Microsoft didn’t sandbox Windows Defender, so I did

Re:Microsoft didn’t sandbox Windows Defender, so I did by excalibur on Wednesday August 02, 2017 @12:07PM (#14911712)

> After extensive differential debugging in ProcMon (comparing AppContainer vs non-AppContainer execution), I realized the issue might actually be with the detected Windows version. Tavis’s code always self-reported the Windows version as Windows XP. My code was reporting the real underlying operating system; Windows 10 in my case. Verification via WinDbg proved that this was indeed the one and only issue causing the initialization failures. I needed to lie to MpEngine about the underlying Windows version.

This doesn't make sense to me. It may have been easier to accomplish within the author's skillset, but it seems to me that the more beneficial approach would be to modify Tavis’ code to report the correct version of Windows.

[ Parent | on HN ]

Re:Microsoft didn’t sandbox Windows Defender, so I did by tyoma on Wednesday August 02, 2017 @12:56PM (#14912294)

Tavis's code ran on Linux and hooked the import table of Defender's scanning engine to report Windows XP as the underlying Windows version [1].

Originally the author didn't hook and let Defender call the native version check APIs, which (correctly) reported Windows 10. Apparently there was extra initialization code in that case that failed to run in a sandbox. The fix was to reproduce the hooking code, in Rust, to report XP as the underlying Windows version.

[1] https://github.com/taviso/loadlibrary/blob/master/peloader/w...

[ Parent | on HN ]

Re:Microsoft didn’t sandbox Windows Defender, so I did by londons_explore on Wednesday August 02, 2017 @05:14PM (#14914720)

Sounds likley that impersonating an old windows version would probably disable various security features.

[ Parent | on HN ]

Re:Microsoft didn’t sandbox Windows Defender, so I did by dguido on Wednesday August 02, 2017 @01:08PM (#14912441)

The MpEngine behaves differently on XP vs newer operation systems. It was necessary for both Tavis and Andy (Trail of Bits) to lie to MpEngine to get it to start up properly in loadlibrary and AppJailLauncher, respectively.

[ Parent | on HN ]

Re:Microsoft didn’t sandbox Windows Defender, so I did by mook on Wednesday August 02, 2017 @12:20PM (#14911871)

My understanding is that:

- Tavis' original code ran on Linux, where there's no correct version of Windows

- it actually worked with the old code; it's only broken when msmpeng sees the new Windows version

- the old code is not in use at all (the whole thing was ported to rust), which didn't have a good DLL interception library

So it would seem the suggestion to modify the old code wouldn't help.

[ Parent | on HN ]