Windows Internals Blog

Following that through to the blog post ([1]), it's interesting how much new API they had to add. The Windows IO API is already completion-style (as opposed to epoll, etc's readiness-style) - userspace submits an async operation to the kernel, blocks on a channel to receive its result, and the kernel enqueues the result to said channel when it's done. So I naively assumed that they'd "just" have to refit io_uring's API on top of the existing Win32 API. [1]: https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-…

It's worth reading the full technical analysis https://windows-internals.com/printdemon-cve-2020-1048/ It's well written and easy to follow even for someone that doesn't know much about Windows security. And if you didn't read it the bug comes from the fact that the Powershell command Add-PrinterPort can be used to add a printer port as a file that you don't have access to. After restarting the spooler service you can then use this port to write to that file.

> I think you missed the point: io_uring is the newer API. GP was pointing out that io_uring came after RIO; RIO has similar capabilities to io_uring for the network space. GP did not "miss the point". > Microsoft understand quite well that they have pervasive issues with IO performance This has nothing to do with IOCP but rather the file system filters. This is why removal of file system filters from "DevDrive" (a ReFS volume) improves performance vs a ReFS volume with file system filters in place. > If what Windows has had all along is so great, why did they bother cloning io_uring when io_uring came along? IoRing eliminates the need to copy buffers between kernel and user space [0][1]. With regards to performance, this is a bench between a traditional multithreaded UDP server and an RIO IOCP UDP server. The gains are significant. [2] And further comparisons... [3] > seldom bother to assess whether the decades-old async API actually offers good performance in comparison to more recent alternatives There are no complete alternatives [r]. Nor is Linux fully asynchronous throughout the kernel. > introducing DirectStorage Not really relevant to the context. DirectStorage is a method to deliver data from nVME storage with minimal CPU overhead and/or compressed [4]. Such a system would improve performance on any OS and indeed, we can see that on PS OS (PS5, FreeBSD-based (probably)). Again, limited in scope. I'm honestly not sure what you're attempting to argue.…

Is this new async. I/O feature for Linux only? I know Windows has IOCP and also now an IORing implementation of its own (Less familiar with macOS capabilities other than POSIX AIO). https://learn.microsoft.com/en-us/windows/win32/api/ioringapi/ Update: Most of the comments below seem to be missing the fact that Windows now also has an IORing implementation, as I mentioned above. Comparison article here: https://windows-internals.com/ioring-vs-io_uring-a-comparison-of-windo…

IOCP, which originated in NT 3.1, is not a circular buffer like io_uring, but both are completion-oriented. Microsoft introduced I/O Rings, more or less a 1:1 copy of io_uring, in Windows 21H1. https://learn.microsoft.com/en-us/windows/win32/api/ioringapi/ https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-… https://windows-internals.com/ioring-vs-io_uring-a-comparison-of-windo… Windows 8/2012 R2 did introduce Registered I/O for WinSock which is very similar to I/O Rings and io_uring. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/win…

I wasn't referring to async I/O. I'm talking about the ability to make system calls using a user/kernel shared memory buffer, without having to enter and exit the kernel. (This is particularly important with all the security mitigations that make kernel entry/exit more expensive.) https://windows-internals.com/ioring-vs-io_uring-a-comparison-of-windo…

Interestingly io_uring was added to NT. https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-…

> io_uring is significantly better than anything available on Windows right now. Windows 11 copied io_uring almost 1:1 - https://windows-internals.com/ioring-vs-io_uring-a-comparison-of-windo…

In Windows 10/11 the core of the Windows kernel can run in a virtual machine totally separated from the rest of the kernel. > HyperGuard takes advantage of VBS – Virtualization Based Security > Having memory that cannot be tampered with even from normal kernel code allows for many new security features > This is also what allows Microsoft to implement HyperGuard – a feature similar to PatchGuard that can’t be tampered with even by malicious code that managed to elevate itself to run in the kernel. https://windows-internals.com/hyperguard-secure-kernel-patch-guard-par…

https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-… https://docs.microsoft.com/en-us/windows/win32/api/ioringapi/

Seems windows is getting ring buffers based io too, eventually: https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-… Not identical to io_uring, but close enough that porting between them will probably be quite simple.

Btw Windows built an api based on io_uring https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-…

Yes, and now things are going full circle and windows is adopting the ring model too. https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-…

It did, then io_uring leapfrogged it, and now Windows is moving towards adding a ring-based IO submission system: https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-…

The url should be updated to the source article https://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-…

Forgot to check for replies. In particular, I was thinking of this blog post: https://windows-internals.com/exploiting-a-simple-vulnerability-in-35-… Thanks for the correction, sorry I typoed her name. Here's a tweet from the original finder: https://twitter.com/gabe_k/status/1330966182543777792?s=20 Yarden & Ionescu's work are both really top notch. Also anything by Google Project Zero if you want to do a deep dive on the subject.

I tried Googling to find this blog post. Did you mean to write Yarden Shafir? If yes, maybe it was this blog post? https://windows-internals.com/printdemon-cve-2020-1048/ I also found another hint about their findings in this PDF written by Yarden's co-researcher Alex Ionescu: https://www.usenix.org/system/files/woot20_slides_ionescu.pdf. One of the slides specifically mentions the use of fuzzing tools to find these issues. If there are other, better links I don't know about, please kindly share. :)

I think the key problem is that it's very old; almost certainly the core code dates from NT, possibly earlier. Longer analysis: https://windows-internals.com/printdemon-cve-2020-1048/ The core is: a) you can set up a printer port that prints to a file b) no admin privilege is required to do this, just a check on the ownership of the file c) the ownership check is in the wrong place, so you can just create a port that prints to a DLL in system32 d) a second export forces Windows to load that DLL and run a specific function as SYSTEM, at which point game over