Sfc_ OS .dll function replacement File

Windows File Protection is an annoying thing. When we write a pony, we inevitably want to take it out.
There are several popular ideas:
1. Remotely inject the Winlogon process to uninstall sfc_ OS .dll
2. forcibly replace the files in the dllcache, monitor the pop-up window, and use postmessage to send the wm_close message to close it.
3. Call the 5th export function of sfc_ OS .dll to replace the file

Windows File Protection is a waste, solutions usually is:
1. creae a remote thread to freelibrary sfc_ OS .dll
2. Use postmessage to close WFP dialogs.
3. Call setsfcfileexception function in sfc_ OS .dll

If you use the first method, sorry, because you use createremotethread, you will die badly. You certainly cannot pass AVP.
But the second method seems a little too child, And the pop-up window may flash, affecting concealment.
So the remaining method is what I want to talk about today. We can call an undoc H5 function in sfc_ OS .dll to replace protected files within 60 seconds, call it "Gate 5" for the moment. The function prototype is as follows:

Today, I will demonstrate third method to solve, function is:

Setsfcfileexception (DWORD param1, pwchar param2, DWORD param3 );

Param1: always set to 0
Param2: the full path of the file to modify later
Param3: always set to-1

The sample code of C can be easily searched on the Internet. The Code excerpt is as follows:

// C code demo
Typedef DWORD (_ stdcall * CPP) (DWORD param1, pwchar param2, DWORD param3 );

Void disable_wfp ()

{
Hinstance hmod = loadlibrary ("sfc_ OS .dll ");
CPP setsfcfileexception;

// The function is stored at the specified th ordinal in sfc_ OS .dll
Setsfcfileexception = (CPP) getprocaddress (hmod, (lpcstr) 5 );

Setsfcfileexception (0, l "C: // windows // system32 // calc.exe",-1 );

// Now we can modify the system file in a complete stealth.

}
So with the function prototype and c demo code, we can easily translate it into Delphi.

{
Call "5th function" to close WFP
Delphi code demo.
Develop by binjian in sleepless.org.cn.
Thank anskya for correction.
}
Procedure closewfp (destfile: pwchar );
VaR
H: DWORD;
FUNC: Procedure (P1: longint; P2: pwchar; P3: longint); stdcall;
Begin
H: = loadlibrary ('sfc _ OS. dll ');
@ FUNC: = getprocaddress (H, lpcstr (5 ));
Func (0, destfile,-1 );
End;
However, the above Code cannot pass AVP, and AVP can be used with a little trick.
In fact, AVP implements a signature for "sfc_ OS .dll", and you only need to find a way to modify it.
For some reason, I will not release the complete code. Please think for yourself.

References

Hacking Windows File Protection

Windows File Protection (WFP) is a mechanic that protects system files from being modified or deleted. introduced in Windows 2000, Windows File Protection was a leap forward in operating system stability since it protected the core modules from being upted or updated partition t by service packs or hotfixes sent from Microsoft.

A big problem prior to Windows 2000 was 'dll hell '. applications wocould often update system modules with their own versions, regardless if other applications already installed were depending on a different version of that same module. although Microsoft recommended that application programmers place modules into the program's folder instead of the system folder, few programmers did. WFP solved DLL hell, along with your other issues.

In order to protect the integrity of the system, Microsoft did not document a way to disable WFP. if they had, programmers wocould surely begin to circumvent it and have their application installers overwrite system modules with their own versions. booting to safe mode was the only way Microsoft provided for replacing a protected file. in theory, this was a good idea. however, programmers and Power Users sometimes desire the power to replace or delete protected modules without the cumbersome process of booting to safe mode and back.

Enter the hacks.

In Windows 2000, a hidden registry value to fully disable WFP existed. unfortunately, this didn't last long after I discovered and posted it to ntbugtraq. microsoft soon tweaked their code so that the hidden registry value was neutralized (curiously, it wasn't completely removed from the Code ). I then created patches to re-enable this uninitialized ented value. appendix A describes the history of the discovery of the unencrypted ented registry value and creation of the patches to re-enable it.

Since that time, when other techniques to disable or circumvent Windows File Protection have been discovered.

How the System File Checker monitors files for changes

The executable portion of WFP is called the System File Checker (SFC ). it exists throughout SFC. DLL, sfc_ OS .dll, sfcfiles. DLL, and SFC. EXE. the contents of SFC. DLL and sfc_ OS .dll have changed between Windows 2000 and Windows XP. in Windows XP, sfc_ OS .dll contains all the core code and SFC. DLL is merely a proxy to it. the exports of SFC. DLL are forwarded on to sfc_ OS .dll. the sfcfiles. DLL module is simply a data holder that contains a list of all files protected by WFP.

At startup the Winlogon service invokes the unnamed export ordinal 1 of sfc_ OS .dll, sfcinitprot. this API launches a new free thread called the 'sfc watcher thread '. this thread creates a series of Directory change notification events, one for each folder that contains a protected file. the waitformultipleobjects API is then called within loop to wait for any of these events to be signalled. upon event signaling, the modified file (s) are determined and replaced with copies found in the cache folder, if one exists there. if it doesn't, the user is prompted to insert the Windows installation CD so that the file can be replaced from the copy found on it.

