First of all, it is necessary to have disassembling skills and knowledge of Microsoft Windows PE COFF executable file format. To edit .exe/.dll the import table (NT_IMPORT_TABLE) you will need tools like:
As a minimal example, you should rewrite a typical KERNE32.DLL into your own implementation of Kernel64.dll:
Use Dependency Walker for determine absent WinAPIs in Windows 7 system (KERNE32.DLL, red C flag, GetProcessMitigationPolicy/PrefetchVirtualMemory/SetProcessMitigationPolicy/SetThreadInformation) :
- API-MS-WIN-CORE-HANDLE-L1-1-0
- API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0
- API-MS-WIN-CORE-REALTIME-L1-1-1
- API-MS-WIN-CORE-WINRT-ERROR-L1-1-0
- API-MS-WIN-CORE-WINRT-L1-1-0
- API-MS-WIN-CORE-WINRT-STRING-L1-1-0
- API-MS-WIN-POWER-BASE-L1-1-0
- API-MS-WIN-SHCORE-SCALING-L1-1-1
- API-MS-WIN-CORE-SYSINFO-L1-2-1
- msvproc
- kernel64
- netapi64
- user64
- userenx
- WinXttp
- wldp
- xcryptprimitives
- Xfplat
Simple: after link you DLL (kernel64, API-MS-WIN-CORE-HANDLE-L1-1-0, user64, WinXttp ...) in MSVC (or you choose) set the latest command -
linker_export.exe "kernel64.dll"
More technical info:
1) We cannot directly compile DLLs with exported functions whose names are already written in the original Microsoft system dll-libraries.
For example, WinAPI GetProcessMitigationPolicy
, CreateFileA
from %SYSTEMROOT%\System32\kernel32.dll and so on.
2) Also, we cannot take the same system library name (e.g. kernel32) for our library to use without editing the PE COFF export table.
To solve the first problem (1), we mark the exported functions in our library with a special marker (lower _ dash).
_GetProcessMitigationPolicy
.
is a sign for linker_export that the name of the specified function should be renamed (remove the marker) to get the original name GetProcessMitigationPolicy
.
At the same time linker_export removes unnecessary characters such as @ that are left after x86 (32-bit compiler). On the output we get a correct name of the exported function, which is correctly recognized during initial library loading and after GetProcAddress()
call.
To solve the second problem, we need to assign a name different from the name of the source system library: kernel64.dll
instead of kernel32.dll. In this case, our library kernel64.dll
performs the following functions
- proxy/bridged functions into the original system library "%SYSTEMROOT%\System32\kernel32.dll". This requires editing of the Chrome/EDGE/Opera/Spotify import table, etc.*
- substitutes or emulates WinAPI exported functions missing in Windows 7 such as
GetProcessMitigationPolicy
,SetThreadInformation
,GetFirmwareType
and so on.
std::u16string name;
if (win::GetVersion() < win::Version::WIN8_1) {
// Windows < 8.1 ignores DACLs on certain unnamed objects (like shared
// sections). So, we generate a random name when we need to enforce
// read-only.
/*
Windows < 8.1 игнорирует DACL для некоторых неименованных объектов (like shared sections).
Поэтому мы генерируем случайное имя, когда нам нужно обеспечить только для чтения.
uint64_t rand_values[4];
RandBytes(&rand_values, sizeof(rand_values));
name = ASCIIToUTF16(StringPrintf("CrSharedMem_%016llx%016llx%016llx%016llx",
rand_values[0], rand_values[1],
rand_values[2], rand_values[3]));
DCHECK(!name.empty());
}
- MPFLAT/WLDP preloader func. WLDP.dll for from MS EDSGE;
- DDRAW_FontCase_Service_SANDBOX_hook() - fixed fails in Windows 7 DirectDRAW (DDRAW.DLL)
public: static bool cdecl ClientSideConnection::StartFontCacheService(unsigned int)
- WinAPI UpdateProcThreadAttribute must be fixed manually in the assembly binary code;
Library Name | Bridged to %SYSTEMROOT%\System32... | EXPORT_TABLE |
---|---|---|
API-MS-WIN-CORE-HANDLE-L1-1-0 | ❌ | CompareObjectHandles |
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 | kernel32.dll | ❓*{skip_entrys.cpp}* |
API-MS-WIN-CORE-REALTIME-L1-1-1 | ❌ | QueryUnbiasedInterruptTimePrecise |
API-MS-WIN-CORE-WINRT-ERROR-L1-1-0 | ❌ | RoOriginateError, RoTransformError, ... |
API-MS-WIN-CORE-WINRT-L1-1-0 | ❌ | RoActivateInstance,GetActivationFactory,RoGetActivationFactory, ... |
API-MS-WIN-CORE-WINRT-STRING-L1-1-0 | ❌ | HSTRING_UserMarshal,... |
API-MS-WIN-POWER-BASE-L1-1-0 | ❌ | CallNtPowerInformation,PowerDeterminePlatformRoleEx |
API-MS-WIN-SHCORE-SCALING-L1-1-1 | ❌ | GetDpiForMonitor, SetProcessDpiAwareness, GetScaleFactorForMonitor |
API-MS-WIN-CORE-SYSINFO-L1-2-1 | ❌/⏳kernel32.dll | DnsHostnameToComputerNameExW, InstallELAMCertificateInfo, SetComputerNameEx2W |
msvproc | ❓ | |
kernel64 | kernel32.dll | DiscardVirtualMemory, PrefetchVirtualMemory, SetThreadInformation, GetProcessMitigationPolicy,SetProcessMitigationPolicy, Wow64GetThreadContext, GetPackageFamilyName,... |
netapi64 | netapi32.dll | NetGetAadJoinInformation, NetFreeAadJoinInformation |
user64 | user32.dll | GetPointerPenInfo, GetPointerType, RegisterSuspendResumeNotification, GetDpiForWindow, PhysicalToLogicalPointForPerMonitorDPI, GetPointerInputTransform,... |
userenx | userenv.dll | CreateAppContainerProfile,DeriveAppContainerSidFromAppContainerName |
WinXttp | WinHttp.dll | WinHttpCreateProxyResolver, WinHttpFreeProxyResult, WinHttpGetProxyForUrlEx, WinHttpGetProxyResult |
wldp | ❌ | WldpQueryWindowsLockdownMode |
xcryptprimitives | bcryptprimitives.dll | ProcessPrng |
Xfplat | Mfplat.dll | MFCreateDXGIDeviceManager, MFCreateDXGISurfaceBuffer,MFLockDXGIDeviceManager, MFUnlockDXGIDeviceManager |
Nice hunt! ELF/80_PA