Theoretical DKOM

#salam manislar#

*This head can be found by checking the PsActiveProcessHead symbol*

00573     /* Get a reference to it */
00574     ObReferenceObjectByHandle(PspInitialSystemProcessHandle,
00575                               0,
00576                               PsProcessType,
00577                               KernelMode,
00578                               (PVOID*)&PsInitialSystemProcess,
00579                               NULL);
00580
00581     /* Copy the process names */
00582     strcpy(PsIdleProcess->ImageFileName, "Idle");
00583     strcpy(PsInitialSystemProcess->ImageFileName, "System"); <==== set up System image
00584
00585     /* Allocate a structure for the audit name */
00586     PsInitialSystemProcess->SeAuditProcessCreationInfo.ImageFileName =
00587         ExAllocatePoolWithTag(PagedPool,
00588                               sizeof(OBJECT_NAME_INFORMATION),
00589                               TAG_SEPA);
00590     if (!PsInitialSystemProcess->SeAuditProcessCreationInfo.ImageFileName)
00591     {
00592         /* Allocation failed */
00593         return FALSE;
00594     }
00595
00596     /* Zero it */
00597     RtlZeroMemory(PsInitialSystemProcess->
00598                   SeAuditProcessCreationInfo.ImageFileName,
00599                   sizeof(OBJECT_NAME_INFORMATION));


