Press "Enter" to skip to content

Posts published in “Windows”

Reversing Windows Internals (Part 1) – Digging Into Handles, Callbacks & ObjectTypes

Sina Karvandi 7

Introduction Welcome to the first part of a series of posts about Exploring & Reversing Windows Concepts and Internals. If you reach here then you’re probably a security researcher or a programmer and this post and similar posts can help you understand what’s going on in some parts of Windows when you use objects with different users and credentials and what you can expect from Windows and how it internally works. If you want to follow other parts of this…

Why you should not always trust MSDN: Finding Real Access Rights Needed By Handles

Sina Karvandi 0

Introduction Hi guys, The title of this topic is somehow weird, if you think everything in MSDN is 100% match with what Microsoft implemented in Windows (like what I used to think), you’re definitely wrong, this post shows some proofs and in the last part, I’ll give you a solution to ACCESS_RIGHTS problem. Before starting let’s talk about some backgrounds about “ACCESS_MASK“. Most of the explanations derived from here. Backgrounds The ACCESS_MASK data type is a DWORD value that defines standard, specific, and generic…

Call Gates’ Ring Transitioning in IA-32 Mode

Sina Karvandi 0

Have you ever thought how transitions between different rings performed? Well, SYSENTER & SYSCALL used in modern OSs for transitioning between ring 3 to ring 0 but if there are other rings, then what’s Intel solution for entering them? The answer is call gates. The rest of this topic described how to use call gates in modern processors. 80386 and its successors have 4 levels protections which isolate and protect user programs from each other and the operating system. It…

x64 Inline Assembly in Windows Driver Kit

Sina Karvandi 1

As my testing always interferes with running assembly directly in kernel-level and unfortunately Microsoft no longer supports x64 inline assembly through their compilers and as I always have struggle creating a simple inline assembly project so I decided to create a post to describe how to create a Windows Driver Kit project with Inline assembly to run kernel code directly in a kernel driver. This terms only applies to x64 Windows Kernel Driver, you can use _asm and asm directly in…

Inside Windows Page Frame Number (PFN) – Part 2

Sina Karvandi 0

Hey there, In the previous part, I’d explained about Page Frame Number and its importance in the OSs architecture. In this part, I’ll trace PFN more practically. I strongly recommend to read the first part, to make sure you didn’t miss anything about basic concepts. As I described in the previous part, the PFN database is located at nt!MmPFNDatabase, in the previous versions of Windows (<Windows 10) it was statically located at 0xFFFFFA8000000000 but in Windows 10, it’s subject to ASLR.…