mirror-ac/driver/pool.c

#include "pool.h"

#include <intrin.h>

#include "callbacks.h"
#include "queue.h"

#define PAGE_BASE_SIZE 0x1000
#define POOL_TAG_SIZE 0x004

#define PML4_ENTRY_COUNT 512
#define PDPT_ENTRY_COUNT 512
#define PD_ENTRY_COUNT 512
#define PT_ENTRY_COUNT 512

#define LARGE_PAGE_2MB_ENTRIES 512
#define LARGE_PAGE_1GB_ENTRIES 0x40000

#define CHUNK_SIZE 16

#define PROCESS_OBJECT_ALLOCATION_MARGIN 0x90

#define POOL_TAG_LENGTH 4
#define EXECUTIVE_OBJECT_COUNT 8

#define INDEX_PROCESS_POOL_TAG 0
#define INDEX_THREAD_POOL_TAG 1
#define INDEX_DESKTOP_POOL_TAG 2
#define INDEX_WINDOW_STATIONS_POOL_TAG 3
#define INDEX_MUTANTS_POOL_TAG 4
#define INDEX_FILE_OBJECTS_POOL_TAG 5
#define INDEX_DRIVERS_POOL_TAG 6
#define INDEX_SYMBOLIC_LINKS_POOL_TAG 7

CHAR EXECUTIVE_OBJECT_POOL_TAGS[EXECUTIVE_OBJECT_COUNT][POOL_TAG_LENGTH] =
{
	"\x50\x72\x6f\x63",		/* Process */
	"\x54\x68\x72\x64",		/* Thread */
	"\x44\x65\x73\x6B",		/* Desktop */
	"\x57\x69\x6E\x64",		/* Windows Station */
	"\x4D\x75\x74\x65",		/* Mutants i.e mutex etc. */
	"\x46\x69\x6C\x65",		/* File objects */
	"\x44\x72\x69\x76",		/* Drivers */
	"\x4C\x69\x6E\x6B"		/* Symbolic links */
};

typedef struct _PROCESS_SCAN_CONTEXT
{
	ULONG process_count;
	PVOID process_buffer;

}PROCESS_SCAN_CONTEXT, * PPROCESS_SCAN_CONTEXT;

PKDDEBUGGER_DATA64
GetGlobalDebuggerData()
{
	CONTEXT context = { 0 };
	PDUMP_HEADER dump_header = { 0 };
	UINT64 thread_state;
	PKDDEBUGGER_DATA64 debugger_data = NULL;

	context.ContextFlags = CONTEXT_FULL;

	RtlCaptureContext(&context);

	dump_header = ExAllocatePool2(POOL_FLAG_NON_PAGED, DUMP_BLOCK_SIZE, POOL_DUMP_BLOCK_TAG);

	if (!dump_header)
		goto end;

	KeCapturePersistentThreadState(
		&context,
		NULL,
		NULL,
		NULL,
		NULL,
		NULL,
		NULL,
		dump_header
	);

	debugger_data = (PKDDEBUGGER_DATA64)ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(KDDEBUGGER_DATA64), POOL_DEBUGGER_DATA_TAG);

	if (!debugger_data)
		goto end;

	RtlCopyMemory(debugger_data, dump_header->KdDebuggerDataBlock, sizeof(KDDEBUGGER_DATA64));

end:

	if (dump_header)
		ExFreePoolWithTag(dump_header, POOL_DUMP_BLOCK_TAG);

	return debugger_data;
}

VOID
GetPsActiveProcessHead(
	_In_ PUINT64 Address
)
{
	PKDDEBUGGER_DATA64 debugger_data = GetGlobalDebuggerData();

	*Address = *(UINT64*)(debugger_data->PsActiveProcessHead);

