0

I've encountered an image validation error while trying to inject dll from driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the requested dll to load.

NOTICE: this error occurs only in the latest update (1903)

The injection timing is on creation of new thread on an existing process (so that processes that existed before the driver is loaded could be injected as well - assuming new alertable threads will be created on them).

Anyhow, it seems that although the dll is signed, it fails on signing issue (perhaps mismatch between processes executable file and dll signatures)

here's the stack trace from the context of the injected processes after initial injected code tried to call ldrloaddll

[0x0]   CI!CipReportAndReprieveUMCIFailure + 0x563   
[0x1]   CI!CiValidateImageHeader + 0xbdb   
[0x2]   nt!SeValidateImageHeader + 0xd6   
[0x3]   nt!MiValidateSectionCreate + 0x436   
[0x4]   nt!MiValidateSectionSigningPolicy + 0xa6   
[0x5]   nt!MiValidateExistingImage + 0x12e   
[0x6]   nt!MiShareExistingControlArea + 0xc2   
[0x7]   nt!MiCreateImageOrDataSection + 0x1a3   
[0x8]   nt!MiCreateSection + 0xf4   
[0x9]   nt!MiCreateSectionCommon + 0x1ff   
[0xa]   nt!NtCreateSection + 0x60   
[0xb]   nt!KiSystemServiceCopyEnd + 0x25   
[0xc]   ntdll!NtCreateSection + 0x14   
[0xd]   ntdll!LdrpMapDllNtFileName + 0x136   
[0xe]   ntdll!LdrpMapDllFullPath + 0xe0   
[0xf]   ntdll!LdrpProcessWork + 0x74   
[0x10]   ntdll!LdrpLoadDllInternal + 0x13e   
[0x11]   ntdll!LdrpLoadDll + 0xa8   
[0x12]   ntdll!LdrLoadDll + 0xe4   

the process is image is spawned from dllhost.exe and it's not revealed as protected using method PsIsProtectedProcess

Any idea what can lead to this error ?

thanks

  • Is there a stats code? – Igor Skochinsky Sep 15 at 15:07
  • do you mean error code ? in this case, here's the code 1: kd> !gle LastErrorValue: (Win32) 0 (0) - The operation completed successfully. LastStatusValue: (NTSTATUS) 0xc000000d - An invalid parameter was passed to a service or function. doesn't says anything specific ... notice that it happens only in 1903 – Zohar81 Sep 15 at 18:12
  • try to enable loader snaps – Igor Skochinsky Sep 15 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.