April 3, 2018
This is the first public remote class that I will be delivering. It's Windows Internals this time (other classes will be provided in the future). Here are the basic details:
Windows Internals Training
Instructor: Pavel Yosifovich
Public 5-day remote class
Dates (updated): June 19, 20, 21, 25, 26
Time: 8 hours / day. Exact hours TBD
Price: 1950 USD
Register by emailing firstname.lastname@example.org and specifying “Windows Internals Training” in the title and provide names of participants (discount available for multiple participants from the same company), company name and time zone.
You’ll receive instructions for payment and other details.
Virtual space is limited!
Note the changed dates!
Understand the Windows system...
February 28, 2018
A while back I wrote about COM interception with CoTreatAsClass. The idea there is to redirect a CLSID to another CLSID implemented by the interceptor. This has the advantage of automatic redirection in cases where a different implementation is desired. However, it makes it difficult to just wrap the original class because its creation becomes masked as well, and so CoTreatAsClass needs to be called again, removing the redirection just enough time to create the original object. This creates an inherent race condition, where new instances could be created in between and the interception "missed".
The COM infrastructure includes other...
January 17, 2018
The (now classic) Process Monitor tool from Sysinternals allows watching important activities on a system: process and thread creation/termination, image loading/unloading, file system operations and registry operations (and some profiling events). This tool helped me many times in diagnosing issues or just understanding what's going on in a particular scenario.
Yesterday I released the first preview of a tool called Process Monitor X (ProcMonX), as a possible alternative to ProcMon. ProcMonX provides information on similar activities to ProcMon, but adds many more events, such as networking, ALPC and memory. In fact, the number of possible events is staggering, since there...
November 18, 2017
In the past few weeks I've been working in my non-existent spare time on DriverMon - a driver monitoring tool for Windows. The tool is far from complete, but it's already quite useful. In this post I'll describe how to use it and some of the challenges of building such a tool.
Initially I wanted to be able to track every I/O Request Packet (IRP) targeted to monitored devices. The term "devices" here is important, as the Windows I/O system is device-centric rather than driver-centric. That is, requests are delivered to devices, not drivers. A device can be thought of...
October 6, 2017
A few days ago at work, a requirement arouse to create some form of inter-process communication (IPC) between two cooperating processes where the source code for the executables themselves already existed, so such mechanism should integrate into the existing code as easily as possible, while providing bi-directional communication.
Several options were brought up, including pipes and sockets. The processes are services and have no UI, so Window messages were not an option. Other ideas included shared memory with notifications using kernel event objects... and then I suggested COM.
There was a brief silence and then people started murmuring things like "COM...
September 5, 2017
There are several techniques available for injecting a DLL into a process. Each has its own strengths and drawbacks.
The simplest one uses the CreateRemoteThread function to create a new thread in the target process and point the thread's start function to the the LoadLibrary function, as LoadLibray and a thread's starting function have the same prototype from a binary perspective (both accept a pointer).
This method is the easiest to use but also the most visible. Creating a new thread can be "noticed" in several ways, such as with an ETW event. If a driver is present and is hooking...
August 7, 2017
There are some common scenarios that benefit from the ability to hook operations. The canonical example is hooking Windows API functions for debugging purposes, or for malware detection. In this scenario, some DLL is injected into a target process and then hooks relevant functions. There are several ways to do that, but that is not the focus of this post; the interested reader can search the web for more information.
In the Component Object Model (COM) world, things are not so easy. Since COM is object based, it's not generally possible to get the address of a COM interface method,...
One of the nice features of C++ 11 is scoped enums ("enum class"). This solves a few issues with the classic C++ enums:
Scoped enums don't "leak" into the enclosing scope as classic C++ enums do.
Scoped enums don't automatically convert to integers, helping with type safety.
Scoped enums can be declared with the size of the underlying integer.
However, there is one feature that I believe was overlooked, or at least deemed unimportant to get into the standard: the automatic support for bitwise operations.
For example, suppose I'm writing a class called Process that wraps a Windows process handle and provides convenient access...
June 17, 2017
Job objects have been around since Windows 2000, providing a convenient way to set limits and otherwise manage a set of processes. Up until Windows 8 job objects were used sparingly, because a process could only be associated with a single job at most. That would mean an application wanting to set some limits on a process it does not create explicitly had no way of knowing whether that process was already part of a job. If it were, assigning it to another job would simply fail.
Starting with Windows 8, jobs can be nested, effectively creating a job hierarchy...
May 9, 2017
One of the hallmarks of easy-to-use tools is simple installation, preferably no installation at all. The classic example is the Sysinternals tools. Each tool is a single executable, self contained, and can be run from anywhere, including network shares and web locations.
These tools have no dependencies (except for built-in Windows DLLs), or so it seems.
One canonical example is Process Explorer that hides within it two binaries. The first is a kernel driver, used to extract information from the system that cannot be done from user mode (such as reading values of kernel variables), and the other is a 64...