	ExFreePoolWithTag(debugger_data, POOL_DEBUGGER_DATA_TAG);
}

/*
* Here we define a signature that can be used to find EPROCESS structures consistently across
* major windows versions. The fields we test have proven to be consistent in the following study:
*
* https://www.cise.ufl.edu/~traynor/papers/ccs09b.pdf
*
* Aswell as some of my own additional research and testing. The following signature is used:
*
* PeakVirtualSize must be greater then 0 for any valid process:
*	-> EPROCESS->PeakVirtualSize > 0
*
* The DirectoryTableBase must be 0x20 aligned:
*	-> EPROCESS->DirectoryTableBase % 20 == 0
*
* The pool allocation size must be greater then the size of an EPROCESS allocation and
* less then the size of a page. Allocation size can be found with the following formula:
*	-> AllocationSize = POOL_HEADER->BlockSize * CHUNK_SIZE - sizeof(POOL_HEADER)
*	-> AllocationSize > sizeof(EPROCESS)
*	-> AllocationSize < PAGE_SIZE (4096)
*
* Pool type must be non-null:
*	-> POOL_HEADER->PoolType != NULL
*
* The process PEB must be a usermode address and 0x1000 aligned:
*	-> EPROCESS->Peb & 0x7ffd0000 == 0x7ffd0000 && EPROCESS->Peb % 0x1000 == 0
*
* The object table must have the following properties and be 0x8 aligned:
*	-> EPROCESS->ObjectTable & 0xe0000000 == 0xe0000000 && EPROCESS->ObjectTable % 0x8 == 0
*
* The allocation size, when AND'd with 0xfff0 must not equal 0xfff0:
*	-> AllocationSize & 0xfff0 != 0xfff0
*
* This signature will allow us to consistently and accurately determine if a given pool allocation is
* indeed an executive process allocation across major versions of Windows.
*/
STATIC
BOOLEAN
ValidateIfAddressIsProcessStructure(
	_In_ PVOID Address,
	_In_ PPOOL_HEADER PoolHeader
)
{
	UINT64 peak_virtual_size = NULL;
	UINT64 dir_table_base = NULL;
	UINT64 allocation_size = NULL;
	UINT64 peb = NULL;
	UINT64 object_table = NULL;
	BOOLEAN peb_test = FALSE;
	BOOLEAN object_table_test = FALSE;
	UINT64 allocation_size_test = NULL;

	if (MmIsAddressValid((UINT64)Address + KPROCESS_DIRECTORY_TABLE_BASE_OFFSET))
		dir_table_base = *(UINT64*)((UINT64)Address + KPROCESS_DIRECTORY_TABLE_BASE_OFFSET);

	if (MmIsAddressValid((UINT64)Address + EPROCESS_PEAK_VIRTUAL_SIZE_OFFSET))
		peak_virtual_size = *(UINT64*)((UINT64)Address + EPROCESS_PEAK_VIRTUAL_SIZE_OFFSET);

	if (MmIsAddressValid((UINT64)PoolHeader + POOL_HEADER_BLOCK_SIZE_OFFSET))
		allocation_size = PoolHeader->BlockSize * CHUNK_SIZE - sizeof(POOL_HEADER);

	if (MmIsAddressValid((UINT64)Address + EPROCESS_PEB_OFFSET))
		peb = *(UINT64*)((UINT64)Address + EPROCESS_PEB_OFFSET);

	if (MmIsAddressValid((UINT64)Address + EPROCESS_OBJECT_TABLE_OFFSET))
		object_table = *(UINT64*)((UINT64)Address + EPROCESS_OBJECT_TABLE_OFFSET);

	peb_test = peb == NULL || (peb & 0x7ffd0000 == 0x7ffd0000 && peb % 0x1000 == NULL);
	object_table_test = object_table == NULL || (object_table & 0xe0000000 == 0xe0000000 && object_table % 0x8 == 0);
	allocation_size_test = allocation_size & 0xfff0;

	if (peak_virtual_size > 0 && (dir_table_base & 0x20) == 0 &&
		allocation_size > (EPROCESS_SIZE + OBJECT_HEADER_SIZE + sizeof(POOL_HEADER)) &&
		PoolHeader->PoolType != NULL && !(allocation_size_test == 0xfff0) && !peb_test && !object_table_test)
	{
		return TRUE;
	}

	return FALSE;
}

/*
* OBJECT_HEADER->InfoMask is a bit mask that tells us which optional
* headers the object has. The bits are as follows:
*
* 0x1 = OBJECT_HEADER_CREATOR_INFO
* 0x2 = OBJECT_HEADER_NAME_INFO
* 0x4 = OBJECT_HEADER_HANDLE_INFO
* 0x8 = OBJECT_HEADER_QUOTA_INFO
* 0x10 = OBJECT_HEADER_PROCESS_INFO
* 0x20 = OBJECT_HEADER_AUDIT_INFO
* 0x40 = OBJECT_HEADER_HANDLE_REVOCATION_INFO
*/

