Void’s Blog

Analysing the Process Environment Block

2022-09-10T00:00:00+00:00

The Process Environment Block is a critical structure in the Windows OS, most of its fields are not intended to be used by other than the operating system. It contains data structures that apply across a whole process and is stored in user-mode memory, which makes it accessible for the corresponding process. The structure contains valuable information about the running process, including:

whether the process is being debugged or not
which modules are loaded into memory
the command line used to invoke the process

Installation of WinDbg (Microsoft Store)

Download and install WinDbg, then attach it to the running process as the example I will be using notepad.exe.

Navigate to your installation directory, and open WinDbg.exe.
On the File menu, choose 1) Open Executable or 2) Attach to process.

1) In the Open Executable dialog box, navigate to the folder that contains notepad.exe (typically, C:\Windows\System32). For the File name, enter notepad.exe. Select Open.

2) In the second option just pick the running process in our case it’s notepad.exe.

You should end up with something like this, near the bottom of the WinDbg window, in the command line, enter these commands.

Overview of PEB structure

First, based on MSDN documentation the PEB structure

typedef struct _PEB {
  BYTE                          Reserved1[2];
  BYTE                          BeingDebugged;
  BYTE                          Reserved2[1];
  PVOID                         Reserved3[2];
  PPEB_LDR_DATA                 Ldr;
  PRTL_USER_PROCESS_PARAMETERS  ProcessParameters;
  PVOID                         Reserved4[3];
  PVOID                         AtlThunkSListPtr;
  PVOID                         Reserved5;
  ULONG                         Reserved6;
  PVOID                         Reserved7;
  ULONG                         Reserved8;
  ULONG                         AtlThunkSListPtr32;
  PVOID                         Reserved9[45];
  BYTE                          Reserved10[96];
  PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;
  BYTE                          Reserved11[128];
  PVOID                         Reserved12[1];
  ULONG                         SessionId;
} PEB, *PPEB;

The PEB isn’t fully documented, so you must use WinDbg to see its full structure or use sites like !NirSoft.

typedef struct _PEB
{
     UCHAR InheritedAddressSpace;
     UCHAR ReadImageFileExecOptions;
     UCHAR BeingDebugged;
     UCHAR BitField;
     ULONG ImageUsesLargePages: 1;
     ULONG IsProtectedProcess: 1;
     ULONG IsLegacyProcess: 1;
     ULONG IsImageDynamicallyRelocated: 1;
     ULONG SpareBits: 4;
     PVOID Mutant;
     PVOID ImageBaseAddress;
     PPEB_LDR_DATA Ldr;
     PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
     PVOID SubSystemData;
     PVOID ProcessHeap;
     PRTL_CRITICAL_SECTION FastPebLock;
     PVOID AtlThunkSListPtr;
     PVOID IFEOKey;
     ULONG CrossProcessFlags;
     ULONG ProcessInJob: 1;
     ULONG ProcessInitializing: 1;
     ULONG ReservedBits0: 30;
     union
     {
          PVOID KernelCallbackTable;
          PVOID UserSharedInfoPtr;
     };
     ULONG SystemReserved[1];
     ULONG SpareUlong;
     PPEB_FREE_BLOCK FreeList;
     ULONG TlsExpansionCounter;
     PVOID TlsBitmap;
     ULONG TlsBitmapBits[2];
     PVOID ReadOnlySharedMemoryBase;
     PVOID HotpatchInformation;
     VOID * * ReadOnlyStaticServerData;
     PVOID AnsiCodePageData;
     PVOID OemCodePageData;
     PVOID UnicodeCaseTableData;
     ULONG NumberOfProcessors;
     ULONG NtGlobalFlag;
     LARGE_INTEGER CriticalSectionTimeout;
     ULONG HeapSegmentReserve;
     ULONG HeapSegmentCommit;
     ULONG HeapDeCommitTotalFreeThreshold;
     ULONG HeapDeCommitFreeBlockThreshold;
     ULONG NumberOfHeaps;
     ULONG MaximumNumberOfHeaps;
     VOID * * ProcessHeaps;
     PVOID GdiSharedHandleTable;
     PVOID ProcessStarterHelper;
     ULONG GdiDCAttributeList;
     PRTL_CRITICAL_SECTION LoaderLock;
     ULONG OSMajorVersion;
     ULONG OSMinorVersion;
     WORD OSBuildNumber;
     WORD OSCSDVersion;
     ULONG OSPlatformId;
     ULONG ImageSubsystem;
     ULONG ImageSubsystemMajorVersion;
     ULONG ImageSubsystemMinorVersion;
     ULONG ImageProcessAffinityMask;
     ULONG GdiHandleBuffer[34];
     PVOID PostProcessInitRoutine;
     PVOID TlsExpansionBitmap;
     ULONG TlsExpansionBitmapBits[32];
     ULONG SessionId;
     ULARGE_INTEGER AppCompatFlags;
     ULARGE_INTEGER AppCompatFlagsUser;
     PVOID pShimData;
     PVOID AppCompatInfo;
     UNICODE_STRING CSDVersion;
     _ACTIVATION_CONTEXT_DATA * ActivationContextData;
     _ASSEMBLY_STORAGE_MAP * ProcessAssemblyStorageMap;
     _ACTIVATION_CONTEXT_DATA * SystemDefaultActivationContextData;
     _ASSEMBLY_STORAGE_MAP * SystemAssemblyStorageMap;
     ULONG MinimumStackCommit;
     _FLS_CALLBACK_INFO * FlsCallback;
     LIST_ENTRY FlsListHead;
     PVOID FlsBitmap;
     ULONG FlsBitmapBits[4];
     ULONG FlsHighIndex;
     PVOID WerRegistrationData;
     PVOID WerShipAssertPtr;
} PEB, *PPEB;