Therefore, SFC actually allows for files to be replaced or modified, then overwrites them. A few second delay is instorated so that time is given for write operations to 'settle lower' before the affected file (s) are restored.

Knowing how SFC works means that one can easily disable it by terminating the watcher thread or by closing the Directory change notification event handles. This leads us to methods 1 and 2:
The core of Windows File Protection
SFC. dll WFP executable content. In XP only a proxy to sfc_ OS .dll.
Sfc_ OS .dll WFP executable content.
Sfcfiles. dll contains list of protected files. Exports sfcgetfiles API.
SFC. EXE System File Checker utility. utility to scan WFP protected files for changes and replace altered versions.

Hack Method 1: Disable WFP for specific folders until the computer is next rebooted via manual Handle Manipulation

The first technique to disable WFP is to close the Directory change notification handles by enumerating the handles that Winlogon has opened, determining which ones correspond to the folder (s) we wish to deprotect by querying and comparing the handle names, then closing those handles via NTDLL. ntduplicatehandle (or kernel32.duplicatehandle ). this method is used by wfpadmin.

Hack Method 2: Disable WFP completely until the computer is next rebooted via uninitialized ented SFC API

The second technique is to terminate the SFC watcher thread that continually waits for and responds to the Directory change notification events to be signalled. doing this manually isn' t very practical since it is diffucult to be sure the right thread has been located. fortunately, the sfc_ OS .dll exposes a nice unnamed export at ordinal 2: sfcterminatewatcherthread .. this API accepts no parameters and does exactly as its name implies. however, there is one caveat to using this function: it must be invoked in the process that created the SFC watcher thread: Winlogon. to accomplish this, virtual memory needs to be allocated in the Winlogon process space and a thread procedure that invokes sfcterminatewatcherthread copied into that memory. the thread procedure shoshould then be invoked using kernel32.createremotethread and WFP will be disabled until the Winlogon process restarts (computer is rebooted ).

Ordinal 2:
DWORD winapi sfcterminatewatcherthread ();

The return value is 0 if success, or 1 if an error occurred.

Hack method 3: Disable WFP on a specific file for 1 minute via unauthenticated ented SFC API

The sfc_ OS .dll module exports another very useful unmarshented, unnamed API at oridinal 5: sfcfileexception. this handy API will register a temporary SFC exception for specific file, allowing the file to be updated. the period the exception is in place is currently one minute.

Ordinal 5:
DWORD winapi sfcfileexception (DWORD dwunknown0, pwchar pwszfile, DWORD dwunknown1 );

Dwunknown0 unknown. set to 0
Pwszfile filename
Dwunknown1 unknown. Set to-1

The return value is 0 if success, or 1 if an error occurred (usually that the file is not protected by WFP ).

An example call to this API is:
Setsfcfileexception (0, l "C: // windows // notepad.exe",-1 );

Hack Method 4: Disable WFP permanently via patches and unmarshented registry value

Prior to Windows 2000 sp1 there was an uninitialized ented registry value that wowould fully disable WFP. this is the famous 0xffffff9d value I discovered while reverse engineering SFC. DLL in windows2000. unfortunately, soon after its discovery Microsoft disabled it. fortunately, the core code to disable WFP was left in SFC. DLL (later moved to sfc_ OS .dll ). therefore, a simple patch to SFC. DLL or sfc_ OS .dll will re-enable this value. I 've created patches for 2 K and XP and have generalized the patching procedure so the patch may be applied to all current and (hopefully) future versions of the SFC module without having to worry about a specific patch address.

General patch procedure:

For Windows 2000, the patch is applied to SFC. dll.
For Windows XP and 2003, the patch is applied to sfc_ OS .dll.

Copy the target file to a temporary one.

Search for the bytes '83 F8 9d 75 07 8B C6 ′.
Replace the '8b C6 'with '90 90 ′.

You must correct the checksum of the image by using our pechksum utility. It can be obtained here.

Now set the temporary file to replace the original at boot-time by using our moveltargetutility. It can be obtained here.

Set the sfcdisable value described below and then reboot the computer to complete the process.

Uninitialized ented sfcdisable value:

Key: HKEY_LOCAL_MACHINE/software/policies/Microsoft/Windows NT/Windows File Protection
Value Name: sfcdisable
Value: 0xffffff9d

Hack Method 5: Disable WFP permanently for specific files via patching the protected file list

More simple than patching executable code is simply patching the list of files contained in sfcfiles. DLL. first, copy sfcfiles. DLL to a temporary file. using a hex Editor (I. e. ultraedit), search for files to disable protection on inside the temporary file. once found, replacing the first character of the file name with 0 (that is: Value 0 not ASCII '0' character ). after completing the modifications, correct the checksum using our pechksum utility and set the temporary file to replace the original at boot-time using our movelvatutility. reboot the computer to finish the process.

-Jeremy collake
Jeremy@bitsum.com

The end

 

 

Address: http://hi.baidu.com/dsyhxb/blog/item/636454ab44b163bacb130ce5.html