/*
* Idea: since we don't know the number of headers or the exact memory layout of the object
* header section for these proc allocations, we can form an estimate address of base + 0x70
* and then iterate the loaded process list and if theres an address within say 0x50 of it we
* can assume that the process is legitmate. Then to find an unlinked process, it wouldn't
* exist in the loaded module list, check that it hasnt been deallocated and then focus on
* scanning it for name etc. Maybe scan for .exe extension?
*
* Also use the full name so we get the file extension and path not the 15 char long one
*/
STATIC
VOID
ScanPageForKernelObjectAllocation(
	_In_ UINT64 PageBase,
	_In_ ULONG PageSize,
	_In_ ULONG ObjectIndex,
	_In_ PPROCESS_SCAN_CONTEXT Context
)
{
	INT length = 0;
	CHAR current_char;
	CHAR current_sig_byte;
	PPOOL_HEADER pool_header;
	PEPROCESS process = NULL;
	PEPROCESS process_size_one = NULL;
	PEPROCESS process_size_two = NULL;
	PEPROCESS test_process = NULL;
	LPCSTR process_name;
	PUINT64 address_list;
	ULONG allocation_size;
	ULONG minimum_process_allocation_size = EPROCESS_SIZE - sizeof(POOL_HEADER) - OBJECT_HEADER_SIZE;

	if (!PageBase || !PageSize)
		return;

	for (INT offset = 0; offset <= PageSize - POOL_TAG_LENGTH - minimum_process_allocation_size; offset++)
	{
		for (INT sig_index = 0; sig_index < POOL_TAG_LENGTH + 1; sig_index++)
		{
			if (!MmIsAddressValid(PageBase + offset + sig_index))
				break;

			current_char = *(PCHAR)(PageBase + offset + sig_index);
			current_sig_byte = EXECUTIVE_OBJECT_POOL_TAGS[ObjectIndex][sig_index];

			if (sig_index == POOL_TAG_LENGTH)
			{
				pool_header = (UINT64)PageBase + offset - POOL_HEADER_TAG_OFFSET;

				if (!MmIsAddressValid((PVOID)pool_header))
					break;

				/*
				* Since every executive allocation is required to have an _OBJECT_HEADER, we start
				* iterating from the size of this object header, then jump up in blocks of 0x10 since
				* every object header is divisible by 0x10. We iterate up to 0xb0 which is equal to the following:
				*
				* 0xb0 = sizeof(ALL_HEADER_OBJECTS) + 0x10 where the 0x10 is 16 bytes of padding.
				*/
				for (ULONG header_size = OBJECT_HEADER_SIZE; header_size < 0xb0; header_size += 0x10)
				{
					test_process = (PEPROCESS)((UINT64)pool_header + sizeof(POOL_HEADER) + header_size);

					if (ValidateIfAddressIsProcessStructure(test_process, pool_header))
					{
						process = test_process;
						break;
					}
				}

				if (process == NULL)
					break;

				DEBUG_LOG("Process: %llx", (UINT64)process);

				address_list = (PUINT64)Context->process_buffer;

				for (INT i = 0; i < Context->process_count; i++)
				{
					if (address_list[i] == NULL)
					{
						address_list[i] = (UINT64)process;
						break;
					}
				}

				break;
			}

			if (current_char != current_sig_byte)
				break;
		}
	}
}

/*
* Using MmGetPhysicalMemoryRangesEx2(), we can get a block of structures that
* describe the physical memory layout. With each physical page base we are going
* to enumerate, we want to make sure it lies within an appropriate region of
* physical memory, so this function is to check for exactly that.
*/
STATIC
BOOLEAN
IsPhysicalAddressInPhysicalMemoryRange(
	_In_ UINT64 PhysicalAddress,
	_In_ PPHYSICAL_MEMORY_RANGE PhysicalMemoryRanges
)
{
	ULONG page_index = 0;
	UINT64 start_address = 0;
	UINT64 end_address = 0;