Usage and useful commands when exploring the PEB.

Dump _PEB structure: dt ntdll!_PEB.
“dt” stands for “Display Type” and can be used to display information about a specific data-type

PEB address of the process: r $peb.

The _PEB structure can now be overlaid on the memory pointed to by the $peb to see what values the structure members are holding/pointing to: dt ntdll!_PEB @$peb.

BeingDebugged

+0x002 BeingDebugged : 0x1 ''

The most obvious flag to identify is whether a debugger is attached to the process or not. By reading the variable directly from memory instead of using usual suspects like NtQueryInformationProcess or IsDebuggerPresent, malware can prevent noisy WINAPI calls. This makes it harder to spot this technique.

Ldr (Getting a list of loaded modules)

+0x018 Ldr : 0x00007ffd5ed1a4c0 _PEB_LDR_DATA

Is one of the most important fields in the PEB. This is a pointer to a structure that contains information about the process’s loaded modules, and to the Head node of a doubly-linked list.
The linked list can help us find the addresses of structures that represent the loaded DLLs.

We can get InMemoryOrderModuleList by dt _PEB_LDR_DATA 0x00007ffd5ed1a4c0

Or more fancy way dt _peb @$peb Ldr->InMemoryOrderModuleList

Go go over linked list we can use !list -x "dt _LDR_DATA_TABLE_ENTRY FullDllName->Buffer" 0x00000257b19a4210 where 0x00000257b19a4210 is our InMemoryOrderModuleList.

ImageBaseAddress

+0x010 ImageBaseAddress : 0x00007ff7f45b0000 Void

Is it actually the valid address of the executable image in process memory we can try to inspect it using our PEB dump
db 0x00007ff7f45b0000 L100

ProcessParameters

Is a pointer to RTL_USER_PROCESS_PARAMETERS structure. To inspect it we are going to find ProcessParameters address.

dt _peb @$peb ProcessParameters

Now we can dump it using dt _RTL_USER_PROCESS_PARAMETERS 0x00000257b19a37b0

Or we can forget about all of the above and just use: !peb

How the Process Environment Block (PEB) is actually found.

On the user mode basis of a 32-bit window, the FS register points to a structure called a Thread Environment Block (TEB) or Thread Information Block (TIB). This structure stores information about the currently running thread. This is mainly used because information can be obtained without calling API functions. Note that the FS register points to the first address of the TEB, so you can add values by position to access the desired fields. In the x64 environment, the GS register is used instead of the FS register.

