTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyImage;
(void)ControllerEtwGetU64Property(Record, L"imageBase", &imageBase);
(void)ControllerEtwGetU64Property(Record, L"imageSize", &imageSize);
(void)ControllerEtwGetWideProperty(Record, L"imagePath", event.ImagePath, RTL_NUMBER_OF(event.ImagePath));
if (ControllerEtwGetBoolProperty(Record, L"isSystemModeImage", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_IMAGE_SYSTEM_MODE;
}
if (ControllerEtwGetBoolProperty(Record, L"isSignatureLevelKnown", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_IMAGE_SIGNATURE_KNOWN;
}
(void)ControllerEtwGetU8Property(Record, L"signatureLevel", &signatureLevel);
(void)ControllerEtwGetU8Property(Record, L"signatureType", &signatureType);
event.ImageBase = imageBase;
event.ImageSize = imageSize;
event.SignatureLevel = signatureLevel;
event.SignatureType = signatureType;
}
else if (EventName != NULL && wcscmp(EventName, L"RegistryTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyRegistry;
(void)ControllerEtwGetAnsiProperty(Record, L"operation", event.Operation, RTL_NUMBER_OF(event.Operation));
(void)ControllerEtwGetU32Property(Record, L"sessionId", &sessionId);
(void)ControllerEtwGetU32Property(Record, L"notifyClass", &notifyClass);
(void)ControllerEtwGetU32Property(Record, L"dataType", &dataType);
(void)ControllerEtwGetU32Property(Record, L"dataSize", &dataSize);
(void)ControllerEtwGetWideProperty(Record, L"keyPath", event.KeyPath, RTL_NUMBER_OF(event.KeyPath));
(void)ControllerEtwGetWideProperty(Record, L"valueName", event.ValueName, RTL_NUMBER_OF(event.ValueName));
if (ControllerEtwGetBoolProperty(Record, L"isHighValuePath", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_REGISTRY_HIGH_VALUE;
}
event.SessionId = sessionId;
event.NotifyClass = notifyClass;
event.DataType = dataType;
event.DataSize = dataSize;
}
else if (EventName != NULL && wcscmp(EventName, L"ApcTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyApc;
(void)ControllerEtwGetAnsiProperty(Record, L"class", event.ClassName, RTL_NUMBER_OF(event.ClassName));
(void)ControllerEtwGetU32Property(Record, L"desiredAccess", &desiredAccess);
if (ControllerEtwGetBoolProperty(Record, L"isDuplicateOperation", &boolValue) && boolValue)
{
event.Flags |= BKIPC_ETW_FLAG_APC_DUPLICATE_OPERATION;
}
event.DesiredAccess = desiredAccess;
}
else if (EventName != NULL && wcscmp(EventName, L"DetectionTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyDetection;
(void)InterlockedIncrement(&g_EtwDetectionEvents);
(void)ControllerEtwGetAnsiProperty(Record, L"detectionName", event.DetectionName,
RTL_NUMBER_OF(event.DetectionName));
if (event.DetectionName[0] == '\0')
{
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "UNKNOWN");
}
(void)ControllerEtwGetWideProperty(Record, L"reason", event.Reason, RTL_NUMBER_OF(event.Reason));
}
else if (EventName != NULL && wcscmp(EventName, L"QpcTimingTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyUserHook;
event.Severity = 2u;
if (callerPid != 0)
{
event.ProcessId = callerPid;
event.CallerPid = callerPid;
}
if (callerTid != 0)
{
event.ThreadId = callerTid;
}
(void)StringCchCopyA(event.Operation, RTL_NUMBER_OF(event.Operation), "NtQueryPerformanceCounter");
(void)StringCchCopyW(event.EventName, RTL_NUMBER_OF(event.EventName), L"NtQueryPerformanceCounter");
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "ANTIVM_TIMING_QPC_COMPENSATION");
(void)ControllerEtwGetU64Property(Record, L"rawCounter", &rawCounter);
(void)ControllerEtwGetU64Property(Record, L"virtualCounter", &virtualCounter);
(void)ControllerEtwGetU64Property(Record, L"rawDelta", &rawDelta);
(void)ControllerEtwGetU64Property(Record, L"virtualDelta", &virtualDelta);
(void)ControllerEtwGetU64Property(Record, L"correctionTicks", &correctionTicks);
(void)ControllerEtwGetU32Property(Record, L"sourceFlags", &sourceFlags);
(void)ControllerEtwGetU64Property(Record, L"autoBiasTicks", &autoBiasTicks);
(void)ControllerEtwGetI32Property(Record, L"queryStatus", &queryStatus);
if (queryStatus != 0)
{
return;
}
event.HookArgCount = 7u;
event.HookArgs[0] = rawCounter;
event.HookArgs[1] = virtualCounter;
event.HookArgs[2] = rawDelta;
event.HookArgs[3] = virtualDelta;
event.HookArgs[4] = correctionTicks;
