3

I wrote a Pintool that intercepts system calls based on their system call number. I'm currently on a windows 7 machine and I'm using the system calls listed here as a reference. I'm tracing a hello world style executable that does the following :-

int (*dyncode)(int);
dyncode = (int(*)*int)) VirtualAlloc(NULL, 4096, MEM_COMMIT, PAGE_EXECUTE_READWRITE);

I went through the system calls being invoked and it doesn't seem to me that the NTProtectVirtualMemory system call is being invoked. It would be helpful to know which system calls are invoked when the VirtualAlloc function is called. From the results I see so far, no system calls show up for VirtualAlloc even though I can see them appear for calls to VirtualFree.

What I'm trying to do is intercept all system calls that allocate regions with executable privileges.

[EDIT]

A bit more of context. The reason I'm trying to intercept system calls is because I had initially written the pintool for linux and I had resorted to hooking system calls as opposed to libc calls(as I did not want to miss direct mprotect system calls). However, it seems this approach wouldn't work for Windows so I've resorted to using IMG_Instrument PIN functions to look for and instrument VirtualAlloc.

Improve this question
4
  • 1
    Just as a note: syscall IDs are different across systems in userland (maybe not at kernel level), so that table won't help you much. If you want to catch the calls for VirtualAlloc for a specific process, inject your DLL inside, hook VirtualAlloc ( which looks like this ; you can use GetProcAddress(kernel32_handle, "VirtualAlloc") for the offset at runtime ) and intercept. If you want to do it system-wide, you can do it using a driver... or injecting your DLL into every process. Do tell me if you need help doing it for a single process.
    – rev
    Feb 14, 2015 at 14:26
  • Thank you very much, this helps. I've not yet used using a DLL for hooking, but I've modified my pintool to look for VirtualAlloc whenever a new IMG is loaded and hook that. For now that seems to work. Thank you, again.
    – user1743
    Feb 14, 2015 at 14:55
  • @AcidShout I've added in a bit more context into the question too. I'm just curious though, when you say "syscall IDs vary across systems in userland" did you mean for different versions of Windows(across service packs too)? Thanks.
    – user1743
    Feb 14, 2015 at 15:01
  • yes, they vary even between different service packs. I don't know what's your system, but mine's Windows 7 x64 Ultimate SP1, and the syscall ID for ZwResumeThread is 0x4F (ntdll.dll, x64). It is probably different on your system. While it is possible for the IDs to be the same, you shouldn't rely on that if you want portability. I'm not sure about ring0, though.
    – rev
    Feb 14, 2015 at 15:09

1 Answer 1

Reset to default
3

NtProtectVirutalMemory is not a part of VirtualAlloc call it is a part of VirtualProtect call

you can verify your pintool trace with this windbg conditional breakpoint on any executable that allocates memory

0:000> bl
0 e 7c809af1 0001 (0001) 0:**** kernel32!VirtualAlloc "bp /1 @$ra \"g\";wt"

0:000> $$ break on valloc set a one time condtional break on return address on the stack (condition == keep executing as is) and trace the call
0:000> g

result

Tracing kernel32!VirtualAlloc to return address 76fdc3ac
    9     0 [  0] kernel32!VirtualAlloc
    3     0 [  1]   kernel32!VirtualAllocEx
   19     0 [  2]     kernel32!_SEH_prolog
   16    19 [  1]   kernel32!VirtualAllocEx
    1     0 [  2]     ntdll!ZwAllocateVirtualMemory
    2     0 [  2]     ntdll!NtAllocateVirtualMemory
    2     0 [  3]       ntdll!KiFastSystemCall
    1     0 [  2]     ntdll!NtAllocateVirtualMemory
   22    25 [  1]   kernel32!VirtualAllocEx
    9     0 [  2]     kernel32!_SEH_epilog
   23    34 [  1]   kernel32!VirtualAllocEx
   11    57 [  0] kernel32!VirtualAlloc

68 instructions were executed in 67 events (0 from other threads)

Function Name                               Invocations MinInst MaxInst AvgInst
kernel32!VirtualAlloc                                 1      11      11      11
kernel32!VirtualAllocEx                               1      23      23      23
kernel32!_SEH_epilog                                  1       9       9       9
kernel32!_SEH_prolog                                  1      19      19      19
ntdll!KiFastSystemCall                                1       2       2       2
ntdll!NtAllocateVirtualMemory                         2       1       2       1
ntdll!ZwAllocateVirtualMemory                         1       1       1       1

1 system call was executed

Calls  System Call
    1  ntdll!KiFastSystemCall

edit

a trace result for VirtualProtect with call stack and raw Dword dump of esp

0:001> bl
0 e 7c801ad4 0001 (0001) 0:**** kernel32!VirtualProtect "dd esp l8;kb 3;bp /1 @$ra \"g\";wt"

dd esp l8

009df560  03042c08 00b10000 00002ab0 00000002
009df570  009df588 00000440 00832758 009df54c

kb 3

ChildEBP RetAddr  Args to Child              
009df55c 03042c08 00b10000 00002ab0 00000002 kernel32!VirtualProtect
009df58c 030420f7 008124b0 0084a610 00832758 dbghelp!idd2me+0x3d8
009dfa3c 03041c5a 00000440 00832758 00832758 dbghelp!modload+0x367

wt

Tracing kernel32!VirtualProtect to return address 03042c08
    9     0 [  0] kernel32!VirtualProtect
   14     0 [  1]   kernel32!VirtualProtectEx
    1     0 [  2]     ntdll!ZwProtectVirtualMemory
    2     0 [  2]     ntdll!NtProtectVirtualMemory
    2     0 [  3]       ntdll!KiFastSystemCall
    1     0 [  2]     ntdll!NtProtectVirtualMemory
   23     6 [  1]   kernel32!VirtualProtectEx
   11    29 [  0] kernel32!VirtualProtect

40 instructions were executed in 39 events (0 from other threads)

Function Name                               Invocations MinInst MaxInst AvgInst
kernel32!VirtualProtect                               1      11      11      11
kernel32!VirtualProtectEx                             1      23      23      23
ntdll!KiFastSystemCall                                1       2       2       2
ntdll!NtProtectVirtualMemory                          2       1       2       1
ntdll!ZwProtectVirtualMemory                          1       1       1       1

1 system call was executed

Calls  System Call
    1  ntdll!KiFastSystemCall
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.