	while (PhysicalMemoryRanges[page_index].NumberOfBytes.QuadPart != NULL)
	{
		start_address = PhysicalMemoryRanges[page_index].BaseAddress.QuadPart;
		end_address = start_address + PhysicalMemoryRanges[page_index].NumberOfBytes.QuadPart;

		if (PhysicalAddress >= start_address && PhysicalAddress <= end_address)
			return TRUE;

		page_index++;
	}

	return FALSE;
}

STATIC
VOID
EnumerateKernelLargePages(
	_In_ UINT64 PageBase,
	_In_ ULONG PageSize,
	_In_ PPROCESS_SCAN_CONTEXT Context,
	_In_ ULONG ObjectIndex
)
{
	/*
	* Split the large pages up into blocks of 0x1000 and scan each block
	*/
	for (UINT64 page_index = 0; page_index < PageSize; page_index++)
	{
		ScanPageForKernelObjectAllocation(
			PageBase + (page_index * PAGE_SIZE),
			PAGE_SIZE,
			ObjectIndex,
			Context
		);
	}
}

/*
* This is your basic page table walk function. On intel systems, paging has 4 levels,
* each table holds 512 entries with a total size of 0x1000 (512 * sizeof(QWORD)). Each entry
* in each table contains a value with a subset bitfield containing the physical address
* of the base of the next table in the structure. So for example, a PML4 entry contains
* a physical address that points to the base of the PDPT table, it is the same for a PDPT
* entry -> PD base and so on.
*
* However, as with all good things Windows has implemented security features meaning
* we cannot use functions such as MmCopyMemory or MmMapIoSpace on paging structures,
* so we must find another way to walk the pages. Luckily for us, there exists
* MmGetVirtualForPhysical. This function is self explanatory and returns the corresponding
* virtual address given a physical address. What this means is that we can extract a page
* entry physical address, pass it to MmGetVirtualForPhysical which returns us the virtual
* address of the base of the next page structure. This is because page tables are still
* mapped by the kernel and exist in virtual memory just like everything else and hence
* reading the value at all 512 entries from the virtual base will give us the equivalent
* value as directly reading the physical address.
*
* Using this, we essentially walk the page tables as any regular translation would
* except instead of simply reading the physical we translate it to a virtual address
* and extract the physical address from the value at each virtual address page entry.
*/
STATIC
VOID
WalkKernelPageTables(
	_In_ PPROCESS_SCAN_CONTEXT Context
)
{
	CR3 cr3;
	PML4E pml4_base;
	PML4E pml4_entry;
	UINT64 pdpt_base;
	UINT64 pd_base;
	UINT64 pt_base;
	PDPTE pdpt_entry;
	PDPTE_LARGE pdpt_large_entry;
	PDE pd_entry;
	PDE_LARGE pd_large_entry;
	PTE pt_entry;
	UINT64 base_physical_page;
	UINT64 base_virtual_page;
	UINT64 base_2mb_virtual_page;
	UINT64 base_1gb_virtual_page;
	PHYSICAL_ADDRESS physical;
	PPHYSICAL_MEMORY_RANGE physical_memory_ranges;
	KIRQL irql;

	physical_memory_ranges = MmGetPhysicalMemoryRangesEx2(NULL, NULL);

	if (physical_memory_ranges == NULL)
	{
		DEBUG_ERROR("LOL stupid cunt not working");
		return;
	}

	cr3.BitAddress = __readcr3();

	physical.QuadPart = cr3.Bits.PhysicalAddress << PAGE_4KB_SHIFT;

	pml4_base.BitAddress = MmGetVirtualForPhysical(physical);

	if (!MmIsAddressValid(pml4_base.BitAddress) || !pml4_base.BitAddress)
		return;

	for (INT pml4_index = 0; pml4_index < PML4_ENTRY_COUNT; pml4_index++)
	{
		if (!MmIsAddressValid(pml4_base.BitAddress + pml4_index * sizeof(UINT64)))
			continue;

