Finding process in kernel mode

[aghamir]

Hi @Wenzel , First of all, I apologize for asking question(not submitting issue). Since you are professional in Windows structs, do you know a way in windows to find all running process in kernel mode? Now, I traverse EPROCESS then get KPROCESS and then go through the KTHREADs. However, I feel it is not the correct way to do so.

[Wenzel]

Hi @aghamir , You can ask questions here also, not worries.

Since you are professional in Windows structs

Not really, but i will help, if i can

find all running process in kernel mode?

So all processes running in ring-0 context ?

by going throught the KTHREADS you are just enumerating all the threads of a given process. Try to find where the KTHREAD store it's execution context, read the IOPL flag. https://en.wikipedia.org/wiki/Protection_ring#IOPL

That's a quick and dirty solution, maybe there is a better way.

[aghamir]

@Wenzel Thanks a lot. You've helped me a lot.

So all processes running in ring-0 context ?

Yes I want to find all threads which be running in ring-0 if scheduler chooses them(in ready and running state in Windows).

Try to find where the KTHREAD store it's execution context, read the IOPL flag.

It returns only currently running process execution context. However, I need to find others too.

P.S.: In Linux we can find out a task_struct will be running in kernel-mode by seeing stack pointer sp0 and sp like this: https://stackoverflow.com/questions/25253231/context-of-linux-kernel-threads

Do you think we can use KTHREAD-->KernelStack pointer to find out execution context in windows?

[Wenzel]

@aghamir this KTHREAD->KernelStack is interesting ! If you can extract the context from there i'm curious if you can find the registers :)

I opened an issue like related to this on one of my projects a few months ago, but didn't investigate further. https://github.com/Wenzel/r2vmi/issues/19

[aghamir]

@Wenzel , I found how to get eip from KernelStack: http://blog.airesoft.co.uk/2009/02/grabbing-kernel-thread-contexts-the-process-explorer-way/ https://github.com/jrmuizel/KStack/blob/master/Driver/KStack.c I've implemented this in KVM_VMI as:

kthread_stack = self.libvmi.read_addr_va(start_kthrd + self.symbols['offsets']['KTHREAD']['KernelStack'], 0)
ks_eip = self.libvmi.read_addr_va(kthread_stack + 2, 0)
ks_ebp = self.libvmi.read_addr_va(kthread_stack + 3, 0)

The output is like(eip and ebp in following figure): I think i made mistake to get eip and ebp in above. Am I supposed to change the above code to following for 64 bit windows?

kthread_stack = self.libvmi.read_addr_va(start_kthrd + self.symbols['offsets']['KTHREAD']['KernelStack'], 0)
ks_eip = self.libvmi.read_addr_va(kthread_stack + 2*8, 0)
ks_ebp = self.libvmi.read_addr_va(kthread_stack + 3*8, 0)

Thanks a lot. I didn't reach to this solution without your guides.

[aghamir]

@Wenzel , I'd really appreciated for your guidance. The second one(times to 8) was the solution. I will close this issue. That was not issue though. Thanks a lot. I'm really happy that I have a chance to use your guides.