[Bug 45119] New: Multiple applications from Google sandbox-attacksurface-analysis-tools ( targeting native API) need 'ntdll.NtGetNextProcess' implementation
wine-bugs at winehq.org
wine-bugs at winehq.org
Wed May 2 17:28:06 CDT 2018
https://bugs.winehq.org/show_bug.cgi?id=45119
Bug ID: 45119
Summary: Multiple applications from Google
sandbox-attacksurface-analysis-tools (targeting native
API) need 'ntdll.NtGetNextProcess' implementation
Product: Wine
Version: 3.7
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: ntdll
Assignee: wine-bugs at winehq.org
Reporter: focht at gmx.net
Distribution: ---
Hello folks,
required by various .NET-based apps from
https://github.com/google/sandbox-attacksurface-analysis-tools
--- quote ---
sandbox-attacksurface-analysis-tools
(c) Google Inc. 2015, 2016, 2017, 2018
Developed by James Forshaw
This is a small suite of tools to test various properties of sandboxes on
Windows. Many of the checking
tools take a -p flag which is used to specify the PID of a sandboxed process.
The tool will impersonate
the token of that process and determine what access is allowed from that
location. Also it's recommended
to run these tools as an administrator or local system to ensure the system can
be appropriately enumerated.
CheckExeManifest: Check for specific executable manifest flags.
CheckNetworkAccess: Check access to network stack.
NewProcessFromToken: Create a new process based on existing token.
TokenView: View and manipulate various process token values.
NtApiDotNet: A basic managed library to access NT system calls and objects.
NtObjectManager: A powershell module which uses NtApiDotNet to expose the NT
object manager.
ViewSecurityDescriptor: View the security descriptor from an SDDL string or an
inherited object.
--- quote ---
It's actually a pretty neat "testsuite" for native API, Wine could benefit from
it. I've already found 20+ bugs within one hour of playing with this (missing
exports, stubs, incomplete + incorrect impl. etc.).
Will create more tickets as time/mood permits ;-)
Prerequisite:
* 32-bit WINEPREFIX
* .NET Framework 4.5 -> 'winetricks -q dotnet45'
--- snip ---
$ wine ./TokenViewer.exe
...
Unhandled Exception: System.EntryPointNotFoundException: Unable to find an
entry point named 'NtGetNextProcess' in DLL 'ntdll.dll'.
at NtApiDotNet.NtSystemCalls.NtGetNextProcess(SafeKernelObjectHandle
ProcessHandle, ProcessAccessRights DesiredAccess, AttributeFlags
HandleAttributes, Int32 Flags, SafeKernelObjectHandle& NewProcessHandle)
at NtApiDotNet.NtProcess.GetFirstProcess(ProcessAccessRights desired_access)
at NtApiDotNet.NtProcess.GetProcesses(ProcessAccessRights desired_access,
Boolean from_system_info)
at TokenViewer.MainForm.RefreshProcessList(String filter, Boolean
hideUnrestricted)
at TokenViewer.MainForm..ctor()
at TokenViewer.Program.Main(String[] args)
--- snip ---
https://github.com/mirror/processhacker/blob/master/2.x/trunk/phlib/include/ntimport.h#L15
--- snip ---
#if !(PHNT_VERSION >= PHNT_WS03)
typedef NTSTATUS (NTAPI *_NtGetNextProcess)(
_In_ HANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ ULONG HandleAttributes,
_In_ ULONG Flags,
_Out_ PHANDLE NewProcessHandle
);
...
--- snip ---
$ sha1sum Release-v1.1.14.7z
8cd7991e675a995a3d67ef0aca2a8bf0e1512f6a Release-v1.1.14.7z
$ du -sh Release-v1.1.14.7z
384K Release-v1.1.14.7z
$ wine --version
wine-3.7-50-g8dca6c35e1
Regards
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
More information about the wine-bugs
mailing list