Upgrade to Pro — share decks privately, control downloads, hide ads and more …

重建天堂之門:從 32bit 地獄一路打回天堂聖地

adr
May 06, 2021

重建天堂之門:從 32bit 地獄一路打回天堂聖地

微軟在設計 64bit 的 Windows 時為了向下兼容大多數仍未升級至 64bit 的三十二位元程式,因此設計了一套稱為 Windows 32 on Windows 64 (WoW64) 的架構,此架構用以將 32bit 應用程式託管於 64bit Process 之中,讓 32bit 應用程式通過 WoW64 架構能得以仿真出 64bit 系統中斷呼叫。

本議程將會深度逆向工程 WoW64 架構,並分析此架構從 Kernel 至 Userland 所有流程與 x86 → x64 轉譯仿真原理。並在議程末提出幾個當今安全領域尚未考慮到跨架構問題,因而可以惡意利用 WoW64 的幾種不同手段。

https://cyber.ithome.com.tw/2021/session-page/136

adr

May 06, 2021
Tweet

More Decks by adr

Other Decks in Technology

Transcript

  1. 2021

    Rebuild The Heaven's Gate:


    from 32-bit Hell back to 64-bit Wonderland
    Sheng-Hao Ma

    View full-size slide

  2. April 21, 2021
    2
    Sheng-Hao Ma


    Threat Researcher at TXOne Networks
    • Core member of CHROOT Security Group


    • Over 10-year experience in reverse engineering, Windows
    vulnerability, and Intel 8086.


    • Spoke at S&P, BlackHat, DEFCON, HITB, HITCON, VXCON,
    CYBERSEC, and etc.


    • Instructor of Ministry of National Defense, Ministry of
    Education, HITCON, and etc.


    • Publication "Windows APT Warfare: 惡意程式前線作戰指南"

    View full-size slide

  3. April 21, 2021
    Outline
    A. 32-bit Hell & Userland HIPS Design


    B. Understanding WOW64 Design by Reversing Engineering


    - WOW64 Process Initiation


    - Path to The Heaven


    - Bishop: The Paradise Translator


    C. The 32 bit Hell v.s. 64 bit Heaven


    D. wowGrail: Rebuild the Heaven's Gate


    E. wowInjector: One Gadget to Take Over The Hell
    3

    View full-size slide

  4. What "The Hell"
    Host-based Intrusion Prevention System (HIPS)

    View full-size slide

  5. April 21, 2021
    What "The Hell"
    5
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques

    View full-size slide

  6. April 21, 2021
    6
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    What "The Hell"

    View full-size slide

  7. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    wow64cpu!X86SwitchTo64BitMode
    wow64cpu!CpupReturnFromSimulatedCode
    wow64!Wow64SystemServiceEx
    wow64!turbo_func
    Ring0
    ntdll32!NtAPI#ZwOpenProcess
    ntdll64!NtAPI#ZwOpenProcess
    WoW64 Layer
    normal
    KiFastCall

    View full-size slide

  8. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    Ring0
    ntdll64!NtAPI#ZwOpenProcess
    KiFastCall
    Heaven's Gate
    A. switch to 64bit CPU mode by setting cs flag


    B. get PEB64 by (GS:0x30)->PEB


    C. enumerate loaded 64bit modules via PEB->Ldr


    D. locate imageBase of NtDll64


    E. get expored API ntdll!LdrGetProcedureAddress


    F. BOOM! we got the key of Heaven's Gate!
    #Heaven's Gate

    View full-size slide

  9. April 21, 2021
    Reference


    • 2011 - Mixing x86 with x64 code by ReWolf


    • 2012 - Knockin’ on Heaven’s Gate by george_nicolaou


    • 2012 - KERNEL: Creation of Thread Environment Block (TEB) by waleedassar


    • 2018 - WoW64 internals by wbenny


    • 2020 - WOW64 Subsystem Internals and Hooking Techniques by FireEye


    Heaven's Gate
    9

    View full-size slide

  10. April 21, 2021
    Heaven's Gate
    10
    Reference


    • 2011 - Mixing x86 with x64 code by ReWolf


    • 2012 - Knockin’ on Heaven’s Gate by george_nicolaou


    • 2012 - KERNEL: Creation of Thread Environment Block (TEB) by waleedassar


    • 2018 - WoW64 internals by wbenny


    • 2020 - WOW64 Subsystem Internals and Hooking Techniques by FireEye


    • 2021 - wowGrail: Abusing the Translator to Simulate 32-bit Interrupts
    hard to use & not stable enough ¯\_(ツ)_/¯