TEB Structure for x86/x64

The PEB can be found at fs:[0x30] in the Thread Environment Block (TEB)/Thread Information Block (TIB) for x86 processes as well as at gs:[0x60] for x64 processes.

x64 ASM

GetPEB proc
mov rax, qword ptr gs:[00000060h] // move PEB from TEB into rax (64 bit process  gs : [0x60]);
ret                               // return rax
GetPEB endp

x86 ASM

__declspec(naked) PEB* __stdcall get_peb() 
{
  __asm mov eax, dword ptr fs : [0x30] ; // move PEB from TEB into eax (32 bit process fs : [0x30])
  __asm ret;                             // return eax
}

You do not need to use ASM for this, you can use intrinsic functions like so:
__readfsdword/__readgsqword are compiler intrinsic functions that will generate more optimized code, there is no reason to use inline assembly. Inline assembly is not even supported by Microsoft’s compilers for 64-bit targets.

PEB *GetPeb() 
{
#ifdef _M_X64
  return reinterpret_cast<PEB*>(__readgsqword(0x60));
#elif _M_IX86
  return reinterpret_cast<PEB*>(__readfsdword(0x30));
#else
  #error "PEB Architecture Unsupported"
#endif  
}

Support non-ARM systems

Structure defined inside winnt.h. It’s the staring point for the algorithm. It includes self-referencing field - Self pointer, offset of which is used on non-ARM systems to read Thread Environment Block data.

typedef struct _NT_TIB {
    struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
    PVOID StackBase;
    PVOID StackLimit;
    PVOID SubSystemTib;
#if defined(_MSC_EXTENSIONS)
    union {
        PVOID FiberData;
        DWORD Version;
    };
#else
    PVOID FiberData;
#endif
    PVOID ArbitraryUserPointer;
    struct _NT_TIB *Self;
} NT_TIB;
typedef NT_TIB *PNT_TIB;

After the executable is loaded by the Windows PE loader and before the thread starts running, TEB is saved to fs(x86) or gs(x64) processor register. ARM systems use different technique which utilize coprocessors scheme (it’s unclear whether the coprocessor is real hardware component or emulated). Self field of NT_TIB is the TEB pointer for the current thread.

Even not officially documented, this behavior is observed on/for all available Windows operating systems with NT kernel.

Acquiring pointer to the TEB is done using Microsoft specific compiler intrinsics:

#include <winnt.h>
#include <winternl.h>

#if defined(_M_X64) // x64
    auto pTeb = reinterpret_cast<PTEB>(__readgsqword(reinterpret_cast<DWORD>(&static_cast<NT_TIB*>(nullptr)->Self)));
#elif defined(_M_ARM) // ARM
    auto pTeb = reinterpret_cast<PTEB>(_MoveFromCoprocessor(15, 0, 13, 0, 2)); // CP15_TPIDRURW
#else // x86
    auto pTeb = reinterpret_cast<PTEB>(__readfsdword(reinterpret_cast<DWORD>(&static_cast<NT_TIB*>(nullptr)->Self)));
#endif

Among others, one of the fields inside the TEB is pointer to the PEB (Process Environment Block).

Access TEB the Windows way

User-mode code can easily find its own process’s PEB, albeit only by using undocumented or semi-documented behavior. While a thread executes in user mode, its fs or gs register, for 32-bit and 64-bit code respectively, addresses the thread’s TEB. That structure’s ProcessEnvironmentBlock member holds the address of the current process’s PEB. In NTDLL version 5.1 and higher, this simple work is available more neatly as an exported function, named RtlGetCurrentPeb, but it too is undocumented. Its implementation is something very like

PEB *RtlGetCurrentPeb(VOID)
{
    return NtCurrentTeb()->ProcessEnvironmentBlock;
}

// For its own low-level user-mode programming, Microsoft has long had a macro or inlined 
// routine, apparently named NtCurrentPeb, which reads directly from fs or gs, e.g.
PEB *NtCurrentPeb (VOID)
{
    return (PEB *) __readfsdword (FIELD_OFFSET (TEB, ProcessEnvironmentBlock));
}

To use NtCurrentTeb() without Windows header files declare the function prototype and link against ntdll.dll.