event.HookArgs[5] = sourceFlags;
event.HookArgs[6] = autoBiasTicks;
if ((sourceFlags & BK_QPC_TIMING_SOURCE_SUSPEND_PAUSE) != 0)
{
event.Severity = 3u;
}
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"anti-virtualization.qpc raw=0x%llX virtual=0x%llX rawDelta=0x%llX virtualDelta=0x%llX correction=%lld sourceFlags=0x%X autoBias=%lld status=0x%08X",
(unsigned long long)rawCounter, (unsigned long long)virtualCounter, (unsigned long long)rawDelta,
(unsigned long long)virtualDelta, (long long)correctionTicks, (unsigned int)sourceFlags,
(long long)autoBiasTicks, (unsigned int)queryStatus);
}
else if (EventName != NULL && wcscmp(EventName, L"NtApiTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyUserHook;
(void)ControllerEtwGetAnsiProperty(Record, L"api", apiName, RTL_NUMBER_OF(apiName));
if (apiName[0] == '\0')
{
(void)StringCchCopyA(apiName, RTL_NUMBER_OF(apiName), "UNKNOWN_NTAPI");
}
(void)StringCchCopyA(event.Operation, RTL_NUMBER_OF(event.Operation), apiName);
(void)MultiByteToWideChar(CP_ACP, 0, apiName, -1, event.EventName, (int)RTL_NUMBER_OF(event.EventName));
(void)ControllerEtwGetU64Property(Record, L"arg0", &arg0);
(void)ControllerEtwGetU64Property(Record, L"arg1", &arg1);
(void)ControllerEtwGetU64Property(Record, L"arg2", &arg2);
(void)ControllerEtwGetU64Property(Record, L"arg3", &arg3);
(void)ControllerEtwGetU64Property(Record, L"arg4", &arg4);
(void)ControllerEtwGetU64Property(Record, L"arg5", &arg5);
(void)ControllerEtwGetU64Property(Record, L"arg6", &arg6);
(void)ControllerEtwGetU64Property(Record, L"arg7", &arg7);
(void)ControllerEtwGetU32Property(Record, L"execFlags", &execFlags);
(void)ControllerEtwGetI32Property(Record, L"status", &callStatus);
if (callStatus != 0)
{
return;
}
event.HookArgCount = BKIPC_MAX_HOOK_ARGS;
event.HookArgs[0] = arg0;
event.HookArgs[1] = arg1;
event.HookArgs[2] = arg2;
event.HookArgs[3] = arg3;
event.HookArgs[4] = arg4;
event.HookArgs[5] = arg5;
event.HookArgs[6] = arg6;
event.HookArgs[7] = arg7;
if (callerPid != 0)
{
event.ProcessId = callerPid;
event.CallerPid = callerPid;
}
if (callerTid != 0)
{
event.ThreadId = callerTid;
}
if ((execFlags & BK_NTAPI_EXEC_FLAG_CALLER_KERNEL) != 0)
{
event.Flags |= BKIPC_ETW_FLAG_HOOK_KERNEL_CALLER;
}
if ((execFlags & BK_NTAPI_EXEC_FLAG_CALLER_USER) != 0)
{
event.Flags |= BKIPC_ETW_FLAG_HOOK_USER_CALLER;
}
if ((execFlags & BK_NTAPI_EXEC_FLAG_TARGET_CURRENT_PROCESS) != 0)
{
event.Flags |= BKIPC_ETW_FLAG_HOOK_TARGET_CURRENT_PROCESS;
}
if ((execFlags & BK_NTAPI_EXEC_FLAG_SECTION_IMAGE) != 0)
{
event.Flags |= BKIPC_ETW_FLAG_HOOK_SECTION_IMAGE;
}
if ((lstrcmpiA(apiName, "NtAllocateVirtualMemory") == 0 || lstrcmpiA(apiName, "NtWriteVirtualMemory") == 0 ||
lstrcmpiA(apiName, "NtProtectVirtualMemory") == 0 || lstrcmpiA(apiName, "NtMapViewOfSection") == 0 ||
lstrcmpiA(apiName, "NtMapViewOfSectionEx") == 0) &&
arg6 != 0 && arg6 <= 0xFFFFFFFFull && (UINT32)arg6 != callerPid)
{
event.TargetPid = (UINT32)arg6;
}
else if ((lstrcmpiA(apiName, "NtUnmapViewOfSection") == 0 ||
lstrcmpiA(apiName, "NtUnmapViewOfSectionEx") == 0 || lstrcmpiA(apiName, "NtCreateThread") == 0 ||
lstrcmpiA(apiName, "NtCreateThreadEx") == 0) &&
arg2 != 0 && arg2 <= 0xFFFFFFFFull && (UINT32)arg2 != callerPid)
{
event.TargetPid = (UINT32)arg2;
}
else if (lstrcmpiA(apiName, "NtQueueApcThread") == 0 && arg6 != 0 && arg6 <= 0xFFFFFFFFull &&
(UINT32)arg6 != callerPid)
{
event.TargetPid = (UINT32)arg6;
}
else if ((lstrcmpiA(apiName, "NtQueueApcThreadEx") == 0 || lstrcmpiA(apiName, "NtQueueApcThreadEx2") == 0) &&
arg7 != 0 && arg7 <= 0xFFFFFFFFull && (UINT32)arg7 != callerPid)
{
event.TargetPid = (UINT32)arg7;
}
PCWSTR callerModeText = (event.Flags & BKIPC_ETW_FLAG_HOOK_KERNEL_CALLER) != 0 ? L"kernel" : L"user";
PCWSTR targetText = (event.Flags & BKIPC_ETW_FLAG_HOOK_TARGET_CURRENT_PROCESS) != 0 ? L"current" : L"external";
PCWSTR sectionText = (event.Flags & BKIPC_ETW_FLAG_HOOK_SECTION_IMAGE) != 0 ? L"image" : L"private";
if (lstrcmpiA(apiName, "NtAllocateVirtualMemory") == 0)
{
event.Severity = 2u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "USERMODE_MEMORY_ACTIVITY");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws target=%ws memory.alloc base=0x%llX size=0x%llX allocType=0x%llX protect=0x%llX targetPid=%llu status=0x%08X",
