5 ms·

The site only lists structure definitions without corresponding API functions. There's no explanation what a structure is for, and where it is used... How can

by kgeist 4y ago

The site only lists structure definitions without corresponding API functions. There's no explanation what a structure is for, and where it is used... How can it be practically useful?

therein 4y ago
Extremely useful source for Direct Kernel Object Manipulation. [0] Say I am a Windows driver, and I am running on a system thread. I can do something like this: PKTHREAD currentThread = KeGetCurrentThread(); PVOID win32ThreadPtr = (PVOID)((char*)currentThread + OFFSET_win32ThreadOffset); memcpy(win32ThreadPtr, &newWin32Value, sizeof(PVOID)); PVOID processPtr = (PVOID)((char*)currentThread + OFFSET_processOffset); memcpy(processPtr, &newProcess, sizeof(PEPROCESS)); PVOID clientIdPtr = (PVOID)((char*)currentThread + OFFSET_CID); memcpy(clientIdPtr, &newClientId, sizeof(CLIENT_ID)); And "spoof" these values for my thread which would allow me to make calls to Win32 APIs and I can draw on screen from kernel. PKTHREAD is a pointer to an opaque structure but not opaque to you if you look at Vergilius. Sometimes Microsoft only documents the first N bytes of a struct while the rest is left opaque to us as well. Vergilius where you'd most likely find yourself looking at to find the offsets at which a field is found in a struct for each Windows build. Basically many of these structs are known to be inputs to and outputs of documented and undocumented Windows APIs. And the lesser known ones are inner fields or references from these, or used in unexported functions and discussed in circles interested in this niche. [0] https://en.wikipedia.org/wiki/Direct_kernel_object_manipulation https://en.wikipedia.org/wiki/Direct_kernel_object_manipulat...
_8j50 4y ago
Let's say you are analyzing a crashdump or a memory image after a compromise or developing malware or exploit primitives. Api functions are one thing but making sense if the data in memory or abusing api (and non-api) functions is easier when you see all the hidden structures available.

by kgeist 4y ago

The site only lists structure definitions without corresponding API functions. There's no explanation what a structure is for, and where it is used... How can it be practically useful?

therein 4y ago

Extremely useful source for Direct Kernel Object Manipulation. [0] Say I am a Windows driver, and I am running on a system thread. I can do something like this: PKTHREAD currentThread = KeGetCurrentThread(); PVOID win32ThreadPtr = (PVOID)((char*)currentThread + OFFSET_win32ThreadOffset); memcpy(win32ThreadPtr, &newWin32Value, sizeof(PVOID)); PVOID processPtr = (PVOID)((char*)currentThread + OFFSET_processOffset); memcpy(processPtr, &newProcess, sizeof(PEPROCESS)); PVOID clientIdPtr = (PVOID)((char*)currentThread + OFFSET_CID); memcpy(clientIdPtr, &newClientId, sizeof(CLIENT_ID)); And "spoof" these values for my thread which would allow me to make calls to Win32 APIs and I can draw on screen from kernel. PKTHREAD is a pointer to an opaque structure but not opaque to you if you look at Vergilius. Sometimes Microsoft only documents the first N bytes of a struct while the rest is left opaque to us as well. Vergilius where you'd most likely find yourself looking at to find the offsets at which a field is found in a struct for each Windows build. Basically many of these structs are known to be inputs to and outputs of documented and undocumented Windows APIs. And the lesser known ones are inner fields or references from these, or used in unexported functions and discussed in circles interested in this niche. [0] https://en.wikipedia.org/wiki/Direct_kernel_object_manipulation https://en.wikipedia.org/wiki/Direct_kernel_object_manipulat...

_8j50 4y ago

Let's say you are analyzing a crashdump or a memory image after a compromise or developing malware or exploit primitives. Api functions are one thing but making sense if the data in memory or abusing api (and non-api) functions is easier when you see all the hidden structures available.