What’s next?

In second part we’ll put the described how to manually write functions like IsDebuggerPresent or GetModuleHandle to see how a program can parse the PEB to recover Kernel32.dll address, and then load any other library. Not a single import is needed!

VMUnprotect Call Hijacker for VMP: Part 1

2022-03-19T00:00:00+00:00

Hello fellow readers!

This is my exploration of VMProtect security. It’s well-known Software Protection with a lot of features, the main ones are code mutation and virtualization. I will talk about all of those in future posts, but now I will focus on virtualization.

About Virtualization and design approach.

VMUnprotect is a project engaged in hunting virtualized VMProtect methods. It makes use of Harmony to dynamically read VMP behavior. Currently only supports method administration. Works on VMProtect 3.5.1 (Latest) and few versions back.

As VMProtect describes it on their’s website. Code virtualization is the next step in software protection. Most protection systems encrypt the code and then decrypt it at the application’s startup. VMProtect doesn’t decrypt the code at all! Instead, the encrypted code runs on a virtual CPU that is markedly different from generic x86 and x64 CPUs as the command set is different for each protected file.

But we’re not devirtualizing code at all. What we are doing is done dynamically!

// Author: Washi (https://github.com/Washi1337 - https://rtn-team.cc/)
 
using System;
using System.Collections;
using System.Linq;
using System.Reflection;
using HarmonyLib;
 
namespace ConsoleApplication4
{
    internal class Program
    {
        private static FieldInfo _stackField;
        private static FieldInfo _pcField;
 
        public static void Main(string[] args)
        {
            var assembly = Assembly.LoadFile(@"awesome.vmp_nodbg.exe");
            
            var harmony = new Harmony("com.example.patch");
 
            var vmType = assembly.GetType("4775349C");
            var readMethod = vmType.GetMethod("15154B6D", BindingFlags.Instance | BindingFlags.NonPublic);
            _stackField = vmType.GetField("6BAE5C1B", BindingFlags.Instance | BindingFlags.NonPublic);
            _pcField = vmType.GetField("58392466", BindingFlags.Instance | BindingFlags.NonPublic);
            
            var prefixMethod = typeof(Program).GetMethod(nameof(ReadBytePrefix), BindingFlags.Static | BindingFlags.Public);
            var postfixMethod = typeof(Program).GetMethod(nameof(ReadBytePostfix), BindingFlags.Static | BindingFlags.Public);
            
            harmony.Patch(readMethod, new HarmonyMethod(prefixMethod), new HarmonyMethod(postfixMethod));
 
            var invokeMethod = typeof(object).Assembly
                .GetType("System.Reflection.RuntimeMethodInfo")
                .GetMethod("UnsafeInvokeInternal", BindingFlags.NonPublic | BindingFlags.Instance);
            
            prefixMethod = typeof(Program).GetMethod(nameof(InvokePrefix), BindingFlags.Static | BindingFlags.Public);
            postfixMethod = typeof(Program).GetMethod(nameof(InvokePostfix), BindingFlags.Static | BindingFlags.Public);
            harmony.Patch(invokeMethod, new HarmonyMethod(prefixMethod), new HarmonyMethod(postfixMethod));
            
            assembly.EntryPoint.Invoke(null, null);
        }
 
        private static string FormatObject(object obj)
        {
            try
            {
                switch (obj)
                {
                    case null:
                        return "null";
 
                    case string x:
                        return $"\"{x}\"";
 
                    case IEnumerable enumerable:
                        return
                            $"{obj.GetType().Name} {string.Join(", ", enumerable.Cast<object>().Select(FormatObject))}";
 
                    case { } o when o.GetType().Name == "0FE23521":
                    {
                        var field = o.GetType().GetField("5BE47E90", BindingFlags.Instance | BindingFlags.NonPublic);
                        return FormatObject(field.GetValue(o));
                    }
                    case { } o when o.GetType().Name == "6F9B56A3":
                    {
                        var field = o.GetType().GetField("1B4E1C53", BindingFlags.Instance | BindingFlags.NonPublic);
                        return FormatObject(field.GetValue(o));
                    }
                    default:
                        return obj.ToString();
                }
            }
            catch (Exception ex)
            {
                return "???";
            }
        }
 