callerModeText, targetText, (unsigned long long)arg1, (unsigned long long)arg2,
(unsigned long long)arg4, (unsigned long long)arg5, (unsigned long long)arg6, (unsigned int)callStatus);
}
else if (lstrcmpiA(apiName, "NtProtectVirtualMemory") == 0)
{
const BOOL sr71ProtectBlocked = (arg5 != 0 && callStatus == (NTSTATUS)0xC0000022L);
event.Severity = sr71ProtectBlocked ? 8u : 3u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName),
sr71ProtectBlocked ? "SR71_HOOK_PROTECT_BLOCKED" : "USERMODE_MEMORY_ACTIVITY");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws target=%ws memory.protect base=0x%llX size=0x%llX newProtect=0x%llX oldProtect=0x%llX blockedSr71=%llu targetPid=%llu status=0x%08X",
callerModeText, targetText, (unsigned long long)arg1, (unsigned long long)arg2,
(unsigned long long)arg3, (unsigned long long)arg4, (unsigned long long)arg5, (unsigned long long)arg6,
(unsigned int)callStatus);
}
else if (lstrcmpiA(apiName, "NtWriteVirtualMemory") == 0)
{
const BOOL sr71WriteBlocked = (arg5 != 0 && callStatus == (NTSTATUS)0xC0000022L);
event.Severity = sr71WriteBlocked ? 8u : 3u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName),
sr71WriteBlocked ? "SR71_HOOK_WRITE_BLOCKED" : "USERMODE_MEMORY_ACTIVITY");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws target=%ws memory.write base=0x%llX size=0x%llX bytesWritten=0x%llX blockedSr71=%llu targetPid=%llu status=0x%08X",
callerModeText, targetText, (unsigned long long)arg1, (unsigned long long)arg3,
(unsigned long long)arg4, (unsigned long long)arg5, (unsigned long long)arg6, (unsigned int)callStatus);
}
else if (lstrcmpiA(apiName, "NtUnmapViewOfSection") == 0 || lstrcmpiA(apiName, "NtUnmapViewOfSectionEx") == 0)
{
const BOOL remoteUnmap = event.TargetPid != 0 && event.TargetPid != event.ProcessId;
event.Severity = remoteUnmap ? 6u : 3u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName),
"USERMODE_SECTION_UNMAP_ACTIVITY");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws section.unmap api=%S processHandle=0x%llX base=0x%llX targetPid=%llu flags=0x%llX status=0x%08X",
callerModeText, apiName, (unsigned long long)arg0, (unsigned long long)arg1, (unsigned long long)arg2,
(unsigned long long)arg3, (unsigned int)callStatus);
}
else if (lstrcmpiA(apiName, "NtCreateThread") == 0 || lstrcmpiA(apiName, "NtCreateThreadEx") == 0)
{
const BOOL oldCreateThread = lstrcmpiA(apiName, "NtCreateThread") == 0;
const BOOL remoteThread = event.TargetPid != 0 && event.TargetPid != event.ProcessId;
const ULONGLONG startRoutine = oldCreateThread ? 0ull : arg3;
const ULONGLONG argument = oldCreateThread ? 0ull : arg4;
const ULONGLONG targetTid = oldCreateThread ? arg3 : arg6;
const ULONGLONG createFlags = oldCreateThread ? 0ull : arg5;
const BOOL createSuspended = oldCreateThread ? (arg4 != 0) : ((arg5 & 0x1ull) != 0);
const BOOL hideFromDebugger = !oldCreateThread && ((arg5 & 0x4ull) != 0);
event.Severity = remoteThread ? 6u : 2u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName),
"USERMODE_THREAD_CREATE_ACTIVITY");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws thread.create api=%S processHandle=0x%llX threadHandle=0x%llX targetPid=%llu targetTid=%llu startRoutine=0x%llX argument=0x%llX createFlags=0x%llX createSuspended=%u hideFromDebugger=%u status=0x%08X",
callerModeText, apiName, (unsigned long long)arg0, (unsigned long long)arg1, (unsigned long long)arg2,
(unsigned long long)targetTid, (unsigned long long)startRoutine, (unsigned long long)argument,
(unsigned long long)createFlags, (unsigned int)createSuspended, (unsigned int)hideFromDebugger,
(unsigned int)callStatus);
}
else if (lstrcmpiA(apiName, "NtQueueApcThread") == 0 || lstrcmpiA(apiName, "NtQueueApcThreadEx") == 0 ||
lstrcmpiA(apiName, "NtQueueApcThreadEx2") == 0)
{
const BOOL ex2 = lstrcmpiA(apiName, "NtQueueApcThreadEx2") == 0;
const BOOL ex = lstrcmpiA(apiName, "NtQueueApcThreadEx") == 0;
const ULONGLONG routine = ex2 ? arg3 : (ex ? arg2 : arg1);
const ULONGLONG targetPidForReason = (ex || ex2) ? arg7 : arg6;
event.Severity = (event.TargetPid != 0 && event.TargetPid != event.ProcessId) ? 6u : 2u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName),
