[Windows] Instrumentation Callback 응용하기 - syscall tracking

GitHub - jungjin0003/Instrumentation-Callback

Instrumentation Callback을 통해 알 수 있는 것

지금까지의 포스팅만 봤을 때 Instrumentation Callback은 그저 syscall 어셈블리가 실행되었다는 정보 밖에 알 수 없었다. 하지만 Instrumentation Callback은 그 외에도 아래와 같은 정보들을 구할 수 있다.

 

• Original Return Address (sysret 가 되었을 때 원래 돌아가야 할 주소)
• Syscall Number
• Function Name

How Do I Get The Above Information?

Instrumentation Callback으로 등록된 함수가 호출되었을 때 r10 레지스터에는 원래 돌아가야 할 리턴 주소가 기록되어 있다. 이를 보고 어떠한 커널 함수를 호출했는지 알아낼 수 있다.

Sample

#include <stdio.h>
#include <windows.h>

#pragma comment (lib, "ntdll.lib")

#define PROCESS_INFO_CLASS_INSTRUMENTATION 40

typedef struct _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION
{
	ULONG Version;
	ULONG Reserved;
	PVOID Callback;
} PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION, * PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION;

#ifdef _MSC_VER
extern VOID GetInstrumentationCallbackData(PDWORD lpSyscallNumber, FARPROC *lpProcAddress);
#endif

VOID CALLBACK InstrumentationCallback()
{
    FARPROC Function = NULL;
	DWORD SystemCallNumber = 0;
#ifdef __GNUC__
    __asm__ __volatile__ (
        "mov eax, dword ptr ds:[r10 - 0x10]\n\t"
        "mov %[SystemCallNumber], eax\n\t"
        "lea rax, qword ptr ds:[r10 - 0x14]\n\t"
        "mov %[Function], rax\n\t"
        :
        : [SystemCallNumber] "m" (SystemCallNumber), [Function] "m" (Function)
    );
#elif _MSC_VER
    GetInstrumentationCallbackData(&SystemCallNumber, &Function);
#else
#error This compiler is not supported. Please checck the compiler or target OS
#endif
    ULONG_PTR ImageBase = GetModuleHandleA("ntdll.dll");
    IMAGE_EXPORT_DIRECTORY *EXPORT = ImageBase + ((IMAGE_NT_HEADERS *)(ImageBase + ((IMAGE_DOS_HEADER *)ImageBase)->e_lfanew))->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;

    printf("System Call Number : 0x%02x\n", SystemCallNumber);
    printf("Function Address : 0x%p\n", Function);

    for (int i = 0; i < EXPORT->NumberOfNames; i++)
    {
        if (ImageBase + *(DWORD *)(ImageBase + EXPORT->AddressOfFunctions + *(WORD *)(ImageBase + EXPORT->AddressOfNameOrdinals + i * 2) * 4) == Function)
        {
            printf("Function name : %s\n", ImageBase + *(DWORD *)(ImageBase + EXPORT->AddressOfNames + i * 4));
            break;
        }
    }
}

int main(int argc, char *argv[])
{
    PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION nirvana;
    nirvana.Version = 0;
    nirvana.Reserved = 0;
    nirvana.Callback = InstrumentationCallback;
    
    NtSetInformationProcess(GetCurrentProcess(), PROCESS_INFO_CLASS_INSTRUMENTATION, &nirvana, sizeof(nirvana));
    OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());

    return 0;
}

MSVC 컴파일용 어셈블리

; File : extern.asm
_TEXT SEGMENT

PUBLIC GetInstrumentationCallbackData

GetInstrumentationCallbackData PROC
    mov eax, dword ptr [r10 - 10h]
    mov dword ptr [rcx], eax
    lea rax, qword ptr [r10 - 14h]
    mov qword ptr [rdx], rax
    ret
GetInstrumentationCallbackData ENDP

_TEXT ENDS

END

=====GCC=====
CommandLine : gcc.exe main.c -o main.exe -lntdll -masm=intel
=====MSVC====
CommandLine : ml64.exe /c extern.asm => result : extern.obj
CommandLink : cl.exe main.c extern.obj /Od /Z7 /link /MANIFEST:NO /DEBUG:FULL /OPT:REF /OPT:ICF /OPT:LBR

실행 결과

System Call Number : 0x26
Function Address : 0x00007FFD5F22D3F0
Function name : NtOpenProcess
System Call Number : 0x2c
Function Address : 0x00007FFD5F22D4B0
Function name : NtTerminateProcess
System Call Number : 0x0f
Function Address : 0x00007FFD5F22D110
Function name : NtClose
System Call Number : 0x0f
Function Address : 0x00007FFD5F22D110
Function name : NtClose
System Call Number : 0x0f
Function Address : 0x00007FFD5F22D110
Function name : NtClose
System Call Number : 0x0f
Function Address : 0x00007FFD5F22D110
Function name : NtClose