        public static void ReadBytePrefix(object __instance)
        {
            Console.Write("{0:X8} ({0}): ", _pcField.GetValue(__instance));
            var stackContents = ((IEnumerable) _stackField.GetValue(__instance))
                .Cast<object>()
                .Reverse()
                .ToArray();
            Console.WriteLine(FormatObject(stackContents));
        }
 
        public static void ReadBytePostfix()
        {
        }
        
        public static void InvokePrefix(object __instance, object obj, object[] parameters, object[] arguments)
        {
            var method = (MethodBase) __instance;
            string returnType = method is MethodInfo info ? info.ReturnType.FullName : "System.Object";
            Console.WriteLine($"--- call to {returnType} {method.DeclaringType}::{method.Name}({string.Join(", ", method.GetParameters().Cast<object>())})");
            if (arguments != null)
            {
                for (int i = 0; i < arguments.Length; i++)
                    Console.WriteLine($"--- {i}: {FormatObject(arguments[i])}");
            }
        }
 
        public static void InvokePostfix(object __instance, ref object __result, object obj, object[] parameters, object[] arguments)
        {
            Console.WriteLine("--- Resulted in " + FormatObject(__result));
        }
    }
}

This piece of code might look complicated at first, but this is what inspired me to make VMUP. When we look at Washi notes from Tuts4You and we look at sample ourselves in DnspyEx which is a Revival of the well-known .NET debugger and assembly editor, dnSpy.

We can see that methods are empty. This is part of VMProtect protection which can be defeated by placing a breakpoint in cctor (right-click on the module and Go to <Module>. cctor) and debugging the application. I also made a tool that does that for you VMProtect.Dumper.

(If you can’t see Modules)

Voila! We can see juicy code now and a part that Validates password isn’t virtualized LOL! It’s
only protected by delegates and mutation. This isn’t the point of this article to clean those but Washi made some notes that we can use to explore VM (VMP always injects their VM because they virtualize most of their features for example Anti Debug that is running before main in <Module>. cctor).

If we press Ctrl + D and type 0x04000048 we now now this is virtual program counter. Same goes for 0x0400004A - stack. Previous harmony script performs a VM trace that dumps the program counter, stack contents, and calls.

What’s next?

In Part 2 we’ll put the described how my older approach was made and how current works.

VMUnprotect Call Hijacker for VMP: Part 2

2022-03-19T00:00:00+00:00

Now what if… we make an program that does everything for us!

At first I made my approach that tries to search for function 0x06000153 in this sample. Which appears to be invoking functions called in virtualized methods.

And replace this call with my own middle man invoke. This can be achieved by transpiler from Harmony. Which was my older method.

My old approach VmProtectDumperTranspiler.cs

/// <summary>A transpiler that replaces all occurrences of a given method with another with additional Ldarg_1 instruction</summary>
/// <param name="instructions">The enumeration of <see cref="T:HarmonyLib.CodeInstruction" /> to act on</param>
/// <param name="from">Method to search for</param>
/// <param name="to">Method to replace with</param>
/// <returns>Modified enumeration of <see cref="T:HarmonyLib.CodeInstruction" /></returns>
private static void ReplaceVmpInvoke(ref IEnumerable < CodeInstruction > instructions, MethodBase @from, MethodBase to) {
    if ((object) from == null) throw new ArgumentException("Unexpected null argument", nameof(from));
    if ((object) to == null) throw new ArgumentException("Unexpected null argument", nameof(to));
    var code = new List < CodeInstruction > (instructions);
    for (var x = 0; x < code.Count; x++) {
        var ins = code[x];
        if (ins.operand as MethodBase != from) continue;
        // replace callvirt Invoke with our debug invoke.
        ins.opcode = OpCodes.Callvirt;
        ins.operand = to;
        // insert additional Ldarg_1 which corresponds to MethodBase of invoked function.
        // TODO: Improve this, can be easily broken by obfuscation or future VMP updates
        code.Insert(x, new CodeInstruction(OpCodes.Ldarg_1));
        Logger.Info("Replaced with custom Invoke and injected MethodBase argument at {0}.", x);
    }
}

