軟件調試(4) - 探討內核進程對象與內核簡介

每個Win32進程擁有以下元素:

- 一個全局唯一的PID
- 一個可執行映象(IMAGE)
- 一個或多個線程
- 一個EPROCESS位於內核空間
- 一個對象句柄表 用以記錄或索引該進程所創建/打開的內核對象
- 一個用於描述內存目錄表起始位址的基址,簡稱頁目錄基址(DirBase),當cpu切換時會將該地址加載到cr3 -> 一直索引到真實存在的物理地
- 一個位於用戶空間中的進程環境塊(peb) , 被內核空間映射到用戶空間
- 一個訪問權限令牌(access token) 用於表示進程用戶,安全組,優先級


!process 0 0

第一個為pid, 0代表所有進程,第二個0指定要顯示的進程屬性,0代表進程基本屬性

EPROCESS
------------------------------------
dt _EPROCESS 86a7d030

把目標地址用_EPROCESS結構解析


EPROCESS有兩個與調試有關的位
- DebugPort ; EPROCESS+0xBC
- ExceptionPort ; EPROCESS+0xC0

PEB
-------------------------------------
PEB是進程環境塊, 它包含了進程的大多數用戶態信息, 與EPROCESS結構是位於內核空間不同
PEB是在內核態建立後,映射到用戶空間, 因此,在一個系統中,多個進程的PEB地址可能是同一個值
因為PEB是生存在R3

.process 86a7d030 <<< 先指明進程eprocess位置 dt _PEB 7ffdf000 <<< 才能使用dt _PEB 查看進程peb SESSION ID -------------------------------------- 進程的SESSION ID 是指該進程所在的WINDOWS會話的ID號, 當有多個用戶同時登錄時,WINDOWS會為每個用戶建立一個會話, - 每個會話有自己的WorkStation和卓面 - 這樣可以工作在不同的會話中共用同一個windows系統 - 對於典型xp系統,當只有一個用戶登錄時,用戶啟動的程序和系統服務都在session 0 - 當切換到另一個用戶時,系統會建立session 2, 如此類推...... - vista只允許系統服務(驅動)運行在session 0 , 因此一開機會有兩個子系統進程(csrss.exe) 對象表格 ---------------------------------------- ObjectTable被用作翻譯句柄成指向內核對象的指針 快速調用 ----------------------------------------- - 可以使用CPUID指令檢查是否支持快速調用 - 不支持=>INT2E =>查看idt=>KiSystemService
- 支持=> MSR寄存器 174H,175H,176H 對應 CS選擇子,ESP,EIP ->Kifastcallentry

逆向調用
-----------------------------------------
-兩種方法 由R3進入R0
-由R0逆向調用R3, 可以透過KiCallUserMode發起調用=>接下來執行ntdll的KiUserCallbackDispatcher,然後他會調用內核希望調用的用戶態函數,當用戶態工作完成後,執行返回動作函數會執行INT 2b產生異常,這個異常處理函數是內核態的KiCallbackReturn函數

整個系統調用與逆向調用在(p.183) GetMessage例子

內核空間
------------------------------------------
硬件抽象層 (HAL)
操作系統內核
執行體
內核態驅動程序
win32子系統驅動程序
內核支持模塊

內核文件+執行體 = NTOSKRNL.exe
-------------------------------------------
單核CPU: WIN64bit => NTOSKRNL.Exe
WIN32bit => NTKRNLPA.Exe(支持PAE) 或NTOSKRNL.Exe(不支持PAE)
多核CPU: 64BIT => NTKRNLMP.exe
32bit => NTKRPAMP.Exe(支持PAE) 或NTKRNLMP.exe(不支持PAE)

加載過程參考(P.186)

HALL.dll 標準平台

Idle.exe和system.exe 沒有真實文件存在,只有內核模式

用戶空間
--------------------------------------------
會話管理進程(SMSS.exe) => 第一個根據映像文件創建的進程 , 由執行體初始化函數創建=>他負責加載win32.sys,創建win32子系統服務器進程(CSRSS.exe),並建立登陸進程,Winlogon.exe

Windws子系統服務器進程(CSRSS.exe) 負責維護Windows子系統(win32k.sys)的日常事務,為子系統中的各個進程提供服務,如登記進程,線程,管理窗口,管理dos程序虛擬機,CSRSS是client/server runtime server subsystem

登陸進程(WinLogon.exe),負責用戶登陸,和安全有關事務
本地安全和認證進程(lsass.exe),負責用戶驗證
服務管理進程(Service.exe),負責啟動和管理系統服務程序(按照nt系統服務規範寫的exe),通常沒有界面,只在後台運行,例如:
- spoolsv.exe打印機脫機服務,
- wmiPrvSE.exe是WMI提供器管理服務,
- svchost.exe是一個通用的服務宿主進程(由他產生其他服務)



參考:Windows軟件調試

Comments

Post a Comment

Popular posts from this blog

Android Kernel Development - Kernel compilation and Hello World

Image
Introduction Due to the lack of the material that clearly kick off the  android kernel development , hopefully it will gives the clearer  guide to develop your own android driver and debugging it. p.s. Due to the version differential, this article  is not ensure all of the Android Version , SDK version,  source  code , and   Emulator is compatible , however,  the door of   research is always opened,   just   feel   free   to contact me  and play together :P All the materials   are also  saved   in   the VM  ,   you can just directly leverage  the  existing VM Image for  development or  alternatively, as a research and studying, follow the following guide  to create your own workplace.  Android kernel didn't have dynamically insmod like the other linux, so this tutorial is trying to build a new Android Kernel and make test our kernel driver as well. Material Ubuntu 18.04.2 LTS  Android studio Android ndk-r10 Android SDK Goldfish v3.10 VMWare 15   
Read more

How does Nested-Virtualization works?

Image
What is Nested virtualization? ----------------------------------------------------------------------------------------------------- Nowadays, Software Security is becoming more important criteria in the industry, and in recent years, virtualization as a popular topic for protecting / attacking a software, however, most of the virtualization technology framework (bluepill-liked) is not provide an ability that let a guest virtualize one more layer, we called it "Nested Virtualization", level 2. Basic Virtual Machine Monitor Architecture ------------------------------------------------------------------------------------------------------ Figure[1] Host VMM trap any type of event which wants to monitor, such as, Interrupt, exception, privileged register access, one of this event is VMX instruction, after VMM loaded, VMM can always monitor a any one of the  VMX instructions, which provide a good chance for us. As following chart: Figure[2] VMM Life Cycle
Read more

Understanding ACPI and Device Tree

Image
This blog document and help to understand how ACPI works AML (ACPI Machine Language) AML is compiled binary that written in the ACPI Source Language (ASL) and it is interpreted binary that interpreted by AML interpreter during OS runtime. AML is provided by hardware manufacture and embedded in the firmware, it provides the entire device base hierarchy (all thing that equipped on your motherboard, and cannot be removed.) and function to OS that could interface the dedicated hardware, like PCI-ISA bridge or processor, controlling the power, turn on/off, etc. AML operated by different object type, and defined in definition block in firmware table (DSDT / SSDT) AML object type Scope String   Constant Package Control Method Device   ACPI Object  Naming Convention 1. All object names are 32 bits long. 2. The first byte of a name must be one of 'A' - 'Z', '_'. 3. Each of the remaining bytes of a name must be one of 'A' - 'Z', '0' - '
Read more