0

I am begginer in RE and also in Win NT world. I used IDA to disassemble ntdll.dll from Win XP SP 3. I care about non oficially documented function NtCreatePort which creates LPC port. I would find out how it work under the cover. So ntdll.dll exports NtCreatePort and I can find this:

 mov     eax, 2Eh
 mov     edx, 7FFE0300h
 call    dword ptr [edx]
 retn    14h

So I think that function on address 7FFE0300h is called. The first problem: I do not know where to find it.

But from literature I found out that function KiFastSystemCall should be called, correct?

 mov edx, esp
 sysenter

I would think that syscall 2Eh could be called. But where to find it? I am quite stucked and I do not know how to continue with tracking.

Thanks you all! Btw I would appraciate if you recommend me a literature of this topic.

1

int 2e was used in systems prior to windows xp from windows xp fast syscall is the preferred method to transition from usermode to kernel mode

fast syscall pointer is embedded in the the Shared User Data Section

0:003> dt ntdll!_KUSER_SHARED_DATA  @@masm(SharedUserData) SystemCall
   +0x300 SystemCall : 0x76dd70f0

0:003> uf 0x76dd70f0
ntdll!KiFastSystemCall:
76dd70f0 8bd4            mov     edx,esp
76dd70f2 0f34            sysenter
76dd70f4 c3              ret

if you are using a usermode debugger you cant see the internals of Nt/Zw functions

ntdll carries only the stub that transitions into kernel mode

you need a kernel debugging connection or you have to depend on static analysis of ntos....(kr/mp).exe (kernel executive code)

or you can use livekd from sysinternals for local debugging

NtCreatePort calls nt!AlpcpCreateConnectionPort internally which calls NtCreateObject, initializes the port Attributes inserts
the object into HANDLE Table and returns back

a small overview of the control flow as follows (win 7 32 bit)

kd> uf /c nt!NtCreatePort
nt!NtCreatePort (8303f8a6)
  nt!NtCreatePort+0x22 (8303f8c8):
    call to nt!AlpcpCreateConnectionPort (8304d35c)
  nt!NtCreatePort+0x52 (8303f8f8):
    call to nt!KiCheckForKernelApcDelivery (82e74b24)


kd> uf /c nt!AlpcpCreateConnectionPort
nt!AlpcpCreateConnectionPort (8304d35c)
  nt!AlpcpCreateConnectionPort+0x7 (8304d363):
    call to nt!_SEH_prolog4 (82ecc240)
  nt!AlpcpCreateConnectionPort+0xb3 (8304d40f):
    call to nt!ObCreateObject (83072413)
  nt!AlpcpCreateConnectionPort+0xc5 (8304d421):
    call to nt!memset (82e864c0)
  nt!AlpcpCreateConnectionPort+0xf4 (8304d450):
    call to nt!AlpcpInitializePort (830b76c5)
  nt!AlpcpCreateConnectionPort+0x101 (8304d45d):
    call to nt!ObfDereferenceObject (82ec5163)
  nt!AlpcpCreateConnectionPort+0x120 (8304d47c):
    call to nt!AlpcpValidateAndSetPortAttributes (830b75a5)
  nt!AlpcpCreateConnectionPort+0x140 (8304d49c):
    call to nt!AlpcpSetOwnerProcessPort (830b77dc)
  nt!AlpcpCreateConnectionPort+0x14d (8304d4a9):
    call to nt!AlpcpAllocateBlob (830b7526)
  nt!AlpcpCreateConnectionPort+0x181 (8304d4dd):
    call to nt!AlpcInitializeHandleTable (830b7898)
  nt!AlpcpCreateConnectionPort+0x198 (8304d4f4):
    call to nt!ObInsertObjectEx (83071380)
  nt!AlpcpCreateConnectionPort+0x1d5 (8304d531):
    call to nt!_SEH_epilog4 (82ecc285)
kd>
0

First question:

in your example you right - KiFastSystemCall() is called. 7FFE0300h is pointer to it on non-ASLR systems.
In windbg, you can look at it like this: uf poi(7ffe0300)

Second question:

Where to find int 2E - in older Windows versions - Windows 2k and earlier. In Windows XP mechanism has changed, and the new one is exactly what you see in your IDA.

Please note that this relevant to x86 machines.

More details:

https://opcode0x90.wordpress.com/2007/05/18/kifastsystemcall-hook/

https://www.evilsocket.net/2014/02/11/on-windows-syscall-mechanism-and-syscall-numbers-extraction-methods/

https://www.codemachine.com/article_syscall.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.