		pml4_entry.BitAddress = *(UINT64*)(pml4_base.BitAddress + pml4_index * sizeof(UINT64));

		if (pml4_entry.Bits.Present == NULL)
			continue;

		physical.QuadPart = pml4_entry.Bits.PhysicalAddress << PAGE_4KB_SHIFT;

		pdpt_base = MmGetVirtualForPhysical(physical);

		if (!pdpt_base || !MmIsAddressValid(pdpt_base))
			continue;

		for (INT pdpt_index = 0; pdpt_index < PDPT_ENTRY_COUNT; pdpt_index++)
		{
			if (!MmIsAddressValid(pdpt_base + pdpt_index * sizeof(UINT64)))
				continue;

			pdpt_entry.BitAddress = *(UINT64*)(pdpt_base + pdpt_index * sizeof(UINT64));

			if (pdpt_entry.Bits.Present == NULL)
				continue;

			if (IS_LARGE_PAGE(pdpt_entry.BitAddress))
			{
				/* 1gb size page */
				pdpt_large_entry.BitAddress = pdpt_entry.BitAddress;

				physical.QuadPart = pdpt_large_entry.Bits.PhysicalAddress << PAGE_1GB_SHIFT;

				if (IsPhysicalAddressInPhysicalMemoryRange(physical.QuadPart, physical_memory_ranges) == FALSE)
					continue;

				base_1gb_virtual_page = MmGetVirtualForPhysical(physical);

				if (!base_1gb_virtual_page || !MmIsAddressValid(base_1gb_virtual_page))
					continue;

				EnumerateKernelLargePages(
					base_1gb_virtual_page,
					LARGE_PAGE_1GB_ENTRIES,
					Context,
					INDEX_PROCESS_POOL_TAG
				);

				continue;
			}

			physical.QuadPart = pdpt_entry.Bits.PhysicalAddress << PAGE_4KB_SHIFT;

			pd_base = MmGetVirtualForPhysical(physical);

			if (!pd_base || !MmIsAddressValid(pd_base))
				continue;

			for (INT pd_index = 0; pd_index < PD_ENTRY_COUNT; pd_index++)
			{
				if (!MmIsAddressValid(pd_base + pd_index * sizeof(UINT64)))
					continue;

				pd_entry.BitAddress = *(UINT64*)(pd_base + pd_index * sizeof(UINT64));

				if (pd_entry.Bits.Present == NULL)
					continue;

				if (IS_LARGE_PAGE(pd_entry.BitAddress))
				{
					/* 2MB size page */
					pd_large_entry.BitAddress = pd_entry.BitAddress;

					physical.QuadPart = pd_large_entry.Bits.PhysicalAddress << PAGE_2MB_SHIFT;

					if (IsPhysicalAddressInPhysicalMemoryRange(physical.QuadPart, physical_memory_ranges) == FALSE)
						continue;

					base_2mb_virtual_page = MmGetVirtualForPhysical(physical);

					if (!base_2mb_virtual_page || !MmIsAddressValid(base_2mb_virtual_page))
						continue;

					EnumerateKernelLargePages(
						base_2mb_virtual_page,
						LARGE_PAGE_2MB_ENTRIES,
						Context,
						INDEX_PROCESS_POOL_TAG
					);

					continue;
				}

				physical.QuadPart = pd_entry.Bits.PhysicalAddress << PAGE_4KB_SHIFT;

				if (!MmIsAddressValid(pd_base + pd_index * sizeof(UINT64)))
					continue;

				pt_base = MmGetVirtualForPhysical(physical);

				if (!pt_base || !MmIsAddressValid(pt_base))
					continue;

				for (INT pt_index = 0; pt_index < PT_ENTRY_COUNT; pt_index++)
				{
					if (!MmIsAddressValid(pt_base + pt_index * sizeof(UINT64)))
						continue;

					pt_entry.BitAddress = *(UINT64*)(pt_base + pt_index * sizeof(UINT64));

					if (pt_entry.Bits.Present == NULL)
						continue;

					physical.QuadPart = pt_entry.Bits.PhysicalAddress << PAGE_4KB_SHIFT;

