Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement 1909 build 18363 DSE mitigation #2

Open
wants to merge 4 commits into
base: master
Choose a base branch
from

Conversation

kkent030315
Copy link

After 1909, MSFT enforced counter for ci!g_CiOptions DSE disable technique, by just changing section protection via MmProtectDriverSection which result in ATTEMTED_WRITE_TO_READONLY_MEMORY.

image

PAGE:00000001C0040443                 mov     eax, cs:g_CiOptions
PAGE:00000001C0040449                 test    al, 10h
PAGE:00000001C004044B                 jnz     short loc_1C0040465
PAGE:00000001C004044D                 mov     rax, cs:KdDebuggerEnabled
PAGE:00000001C0040454                 cmp     byte ptr [rax], 1
PAGE:00000001C0040457                 jnz     short loc_1C0040465
PAGE:00000001C0040459                 mov     rax, cs:KdDebuggerNotPresent
PAGE:00000001C0040460                 cmp     byte ptr [rax], 0
PAGE:00000001C0040463                 jz      short loc_1C004047E
PAGE:00000001C0040465
PAGE:00000001C0040465 loc_1C0040465:                          ; CODE XREF: CiInitializePolicy+2BB↑j
PAGE:00000001C0040465                                         ; CiInitializePolicy+2C7↑j
PAGE:00000001C0040465                 xor     edx, edx        ; _QWORD
PAGE:00000001C0040467                 lea     rcx, g_CiOptions ; _QWORD
PAGE:00000001C004046E                 lea     r8d, [rdx+1]    ; _QWORD
PAGE:00000001C0040472                 call    cs:__imp_MmProtectDriverSection
PAGE:00000001C0040479                 nop     dword ptr [rax+rax+00h]

@kkent030315
Copy link
Author

@SwenenzY reported me that KB5003173 which is applied after 1909 causing BSOD.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants