https://github.com/mandiant/win10_auto
https://github.com/mandiant/win10_auto
Last synced: about 1 year ago
JSON representation
- Host: GitHub
- URL: https://github.com/mandiant/win10_auto
- Owner: mandiant
- License: apache-2.0
- Archived: true
- Created: 2019-08-08T14:14:14.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2019-08-30T15:31:51.000Z (almost 7 years ago)
- Last Synced: 2025-03-13T12:32:10.159Z (over 1 year ago)
- Language: Python
- Size: 82 KB
- Stars: 24
- Watchers: 15
- Forks: 19
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.txt
Awesome Lists containing this project
README
# Win10Deflate Automated Structure Extraction
`Win10Deflate` currently consists of the FLARE team's Volatility & Rekall plugins designed to support the extraction of compressed pages located in the RAM-backed virtual store. The structures required to decompress these pages are undocumented and ever-changing. The `Win10Deflate Auto` project locates these structures and extracts the corresponding magics & field-offsets of interest for use in FLARE's Volatility & Rekall plugins. The project leverages Tom Bennett's `FLARE-EMU` utility, which provides a series of helper functions to lower the barrier of entry to using the `Unicorn Engine` for emulation.
## Setup
1. Clone repository
2. If `flare_emu` is installed on your machine, skip to `Usage`
3. Use `git submodule init` & `git submodule update` to clone the `FLARE-EMU` repository locally
## Usage
The `Win10Deflate Auto` script is designed to work in an `IDA Pro 7.x` environment in the context of a Windows 10 `ntoskrnl.exe`. Use `Alt+F7` or `File > Script File` to load `win10deflate_auto.py`.
## Output
Expected output will look similar to the output below (`Win10.1809.x64`).
```
INFO:Magic:MAGIC.SmGlobals: 0x55a9c0
INFO:Magic:MAGIC.MmPagingFile: 0x43e5e0
INFO:SMKM_STORE_MGR:SMKM_STORE_MGR.sSmKm: 0x0
INFO:SMKM_STORE_MGR:SMKM_STORE_MGR.sGlobalTree: 0x1c0
INFO:SMKM:SMKM.SmkmStoreMetadataArray: 0x0
INFO:SMKM_STORE_METADATA:SMKM_STORE_METADATA.Size: 0x28
INFO:SMKM_STORE_METADATA:SMKM_STORE_METADATA.pSmkmStore: 0x0
INFO:SMKM_STORE:SMKM_STORE.StStore: 0x0
INFO:SMKM_STORE:SMKM_STORE.pCompressedRegionPtrArray: 0x1848
INFO:SMKM_STORE:SMKM_STORE.StoreOwnerProcess: 0x19a8
INFO:ST_STORE:ST_STORE.StDataMgr: 0x50
INFO:ST_STORE:ST_DATA_MGR.sLocalTree: 0x0
INFO:ST_STORE:ST_DATA_MGR.ChunkMetadata: 0xc0
INFO:ST_STORE:ST_DATA_MGR.SmkmStore: 0x320
INFO:ST_STORE:ST_DATA_MGR.RegionSizeMask: 0x328
INFO:ST_STORE:ST_DATA_MGR.RegionLSB: 0x32c
INFO:ST_STORE:ST_DATA_MGR.CompressionFormat: 0x3e0
```
## Functionality
The `Win10Deflate` automation script relies on known function arguments, callstacks, order of operation, and data manipulation within `ntoskrnl.exe`'s Store Manager functions. By leveraging emulation via `FLARE-EMU`, arguments and structures can be injected into the system, traced, and then located to calculate field offsets in structures of interest.
## Additional Reading
1. [Part 1 - Rekall & Volatility Announcement Blog](https://www.fireeye.com/blog/threat-research/2019/07/finding-evil-in-windows-ten-compressed-memory-part-one.html)
1. Part 2 - Virtual Store Deep Dive Blog
1. Part 3 - Automating Undocumented Structure Extraction Blog
1. BlackHat USA 2019 Whitepaper