system will be crash when calling NtControlTrace #7
Comments
|
Need more informations about the issue.
|
|
1、in function "ImgGetBaseAddress", you must call ZwQuerySystemInformation two times to get moduleinfomation, but you forgot to do it. Buffer memory is empty. my computer is win 7, x64, build 7601，dont have anit-virus! The code I downloaded from GitHub can be compiled and passed, but it can't be loaded and run. |
|
I saw the same thing. Did a bit of debugging trying to adjust the data passed to NtControlTrace, but no success. I personally did not post an issue as I have not had time to properly debug it to see whats going on, but I do have the following details which may help compliment the details provided by @xets007 (assuming we are seeing the same issue) BSOD: ATTEMPTED_WRITE_TO_READONLY_MEMORY OS: Windows 7 7601 x64 (7601.24475.amd64fre.win7sp1_ldr.190516-0600) Stack: I am assuming from my limited testing and looking at the implementation of ZwControlTrace that it is probably not as simple as replacing the Zw version for the Nt version on Windows 7. The above info comes from using the packaged project. I did make some changes so that the offsets would be correct for Windows 7 when walking the stack, but all the code I modified seems to come after this crash occurs and so I don't think it is related. The machine it is being tested on is a VM running inside Hyper-V on a Windows 10 host (1903). It is fully patched and has no anti-virus. It is pretty much a clean install. |
|
With the stack trace and given bug check, we can deduce that when The address of that read-only memory region (0xfffff880038b5260) is very very close to the driver's one (around 0xfffff880038b3360 for IfhpModifyTraceSettings), so I suppose it's the data section of your driver module. The only UNICODE_STRING allocated by this project that I can see is the ProviderName. Can you try allocating the provider name yourself and see if it still crashes ? Something like : PVOID Buffer = ExAllocatePool(NonPagedPool, 128);
UNICODE_STRING ProviderName = { };
ProviderName.Buffer = (PWCH) Buffer;
ProviderName.Length = sizeof(L"Circular Kernel Context Logger");
ProviderName.MaximumLength = 128;
RtlCopyMemory(Buffer, L"Circular Kernel Context Logger", (SIZE_T) ProviderName.Length);
Property->ProviderName = ProviderName;
// ..
// This code is for debugging purpose,
// use 'RtlInitUnicodeString(&ProviderName, L"Circular Kernel Context Logger")' instead.
//
// Don't forget to ExFreePool if you use the code I've posted. |
|
So I allocated the string manually, code was almost exactly the same as yours above except I used a temp UNICODE_STRING to store the data. UNICODE_STRING pnameTmp = RTL_CONSTANT_STRING(L"Circular Kernel Context Logger");
PWCHAR pname = (PWCHAR)ExAllocatePool(NonPagedPool, (SIZE_T)(pnameTmp.Length));
RtlCopyMemory(pname, pnameTmp.Buffer, pnameTmp.Length);
Property->ProviderName.Buffer = pname;Doing so did indeed fix the crash! Thank you very much. I do seem to have run into other problems though. I was working on the version of the source from the original commit, it failed inside of MmSearchMemory (not a bug check, it just couldn't find what it was looking for). As a test, I downloaded the latest version of the code with the various bugfixes from the past few days to make sure I hadn't broken something. Surprisingly, doing so resulted in a new bugcheck inside of ImgGetBaseAddress. The bugcheck was PAGE_FAULT_IN_NONPAGED_AREA The exception occured here: InfinityHook/src/libinfinityhook/img.cpp Line 104 in c3c66c9 Looks like it is due to freeing that buffer immediately above. I made the following change which seems to work: |
|
Correct, one of the collaborator made a "patch" without actually testing it :p (Hi @nmulasmajic ) |
|
Cool :) Out of curiosity, in the source there is a comment regarding the signature for EtwpDebuggerData stating that it should be the same on Windows 7+. I was wondering if you (or anyone else) had got it working for Windows 7 before? It does not seem to locate the pattern in my tests so far. Currently, I am seeing IfhpResolveSymbols fail in the second search phase. It is not able to get the section base address for .rdata here: |
|
Still investigating, but it appears as it the routine does not come across the .rdata section at all. I added a debug print to the search function to note the names: This seemed odd, so I took a look at ntoskrnl.exe and it turns out that on Windows 7 there is no .rdata section. So I am not entirely sure what @ivanpos2015 was referring to in their issue. The only difference I can think of is that they specifically mentioned build 7600 but I am testing on 7601. I believe the difference there is whether or not SP1 is installed but I might be wrong. |
|
Just open ntoskrnl in ida and look for the pattern. |
|
Thanks @Ch40zz I was doing a search too, didn't expect to see it in the .text section :) Its curious that it got moved like that |
|
So I made the following addition and now it loads without issue for me. Once the offsets are fixed for Windows 7 it works perfectly! Thanks for the assistance @BerkanYildiz and @Ch40zz SectionBase = ImgGetImageSection(NtBaseAddress, ".rdata", &SizeOfSection);
if (!SectionBase)
{
SectionBase = ImgGetImageSection(NtBaseAddress, ".text", &SizeOfSection);
if (!SectionBase)
{
return FALSE;
}
}I am happy to post the offsets for Windows 7 too, but I get the impression they were intentionally not included? |
|
Happy you got it working, yay ! 🎉 |
Fixed it. My fault for not testing, sorry.
