mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
64 lines
2.1 KiB
Markdown
64 lines
2.1 KiB
Markdown
# PoC: heavens_gate
|
|
|
|
**Location:** `pocs/heavens_gate/`
|
|
|
|
This PoC demonstrates SindriKit's capability to transition from a 32-bit WoW64 environment into native 64-bit mode using the `0x33` segment selector (Heaven's Gate).
|
|
|
|
## What it demonstrates
|
|
|
|
- Checking whether the current process is running under WoW64.
|
|
- Passing a 64-bit function pointer and argument array across the boundary.
|
|
- Executing 64-bit shellcode from a 32-bit process and retrieving a 64-bit return value in `RAX`.
|
|
|
|
## Walkthrough
|
|
|
|
Because this primitive relies on the WoW64 subsystem, the PoC is only functional when compiled as a 32-bit executable (`x86`) and run on a 64-bit Windows OS.
|
|
|
|
### Step 1: Validate the Environment
|
|
|
|
```c
|
|
if (!snd_is_wow64()) {
|
|
printf("[-] Not running in WOW64... Heaven's Gate requires WOW64.\n");
|
|
return SND_STATUS_ARCH_MISMATCH;
|
|
}
|
|
```
|
|
|
|
The framework parses the PEB to determine if the 32-bit process is being emulated by the 64-bit OS.
|
|
|
|
### Step 2: Allocate 64-bit Payload
|
|
|
|
For demonstration purposes, this PoC uses `VirtualAlloc` to allocate a simple 64-bit shellcode block that loads a magic value into `RAX` and returns:
|
|
|
|
```nasm
|
|
mov rax, 0x1122334455667788
|
|
ret
|
|
```
|
|
|
|
```c
|
|
unsigned char shellcode64[] = {
|
|
0x48, 0xB8, 0x88, 0x77, 0x66,
|
|
0x55, 0x44, 0x33, 0x22, 0x11,
|
|
0xC3
|
|
};
|
|
|
|
PVOID pExec = VirtualAlloc(NULL, sizeof(shellcode64), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
|
|
memcpy(pExec, shellcode64, sizeof(shellcode64));
|
|
```
|
|
|
|
### Step 3: Transition and Execute
|
|
|
|
The PoC invokes the `snd_hg_execute_64` API, which performs the segment selector transition internally, executes the provided address, and passes back the 64-bit return value.
|
|
|
|
```c
|
|
UINT64 result = 0;
|
|
|
|
// Invoke Heaven's Gate with 0 arguments
|
|
snd_status_t status = snd_hg_execute_64((UINT64)(ULONG_PTR)pExec, 0, NULL, &result);
|
|
|
|
if (status.code == SND_SUCCESS) {
|
|
// result == 0x1122334455667788
|
|
}
|
|
```
|
|
|
|
**OpSec impact:** Bypassing WoW64 completely blinds any security products that have only placed userland hooks inside the 32-bit `ntdll.dll`. The execution happens entirely in native 64-bit mode.
|