    View full-size slide

  11. The WOW64 Layer
    Understanding WOW64 Design by Reversing Engineering

    View full-size slide

  12. April 21, 2021
    12
    32BIT PROGRAM MANAGED IN 64BIT PROCESS
    WOW64 Process Initiation

    View full-size slide

  13. April 21, 2021
    wow64cpu!BtCpuSimulate
    13

    View full-size slide

  14. April 21, 2021
    14
    wow64cpu!RunSimulatedCode
    r12 point to TEB64 struct


    r15 point to TurboThunk Table


    r13 point to WoW64 Thread Context

    View full-size slide

  15. April 21, 2021
    15
    r12 point to TEB64 struct


    r15 point to TurboThunk Table


    r13 point to WoW64 Thread Context
    wow64cpu!RunSimulatedCode

    View full-size slide

  16. April 21, 2021
    NtAPI Trampoline
    16
    32 BIT INTERRUPT BACK TO 64 BIT

    View full-size slide

  17. 17
    wow64cpu!CpupReturnFromSimulatedCode

    View full-size slide

  18. 18
    #Simulate
    wow64cpu!CpupReturnFromSimulatedCode

    View full-size slide

  19. 19
    #Simulate
    wow64cpu!CpupReturnFromSimulatedCode

    View full-size slide

  20. April 21, 2021
    Heaven's Translator
    CONVERT X86 CALLING CONVENTION INTO X64 MODE
    20

    View full-size slide

  21. 21
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64!Wow64SystemServiceEx
    #Translator

    View full-size slide

  22. 22
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64!Wow64SystemServiceEx
    #Translator

    View full-size slide

  23. 23
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64!Wow64SystemServiceEx
    #Translator

    View full-size slide

  24. 24
    [FireEye] WOW64!Hooks: WOW64 Subsystem Internals and Hooking Techniques
    wow64!Wow64SystemServiceEx
    #Translator

    View full-size slide

  25. Ring0
    f. syscall
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    invoke ntdll64!NtAPI
    25
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    wow64cpu!X86SwitchTo64BitMode
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status
    wow64cpu!restoreStatus
    g. back to caller
    a. NtAPI

    View full-size slide

  26. April 21, 2021
    Recap
    • Switching the CS segment to 23h or 33h makes it possible for the Intel
    chip to change the chosen instruction set with 32 bit or 64 bit.


    • Register r13 point to the 32-bit thread context used as snapshot status. It
    will be back up when the thread jumps from 32-bit to 64-bit, and reset
    from 64 bit back to 32-bit.


    • wow64!Wow64SystemServiceEx used as translator for us to simulate any
    32-bit system interrupt to the 64-bit kernel.
    26

    View full-size slide

  27. Rebuild A Path To Heaven's Gate
    From 32-bit Hell Back to 64-bit Wonderland

    View full-size slide

  28. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    wow64cpu!X86SwitchTo64BitMode
    wow64cpu!CpupReturnFromSimulatedCode
    wow64!Wow64SystemServiceEx
    wow64!turbo_func
    Ring0
    ntdll32!NtAPI#ZwOpenProcess
    ntdll64!NtAPI#ZwOpenProcess
    WoW64 Layer
    normal
    KiFastCall