"USERMODE_APC_QUEUE_ACTIVITY");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws thread.apc api=%S threadHandle=0x%llX routine=0x%llX targetPid=%llu status=0x%08X",
callerModeText, apiName, (unsigned long long)arg0, (unsigned long long)routine,
(unsigned long long)targetPidForReason, (unsigned int)callStatus);
}
else if (lstrcmpiA(apiName, "NtMapViewOfSection") == 0 || lstrcmpiA(apiName, "NtMapViewOfSectionEx") == 0)
{
const BOOL remoteMap = event.TargetPid != 0 && event.TargetPid != event.ProcessId;
event.Severity = remoteMap ? 3u : 1u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName),
"USERMODE_SECTION_MAP_ACTIVITY");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws section.map api=%S sectionHandle=0x%llX processHandle=0x%llX base=0x%llX size=0x%llX protect=0x%llX targetPid=%llu status=0x%08X",
callerModeText, apiName, (unsigned long long)arg0, (unsigned long long)arg1, (unsigned long long)arg2,
(unsigned long long)arg3, (unsigned long long)arg4, (unsigned long long)arg6, (unsigned int)callStatus);
}
else if (lstrcmpiA(apiName, "NtQueryInformationProcess") == 0 ||
lstrcmpiA(apiName, "NtQuerySystemInformation") == 0)
{
event.Severity = 3u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "USERMODE_PROCESS_RECON");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws target=%ws process.recon api=%S c0=0x%llX c1=0x%llX c2=0x%llX c3=0x%llX status=0x%08X",
callerModeText, targetText, apiName, (unsigned long long)arg0, (unsigned long long)arg1,
(unsigned long long)arg2, (unsigned long long)arg3, (unsigned int)callStatus);
}
else
{
event.Severity = 2u;
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "USERMODE_HOOK_API_CALL");
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"kind=kernel_ntapi callerMode=%ws target=%ws section=%ws api=%S c0=0x%llX c1=0x%llX c2=0x%llX c3=0x%llX c4=0x%llX c5=0x%llX c6=0x%llX c7=0x%llX status=0x%08X",
callerModeText, targetText, sectionText, apiName, (unsigned long long)arg0, (unsigned long long)arg1,
(unsigned long long)arg2, (unsigned long long)arg3, (unsigned long long)arg4, (unsigned long long)arg5,
(unsigned long long)arg6, (unsigned long long)arg7, (unsigned int)callStatus);
}
}
else if (EventName != NULL && wcscmp(EventName, L"SystemInformationTelemetry") == 0)
{
event.Family = BlackbirdIpcEtwFamilyUserHook;
event.Severity = 3u;
if (callerPid != 0)
{
event.ProcessId = callerPid;
event.CallerPid = callerPid;
}
if (callerTid != 0)
{
event.ThreadId = callerTid;
}
(void)StringCchCopyA(event.Operation, RTL_NUMBER_OF(event.Operation), "NtQuerySystemInformation");
(void)StringCchCopyW(event.EventName, RTL_NUMBER_OF(event.EventName), L"NtQuerySystemInformation");
(void)StringCchCopyA(event.DetectionName, RTL_NUMBER_OF(event.DetectionName), "USERMODE_PROCESS_RECON");
(void)ControllerEtwGetU32Property(Record, L"systemInformationClass", &systemInformationClass);
(void)ControllerEtwGetU32Property(Record, L"systemInformationLength", &systemInformationLength);
(void)ControllerEtwGetU32Property(Record, L"returnLength", &returnLength);
(void)ControllerEtwGetI32Property(Record, L"queryStatus", &queryStatus);
if (queryStatus != 0)
{
return;
}
event.HookArgCount = 6u;
event.HookArgs[0] = systemInformationClass;
event.HookArgs[1] = 0ull;
event.HookArgs[2] = systemInformationLength;
event.HookArgs[3] = 0ull;
event.HookArgs[4] = returnLength;
event.HookArgs[5] = (UINT32)queryStatus;
(void)StringCchPrintfW(
event.Reason, RTL_NUMBER_OF(event.Reason),
L"process.recon api=NtQuerySystemInformation systemInformationClass=0x%X systemInformationLength=0x%X returnLength=0x%X status=0x%08X",
(unsigned int)systemInformationClass, (unsigned int)systemInformationLength, (unsigned int)returnLength,
(unsigned int)queryStatus);
}
else
{
if (event.Source == BlackbirdIpcEtwSourceThreatIntel)
{
event.Family = BlackbirdIpcEtwFamilyThreatIntel;
}
}
ControllerProcessHollowingEtwRecord(Record, EventName, &event);
if (EventName != NULL && wcscmp(EventName, L"ProcessTelemetry") == 0)
{
DWORD sourcePid32 = 0;
DWORD childPid32 = 0;
if (event.ProcessId != 0 && event.ProcessId <= 0xFFFFFFFFull)
{
childPid32 = (DWORD)event.ProcessId;
if (event.CreatorProcessId != 0 && event.CreatorProcessId <= 0xFFFFFFFFull)