DKOM

lkd> dt nt!_eprocess poi(PsInitialSystemProcess)
   +0x000 Pcb              : _KPROCESS
   +0x0a0 ProcessLock      : _EX_PUSH_LOCK
   +0x0a8 CreateTime       : _LARGE_INTEGER 0x01d0d8aa`285bd24e
   +0x0b0 RundownProtect   : _EX_RUNDOWN_REF
   +0x0b4 UniqueProcessId  : 0x00000004 Void
   +0x0b8 ActiveProcessLinks : _LIST_ENTRY [ 0x8933cd78 - 0x81003a58 ] <======== -- Linked List HEAD -- point to ACtive Process State (doubly linked list)
   +0x0c0 Flags2           : 0x2d000
   +0x0c0 JobNotReallyActive : 0y0
   +0x0c0 AccountingFolded : 0y0
   +0x0c0 NewProcessReported : 0y0
   +0x0c0 ExitProcessReported : 0y0
   +0x0c0 ReportCommitChanges : 0y0
   +0x0c0 LastReportMemory : 0y0
   +0x0c0 ForceWakeCharge  : 0y0
   +0x0c0 CrossSessionCreate : 0y0
   +0x0c0 NeedsHandleRundown : 0y0
   +0x0c0 RefTraceEnabled  : 0y0
   +0x0c0 DisableDynamicCode : 0y0
   +0x0c0 EmptyJobEvaluated : 0y0
   +0x0c0 DefaultPagePriority : 0y101
   +0x0c0 PrimaryTokenFrozen : 0y1
   +0x0c0 ProcessVerifierTarget : 0y0
   +0x0c0 StackRandomizationDisabled : 0y1
   +0x0c0 AffinityPermanent : 0y0
   +0x0c0 AffinityUpdateEnable : 0y0
   +0x0c0 PropagateNode    : 0y0
   +0x0c0 ExplicitAffinity : 0y0
   +0x0c0 ProcessExecutionState : 0y00
   +0x0c0 DisallowStrippedImages : 0y0
   +0x0c0 HighEntropyASLREnabled : 0y0
   +0x0c0 ExtensionPointDisable : 0y0
   +0x0c0 ForceRelocateImages : 0y0
   +0x0c0 ProcessStateChangeRequest : 0y00
   +0x0c0 ProcessStateChangeInProgress : 0y0
   +0x0c0 DisallowWin32kSystemCalls : 0y0
   +0x0c4 Flags            : 0x14040c00
   +0x0c4 CreateReported   : 0y0
   +0x0c4 NoDebugInherit   : 0y0
   +0x0c4 ProcessExiting   : 0y0
   +0x0c4 ProcessDelete    : 0y0
   +0x0c4 ControlFlowGuardEnabled : 0y0
   +0x0c4 VmDeleted        : 0y0
   +0x0c4 OutswapEnabled   : 0y0
   +0x0c4 Outswapped       : 0y0
   +0x0c4 ForkFailed       : 0y0
   +0x0c4 Wow64VaSpace4Gb  : 0y0
   +0x0c4 AddressSpaceInitialized : 0y11
   +0x0c4 SetTimerResolution : 0y0
   +0x0c4 BreakOnTermination : 0y0
   +0x0c4 DeprioritizeViews : 0y0
   +0x0c4 WriteWatch       : 0y0
   +0x0c4 ProcessInSession : 0y0
   +0x0c4 OverrideAddressSpace : 0y0
   +0x0c4 HasAddressSpace  : 0y1
   +0x0c4 LaunchPrefetched : 0y0
   +0x0c4 Background       : 0y0
   +0x0c4 VmTopDown        : 0y0
   +0x0c4 ImageNotifyDone  : 0y0
   +0x0c4 PdeUpdateNeeded  : 0y0
   +0x0c4 VdmAllowed       : 0y0
   +0x0c4 ProcessRundown   : 0y0
   +0x0c4 ProcessInserted  : 0y1
   +0x0c4 DefaultIoPriority : 0y010
   +0x0c4 ProcessSelfDelete : 0y0
   +0x0c4 SetTimerResolutionLink : 0y0
   +0x0c8 ProcessQuotaUsage : [2] 0
   +0x0d0 ProcessQuotaPeak : [2] 0
   +0x0d8 PeakVirtualSize  : 0x34a9000
   +0x0dc VirtualSize      : 0x2749000
   +0x0e0 SessionProcessLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x0e8 ExceptionPortData : (null)
   +0x0e8 ExceptionPortValue : 0
   +0x0e8 ExceptionPortState : 0y000
   +0x0ec Token            : _EX_FAST_REF
   +0x0f0 WorkingSetPage   : 0
   +0x0f4 AddressCreationLock : _EX_PUSH_LOCK
   +0x0f8 PageTableCommitmentLock : _EX_PUSH_LOCK
   +0x0fc RotateInProgress : (null)
   +0x100 ForkInProgress   : (null)
   +0x104 CommitChargeJob  : (null)
   +0x108 CloneRoot        : _RTL_AVL_TREE
   +0x10c NumberOfPrivatePages : 0x24a4
   +0x110 NumberOfLockedPages : 0x120
   +0x114 Win32Process     : (null)
   +0x118 Job              : (null)
   +0x11c SectionObject    : (null)
   +0x120 SectionBaseAddress : (null)
   +0x124 Cookie           : 0xf94c46cd
   +0x128 VdmObjects       : (null)
   +0x12c WorkingSetWatch  : (null)
   +0x130 Win32WindowStation : (null)
   +0x134 InheritedFromUniqueProcessId : (null)
   +0x138 LdtInformation   : (null)
   +0x13c OwnerProcessId   : 2
   +0x140 Peb              : (null)
   +0x144 Session          : (null)
   +0x148 AweInfo          : (null)
   +0x14c QuotaBlock       : 0x80ffc680 _EPROCESS_QUOTA_BLOCK
   +0x150 ObjectTable      : 0x82203000 _HANDLE_TABLE
   +0x154 DebugPort        : (null)
   +0x158 PaeTop           : 0x82433000 Void
   +0x15c DeviceMap        : 0x8220a6c0 Void
   +0x160 EtwDataSource    : (null)
   +0x168 PageDirectoryPte : 0
   +0x170 ImageFileName    : [15]  "System"
   +0x17f PriorityClass    : 0x2 ''

-----------------------------------------------------------
during exploitation time
FS:[0xCC]	216	NT, Wine	Reserved for OS (NT), kernel32 private data (Wine)
herein: FS:[0x124] 4 NT Pointer to KTHREAD (ETHREAD) structure = not affected :)