    View full-size slide

  29. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    wow64cpu!X86SwitchTo64BitMode
    wow64cpu!CpupReturnFromSimulatedCode
    wow64!Wow64SystemServiceEx
    wow64!turbo_func
    Ring0
    ntdll32!NtAPI#ZwOpenProcess
    ntdll64!NtAPI#ZwOpenProcess
    WoW64 Layer
    Abusing The Heaven's Translator
    KiFastCall

    View full-size slide

  30. a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    4G
    ntdll.dll
    x86 Modules
    x64 Modules
    Ring0
    ntdll64!NtAPI#ZwOpenProcess
    KiFastCall
    wowGrail
    A. switch to 64bit CPU mode by setting cs flag


    B. get PEB64 by (GS:0x30)->PEB


    C. enumerate loaded 64bit modules via PEB->Ldr


    D. locate imageBase of WoW64.dll


    E. get expored API wow64!Wow64SystemServiceEx


    F. pass 32-bit va_start & executing it to
    simulate our 32-bit as 64-bit interrupt ;)
    #wowGrail
    wow64!Wow64SystemServiceEx

    View full-size slide

  31. DEMO: wowGrail
    New Path Back to The Heaven
    Process Hollowing & Bypass HIPS of NOD32

    View full-size slide

  32. WOW64 Thread Snapshot
    One Gadget To Take Over The 32-bit Hell

    View full-size slide

  33. Ring0
    f. syscall
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    invoke ntdll64!NtAPI
    33
    a.exe
    wow64
    ntdll.dll
    kernel32.dll
    ...
    wow64.dll
    wow64cpu.dll
    wow64win.dll
    wow64cpu!X86SwitchTo64BitMode
    b. switch x86 → x64 architecture
    wow64cpu!CpupReturnFromSimulatedCode
    c. save context status
    wow64cpu!restoreStatus
    g. back to caller
    a. NtAPI

    View full-size slide

  34. Ring0
    f. syscall
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    View full-size slide

  35. Ring0
    f. syscall
    wow64!Wow64SystemServiceEx
    d. lookup turbo function
    wow64!turbo_func
    e. translate x86 arguments &


    View full-size slide

  36. April 21, 2021
    Recap
    • Register r13 point to the 32-bit thread context used as snapshot status. It
    will be back up when the thread jumps from 32-bit to 64-bit, and reset
    from 64 bit back to 32-bit.


    • when $RIP jump into wow64cpu!X86SwitchTo64BitMode, current thread
    context status will be saved into the 32-bit thread context dereferenced
    from r13.


    • $RIP jump from 64-bit back to 32-bit, and the thread context will be
    restored from the 32-bit thread context.
    36

    View full-size slide

  37. April 21, 2021
    Recap
    • Register r13 point to the 32-bit thread context used as snapshot status. It
    will be back up when the thread jumps from 32-bit to 64-bit, and reset
    from 64 bit back to 32-bit.


    • when $RIP jump into wow64cpu!X86SwitchTo64BitMode, current thread
    context status will be saved into the 32-bit thread context dereferenced
    from r13.


    • $RIP jump from 64-bit back to 32-bit, and the thread context will be
    restored from the 32-bit thread context.

    → It can be used as one gadget to exploit the next 32-bit $RIP ;)
    37

    View full-size slide

  38. • 0x2000 or 0x3000 (it's up to WoW64)


    • TEB64 + TEB32 + PEB64 + PEB32


    • fixup TEB64: .self, .peb, .stack etc


    • TEB64.ExceptionList always null


    • fixup TEB32 based on TEB64


    • TEB32.ExceptionList[0] = ffffffff
    0x3000
    nt!MiCreatePebOrTeb()
    → Leak any one of the 4 blocks,


    and we can get the other 3 blocks.

    View full-size slide

  39. DEMO: wowInjector
    One Gadget Injection


    to Take Over The 32-bit Hell
    Process Inject & Bypass HIPS of AVAST

    View full-size slide

  40. 發售⽇ 2021/05/05
    Windows APT Warfare
    惡意程式前線戰術指南

    View full-size slide

  41. 發售⽇ 2021/05/05
    Windows APT Warfare
    惡意程式前線戰術指南

    View full-size slide