3 ms·

> After extensive differential debugging in ProcMon (comparing AppContainer vs non-AppContainer execution), I realized the issue might actually be with the dete

> After extensive differential debugging in ProcMon (comparing AppContainer vs non-AppContainer execution), I realized the issue might actually be with the detected Windows version. Tavis’s code always self-reported the Windows version as Windows XP. My code was reporting the real underlying operating system; Windows 10 in my case. Verification via WinDbg proved that this was indeed the one and only issue causing the initialization failures. I needed to lie to MpEngine about the underlying Windows version. This doesn't make sense to me. It may have been easier to accomplish within the author's skillset, but it seems to me that the more beneficial approach would be to modify Tavis’ code to report the correct version of Windows.

mook 9y ago
My understanding is that: - Tavis' original code ran on Linux, where there's no correct version of Windows - it actually worked with the old code; it's only broken when msmpeng sees the new Windows version - the old code is not in use at all (the whole thing was ported to rust), which didn't have a good DLL interception library So it would seem the suggestion to modify the old code wouldn't help.
tyoma 9y ago
Tavis's code ran on Linux and hooked the import table of Defender's scanning engine to report Windows XP as the underlying Windows version [1]. Originally the author didn't hook and let Defender call the native version check APIs, which (correctly) reported Windows 10. Apparently there was extra initialization code in that case that failed to run in a sandbox. The fix was to reproduce the hooking code, in Rust, to report XP as the underlying Windows version. [1] https://github.com/taviso/loadlibrary/blob/master/peloader/winapi/Version.c#L43 https://github.com/taviso/loadlibrary/blob/master/peloader/w...
- londons_explore 9y ago
  Sounds likley that impersonating an old windows version would probably disable various security features.
dguido 9y ago
The MpEngine behaves differently on XP vs newer operation systems. It was necessary for both Tavis and Andy (Trail of Bits) to lie to MpEngine to get it to start up properly in loadlibrary and AppJailLauncher, respectively.

mook 9y ago

My understanding is that: - Tavis' original code ran on Linux, where there's no correct version of Windows - it actually worked with the old code; it's only broken when msmpeng sees the new Windows version - the old code is not in use at all (the whole thing was ported to rust), which didn't have a good DLL interception library So it would seem the suggestion to modify the old code wouldn't help.

tyoma 9y ago

Tavis's code ran on Linux and hooked the import table of Defender's scanning engine to report Windows XP as the underlying Windows version [1]. Originally the author didn't hook and let Defender call the native version check APIs, which (correctly) reported Windows 10. Apparently there was extra initialization code in that case that failed to run in a sandbox. The fix was to reproduce the hooking code, in Rust, to report XP as the underlying Windows version. [1] https://github.com/taviso/loadlibrary/blob/master/peloader/winapi/Version.c#L43 https://github.com/taviso/loadlibrary/blob/master/peloader/w...

londons_explore 9y ago
Sounds likley that impersonating an old windows version would probably disable various security features.

dguido 9y ago

The MpEngine behaves differently on XP vs newer operation systems. It was necessary for both Tavis and Andy (Trail of Bits) to lie to MpEngine to get it to start up properly in loadlibrary and AppJailLauncher, respectively.