Emulation of ExAllocatePoolWithTag

Question

Emulation of ExAllocatePoolWithTag

p0w1 opened this issue 2 years ago · comments

I looked into fuzzing a driver. However, I'm running into issues when a call to ExAllocatePoolWithTag is executed during the fuzzing withs bochscpu or KVM. Sometimes it crashes directly inside the function and sometimes afterwards. Do you have an idea how to resolve/emulate this? I've attached an example trace file. The last call from the Target is nt!ExAllocatePoolWithTag

Thanks for your help!
efd332708da860ec4c82a347b65118e4.trace.txt

Axel Souchet · Answer 1 · Thu Oct 20 2022 04:49:35 GMT+0800 (China Standard Time)

Thanks for the report! I'll check that out later this month once I'm back from vacation :) Hang tight! Cheers

…

On Mon, Oct 17, 2022 at 12:52 AM p0w1 ***@***.***> wrote: I looked into fuzzing a driver. However, I'm running into issues when a call to ExAllocatePoolWithTag is executed during the fuzzing withs bochscpu. Sometimes it crashes directly inside the function and sometimes afterwards. Do you have an idea how to resolve/emulate this? I had a similar problem with ProbeForWrite/Read. This function never raised an error although a non-accessible memory location was provided as an arument. My solution was to test the address (parameter for ProbeForWrite) with VirtTranslate and stop if it cannot be translated. Thanks for your help! — Reply to this email directly, view it on GitHub <#138>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIORL5W3OX3LMGVGYNB4DWDUASNANCNFSM6AAAAAARGZHKHE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

Axel Souchet · Answer 2 · Fri Mar 31 2023 10:27:44 GMT+0800 (China Standard Time)

Oh man, seems like I never got back to you - so sorry I forgot! Feel free to bug me in the future if I forget 🤦🏽‍♂️😅

Let me try to take a look at that trace..

Axel Souchet · Answer 3 · Fri Mar 31 2023 10:35:33 GMT+0800 (China Standard Time)

Okay this is something I haven't seen - do you remember what kind of bugcheck this was triggering? Also, is this possible that your fuzzing module corrupts memory that is then detected by the LFH which bugchecks (callstack seems to match yours in LFH Kernel Pool Allocator Challenges the Incumbent
)?

Cheers

Axel Souchet · Answer 4 · Wed May 10 2023 10:30:46 GMT+0800 (China Standard Time)

Closing as it has been idle for months; please feel free to re-open if you have the same problem again :)

Cheers

p0w1 · Answer 5 · Wed May 10 2023 16:58:19 GMT+0800 (China Standard Time)

Sorry, I did not have any time for having a look at it. If I'll get back to it I let you know. Thanks for the help!

Axel Souchet · Answer 6 · Wed May 10 2023 22:31:21 GMT+0800 (China Standard Time)

No worries at all - just doing a spring cleaning :)

Cheers

p0w1 · Answer 7 · Wed Oct 25 2023 19:16:40 GMT+0800 (China Standard Time)

I checked it again, the issue was that the driver requested PagedPool with the IRQL=f which is not allowed.

The actual problem, however, is probably the following:

kd> r cr8
cr8=000000000000000f
kd> !irql
Debugger saved IRQL for processor 0x0 -- 0 (LOW_LEVEL)

The cr8 is changed if a breakpoint is hit in WinDBG and consequently, the regs.json from bdump contains the value "f" instead of "0" in this case.

Axel Souchet · Answer 8 · Thu Oct 26 2023 16:56:28 GMT+0800 (China Standard Time)

Cool this makes sense; the IRQL in your regs.json is probably not right :) Thanks for sharing! Cheers

…

On Wed, Oct 25, 2023 at 1:16 PM p0w1 ***@***.***> wrote: I checked it again, the issue was that the driver requested PagedPool with the IRQL=f. This is not allowed. — Reply to this email directly, view it on GitHub <#138 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALIORL4XNLHZBGFRJWTH6DYBDYKFAVCNFSM6AAAAAARGZHKHGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONZZGA2DCMRSGU> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>