j00ru

KASLR: Kernel Address Space Layout Randomization. See https://en.wikipedia.org/wiki/Address_space_layout_randomization for an overview on what this does. SMAP/SMEP: Intel/x86-specific security features. See http://j00ru.vexillium.org/?p=783 for an early (2011!) take on SMEP. (j00ru is great reading, in any case.) See https://lwn.net/Articles/517475/ for SMAP from LWN. PAN: Privileged Access Never, Basically ARM SMAP: https://community.arm.com/groups/processors/blog/2014/12/02/the-armv8-…

Excellent blog post by Mateusz Jurczyk of Google Project Zero on how the ATMFD DLL vulnerability was discovered and how an exploit POC was developed is here - http://j00ru.vexillium.org/?p=2520 Especially read the linked PDF if you love pain and misery but enjoy understanding complex stuff :)

This seems like it would be a lot of maintenance effort to get right, considering Windows shuffles their syscall table every release, including releases within the Windows 10 family. https://j00ru.vexillium.org/syscalls/nt/64/ Has an excellent table of syscalls by version.

Windows NT 3.5 ran the Win32 subsystem inside csrss.exe [1]. But csrss.exe was and continues to be a "God process" that is game-over if compromised. The difference between NT AUTHORITY\SYSTEM (what CSRSS runs as) and the kernel isn't particularly meaningful to an attacker: both are essentially unrestricted access. [1]: http://j00ru.vexillium.org/?p=492

Great work. From looking at the PDF [1], it seems that this was done with something like IDA Pro rather than from sources. I imagine work like this would be a good candidate for the Microsoft Shared Source Initiative [2]. [1] http://j00ru.vexillium.org/dump/recon2015.pdf [2] https://www.microsoft.com/en-us/sharedsource/

> I wonder how many of the bugs led to code execution? The linked blog article [1] suggests 10% - 20%: Our personal feeling is that between 10% and 20% of the problems could be considered easily exploitable security issues; however, the estimation has not been formally confirmed in any way. [1] http://j00ru.vexillium.org/?p=2211

https://j00ru.vexillium.org/syscalls/nt/64/ (One example: hit "Show" on the table header for Win11, then use the form at the top of the page to highlight syscall 8c)

The syscall numbers change with every release: https://j00ru.vexillium.org/syscalls/nt/64/

FFmpeg and a thousand fixes: https://j00ru.vexillium.org/2014/01/ffmpeg-and-the-tale-of-a-thousand-… "While reading about the 4xm demuxer vulnerability, we thought that we could help FFmpeg eliminate many potential low-hanging problems from the code by making use of the Google fleet and fuzzing infrastructure we already had in place"

Linux is exceptional in that it has stable syscall numbers and guarantees stability. This is largely why statically linked binaries (and containers) "just work" on Linux, meanwhile Windows and Mac OS inevitably break things with an OS update. Microsoft frequently tweaks syscall numbers, and they make it clear that developers must access functions through e.g. NTDLL. Mac OS at least has public source files used to generate syscall.h, but they do break things, and there was a recent incident where Go programs all broke after a major OS update. Now Go uses libSystem (and dynamic linking)[2]. [1] https://j00ru.vexillium.org/syscalls/nt/64/ [2] https://go.dev/doc/go1.11#runtime

Unlike Linux, Windows syscalls aren't documented and their IDs constantly change[1]. Instead, you're supposed to call wrapper functions provided by ntdll.dll. That said, most programs use even higher level functions from kernel32.dll and friends. You don't need C/C++ to call a function from a DLL, but it makes things easier, especially for more complex APIs like DirectX. [1] - https://j00ru.vexillium.org/syscalls/nt/64/

libav was the fork [1], and libav is dead now [2,3] (and many developers returned to ffmpeg). libav was forced to rename their project because Fabrice Bellard, still owner of the trademark and the ffmpeg.org domain, did not hand it over. ffmpeg put in much effort retain compatibility with libav, mostly by merging all their changes wholesale, while libav ignored ffmpeg, including and most crucially, their security fixes [4]. [1] http://blog.pkh.me/p/13-the-ffmpeg-libav-situation.html [2] https://www.libav.org/ [3] https://www.phoronix.com/news/FFmpeg-Back-In-Debian [4] https://j00ru.vexillium.org/2014/01/ffmpeg-and-the-tale-of-a-thousand-…

