flat assembler
Message board for the users of flat assembler.

Index > Windows > NATIVE API INTERCEPTOR (last pages)

Goto page Previous  1, 2, 3, 4

Should i relase Drivers for create, modify or delete any IDT, GDT or LDT descriptors? (these drivers with source -code may be dangerous in bad hands)
Yes, let programmes know the methods
76%
 76%  [ 13 ]
No, for security reasons
11%
 11%  [ 2 ]
I don't know
11%
 11%  [ 2 ]
Total Votes : 17

Author
Thread Post new topic Reply to topic
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
is 7z format still so rare? Shocked
i tought it is automatically included in many archives programs

I compressed it with 7z because the output file size is smaller than the zip so i can save space in my personal upload/download quota...
(now i'm near 50% and publishing files will full all my remained quota)

Ok, i'll change the package, but i advice you to try IZARC Freeware
For me it is better than winzip or winrar because it has: *.zip,*.rar,*.iso,*.7z,*.lib,*.deb,.......... ect formats included

Once installed you don't need others
Post 14 Jul 2009, 14:35
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
My PC died yesterday....

It couldn't tolerate my kernel tests no more.... Crying or Very sad

With its death, it has taken away all my project! D'OH

R.I.P.

(i'm lucky because i can get back a part of my project just downloading posted packages)
Post 23 Jul 2009, 13:36
View user's profile Send private message Send e-mail Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3170
Location: Denmark
f0dder
1) sysinternals' sync.exe when doing driver development (and ideally a virtual machine or dedicated testbox)

2) source control/revision system

3) backups
Post 23 Jul 2009, 14:07
View user's profile Send private message Visit poster's website Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Thanks f0dder.

What programming language does Mark R. use to make sysinternal's programs so small?

C+ or a kind of High ASM ???
Post 23 Jul 2009, 16:39
View user's profile Send private message Send e-mail Reply with quote
windwakr



Joined: 30 Jun 2004
Posts: 827
Location: Michigan, USA
windwakr
looks like C++, I see the text "Microsoft Visual C++ Runtime Library" in the sync executable. I wouldn't really call 146kB small.
Post 23 Jul 2009, 17:19
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Consider that i downloaded Sync.exe and it is 40 KB and the 70% of size is the license text data.

Also TCPView is 200 KB but about the 25% is data and NULL bytes, so there's 150 KB of code.

IT isn't bigger neither smaller.
I think the FASM one can be 50 KB (only code i intend)

PS: what use have the NULL_subs?
Sometime when disasembling i find the NULL_subs:
Code:
NULL_sub: ret    

Are they useless, only to waste clock cycles?
Post 23 Jul 2009, 17:34
View user's profile Send private message Send e-mail Reply with quote
windwakr



Joined: 30 Jun 2004
Posts: 827
Location: Michigan, USA
windwakr
PIRATA, the zip file is 40kB....the actual executable is 146kB! And 70% of it is not the license data.
Post 23 Jul 2009, 19:24
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
Oh, yes. i was distracted Embarassed
TCPview.exe is correct.
Post 24 Jul 2009, 10:04
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
This is the NATIVE API INTERCEPTOR.
i made it in one day.

It has the driver that intercepts and checks all system call throught SYSENTER.
There's the library that comunicate with the driver when it is loaded into kernel pool, and offers export functions for any programs.

All functions work, but only one thing:
When the driver intercepts a system call it goes into the offset of the user-mode dispatch routine (there is a function that set it), but seems system puts the old interceptor process image into a page and it disappears from RAM, so driver IRETD go into a null code area and cause a stupid error.
I have to find a way to set the interceptions dispatch routine resident in memory (it doesn't change its linear address)

How should i do to let interceptions pass to user-mode program?


Description: Pre-relase
Download
Filename: Native API interceptor.zip
Filesize: 346.72 KB
Downloaded: 178 Time(s)

Post 25 Jul 2009, 12:37
View user's profile Send private message Send e-mail Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
Pirata Derek wrote:
Ok, i'll change the package, but i advice you to try IZARC Freeware
For me it is better than winzip or winrar because it has: *.zip,*.rar,*.iso,*.7z,*.lib,*.deb,.......... ect formats included

Once installed you don't need others
Why just not use 7Zip File manager?

_________________
Previously known as The_Grey_Beast
Post 25 Jul 2009, 14:35
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
To me?

I prefer One program that support multiple purposes (generally).
IZARC is a multi-archives manager.
Post 27 Jul 2009, 07:03
View user's profile Send private message Send e-mail Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
I resolved the first problem in the NATIVE API INTERCEPTOR.

It now Interceptor driver uses KePulseEvent to allert user-mode interceptor library.
After driver allert, WaitForSingleObject function in library will return with signaled state, and then control pass to the monitoring program.

eh, eh... that's an IDEA Idea

The new version is coming soon
Post 27 Jul 2009, 09:07
View user's profile Send private message Send e-mail Reply with quote
Borsuc



Joined: 29 Dec 2005
Posts: 2466
Location: Bucharest, Romania
Borsuc
7-Zip FM can handle many different formats, and has an "Ultra" compression mode that surpasses compression even for Gzip better than gzip.exe.

In short, it compresses better gzip format better than gzip.exe does.

_________________
Previously known as The_Grey_Beast
Post 27 Jul 2009, 21:05
View user's profile Send private message Reply with quote
Pirata Derek



Joined: 31 Oct 2008
Posts: 259
Location: Italy
Pirata Derek
The KePulseEvent always make a Bug check error!
Code:
... ; some driver code
invoke KePulseEvent,[Library_event],NO_INCREMENT,FALSE
...

Library_event rd 1 ; the handle passed from library when syncronizating
    


The handle of EVENT parameter is the same direct returned value from CreateEvent function in the native api hooking library.

SHOULD I DUPLICATE THIS HANDLE SO DRIVER USES THE DIFFERENT LIBRARY ONE THAT REFERS TO THE SAME EVENT ?

How the interceptor works:
1) The interceptor driver is loaded and activated into kernel pool.

The library sends the commands to driver via "FastDriverCall" procedure.

2) Library checks the driver echo (to test FastDriverCall function)
3) Library creates its allarm event (used to signal any system call hooks to library) and sends its event handle to driver (syncronization phase)
4) Library sends the values of system call driver will hook.
5) Finally the library ENABLE the interceptions.

During interceptions the driver do:

1) Checks if EDX = 0 (it means the system call is a library command)
2) If it is a command then driver completes the requested command.
3) Else driver check if EAX (the native api number) is in the hook list
4) If isn't in the hook list then relases execution to NT kernel
5) else driver checks if it is BUSY (another hook is pending)
6) if busy then relases execution to nt kernel.
7) else it saves all the system call informations and pulse the library event
Cool after signaling the hook it waits until the library allow or deny the execution
Post 04 Aug 2009, 12:43
View user's profile Send private message Send e-mail Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page Previous  1, 2, 3, 4

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.