{
sourcePid32 = (DWORD)event.CreatorProcessId;
}
else if (event.ParentProcessId != 0 && event.ParentProcessId <= 0xFFFFFFFFull)
{
sourcePid32 = (DWORD)event.ParentProcessId;
}
}
if (sourcePid32 != 0 && childPid32 != 0 && sourcePid32 != childPid32)
{
ControllerExpandMonitoringGraph(sourcePid32, childPid32, BK_CONTROLLER_DRIVER_STREAM_MASK);
}
}
if (event.ProcessId != 0 && event.Severity >= 2u)
{
event.Reserved2 = ControllerComputeEtwDetectionTraits(event);
traitsComputed = TRUE;
UINT32 heurFlags = ControllerHeurFlagsFromDetectionTraits(event.Reserved2);
ControllerHeuristicsObserveEvent((DWORD)event.ProcessId, event.Severity, heurFlags);
}
if (!ControllerShouldForwardEtwRecord(Record, EventName, &event))
{
return;
}
if (!traitsComputed)
{
event.Reserved2 = ControllerComputeEtwDetectionTraits(event);
}
ControllerDispatchEtwEvent(&event);
}
static DWORD WINAPI ControllerEtwThreadProc(_In_ LPVOID Context)
{
DWORD status;
UNREFERENCED_PARAMETER(Context);
if (g_EtwSession == NULL)
{
return 1;
}
status = BkscRunEtwSession(g_EtwSession);
ControllerLog("[ETW] run loop exited status=%lu tiEvents=%ld detectionEvents=%ld\n", status,
InterlockedCompareExchange(&g_EtwTiEvents, 0, 0),
InterlockedCompareExchange(&g_EtwDetectionEvents, 0, 0));
return status;
}
static BOOL ControllerIsThreatIntelRetryableError(_In_ DWORD ErrorCode)
{
if (ErrorCode == ERROR_SUCCESS)
{
return FALSE;
}
if (ErrorCode == ERROR_ACCESS_DENIED || ErrorCode == ERROR_PRIVILEGE_NOT_HELD || ErrorCode == ERROR_NOT_SUPPORTED)
{
return FALSE;
}
return TRUE;
}
static VOID WINAPI ControllerEtwWarmupCallback(_In_ PEVENT_RECORD Record, _In_opt_z_ PCWSTR EventName,
_In_opt_ PVOID Context)
{
UNREFERENCED_PARAMETER(Record);
UNREFERENCED_PARAMETER(EventName);
UNREFERENCED_PARAMETER(Context);
}
static BOOL ControllerWarmupThreatIntelProvider(_Out_opt_ DWORD *ErrorCode)
{
WCHAR warmupSessionName[96];
BKSC_ETW_PROVIDER_CONFIG provider;
BKSC_ETW_SESSION_CONFIG config;
BKSC_ETW_SESSION *warmupSession = NULL;
BOOL ok;
DWORD err = ERROR_SUCCESS;
ZeroMemory(&provider, sizeof(provider));
provider.ProviderId = BKSC_PROVIDER_GUID_TI;
provider.Level = TRACE_LEVEL_INFORMATION;
provider.MatchAnyKeyword = ~0ULL;
provider.MatchAllKeyword = 0;
ZeroMemory(&config, sizeof(config));
(void)StringCchPrintfW(warmupSessionName, RTL_NUMBER_OF(warmupSessionName), L"%ws-TiWarmup",
BK_CONTROLLER_ETW_SESSION_NAMEW);
config.SessionName = warmupSessionName;
config.Providers = &provider;
config.ProviderCount = 1;
config.Callback = ControllerEtwWarmupCallback;
config.CallbackContext = NULL;
ok = BkscStartEtwSession(&config, &warmupSession);
if (ok)
{
Sleep(120);
BkscStopEtwSession(warmupSession);
warmupSession = NULL;
err = ERROR_SUCCESS;
}
else
{
err = GetLastError();
}
if (ErrorCode != NULL)
{
*ErrorCode = err;
}
return ok;
}
static VOID ControllerTryRecoverThreatIntelSession(_In_ DWORD InitialTiError)
{
const DWORD maxAttempts = 3;
DWORD attempt;
DWORD tiErr = InitialTiError;
if (g_EtwSession == NULL || g_ThreatIntelEnabled || !ControllerIsThreatIntelRetryableError(InitialTiError))
{
return;
}
for (attempt = 1; attempt <= maxAttempts && !ControllerShouldStop(); ++attempt)
{
DWORD warmErr = ERROR_SUCCESS;
BOOL warmOk;
ControllerLog("[ETW][WARN] TI inactive after subscribe (err=%lu). warmup+restart attempt %lu/%lu\n", tiErr,
attempt, maxAttempts);
warmOk = ControllerWarmupThreatIntelProvider(&warmErr);
if (!warmOk)
{
ControllerLog("[ETW][WARN] TI warmup failed attempt=%lu err=%lu\n", attempt, warmErr);
}
BkscStopEtwSession(g_EtwSession);
g_EtwSession = NULL;
g_ThreatIntelEnabled = FALSE;
if (!BkscStartBlackbirdEtwSession(BK_CONTROLLER_ETW_SESSION_NAMEW, TRUE, ControllerEtwCallback, NULL,
&g_EtwSession, &g_ThreatIntelEnabled))
{
DWORD restartErr = GetLastError();
tiErr = BkscGetLastThreatIntelEnableError();
ControllerLog("[ETW][WARN] restart after TI warmup failed attempt=%lu startErr=%lu tiErr=%lu\n", attempt,
restartErr, tiErr);
if (attempt < maxAttempts)
{
Sleep(180 * attempt);
}
continue;
}
tiErr = BkscGetLastThreatIntelEnableError();
g_ThreatIntelEnableError = tiErr;
if (g_ThreatIntelEnabled)
{
ControllerLog("[ETW] TI provider enabled after warmup attempt %lu (tiEnableErr=%lu)\n", attempt, tiErr);
return;
}
ControllerLog("[ETW][WARN] TI still inactive after restart attempt=%lu tiEnableErr=%lu\n", attempt, tiErr);
if (!ControllerIsThreatIntelRetryableError(tiErr))
{
return;
}
if (attempt < maxAttempts)
{
Sleep(180 * attempt);
}
}
UNREFERENCED_PARAMETER(tiErr);
}
static BOOL ControllerStartEtwSession(VOID)
{
DWORD tiErr = ERROR_SUCCESS;
ControllerCleanupStaleEtwSessions();
(void)InterlockedExchange(&g_EtwTiEvents, 0);
(void)InterlockedExchange(&g_EtwDetectionEvents, 0);
g_ThreatIntelEnabled = FALSE;
g_ThreatIntelEnableError = ERROR_SUCCESS;
if (!BkscStartBlackbirdEtwSession(BK_CONTROLLER_ETW_SESSION_NAMEW, TRUE, ControllerEtwCallback, NULL, &g_EtwSession,
&g_ThreatIntelEnabled))
{
DWORD err = GetLastError();
g_ThreatIntelEnableError = err;
ControllerLog("[WARN] BlackbirdController: failed to start ETW TI session name=%ws (%lu)\n",
BK_CONTROLLER_ETW_SESSION_NAMEW, err);
g_EtwSession = NULL;
g_ThreatIntelEnabled = FALSE;
return FALSE;
}
tiErr = BkscGetLastThreatIntelEnableError();
g_ThreatIntelEnableError = tiErr;
if (!g_ThreatIntelEnabled)
{
ControllerTryRecoverThreatIntelSession(tiErr);
tiErr = BkscGetLastThreatIntelEnableError();
g_ThreatIntelEnableError = tiErr;
}
if (g_EtwSession == NULL)
{
ControllerLog("[WARN] BlackbirdController: ETW session unavailable after TI recovery attempts\n");
return FALSE;
}
g_EtwThread = CreateThread(NULL, 0, ControllerEtwThreadProc, NULL, 0, NULL);
if (g_EtwThread == NULL)
{
ControllerLog("[WARN] BlackbirdController: failed to start ETW thread (%lu)\n", GetLastError());
BkscStopEtwSession(g_EtwSession);
g_EtwSession = NULL;
g_ThreatIntelEnabled = FALSE;
return FALSE;
}
ControllerLog("[*] BlackbirdController: ETW session started. threat-intel=%s tiEnableErr=%lu\n",
g_ThreatIntelEnabled ? "enabled" : "disabled", tiErr);
return TRUE;
}
static VOID ControllerStopEtwSession(VOID)
{
if (g_EtwSession != NULL)
{
BkscStopEtwSession(g_EtwSession);
g_EtwSession = NULL;
}
if (g_EtwThread != NULL)
{
(void)WaitForSingleObject(g_EtwThread, 3000);
CloseHandle(g_EtwThread);
g_EtwThread = NULL;
}
ControllerStopEtwSessionByNameBestEffort(BK_CONTROLLER_ETW_SESSION_NAMEW, "service-stop");
ControllerLog("[ETW] session stopped tiEvents=%ld detectionEvents=%ld\n",
InterlockedCompareExchange(&g_EtwTiEvents, 0, 0),
InterlockedCompareExchange(&g_EtwDetectionEvents, 0, 0));
}
static BOOL ControllerStartCore(VOID)
{
DWORD serverThreadsStarted = 0;
DWORD serverThreadIndex;
InterlockedExchange(&g_ControllerProtectionReady, 0);
InterlockedExchange(&g_ControllerProtectionArmed, 0);
g_ClientList = NULL;
g_ClientCount = 0;
g_PidIndexCount = 0;
ZeroMemory(g_ClientSlots, sizeof(g_ClientSlots));
ZeroMemory(g_PidIndex, sizeof(g_PidIndex));
ControllerLog("[*] BlackbirdController: core start requested\n");
ControllerResetHollowingState();
ControllerHeuristicsInitialize();
g_StopEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
if (g_StopEvent == NULL)
{
ControllerLog("[-] BlackbirdController: failed to create stop event (%lu)\n", GetLastError());
return FALSE;
}
if (!ControllerStartHollowingWorkers())
{
ControllerLog("[WARN] controller hollowing worker start failed (%lu)\n", GetLastError());
}
if (!ControllerSymbolServiceStart())
{
ControllerLog("[WARN] controller symbol service start failed (%lu)\n", GetLastError());
}
BkscUseServiceProtocol();
g_DriverHandle = BkscOpenControlDevice();
if (g_DriverHandle == INVALID_HANDLE_VALUE)
{
ControllerLog("[WARN] BlackbirdController: initial driver open failed (%lu). retrying in background.\n",
GetLastError());
}
else
{
ControllerLog("[DRIVER] initial open succeeded\n");
}
InterlockedExchange(&g_ControllerProtectionReady, 1);
ControllerTryMarkProtectedReady(g_DriverHandle, TRUE);
if (!ControllerStartDriverSubscriptionWorker())
{
ControllerLog("[WARN] controller subscription apply worker start failed (%lu)\n", GetLastError());
return FALSE;
}
(void)ControllerStartEtwSession();
if (!ControllerStartNetService(g_DriverHandle))
{
ControllerLog("[NETSVC][INFO] network service offline; controller core continuing without node networking\n");
}
ControllerTryMarkProtectedReady(g_DriverHandle, TRUE);
g_DriverPumpThread = CreateThread(NULL, 0, ControllerDriverPumpThreadProc, NULL, 0, NULL);
if (g_DriverPumpThread == NULL)