Microsoft also changes the kernel syscalls between releases. It's not unusual for operating systems to specify ABI at the libc level, in fact I believe Linux is the odd one out to specify ABI at the syscall level. https://j00ru.vexillium.org/syscalls/nt/64/

They do change over time, and programs will break between updates on different windows versions of you make syscalls directly. https://j00ru.vexillium.org/syscalls/nt/64/ (click show all)

Something funny about Windows is that there are no documented system calls. That is, if you want to use some OS service you either call a function in a DLL or you make a COM call to a COM service. If you click on the "show" button in this page https://j00ru.vexillium.org/syscalls/nt/64/ you can see that the syscall numbers change from release to release! I'm pretty sure that this tool https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/log… works by trapping calls to the DLL, which are stable.

Compare this: https://linuxhint.com/list_of_linux_syscalls/ with https://j00ru.vexillium.org/syscalls/nt/64/ and https://j00ru.vexillium.org/syscalls/win32k/64/

Ntdll is the kernel ABI on windows; it is stable, and cosmopolitan uses it. Not sure what you mean by ‘on Windows thing are more stable’; syscall numbers change all the time. See https://j00ru.vexillium.org/syscalls/nt/64/

Well if you really want to you can get the output handle from the PEB[0]. You can then call NtWriteFile[1] using syscall `0x0008` (Windows 10 x64 only)[2]. [0]: https://processhacker.sourceforge.io/doc/struct___r_t_l___u_s_e_r___p_… [1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf… [2]: https://j00ru.vexillium.org/syscalls/nt/64/

Symbol names and function prototypes in ntdll.dll are stable (albeit not officially stable), but system call numbers change frequently: https://j00ru.vexillium.org/syscalls/nt/64/

They don't have them documented, but I didn't think they changed that much. But apparently they did. Just found this neat site: https://j00ru.vexillium.org/syscalls/nt/64/

Windows syscall numbers change with every service pack release (see https://j00ru.vexillium.org/syscalls/nt/64/ for an incomplete table), and the interfaces themselves are not guaranteed to be stable in any way. ntdll is the only reasonable way to make syscalls on Windows. Trying to build your own syscall code on Windows is fragile and unmaintainable. Linux maintains stable syscall interfaces. BSDs don't guarantee it, but generally don't change much. But macOS and Windows can and will change their interfaces.

Note that this page doesn't show the full set of syscalls, just a subset of them (seems to be the ones ntdll calls). The Win32k stuff, for one, don't seem to be there (edit: they're on this page instead: https://j00ru.vexillium.org/syscalls/win32k/64/), let alone more obscure ones that I expect exist but that I don't know about (like WSL stuff).

This kind of issue happens all the time with structs that a kernel, driver etc. expose to userspace: https://j00ru.vexillium.org/papers/2018/bochspwn_reloaded.pdf Not sending the structure over the network is insufficient, and rigorous memset is a clear solution to this problem. Also, C structure layout for a specific ABI is strictly determined; if that weren’t the case you couldn’t compile two C compilation units with different flags/compilers and expect them to work.

> Windows gets this right and is able to iterate faster on kernel interfaces as a result. The only place that'd have any bearing is for modified syscalls. Newly added obviously aren't an issue, And looking at syscalls removed, it's because they removed whole subsystems that never had anyone using it. Those would probably not even get upstreamed into the mainline kernel to being with. I'm not seeing any evidence of what you're saying while looking at how the NT syscall layer has changed over the past couple decades. https://j00ru.vexillium.org/syscalls/nt/64/

Yes Windows does provide such a thing: http://j00ru.vexillium.org/ntapi/ Would be very interesting to see a Wine based on this concept instead...

