Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Rebuild The Heaven's Gate: from 32 bit Hell back to Heaven Wonderland

adr
May 27, 2021

Rebuild The Heaven's Gate: from 32 bit Hell back to Heaven Wonderland

Microsoft embeds a translation design named WoW64 (Windows 32 on Windows 64) used for running 32 bit PE (Portable Executable format) on 64 bit Windows. The design basically hosts every 32 bit PE file inside as a native standalone 64-bit process and translates every 32-bit system interrupt into a 64-bit syscall. In this talk, we’re going to talk about deep reversing engineering on WoW64 architecture how it does translations, and some uncovered issues about crossing-architecture could be abused in the wild.

https://conference.hitb.org/hitbsecconf2021ams/sessions/wow-hell-rebuilding-heavens-gate/

adr

May 27, 2021
Tweet

More Decks by adr

Other Decks in Technology

Transcript

  1. 414141414141414141
    AAAAAAAAAA
    Rebuild The Heaven's Gate:


    from 32-bit Hell back to 64-bit Wonderland
    [email protected]

    View Slide

  2. • Intern at CyCraft


    • Core member of CHROOT Security Group


    • Spoke at S&P, BlackHat, DEFCON, HITCON


    • Instructor of Ministry Of National Defense,


    Ministry of Education, HITCON, and etc.


    • Publication Windows APT Warfare
    #Windows #Reversing #Pwn #Exploit
    Sheng-Hao Ma (aaaddress1)


    Threat Researcher at TXOne Networks

    View Slide

  3. [email protected]
    • 32-bit Hell & Userland HIPS Design


    • Understanding WOW64 Design by Reversing Engineering


    1. WOW64 Process Initiation


    2. Path to The Heaven


    3. The Paradise Translator


    • The 32-bit Hell v.s. 64-bit Heaven


    • wowGrail: Rebuild the Heaven's Gate


    • wowInjector: One Gadget to Take Over The Hell
    /?outline

    View Slide

  4. [email protected]
    〉〉〉What "The Hell"
    Host-based Intrusion Prevention System (HIPS)

    View Slide

  5. [email protected]
    /?theHell
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques

    View Slide

  6. [email protected]
    /?theHell
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques

    View Slide

  7. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    Ring0
    ntdll64!NtAPI#ZwOpenProcess
    KiFastCall
    Heaven's Gate
    A. switch to 64bit CPU mode by setting cs flag


    B. get PEB64 by (GS:0x30)->PEB


    C. enumerate loaded 64bit modules via PEB->Ldr


    D. locate imageBase of NtDll64


    E. get expored API ntdll!LdrGetProcedureAddress


    F. BOOM! we got the key of Heaven's Gate!
    #theGate

    View Slide

  8. [email protected]
    Reference


    • 2011 - Mixing x86 with x64 code by ReWolf


    • 2012 - Knockin’ on Heaven’s Gate by george_nicolaou


    • 2012 - KERNEL: Creation of Thread Environment Block (TEB) by waleedassar


    • 2015 - WoW64 and So Can You Bypassing EMET by Duo Labs


    • 2018 - WoW64 internals by wbenny


    • 2020 - WOW64 Subsystem Internals and Hooking Techniques by FireEye


    #theGate
    too difficult to use & not stable enough ಥ_ಥ
    • 2021 - wowGrail: Abusing the Translator to Simulate 32-bit Interrupts

    View Slide

  9. [email protected]
    〉〉〉The WOW64 layer


    Understanding WOW64 Design by Reversing Engineering

    View Slide

  10. [email protected]
    〉〉〉WoW64 Process Init


    32-bit Program Managed in 64-bit Process

    View Slide

  11. [email protected]
    #BTCpuSimulate
    wow64cpu!BtCpuSimulate

    View Slide

  12. [email protected]
    #RunSimulatedCode
    wow64cpu!RunSimulatedCode
    r12 point to TEB64 struct


    r15 point to TurboThunk Table


    r13 point to WoW64 Thread Context

    View Slide

  13. [email protected]
    #RunSimulatedCode
    wow64cpu!RunSimulatedCode
    r12 point to TEB64 struct


    r15 point to TurboThunk Table


    r13 point to WoW64 Thread Context

    View Slide

  14. [email protected]
    〉〉〉NtAPI Trampoline

    View Slide

  15. [email protected]
    #Trampoline
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64cpu!CpupReturnFromSimulatedCode

    View Slide

  16. [email protected]
    #Simulate
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64cpu!CpupReturnFromSimulatedCode
    1. save current 32bit context


    status, stack, and caller retAddr


    2. simulate 32bit behavior to 64bit


    KiFastCall by wow64SystemServiceEx


    3. save NTSTATUS into WoW64 Thread


    CONTEXT.eax

    View Slide

  17. [email protected]
    #Simulate
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64cpu!CpupReturnFromSimulatedCode

    View Slide

  18. [email protected]
    〉〉〉Heaven's Translator


    Convert x86 Calling Convention into x64 Mode

    View Slide

  19. [email protected]
    #Translation
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64!Wow64SystemServiceEx

    View Slide

  20. [email protected]
    #Translation
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64!Wow64SystemServiceEx

    View Slide

  21. [email protected]
    #Translation
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64!Wow64SystemServiceEx

    View Slide

  22. [email protected]
    〉〉〉Overview

    View Slide

  23. [email protected]
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    #WoW64
    a. NtAPI