7601 (6.1.7601.17514) has EtwpDebuggerData in .rdata. Just checked on my end. What version of the 7 kernel is that? |
6.1.7601.24024 (win7sp1_ldr.180112-0600) |
the returned value of NtTraceControl is 0xC0000035 |
|
I don't think you did it correctly. |
The problem has been solved. It is because of my own stupidity. Thanks to @nmulasmajic for your answers. |
|
You shouldn't be calling NtControlTrace without setting the previous mode. The right convention is to use ZwControlTrace and other Zw functions when operating with kernelmode buffers. In this case, your UNICODE_STRING is allocated in the kernel address space. If you don't set your previous mode (which you can do manually), there may be failures due to extended checks later on. Anyway, on most machines the circular kernel context logger should already be running and therefore you should be able to interact with it fine with |
|
Since the call to NtTraceControl happens as a result of executing DriverEntry, would that not mean that the previous mode will already be set to KernelMode due to it being spawned from a system thread? @SpriteOvO Out of interest, what error were you getting when compiling with a newer SDK version? I am using version 10.0.17763.0 and currently have it compiling fine. |
When compiling a driver project with a version other than 10.0.16299.0, the regular header file (such as ntddk.h ntifs.h, etc.) cannot be found. Compiling the win32 program is fine. It should be caused by some errors when I installed wdk. |
@SpriteOvO , |
Previously my AllocateUnicode function was wrong, I forgot to copy the string, causing the ProviderName content to be empty. 😵 this is new. UNICODE_STRING AllocateUnicode(WCHAR *Content)
{
if (Content == NULL) {
return { 0 };
}
UNICODE_STRING Result;
USHORT StringLength = (USHORT)wcslen(Content);
USHORT StringSize = StringLength * sizeof(WCHAR);
USHORT MemorySize = StringSize + sizeof(WCHAR);
WCHAR *StringBuffer = (WCHAR*)ExAllocatePoolWithTag(NonPagedPool, MemorySize, ALLOC_TAG);
RtlZeroMemory(StringBuffer, MemorySize);
RtlCopyMemory(StringBuffer, Content, wcslen(Content) * sizeof(WCHAR));
Result.Buffer = StringBuffer;
Result.Length = StringSize;
Result.MaximumLength = MemorySize;
Result.Buffer[StringLength] = L'\0';
return Result;
}
void FreeUnicode(UNICODE_STRING *pUnicodeString)
{
ExFreePool(pUnicodeString->Buffer);
RtlZeroMemory(pUnicodeString, sizeof(UNICODE_STRING));
} |
thank you very much! my project can biuld, driver can load, but callback "IfhpInternalGetCpuClock" not be called! |
One thing I forgot to say. |
everything is ok, 3Q very much! |
you are welcome. 😄 |
can you tell me how to find OFFSET_WMI_LOGGER_CONTEXT_CPU_CYCLE_CLOCK ? |
Read README.md carefully. |
got it, thanks :) |
|
[-] infinityhook: Failed to initialize with status: 0xc0000139. |
|
https://github.com/everdox/InfinityHook/blob/master/src/libinfinityhook/infinityhook.cpp#L150-L153 Long story short: sig broke. |
do you know how to fix it, my code look not working : |
|
Why don't you try to fix it yourself? lol |
yeah, why not 👍
then edit IfhpResolveSymbols function :
|
|
yes sorry but im just starting everything from internet, just share my fix to who need it. About me, i have nothing to show off. |
I can't execute normally on win7! [IfhpInternalGetCpuClock] cannot be triggered, can you help me? |
No description provided.
The text was updated successfully, but these errors were encountered: