{"id":6005,"date":"2019-02-24T00:43:20","date_gmt":"2019-02-24T00:43:20","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6005"},"modified":"2019-02-24T00:43:40","modified_gmt":"2019-02-24T00:43:40","slug":"sqm-process-hashes","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/02\/24\/sqm-process-hashes\/","title":{"rendered":"SQM Process Hashes"},"content":{"rendered":"\n<p>Today I came across Registry entries that I have not seen being documented anywhere before, so decided to throw a quick &amp; dirty post about it.<\/p>\n\n\n\n<p>One of the less known\/understood components of Windows is <a href=\"https:\/\/docs.microsoft.com\/en-us\/openspecs\/windows_protocols\/ms-sqmcs\/f6c86685-6419-423b-9410-b040c9d70b3d\">SQM<\/a>. SQM stands for &#8220;<a href=\"https:\/\/en.wikipedia.org\/wiki\/Software_quality_management\">Software Quality Metrics<\/a>&#8221; and I don&#8217;t know really more than what I have read from the linked articles, plus general opinions online that this is a part of MS spying machine, so pardon my ignorance.<\/p>\n\n\n\n<p>Today, I was looking at artifacts created by various processes and spotted this intriguing entry:<\/p>\n\n\n\n<ul><li>HKLM\\Software\\Microsoft\\SQMClient\\Windows\\DisabledProcesses\\&lt;some hash-like looking value><\/li><\/ul>\n\n\n\n<p>Knowing that Windows programmers love hashes, I was curious what this entry is for, and obviously, how to calculate the hash it refers to.<\/p>\n\n\n\n<p>A quick test followed for a couple of popular programs, and I got these results:<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm1.png\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm1.png\" alt=\"\" class=\"wp-image-6006\" width=\"500\" height=\"123\"\/><\/a><\/figure>\n\n\n\n<p>Now that I had a few test values, I looked at the code of ntdll.dll (where I eventually traced the code responsible for these callouts to), and quickly discovered the routine. The hash type used here is known as UHash (I googled the constants used by the algorithm, and this is the name of the function that I found). <\/p>\n\n\n\n<p>It basically takes the filename of the process (anything that follows the last directory separator), then iterates through it starting from its end (from a file extension), and then each character is upper-cased (Unicode!), and then added to the <a href=\"https:\/\/gist.github.com\/Aegean-Homines\/8e017e6234bcd32e8a195eab81e5746e\">UHash<\/a> formula. <\/p>\n\n\n\n<p>You can see the full algo in a script <a href=\"https:\/\/hexacorn.com\/d\/sqm_hash_calc.pl\">here<\/a>.<\/p>\n\n\n\n<p>When ran with example process names as in the screenshot above, we get these values:<\/p>\n\n\n\n<ul><li>494A65DD &#8211; powershell.exe<\/li><li>4DA42CDB &#8211; calc.exe<\/li><li>DA0C75C2 &#8211; cscript.exe<\/li><\/ul>\n\n\n\n<p>The more troubling question is the meaning of it all. This, I frankly don&#8217;t know. There are a couple other keys associated with SQM in the same Registry branch e.g. <em>DisabledSessions<\/em> (under the same node). Googlign around and digging in the ntdll.dll shows that SQM seems to be dependent on Customer Experience settings i.e. CEIPEnable entry described <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/devnotes\/ceipenable\">here<\/a>:<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm2.png\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm2.png\" alt=\"\" class=\"wp-image-6007\" width=\"417\" height=\"229\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm2.png 556w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm2-300x165.png 300w\" sizes=\"(max-width: 417px) 100vw, 417px\" \/><\/a><\/figure>\n\n\n\n<p>So, I guess the <em>DisabledProcesses<\/em> \/ <em>DisabledSession<\/em> entries could be flags that remove _some_ processes from active SQM monitoring (in a more granular way). And all in all, something that we probably want to completely disable via a higher-level <em>CEIPEnable<\/em> value, and others in the same location e.g.:<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm3.png\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/02\/sqm3.png\" alt=\"\" class=\"wp-image-6008\" width=\"500\" height=\"191\"\/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Today I came across Registry entries that I have not seen being documented anywhere before, so decided to throw a quick &amp; dirty post about it. One of the less known\/understood components of Windows is SQM. SQM stands for &#8220;Software &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/02\/24\/sqm-process-hashes\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[44,67],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6005"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6005"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6005\/revisions"}],"predecessor-version":[{"id":6011,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6005\/revisions\/6011"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}