/// <summary>A transpiler that alters instructions that calls specific method</summary>
/// <param name="instructions">The enumeration of <see cref="T:HarmonyLib.CodeInstruction" /> to act on</param>
/// <returns>Modified enumeration of <see cref="T:HarmonyLib.CodeInstruction" /></returns>
public static IEnumerable < CodeInstruction > Transpiler(IEnumerable < CodeInstruction > instructions) {
    Logger.Debug("VMP Function Handler Transpiler");
    // Newer version
    ReplaceVmpInvoke(ref instructions, AccessTools.Method(typeof (MethodBase), "Invoke", new [] {
        typeof (object), typeof (BindingFlags), typeof (Binder), typeof (object[]),
        typeof (CultureInfo)
    }), AccessTools.Method(typeof (VmProtectDumperTranspiler), nameof(HookedInvoke)));
    // Older version
    ReplaceVmpInvoke(ref instructions,
        AccessTools.Method(typeof (MethodBase), "Invoke", new [] {
            typeof (object), typeof (object[])
        }),
        AccessTools.Method(typeof (VmProtectDumperTranspiler), nameof(HookedInvokeOld)));
    return instructions;
}

And this worked just fine, but it wasn’t stable so I didn’t bother with it and just did same as Washi.

How Harmony works

Where other patch libraries simply allow you to replace the original method, Harmony goes one step further and gives you:

A way to keep the original method intact
Execute your code before and/or after the original method
Modify the original with IL code processors
Multiple Harmony patches co-exist and don’t conflict with each other

Prefix - is a method that is executed before the original method. It is commonly used to:

access and edit the arguments of the original method
set the result of the original method
skip the original method and prefixes that alter its input/result
set custom state that can be recalled in the postfix

Postfix is a method that is executed after the original method. It is commonly used to:

read or change the result of the original method
access the arguments of the original method
make sure your code is always executed
read custom state from the prefix

Transpiler is not a patch method that is executed at runtime when the Original method is called. Instead, you can see it more as a post-compiler stage that can alter the source code of the original method. Except that at runtime, it’s not C# but IL code that you change.

Resources

var invokeMethod = typeof (object).Assembly
    .GetType("System.Reflection.RuntimeMethodInfo")
    .GetMethod("UnsafeInvokeInternal", BindingFlags.NonPublic | BindingFlags.Instance);

prefixMethod = typeof (Program).GetMethod(nameof(InvokePrefix), BindingFlags.Static | BindingFlags.Public);
postfixMethod = typeof (Program).GetMethod(nameof(InvokePostfix), BindingFlags.Static | BindingFlags.Public);
harmony.Patch(invokeMethod, new HarmonyMethod(prefixMethod), new HarmonyMethod(postfixMethod));

public static void InvokePrefix(object __instance, object obj, object[] parameters, object[] arguments) {
    var method = (MethodBase) __instance;
    string returnType = method is MethodInfo info ? info.ReturnType.FullName : "System.Object";
    Console.WriteLine($"--- call to {returnType} {method.DeclaringType}::{method.Name}({string.Join(", ", method.GetParameters().Cast<object>())})");
    if (arguments != null) {
        for (int i = 0; i < arguments.Length; i++)
            Console.WriteLine($"--- {i}: {FormatObject(arguments[i])}");
    }
}

public static void InvokePostfix(object __instance, ref object __result, object obj, object[] parameters, object[] arguments) {
    Console.WriteLine("--- Resulted in " + FormatObject(__result));
}

Current approach VmProtectDumperUnsafeInvoke

Since we would be logging all functions called by the assembly, I’ve added an additional check to make sure the call is coming from VMProtect Call Handler.

// Check if this invoke is coming from VMP Handler
var isVmpFunction = structure is {} && new StackTrace().GetFrame(3).GetMethod().MetadataToken ==
  structure.FunctionHandler.MDToken.ToInt32();

if (!isVmpFunction)
  return true;

This works same besides that we have additional features like:

Whole source code on Github: VMUnprotect