{"id":5345,"date":"2018-09-04T21:41:35","date_gmt":"2018-09-04T21:41:35","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5345"},"modified":"2018-09-05T13:29:58","modified_gmt":"2018-09-05T13:29:58","slug":"beyond-good-ol-run-key-part-87","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/09\/04\/beyond-good-ol-run-key-part-87\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 87"},"content":{"rendered":"<p>How many ntdll does it take to change a light bulb?<\/p>\n<p>For 32-bit processes on 32-bit systems &#8211; 1.<\/p>\n<p>For 32-bit processes on 64-bit systems &#8211; 2.<\/p>\n<p>But&#8230; are you sure?<\/p>\n<p>Turns out that newer versions of Windows allow one more. It&#8217;s called a Delegated NTDLL.<\/p>\n<p>When I discovered it during one of my Procmon sessions:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/09\/delegatedntdll.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-5346\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/09\/delegatedntdll.png\" alt=\"\" width=\"500\" height=\"21\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/09\/delegatedntdll.png 1173w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/09\/delegatedntdll-300x13.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/09\/delegatedntdll-768x32.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/09\/delegatedntdll-1024x43.png 1024w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>&#8230; I immediately googled it and found out that <a href=\"http:\/\/redplait.blogspot.de\/2017\/07\/delegatedntdll.html\">redplait<\/a> was the first one to describe this mechanism in detail, and then there was also an <a href=\"https:\/\/stackoverflow.com\/questions\/37252457\/is-there-a-way-to-make-windows-7-x64-load-ntdll-dll-from-local-directory-not-sy\">article<\/a> on StackOverflow about it; still, since it&#8217;s not very well-known I decided to include it in this series anyway.<\/p>\n<p>How to use it?<\/p>\n<ul>\n<li>Build a DLL that exports the export functions as listed in redplait&#8217;s post:\n<ul>\n<li>KiRaiseUserExceptionDispatcher<\/li>\n<li>KiUserApcDispatcher<\/li>\n<li>KiUserCallbackDispatcher<\/li>\n<li>KiUserExceptionDispatcher<\/li>\n<li>LdrInitializeThunk<\/li>\n<li>LdrParentInterlockedPopEntrySList<\/li>\n<li>LdrParentRtlInitializeNtUserPfn<\/li>\n<li>LdrParentRtlResetNtUserPfn<\/li>\n<li>LdrParentRtlRetrieveNtUserPfn<\/li>\n<li>LdrpChildNtdll<\/li>\n<li>LdrSystemDllInitBlock (this one is actually a pointer that must point to a dword storing a value identical with the one stored in the ntdll the delegated ntdll is for and equal e.g. 224 \/0xE0\/)<\/li>\n<li>RtlDispatchAPC<\/li>\n<li>RtlUserThreadStart<\/li>\n<\/ul>\n<\/li>\n<li>Drop it in the system32 directory.<\/li>\n<li>Set up the respective IFEO key for the victim application of choice:\n<ul>\n<li>HKLM\\SOFTWARE\\Microsoft\\Windows NT\\<br \/>\nCurrentVersion\\Image File Execution Options\\<br \/>\n&lt;filename&gt;\\DelegatedNtdll=&lt;filenameonly&gt;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>and you are set. Next time the program is ran it will load the dll.<\/p>\n<p>Note that the DLL must include the exports otherwise it won&#8217;t be executed (not even DllMain) &#8211; this is because the ntdll loads it not via LdrLoadDll, but via NtCreateSection\/ZwMapViewOfSection\/RtlImageNtHeader and then walks through a list of exports that it tries to resolve using LdrpGetProcedureAddress.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How many ntdll does it take to change a light bulb? For 32-bit processes on 32-bit systems &#8211; 1. For 32-bit processes on 64-bit systems &#8211; 2. But&#8230; are you sure? Turns out that newer versions of Windows allow one &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/09\/04\/beyond-good-ol-run-key-part-87\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5345"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=5345"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5345\/revisions"}],"predecessor-version":[{"id":5349,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/5345\/revisions\/5349"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=5345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=5345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=5345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}