I don't know about OS X. You're right about Linux, though, and Torvalds will descend into an angry screed if you try to break the ABI. Windows, on the other hand, does not save the numbers between releases. http://j00ru.vexillium.org/ntapi_64/ is a table showing the system call table for each given release, and how sometimes it even changes between service packs of the same released OS.

http://www.devttys0.com/blog/ http://www.dumpanalysis.org/blog/ https://blogs.oracle.com/ksplice/ http://j00ru.vexillium.org/?lang=en http://blogs.msdn.com/b/ntdebugging/

> relatively little investment compared to migrating to an OS on another kernel One of the more beautiful aspects of Windows is you actually rarely interact with the kernel at all. That portion of the OS could (and in practice often is) switched out and replaced without the user-facing portions being aware. If you look at the list of NT system calls [0] you can see how frequently they've changed. The only programs that can safely talk to the kernel are core OS components, which in turn provide a user-facing stable ABI through the use of DLLs. The fact Wine is running on a separate kernel is essentially 100% transparent to all but a handful of programs that intentionally poke the kernel, either for undocumented functionality or to e.g. detect tampering. This is why IMO for running application software, Wine will always be superior. Linux is a really good kernel for almost everything, and with io_uring the last big deficit (async i/o) may be fixed. ReactOS's remaining advantages are driver support for Win2k, and the whole explorer shell and start menu environment. If someone really wanted to, I bet you could run ReactOS's shell on top of Wine, fullscreened on Linux... [0] https://j00ru.vexillium.org/syscalls/nt/32/ EDIT: A thought I had after finishing this. Another benefit of ReactOS's architecture vs Wine is you could, in principle, directly copy at least some system-level DLLs/software from Windows (2000/XP) and get something akin to Windows 2003/XP running on a…

"Generating Software Tests" (https://www.fuzzingbook.org/) is pretty great (independent of your programming language) - arguably a must read for anyone interested in software testing. John Regehr (the author of the blog post) has written more great posts: - How to Fuzz an ADT Implementation - https://blog.regehr.org/archives/896 - Better Random Testing by Leaving Features Out - https://blog.regehr.org/archives/591 - Tricking a Whitebox Testcase Generator - https://blog.regehr.org/archives/672 - Fuzzers Need Taming - https://blog.regehr.org/archives/925 - Levels of Fuzzing - https://blog.regehr.org/archives/1039 - API Fuzzing vs. File Fuzzing: A Cautionary Tale - https://blog.regehr.org/archives/1269 - Reducers are Fuzzers - https://blog.regehr.org/archives/1284 In terms of software, DeepState (https://github.com/trailofbits/deepstate) may be a good place to start for C and C++. Relevant links: - Fuzzing an API with DeepState: https://blog.trailofbits.com/2019/01/22/fuzzing-an-api-with-deepstate-… https://blog.trailofbits.com/2019/01/23/fuzzing-an-api-with-deepstate-… - NDSS 18 paper, "DeepState: Symbolic Unit Testing for C and C++": https://www.cefns.nau.edu/~adg326/bar18.pdf In terms of choosing among fuzzing solutions, https://blog.trailofbits.com/2018/10/05/how-to-spot-good-fuzzing-resea… is also worth a read -- as well as the article it refers to, http://www.pl-enthusiast.net/2018/08/23/evaluating-empirical-evaluatio… For a…

A value in the range between -4095 and -1 indicates an error, it is -errno. The syscall/errno stuff has always seemed unusual, inelegant, and inefficient --- instead of just returning a negative error code directly, the function returns the vague "an error has occurred" -1, and you have to then check errno separately after that. It only adds insult to injury when you realise that the kernel itself isn't doing it, but the syscall wrappers. And thanks to POSIX standardising this mechanism, the alternative will likely never get much adoption; of course, if you write your own syscall wrappers like this article, then you can skip that bloat. For now this guide is linux-only, but I will be writing a windows version when I feel like firing up a virtual machine. Unfortunately the Windows syscalls are not officially documented and even less stable than on Linux, changing even between service packs. http://j00ru.vexillium.org/ntapi/ http://j00ru.vexillium.org/ntapi_64/ At least on Linux the first few (i.e. the oldest, most common and useful) syscalls have not really moved around over the years: https://filippo.io/linux-syscall-table/