Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support NtAlpcConnectPort/NtAlpcSendWaitReceivePort #128

Open
acheron2302 opened this issue Feb 7, 2025 · 2 comments · Fixed by #129
Open

Support NtAlpcConnectPort/NtAlpcSendWaitReceivePort #128

acheron2302 opened this issue Feb 7, 2025 · 2 comments · Fixed by #129
Labels
feature New feature or request

Comments

@acheron2302
Copy link

acheron2302 commented Feb 7, 2025

Overview
When I tried to emulate a file with comctl32.dll, the emulator fail when tried to run through comctl32.dll entry point.

Reason
user32.dll call CsrClientConnectServer which in turn call "CsrClietnCallServer" and "NtAlpcSendWaitReceivePort" in order to get the information from csrss.exe but "handle_NtAlpcSendWaitReceivePort" hasn't been implemented to support the case.

Version of windows:
windows 11 pro (10.0.22631 build 22631)

Reproduce:
Make change to test.cpp, compile the code and run the command .\analyzer.exe -e "root" -r "registry" "C:\temp\test.exe"

bool test_tls()
{
    std::atomic_bool kill{false};
    std::atomic_uint32_t successes{0};
    constexpr uint32_t thread_count = 2;

    std::vector<std::thread> ts{};
    kill = false;

    for (size_t i = 0; i < thread_count; ++i)
    {
        ts.emplace_back([&] {
            while (!kill)
            {
                std::this_thread::yield();
            }

            if (tls_var.num == GetCurrentThreadId())
            {
                ++successes;
            }
        });
    }

    LoadLibraryA("d3dcompiler_47.dll");
    LoadLibraryA("dsound.dll");
    LoadLibraryA("comctl32.dll"); // the change is here
    /*LoadLibraryA("d3d9.dll");
    LoadLibraryA("dxgi.dll");
    LoadLibraryA("wlanapi.dll");*/

    kill = true;

    for (auto& t : ts)
    {
        if (t.joinable())
        {
            t.join();
        }
    }

    return successes == thread_count;
}

Idea for solutions
Idea 1: just port every argument when the emulator call NtAlpcSendWaitReceivePort to the real NtAlpcSendWaitReceivePort syscall.
Idea 2: Implement a specific case for NtAlpcSendWaitReceivePort of user32.dll and only emulate that case, allocate a memory buffer and copy the content of a fake NtAlpcSendWaitReceivePort to that buffer.
Idea 3 (hardest): dump csrss.exe and fully emulate NtAlpcSendWaitReceivePort.

@momo5502 momo5502 added the feature New feature or request label Feb 7, 2025
@momo5502 momo5502 changed the title Fail to emulate comctl32.dll entry point Support NtAlpcConnectPort/NtAlpcSendWaitReceivePort Feb 7, 2025
@momo5502 momo5502 changed the title Support NtAlpcConnectPort/NtAlpcSendWaitReceivePort Support loading comctl32.dll Feb 7, 2025
@momo5502 momo5502 linked a pull request Feb 7, 2025 that will close this issue
@momo5502
Copy link
Owner

momo5502 commented Feb 7, 2025

Can you test if it works for you now?

@momo5502 momo5502 changed the title Support loading comctl32.dll Support NtAlpcConnectPort/NtAlpcSendWaitReceivePort Feb 9, 2025
@momo5502 momo5502 reopened this Feb 9, 2025
@momo5502
Copy link
Owner

momo5502 commented Feb 9, 2025

Loading comctl32.dll should work now, but NtAlpcSendWaitReceivePort does not. That will be needed sooner or later and I'm going to use this issue to track the progress

momo5502 added a commit that referenced this issue Feb 9, 2025
momo5502 added a commit that referenced this issue Feb 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants