After many unsuccessful attempts trying to find a way to start a working Win32 process from KernelMode, I finally stumbled upon a promising piece of code that was both original and innovative (Note: the idea belongs to Valerino).
Unfortunately that code didn't seem to work properly on my machine, and it always ended up crashing it, or just a process (in the most fortunate cases). So I've decided to reimplement Mighty Valerino's idea in my own way (although the structure of the code is basically the same).
So let's get started. First, you must know of...
APC, standing for Asynchronous Procedure Call, represents a kernel procedure that is queued to a particular thread for execution. In other words, it's a code that is forcibly executed in a thread's context (This method is mostly employed by the I/O Manager). That is the SIMPLEST explanation I can give you, and that's all you need to know for now. There are three types of APCs:
- Kernel APCs - They can be queued to any kernel thread and they will execute only if the specified thread isn't already executing a Kernel APC.
- Special Kernel APCs - Basically the same as above. They run at IRQL
APC_LEVEL and cannot be blocked except by running at a raised IRQL. They can always preempt normal Kernel APCs.
- User APCs - These are APCs that can be queued to
UserMode threads, but there's a catch: the thread must have previously called a wait service like
WaitForSingleObject with the
Alertable field set to
TRUE. The APC will be invoked next time the thread returns from KernelMode. This is the kind of APC that we will be dealing with from now on.
Enough talking. Let's get to the fun part.
Running That Process
A brief description of the idea behind starting a Win32 process is the following:
- We loop through the list of running processes until we find Explorer.exe. Why explorer.exe? Because it's a desktop-interactive service (I tried popping up a message box from WinLogon.exe and I could only hear the sound of it). It also has many waiting threads (both alertable and non-alertable), so it works best with this code.
- Once we've found Explorer.exe, we iterate through its threads searching for an alertable thread. If no such thread is found, we simply save a pointer to a non-alertable one and set its
TRUE, thus making it alertable (Notice: in this case it usually takes a few seconds for the thread to return to KernelMode).
- Now we have the
PEPROCESS of Explorer.exe and one of its
PETHREADs. Next we queue our APC object (which will contain the code to be executed in UserMode) and when it completes, we just release the memory that we have previously allocated for it. That's all.
The main procedure is
RunProcess(LPSTR lpProcess) where
lpProcess must be the FULL PATH to the application that is to be run (c:\RawWrite.exe in our example):
void RunProcess(LPSTR lpProcess)
PEPROCESS pTargetProcess = NULL;
PKTHREAD pTargetThread = NULL;
PKTHREAD pNotAlertableThread = NULL;
PEPROCESS pSystemProcess = NULL;
PETHREAD pTempThread = NULL;
PLIST_ENTRY pNextEntry, pListHead, pThNextEntry;
We start off by retrieving a pointer to the 'System' process:
pSystemProcess = PsGetCurrentProcess();
pSystemProcess->ActiveProcessLinks is a
LIST_ENTRY field that contains links(pointers) to other processes (
PEPROCESS) running on the machine. Let's search for Explorer.exe and save a pointer to it and to one of its threads. (Note: you can queue an APC to ANY process, even
SVCHOST, but the system will probably crash.) Once we've got a pointer to Explorer.exe and one of its threads (I will not explain how to do that here), it's time to queue our APC to that thread:
pTargetThread = pNotAlertableThread;
DbgPrint("KernelExec -> Targeted thread: 0x%p",
InstallUserModeApc has the following prototype...
IN LPSTR lpProcess,
IN PKTHREAD pTargetThread,
IN PEPROCESS pTargetProcess);
pTargetProcess points to the
PEPROCESS of Explorer.exe and
pTargetThread is the
PKTHREAD which the APC will be queued to. Let's now allocate some memory for that APC and for an
MDL (Memory Descriptor List) to map our UserMode code:
PRKAPC pApc = NULL;
PMDL pMdl = NULL;
ULONG dwSize = 0;
pApc = ExAllocatePool (NonPagedPool,sizeof (KAPC));
dwSize = (unsigned char*)ApcCreateProcessEnd-
pMdl = IoAllocateMdl (ApcCreateProcess, dwSize, FALSE,FALSE,NULL);
Our APC is now valid and
pMdl is memory resident and maps our UserMode code (
ApcCreateProcess() that is. We'll get to that later). So what now? Should we deliver our APC to the thread and watch our Win32 process run? No no no.. not so fast!
How is Explorer.exe's thread supposed to invoke our APC routine if it doesn't have access to the Kernel memory? It cannot do that! Fine then, let's map our APC code to UserMode memory:
To continue, first I must show you how
ApcCreateProcess (the code mapped to UserMode memory, into Explorer's address space) works:
We move the address of
0x7C86114D is its address, on WinXP SP2), we push 1 on the stack (
SW_SHOWNORMAL) and then we push...
0xabcd before calling
0xabcd you might ask? Well,
push 0xabcd is the first parameter of
WinExec and it points to the path of the application to be executed. But that means
0xabcd cannot possibly point to the path all the time!
Why don't you simply
push lpProcess from
RunProcess(LPSTR lpProcess) then? Answer - Because
WinExec will NOT be able to access it and it will throw an 'Access Violation' at you! You cannot access Kernel memory from UserMode, remember? Instead, right after we map our code to UserMode memory, we copy the path to the location right after the first
nop instruction (that's why there are so many
nops in there) and we modify
0xabcd to point to it. Now here's the code:
ULONG dwMappedAddress = 0;
dwMappedAddress = (ULONG)pMappedAddress;
memset ((unsigned char*)pMappedAddress + 0x14, 0, 300);
memcpy ((unsigned char*)pMappedAddress + 0x14,
data_addr = (ULONG*)((char*)pMappedAddress+0x9);
*data_addr = dwMappedAddress+0x14;
What's left now is to initialize the APC and queue it to the thread. I will not explain how
KeInsertQueueApc work as Tim Deveaux has already done that here.
pTargetThread->ApcState.UserApcPending = TRUE;
Compiling the Code
This is simple - do a cd sys_path, where sys_path is the path to the driver project, then run build -ceZ. Or just press the F7 key in Microsoft Visual Studio 6.
Now copy KernelExec.sys to your C:\ directory, run Dbgview to see the output of the driver. Then double-click on Start_KE_Driver.exe to install and start the driver. Et voila! RawWrite.exe's window should be on your screen right now!
P.S.: Make sure you first put an application called RawWrite.exe in your c:\ directory, because that is what the driver attempts to run.