Windows 8 Heap Internals

[Nytro]

Windows 8 Heap Internals

Contents
Introduction .................................................................................................................................................. 4
Overview ....................................................................................................................................................... 4
Prior Works ................................................................................................................................................... 5
Prerequisites ................................................................................................................................................. 5
User Land .................................................................................................................................................. 5
Kernel Land ............................................................................................................................................... 5
Terminology .................................................................................................................................................. 6
User Land Heap Manager ............................................................................................................................. 7
Data Structures ......................................................................................................................................... 7
_HEAP (HeapBase) ................................................................................................................................ 7
_LFH_HEAP (Heap?>FrontEndHeap) ..................................................................................................... 8
_HEAP_LOCAL_DATA (Heap?>FrontEndHeap?>LocalData) ................................................................... 9
_HEAP_LOCAL_SEGMENT_INFO (Heap?>LFH?>SegmentInfoArrays[] / AffinitizedInfoArrays[]) .......... 9
_HEAP_SUBSEGMENT (Heap?>LFH?>InfoArrays[]?>ActiveSubsegment) ............................................ 10
_HEAP_USERDATA_HEADER (Heap?>LFH?>InfoArrays[]?>ActiveSubsegment?>UserBlocks) ............. 11
_RTL_BITMAP (Heap?>LFH?>InfoArrays[]?>ActiveSubsegment?>UserBlocks?>Bitmap) ..................... 12
_HEAP_ENTRY ..................................................................................................................................... 12
Architecture ............................................................................................................................................ 13
Algorithms ?? Allocation .......................................................................................................................... 15
Intermediate ....................................................................................................................................... 15
BackEnd ............................................................................................................................................... 18
Front End ............................................................................................................................................. 25
Algorithms – Freeing ............................................................................................................................... 37
Intermediate ....................................................................................................................................... 37
BackEnd ............................................................................................................................................... 40
FrontEnd .............................................................................................................................................. 44
Security Mechanisms .............................................................................................................................. 47
_HEAP Handle Protection ................................................................................................................... 47
Virtual Memory Randomization .......................................................................................................... 48
FrontEnd Activation ............................................................................................................................ 49
FrontEnd Allocation ............................................................................................................................ 50
Fast Fail ............................................................................................................................................... 52
Guard Pages ........................................................................................................................................ 53
Arbitrary Free ...................................................................................................................................... 56
Exception Handling ............................................................................................................................. 57
Exploitation Tactics ................................................................................................................................. 58
Bitmap Flipping 2.0 ............................................................................................................................. 58
_HEAP_USERDATA_HEADER Attack .................................................................................................... 60
User Land Conclusion .............................................................................................................................. 62
Kernel Pool Allocator .................................................................................................................................. 63
Fundamentals ......................................................................................................................................... 63
Pool Types ........................................................................................................................................... 63
Pool Descriptor ................................................................................................................................... 63
Pool Header ......................................................................................................................................... 64
Windows 8 Enhancements ..................................................................................................................... 66
Non?Executable (NX) Non?Paged Pool ................................................................................................ 66
Kernel Pool Cookie .............................................................................................................................. 69
Attack Mitigations ................................................................................................................................... 75
Process Pointer Encoding .................................................................................................................... 75
Lookaside Cookie ................................................................................................................................ 76
Cache Aligned Allocation Cookie ........................................................................................................ 77
Safe (Un)linking ................................................................................................................................... 78
PoolIndex Validation ........................................................................................................................... 79
Summary ............................................................................................................................................. 80
Block Size Attacks .................................................................................................................................... 82
Block Size Attack ................................................................................................................................. 82
Split Fragment Attack .......................................................................................................................... 83
Kernel Land Conclusion ........................................................................................................................... 85
Thanks ......................................................................................................................................................... 85
Bibliography ................................................................................................................................................ 86

Download:

http://t.co/uOgkjkj4