From 0bc67f8ac7532230e6bf9f91588a3e9cc2a56bd1 Mon Sep 17 00:00:00 2001 From: Yarden Shafir Date: Fri, 22 May 2020 18:17:52 +0300 Subject: [PATCH] Scripts --- FindLookasideLists.txt | 5 +++++ FindResourcesInPool.txt | 6 ++++++ FindSymbolForNPagedLookasideList.txt | 4 ++++ enumerateProcessesFromHandleTable.txt | 1 + getMemWritesInFunction.txt | 5 +++++ getProcessNotifyRoutines.txt | 13 +++++++++++++ printApcs.txt | 6 ++++++ printIrpsForLsass.txt | 3 +++ printKernelInvertedFunctionTable.txt | 2 ++ printUserInvertedFunctionTable.txt | 2 ++ writeVerAccessInFile.txt | 4 ++++ 11 files changed, 51 insertions(+) create mode 100644 FindLookasideLists.txt create mode 100644 FindResourcesInPool.txt create mode 100644 FindSymbolForNPagedLookasideList.txt create mode 100644 enumerateProcessesFromHandleTable.txt create mode 100644 getMemWritesInFunction.txt create mode 100644 getProcessNotifyRoutines.txt create mode 100644 printApcs.txt create mode 100644 printIrpsForLsass.txt create mode 100644 printKernelInvertedFunctionTable.txt create mode 100644 printUserInvertedFunctionTable.txt create mode 100644 writeVerAccessInFile.txt diff --git a/FindLookasideLists.txt b/FindLookasideLists.txt new file mode 100644 index 0000000..4cb92a1 --- /dev/null +++ b/FindLookasideLists.txt @@ -0,0 +1,5 @@ +dx -r0 @$GeneralLookaside = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!ExPagedLookasideListHead, "nt!_GENERAL_LOOKASIDE", "ListEntry") +dx -r0 @$lookasideAddr = @$GeneralLookaside.Select(l => ((__int64)&l).ToDisplayString("x")) +dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length)) +dx -r0 @$extractWithSize = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, z)) +dx -r0 @$poolData = @$lookasideAddr.Select(l => Debugger.Utility.Control.ExecuteCommand("!pool "+l+" 2")).Where(l => l[1].Length != 0x55 && l[1].Length != 0).Select(l => new {address = "0x" + @$extractBetween(l[1], "*", "size:"), tag = @$extractWithSize(l[1], "(Allocated) *", 4), tagDesc = l[2].Contains(",") ? @$extractBetween(l[2], ": ", ",") : l[2].Substring(l[2].IndexOf(":")+2), binary = l[2].Contains("Binary") ? l[2].Substring(l[2].IndexOf("Binary :")+9) : "unknown", size = "0x" + @$extractBetween(l[1], "size:", "previous size:").Replace(" ", "")}) diff --git a/FindResourcesInPool.txt b/FindResourcesInPool.txt new file mode 100644 index 0000000..22449de --- /dev/null +++ b/FindResourcesInPool.txt @@ -0,0 +1,6 @@ +dx -r0 @$eresource = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!ExpSystemResourcesList, "nt!_ERESOURCE", "SystemResourcesList") +dx -r0 @$eresourceAddr = @$eresource.Select(l => ((__int64)&l).ToDisplayString("x")) +dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length)) +dx -r0 @$extractWithSize = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, z)) +dx -r0 @$poolData = @$eresourceAddr.Select(l => Debugger.Utility.Control.ExecuteCommand("!pool "+l+" 2")).Where(l => l[1].Length != 0x55 && l[1].Length != 0).Select(l => new {address = "0x" + @$extractBetween(l[1], "*", "size:"), tag = @$extractWithSize(l[1], "(Allocated) *", 4), tagDesc = l[2].Contains(",") ? @$extractBetween(l[2], ": ", ",") : l[2].Substring(l[2].IndexOf(":")+2), binary = l[2].Contains("Binary") ? l[2].Substring(l[2].IndexOf("Binary :")+9) : "unknown", size = "0x" + @$extractBetween(l[1], "size:", "previous size:").Replace(" ", "")}) +dx -r1 @$poolData.Where(l => l.size != "0x80") diff --git a/FindSymbolForNPagedLookasideList.txt b/FindSymbolForNPagedLookasideList.txt new file mode 100644 index 0000000..af10cda --- /dev/null +++ b/FindSymbolForNPagedLookasideList.txt @@ -0,0 +1,4 @@ +dx -r0 @$GeneralLookaside = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!ExNPagedLookasideListHead, "nt!_GENERAL_LOOKASIDE", "ListEntry") +dx -r0 @$lookasideAddr = @$GeneralLookaside.Select(l => ((__int64)&l).ToDisplayString("x")) +dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length)) +dx -r2 @$symData = @$lookasideAddr.Select(l => new {addr = l, sym = Debugger.Utility.Control.ExecuteCommand("ln "+l)}).Where(l => l.sym.Count() > 3).Select(l => new {addr = l.addr, sym = @$extractBetween(l.sym[3], " ", "|")}) \ No newline at end of file diff --git a/enumerateProcessesFromHandleTable.txt b/enumerateProcessesFromHandleTable.txt new file mode 100644 index 0000000..1f34ecc --- /dev/null +++ b/enumerateProcessesFromHandleTable.txt @@ -0,0 +1 @@ +dx -r2 (Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&nt!HandleTableListHead, "nt!_HANDLE_TABLE", "HandleTableList")).Where(h => h.QuotaProcess != 0).Select(h => new { Object = h.QuotaProcess, Name = (char*)h.QuotaProcess->ImageFileName, PID = h.QuotaProcess->UniqueProcessId}) \ No newline at end of file diff --git a/getMemWritesInFunction.txt b/getMemWritesInFunction.txt new file mode 100644 index 0000000..2efcc16 --- /dev/null +++ b/getMemWritesInFunction.txt @@ -0,0 +1,5 @@ +dx -r0 @$rspId = 0x14 +dx -r0 @$rbpId = 0x15 +dx -r0 @$isMemWrite = (b => b.Instructions.Where(i => i.Operands.Count() > 1 && i.Operands[0].Attributes.IsOutput && i.Operands[0].Registers[0].Id != @$rspId && i.Operands[0].Registers[0].Id != @$rbpId && i.Operands[0].Attributes.IsMemoryReference)) +dx -r0 @$findMemWrite = (a => Debugger.Utility.Code.CreateDisassembler().DisassembleBlocks(a).Select(b => @$isMemWrite(b))) +dx -r2 @$findMemWrite(&nt!ZwSetInformationProcess).Where(b => b.Count() != 0) \ No newline at end of file diff --git a/getProcessNotifyRoutines.txt b/getProcessNotifyRoutines.txt new file mode 100644 index 0000000..4924769 --- /dev/null +++ b/getProcessNotifyRoutines.txt @@ -0,0 +1,13 @@ +# define this structure in header file (c:\temp\header.h): +typedef struct _EX_CALLBACK_ROUTINE_BLOCK +{ + _EX_RUNDOWN_REF RundownProtect; + void* Function; + void* Context; +} EX_CALLBACK_ROUTINE_BLOCK, *PEX_CALLBACK_ROUTINE_BLOCK; + + +dx Debugger.Utility.Analysis.SyntheticTypes.ReadHeader("c:\\temp\\header.h", "nt") +dx @$getCallbackRoutine = (a => Debugger.Utility.Analysis.SyntheticTypes.CreateInstance("_EX_CALLBACK_ROUTINE_BLOCK", (__int64)(a & ~0xf))) +dx -r0 @$getsym = (x => Debugger.Utility.Control.ExecuteCommand(".printf\"%y\", " + ((__int64)x).ToDisplayString("x")))[0] +dx ((void**[0x40])&nt!PspCreateProcessNotifyRoutine).Where(a => a != 0).Select(a => @$getsym(@$getCallbackRoutine(a).Function)) \ No newline at end of file diff --git a/printApcs.txt b/printApcs.txt new file mode 100644 index 0000000..4d79128 --- /dev/null +++ b/printApcs.txt @@ -0,0 +1,6 @@ +dx -r0 @$printLn = (a => Debugger.Utility.Control.ExecuteCommand("ln "+((__int64)a).ToDisplayString("x"))) +dx -r0 @$extractBetween = ((x,y,z) => x.Substring(x.IndexOf(y) + y.Length, x.IndexOf(z) - x.IndexOf(y) - y.Length)) +dx -r0 @$printSymbol = (a => @$extractBetween(@$printLn(a)[3], " ", "|")) +dx -r0 @$apcsForThread = (t => new {TID = t.Id, Object = (void*)&t.KernelObject, Apcs = Debugger.Utility.Collections.FromListEntry(*(nt!_LIST_ENTRY*)&t.KernelObject.Tcb.ApcState.ApcListHead[0], "nt!_KAPC", "ApcListEntry").Select(a => new { Kernel = @$printSymbol(a.KernelRoutine), Rundown = @$printSymbol(a.RundownRoutine)})}) +dx -r0 @$procWithKernelApc = @$cursession.Processes.Select(p => new {Name = p.Name, PID = p.Id, Object = (void*)&p.KernelObject, ApcThreads = p.Threads.Where(t => t.KernelObject.Tcb.ApcState.KernelApcPending != 0)}).Where(p => p.ApcThreads.Count() != 0) +dx -r6 @$procWithKernelApc.Select(p => new { Name = p.Name, PID = p.PID, Object = p.Object, ApcThreads = p.ApcThreads.Select(t => @$apcsForThread(t))}) \ No newline at end of file diff --git a/printIrpsForLsass.txt b/printIrpsForLsass.txt new file mode 100644 index 0000000..7cb34e5 --- /dev/null +++ b/printIrpsForLsass.txt @@ -0,0 +1,3 @@ +dx @$lsass = @$cursession.Processes.Where(p => p.Name == "lsass.exe").First() +dx -r4 @$irpThreads = @$lsass.Threads.Select(t => new {irp = Debugger.Utility.Collections.FromListEntry(t.KernelObject.IrpList, "nt!_IRP", "ThreadListEntry")}).Where(t => t.irp.Count() != 0) +dx -r3 @$irpThreads.Select(t => t.irp.Select(i => Debugger.Utility.Control.ExecuteCommand("!irp " + ((__int64)&i).ToDisplayString("x")))) \ No newline at end of file diff --git a/printKernelInvertedFunctionTable.txt b/printKernelInvertedFunctionTable.txt new file mode 100644 index 0000000..98d89df --- /dev/null +++ b/printKernelInvertedFunctionTable.txt @@ -0,0 +1,2 @@ +dx @$inverted = (nt!_INVERTED_FUNCTION_TABLE*)&nt!PsInvertedFunctionTable +dx -g @$tableEntry = *(nt!_INVERTED_FUNCTION_TABLE_ENTRY(*)[0xbe])@$inverted->TableEntry \ No newline at end of file diff --git a/printUserInvertedFunctionTable.txt b/printUserInvertedFunctionTable.txt new file mode 100644 index 0000000..312737a --- /dev/null +++ b/printUserInvertedFunctionTable.txt @@ -0,0 +1,2 @@ +dx @$inverted = *(nt!_INVERTED_FUNCTION_TABLE**)&nt!KeUserInvertedFunctionTable +dx -g @$inverted->TableEntry->Take(@$inverted->CurrentSize) \ No newline at end of file diff --git a/writeVerAccessInFile.txt b/writeVerAccessInFile.txt new file mode 100644 index 0000000..89a5a94 --- /dev/null +++ b/writeVerAccessInFile.txt @@ -0,0 +1,4 @@ +dx @$tmpFile = Debugger.Utility.FileSystem.TempDirectory.OpenFile("log.txt") +dx @$txtWriter = Debugger.Utility.FileSystem.CreateTextWriter(@$tmpFile) +ba r4 nt!PsInitialSystemProcess "dx @$txtWriter.WriteLine(@$getsym(@$curstack.Frames[0].Attributes.InstructionOffset)); g" +dx @$tmpFile.Close() \ No newline at end of file