{
ControllerLog("[-] BlackbirdController: failed to start driver pump thread (%lu)\n", GetLastError());
return FALSE;
}
ZeroMemory(g_ServerAcceptThreads, sizeof(g_ServerAcceptThreads));
ZeroMemory(g_HookAcceptThreads, sizeof(g_HookAcceptThreads));
for (serverThreadIndex = 0; serverThreadIndex < BK_CONTROLLER_SERVER_ACCEPT_THREADS; serverThreadIndex += 1)
{
HANDLE thread = CreateThread(NULL, 0, ControllerServerThreadProc, (LPVOID)&g_ControlEndpointContext, 0, NULL);
if (thread == NULL)
{
ControllerLog("[WARN] BlackbirdController: failed to start control accept thread %lu (%lu)\n",
serverThreadIndex, GetLastError());
break;
}
g_ServerAcceptThreads[serverThreadIndex] = thread;
serverThreadsStarted += 1;
}
if (serverThreadsStarted == 0)
{
ControllerLog("[-] BlackbirdController: failed to start any control accept thread\n");
return FALSE;
}
g_ServerThread = g_ServerAcceptThreads[0];
if (serverThreadsStarted < BK_CONTROLLER_SERVER_ACCEPT_THREADS)
{
ControllerLog("[WARN] BlackbirdController: control accept thread pool reduced to %lu/%lu\n",
serverThreadsStarted, (DWORD)BK_CONTROLLER_SERVER_ACCEPT_THREADS);
}
for (serverThreadIndex = 0; serverThreadIndex < BK_CONTROLLER_HOOK_ACCEPT_THREADS; serverThreadIndex += 1)
{
HANDLE thread = CreateThread(NULL, 0, ControllerServerThreadProc, (LPVOID)&g_HookEndpointContext, 0, NULL);
if (thread == NULL)
{
ControllerLog("[WARN] BlackbirdController: failed to start hook accept thread %lu (%lu)\n",
serverThreadIndex, GetLastError());
break;
}
g_HookAcceptThreads[serverThreadIndex] = thread;
}
ControllerLog("[*] BlackbirdController: IPC endpoints online control=%ls hook=%ls\n", BKIPC_PIPE_NAME,
BKIPC_HOOK_PIPE_NAME);
ControllerTryMarkProtectedReady(g_DriverHandle, TRUE);
return TRUE;
}
static VOID ControllerWakeServerPipe(_In_z_ PCWSTR PipeName, _In_ DWORD Attempts)
{
DWORD index;
if (PipeName == NULL || PipeName[0] == L'\0')
{
return;
}
for (index = 0; index < Attempts; index += 1)
{
HANDLE pipe = CreateFileW(PipeName, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
if (pipe != INVALID_HANDLE_VALUE)
{
CloseHandle(pipe);
}
}
}
static VOID ControllerDisarmRuntimeForTeardown(_In_z_ PCSTR Reason)
{
static const DWORD teardownMask = BK_RUNTIME_FLAG_ANTI_VIRTUALIZATION | BK_RUNTIME_FLAG_SELF_HIDE |
BK_RUNTIME_FLAG_INTERFACE_PROTECTED_ACCESS |
BK_RUNTIME_FLAG_CONTROLLER_PROTECTED_ACCESS |
BK_RUNTIME_FLAG_NTAPI_HOOKS_DISARMED | BK_RUNTIME_FLAG_QPC_TIMING_DISABLED;
static const DWORD teardownFlags = BK_RUNTIME_FLAG_NTAPI_HOOKS_DISARMED | BK_RUNTIME_FLAG_QPC_TIMING_DISABLED;
EnterCriticalSection(g_DriverLock.get());
if (g_DriverHandle != INVALID_HANDLE_VALUE)
{
if (!BkscSetRuntimeConfig(g_DriverHandle, teardownFlags, teardownMask))
{
ControllerLog("[DRIVER][WARN] teardown runtime disarm failed reason=%s err=%lu\n", Reason, GetLastError());
}
else
{
ControllerLog("[DRIVER] teardown runtime disarmed reason=%s flags=0x%08lX mask=0x%08lX\n", Reason,
teardownFlags, teardownMask);
}
}
LeaveCriticalSection(g_DriverLock.get());
InterlockedExchange(&g_ControllerProtectionReady, 0);
InterlockedExchange(&g_ControllerProtectionArmed, 0);
}
static VOID ControllerStopCore(VOID)
{
DWORD waitMs = 0;
DWORD threadIndex = 0;
ControllerLog("[*] BlackbirdController: stop requested\n");
if (g_StopEvent != NULL)
{
(void)SetEvent(g_StopEvent);
}
ControllerDisarmRuntimeForTeardown("stop-core-begin");
ControllerWakeServerPipe(BKIPC_PIPE_NAME, (DWORD)BK_CONTROLLER_SERVER_ACCEPT_THREADS);
ControllerWakeServerPipe(BKIPC_HOOK_PIPE_NAME, (DWORD)BK_CONTROLLER_HOOK_ACCEPT_THREADS);
ControllerStopDriverSubscriptionWorker();
for (threadIndex = 0; threadIndex < BK_CONTROLLER_SERVER_ACCEPT_THREADS; threadIndex += 1)
{
HANDLE thread = g_ServerAcceptThreads[threadIndex];
if (thread != NULL)
{
(void)WaitForSingleObject(thread, 3000);
CloseHandle(thread);
g_ServerAcceptThreads[threadIndex] = NULL;
}
}
for (threadIndex = 0; threadIndex < BK_CONTROLLER_HOOK_ACCEPT_THREADS; threadIndex += 1)
{
HANDLE thread = g_HookAcceptThreads[threadIndex];
if (thread != NULL)
{
(void)WaitForSingleObject(thread, 3000);
CloseHandle(thread);
g_HookAcceptThreads[threadIndex] = NULL;
}
}
g_ServerThread = NULL;
if (g_DriverPumpThread != NULL)
{