					/* if the page base isnt in a legit region, go next */
					if (IsPhysicalAddressInPhysicalMemoryRange(physical.QuadPart, physical_memory_ranges) == FALSE)
						continue;

					base_virtual_page = MmGetVirtualForPhysical(physical);

					/* stupid fucking intellisense error GO AWAY! */
					if (base_virtual_page == NULL || !MmIsAddressValid(base_virtual_page))
						continue;

					ScanPageForKernelObjectAllocation(
						base_virtual_page,
						PAGE_BASE_SIZE,
						INDEX_PROCESS_POOL_TAG,
						Context
					);
				}
			}
		}
	}

	DEBUG_LOG("Finished scanning memory");
}

STATIC
VOID
IncrementProcessCounter(
	_In_ PEPROCESS Process,
	_In_opt_ PVOID Context
)
{
	PPROCESS_SCAN_CONTEXT context = (PPROCESS_SCAN_CONTEXT)Context;

	if (!context)
		return;

	context->process_count++;
}

STATIC
VOID
CheckIfProcessAllocationIsInProcessList(
	_In_ PEPROCESS Process,
	_In_opt_ PVOID Context
)
{
	PUINT64 allocation_address;
	PPROCESS_SCAN_CONTEXT context = (PPROCESS_SCAN_CONTEXT)Context;

	if (!context)
		return;

	for (INT i = 0; i < context->process_count; i++)
	{
		allocation_address = (PUINT64)context->process_buffer;

		if ((UINT64)Process >= allocation_address[i] - PROCESS_OBJECT_ALLOCATION_MARGIN &&
			(UINT64)Process <= allocation_address[i] + PROCESS_OBJECT_ALLOCATION_MARGIN)
		{
			RtlZeroMemory((UINT64)context->process_buffer + i * sizeof(UINT64), sizeof(UINT64));
		}
	}
}

NTSTATUS
FindUnlinkedProcesses(
	_In_ PIRP Irp
)
{
	PUINT64 allocation_address;
	PROCESS_SCAN_CONTEXT context = { 0 };
	PINVALID_PROCESS_ALLOCATION_REPORT report_buffer = NULL;

	EnumerateProcessListWithCallbackFunction(
		IncrementProcessCounter,
		&context
	);

	if (context.process_count == NULL)
	{
		DEBUG_ERROR("Failed to get process count");
		return STATUS_ABANDONED;
	}

	context.process_buffer = 
		ExAllocatePool2(POOL_FLAG_NON_PAGED, context.process_count * 2 * sizeof(UINT64), PROCESS_ADDRESS_LIST_TAG);

	if (!context.process_buffer)
		return STATUS_ABANDONED;

	WalkKernelPageTables(&context);

	EnumerateProcessListWithCallbackFunction(
		CheckIfProcessAllocationIsInProcessList,
		NULL
	);

	allocation_address = (PUINT64)context.process_buffer;

	for (INT i = 0; i < context.process_count; i++)
	{
		if (allocation_address[i] == NULL)
			continue;

		/*
		* It's important to remember that at this point it is still not guaranteed that we have found
		* an unlinked process allocation. It is better to have a few false positives that can be later
		* analysed rather then enforce a strict signature and potentially miss a real unlinked process.
		*/
		DEBUG_ERROR("INVALID POOL proc OMGGG");

		report_buffer = 
			ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(INVALID_PROCESS_ALLOCATION_REPORT), REPORT_POOL_TAG);

		if (!report_buffer)
			goto end;

		report_buffer->report_code = REPORT_INVALID_PROCESS_ALLOCATION;

		RtlCopyMemory(
			report_buffer->process,
			(UINT64)allocation_address[i] - OBJECT_HEADER_SIZE,
			REPORT_INVALID_PROCESS_BUFFER_SIZE
		);

		InsertReportToQueue(report_buffer);
	}

end:

	if (context.process_buffer)
		ExFreePoolWithTag(context.process_buffer, PROCESS_ADDRESS_LIST_TAG);

	return STATUS_SUCCESS;
}