Alex-ionescu.com Website Review

Windows Internals, Thoughts on Security, and Reverse Engineering ------------------------- At boot, the OS now calls KiInitDynamicTraceSupport, which only if kernel debugging is enabled, will call into the TraceInitSystem export provided by the ext-win-ms-ntos-trace-L-1-1-0 API Set, which is not currently shipping in the public OS schemas. This export receives a If the function returns successfully, KiDynamicTraceEnabled is now set. The last routine is not terribly interesting, as it is already used by the debugger when accessing physical memory through commands such as EtwRegisterEventCallback is a new internal function, accessible only by the dynamic trace system, which allows as*ociating a custom ETW event callback routine, and as*ociated context, with any ETW Logger ID. The function validates that the callback function is valid by calling KeIsValidTraceCallbackTarget, which does two things: At this point, any time an ETW event is thrown by this logger, this kernel-mode callback is also called, introducing, for the first time, support for kernel-mode consumption of ETW events, one of the biggest asks of the security industry in the last decade. This call is done by EtwpInvokeEventCallback, which calls the registered ETW callback with the raw ETW buffer data at the correct offset where this event starts, and the size of the event in the buffer. This new callback is called from: This essentially gives access to the callback to any and all ETW event data, including even WPP and TraceLog debug messages. KeSetSystemServiceCallback, on the other hand, fulfills the second Christmas wish of every Windows security researcher: officially implemented system call hooks. The API allows the dynamic trace system to register a system call hook by name and pas* an as*ociated callback KiServicesTab (a new, more comprehensive system call table) into a Red-Black tree which contains an entry for each system call with its Before continuing, it’s worth talking about the format of the new KiServicesTab structure, as it introduces some valuable information