    View Slide

  24. [email protected]
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    #WoW64
    wow64cpu!X86SwitchTo64BitMode
    a. NtAPI
    b. switch x86 → x64 architecture

    View Slide

  25. [email protected]
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    #WoW64
    wow64cpu!X86SwitchTo64BitMode
    a. NtAPI
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status

    View Slide

  26. [email protected]
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    #WoW64
    wow64cpu!X86SwitchTo64BitMode
    a. NtAPI
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status
    wow64!Wow64SystemServiceEx
    d. lookup turbo function

    View Slide

  27. [email protected]
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    #WoW64
    wow64cpu!X86SwitchTo64BitMode
    a. NtAPI
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    invoke ntdll64!NtAPI

    View Slide

  28. [email protected]
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    #WoW64
    wow64cpu!X86SwitchTo64BitMode
    a. NtAPI
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    invoke ntdll64!NtAPI
    Ring0
    f. syscall

    View Slide

  29. [email protected]
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    #WoW64
    wow64cpu!X86SwitchTo64BitMode
    a. NtAPI
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    invoke ntdll64!NtAPI
    Ring0
    f. syscall
    wow64cpu!restoreStatus
    g. back to caller

    View Slide

  30. [email protected]
    #Recap
    • Switching the CS segment to 23h or 33h makes it possible for the Intel


    chip to change the chosen instruction set with 32 bit or 64 bit.


    • Register r13 point to the 32-bit thread context used as snapshot status.


    It will be back up when the thread jumps from 32-bit to 64-bit,


    and reset from 64 bit back to 32-bit.


    • wow64!Wow64SystemServiceEx used as translator for us to simulate


    any 32-bit system interrupt to the 64-bit kernel.

    View Slide

  31. [email protected]
    〉〉〉A New Path to


    the Heaven's Gate

    View Slide

  32. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    wow64cpu!X86SwitchTo64BitMode
    wow64cpu!CpupReturnFromSimulatedCode
    wow64!Wow64SystemServiceEx
    wow64!turbo_func
    Ring0
    ntdll32!NtAPI#ZwOpenProcess
    ntdll64!NtAPI#ZwOpenProcess
    WoW64 Layer
    normal
    KiFastCall

    View Slide

  33. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    wow64cpu!X86SwitchTo64BitMode
    wow64cpu!CpupReturnFromSimulatedCode
    wow64!Wow64SystemServiceEx
    wow64!turbo_func
    Ring0
    ntdll32!NtAPI#ZwOpenProcess
    ntdll64!NtAPI#ZwOpenProcess
    WoW64 Layer
    normal
    KiFastCall
    Abusing The Heaven's Translator

    View Slide

  34. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    Ring0
    ntdll64!NtAPI#ZwOpenProcess
    KiFastCall
    wowGrail
    A. switch to 64bit CPU mode by setting cs flag


    B. get PEB64 by (GS:0x30)->PEB


    C. enumerate loaded 64bit modules via PEB->Ldr


    D. locate imageBase of WoW64.dll


    E. get expored API wow64!Wow64SystemServiceEx


    F. pass 32-bit va_start & executing it to
    simulate our 32-bit as 64-bit interrupt ;)
    #wowGrail
    wow64!Wow64SystemServiceEx

    View Slide

  35. [email protected]
    DEMO: wowGrail
    New Path Back to The Heaven


    github.com/aaaddress1/wowGrail
    Process Hollowing & Bypass HIPS of AV

    View Slide

  36. [email protected]
    〉〉〉WOW64 Thread Snapshot


    One Gadget to Take Over the 32-bit Hell

    View Slide

  37. Ring0
    f. syscall
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    invoke ntdll64!NtAPI
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    wow64cpu!X86SwitchTo64BitMode
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status
    wow64cpu!restoreStatus
    g. back to caller
    a. NtAPI

    View Slide

  38. Ring0
    f. syscall
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    View Slide

  39. Ring0
    f. syscall
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    View Slide

  40. [email protected]
    Recap
    • Register r13 point to the 32-bit thread context used as snapshot status. It
    will be back up when the thread jumps from 32-bit to 64-bit, and reset
    from 64 bit back to 32-bit.


    • when $RIP jump into wow64cpu!X86SwitchTo64BitMode, current thread
    context status will be saved into the 32-bit thread context dereferenced
    from r13.


    • $RIP jump from 64-bit back to 32-bit, and the thread context will be
    restored from the 32-bit thread context.

    → It can be used as one gadget to exploit the next 32-bit $RIP ;)

    View Slide

  41. • 0x2000 or 0x3000 (it's up to WoW64)


    • TEB64 + TEB32 + PEB64 + PEB32


    • fixup TEB64: .self, .peb, .stack etc


    • TEB64.ExceptionList always null


    • fixup TEB32 based on TEB64


    • TEB32.ExceptionList[0] = ffffffff
    0x3000
    → Leak any one of the 4 blocks,


    and we can get the other 3 blocks.
    nt!MiCreatePebOrTeb

    View Slide

  42. [email protected]
    DEMO: wowInjector
    One Gadget Injection


    to Take Over The 32-bit Hell
    Process Inject & Bypass HIPS of another AV
    github.com/aaaddress1/wowInjector

    View Slide

  43. 41414141414141414141414141
    Thanks!
    [email protected]
    Slide
    Github @aaaddress1
    Facebook
    AAAAAAAAAAAAAA
    AAAAAAA
    AAA

    View Slide