(void)WaitForSingleObject(g_DriverPumpThread, 3000);
CloseHandle(g_DriverPumpThread);
g_DriverPumpThread = NULL;
}
EnterCriticalSection(g_ClientListLock.get());
{
PBK_CONTROLLER_CLIENT client;
for (client = g_ClientList; client != NULL; client = client->Next)
{
if (client->Pipe != INVALID_HANDLE_VALUE)
{
(void)CancelIoEx(client->Pipe, NULL);
(void)DisconnectNamedPipe(client->Pipe);
}
}
}
LeaveCriticalSection(g_ClientListLock.get());
while (waitMs < 2000)
{
DWORD remaining;
EnterCriticalSection(g_ClientListLock.get());
remaining = g_ClientCount;
LeaveCriticalSection(g_ClientListLock.get());
if (remaining == 0)
{
break;
}
Sleep(50);
waitMs += 50;
}
ControllerStopEtwSession();
ControllerStopNetService();
EnterCriticalSection(g_DriverLock.get());
if (g_DriverHandle != INVALID_HANDLE_VALUE)
{
CloseHandle(g_DriverHandle);
g_DriverHandle = INVALID_HANDLE_VALUE;
}
LeaveCriticalSection(g_DriverLock.get());
ControllerStopHollowingWorkers();
if (g_StopEvent != NULL)
{
CloseHandle(g_StopEvent);
g_StopEvent = NULL;
}
ControllerSymbolServiceStop();
ControllerResetHollowingState();
ControllerHeuristicsUninitialize();
ControllerLog("[*] BlackbirdController: core stopped\n");
}
static DWORD WINAPI ControllerServiceControlHandlerEx(_In_ DWORD ControlCode, _In_ DWORD EventType,
_In_ LPVOID EventData, _In_ LPVOID Context)
{
UNREFERENCED_PARAMETER(EventType);
UNREFERENCED_PARAMETER(EventData);
UNREFERENCED_PARAMETER(Context);
if (ControlCode == SERVICE_CONTROL_STOP || ControlCode == SERVICE_CONTROL_SHUTDOWN)
{
ControllerLog("[*] BlackbirdController: service control received code=%lu\n", ControlCode);
ControllerUpdateServiceStatus(SERVICE_STOP_PENDING, NO_ERROR, 3000);
if (g_StopEvent != NULL)
{
(void)SetEvent(g_StopEvent);
}
return NO_ERROR;
}
return ERROR_CALL_NOT_IMPLEMENTED;
}
static VOID WINAPI ControllerServiceMain(_In_ DWORD Argc, _In_reads_(Argc) LPWSTR *Argv)
{
UNREFERENCED_PARAMETER(Argc);
UNREFERENCED_PARAMETER(Argv);
ZeroMemory(&g_ServiceStatus, sizeof(g_ServiceStatus));
g_ServiceStatusHandle =
RegisterServiceCtrlHandlerExW(BK_CONTROLLER_SERVICE_NAMEW, ControllerServiceControlHandlerEx, NULL);
if (g_ServiceStatusHandle == NULL)
{
return;
}
ControllerLog("[*] BlackbirdController: service main entered\n");
ControllerUpdateServiceStatus(SERVICE_START_PENDING, NO_ERROR, 6000);
if (!ControllerStartCore())
{
ControllerUpdateServiceStatus(SERVICE_STOPPED, ERROR_SERVICE_SPECIFIC_ERROR, 0);
ControllerStopCore();
return;
}
ControllerUpdateServiceStatus(SERVICE_RUNNING, NO_ERROR, 0);
ControllerLog("[*] BlackbirdController: service running\n");
(void)WaitForSingleObject(g_StopEvent, INFINITE);
ControllerUpdateServiceStatus(SERVICE_STOP_PENDING, NO_ERROR, 3000);
ControllerStopCore();
ControllerUpdateServiceStatus(SERVICE_STOPPED, NO_ERROR, 0);
}
int __cdecl wmain(_In_ int argc, _In_reads_(argc) wchar_t **argv)
{
SERVICE_TABLE_ENTRYW table[] = {{(LPWSTR)BK_CONTROLLER_SERVICE_NAMEW, ControllerServiceMain}, {NULL, NULL}};
BOOL runAsConsole = FALSE;
BOOL forceServiceMode = FALSE;
int i;
ControllerLogInit();
ControllerApplyProcessMitigations();
ControllerLog("[*] BlackbirdController: wmain entered pid=%lu\n", GetCurrentProcessId());
for (i = 1; i < argc; ++i)
{
if (_wcsicmp(argv[i], L"--console") == 0)
{
runAsConsole = TRUE;
continue;
}
if (_wcsicmp(argv[i], L"--service") == 0)
{
forceServiceMode = TRUE;
}
}
#ifdef TEMPUS_DEBUG
if (!forceServiceMode && !runAsConsole)
{
if (GetConsoleWindow() != NULL || AttachConsole(ATTACH_PARENT_PROCESS))
{
runAsConsole = TRUE;
}
}
#endif
if (runAsConsole)
{
#ifdef TEMPUS_DEBUG
if (GetConsoleWindow() == NULL && !AttachConsole(ATTACH_PARENT_PROCESS))
{
(void)AllocConsole();
}
#endif
ControllerLog("[*] BlackbirdController: running in console mode.\n");
if (!ControllerStartCore())
{
ControllerStopCore();
ControllerLogClose();
return 1;
}
ControllerLog("[*] BlackbirdController: running. Press Enter to stop.\n");
(void)getchar();
ControllerStopCore();
ControllerLogClose();
return 0;
}
if (!StartServiceCtrlDispatcherW(table))
{
ControllerLog("[-] BlackbirdController: StartServiceCtrlDispatcherW failed (%lu)\n", GetLastError());
ControllerLogClose();
return 1;
}
ControllerLogClose();
return 0;
}
Reference in New Issue View Git Blame Copy Permalink