{"id":6769,"date":"2019-09-19T23:55:12","date_gmt":"2019-09-19T23:55:12","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6769"},"modified":"2019-09-19T23:56:19","modified_gmt":"2019-09-19T23:56:19","slug":"silentprocessexit-quick-look-under-the-hood","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/09\/19\/silentprocessexit-quick-look-under-the-hood\/","title":{"rendered":"SilentProcessExit – quick look under the hood"},"content":{"rendered":"\n

There is a relatively old, but well-known debugging mechanism called SilentProcessExit<\/em>. It is documented on Microsoft site<\/a>, and there are many blogs talking about it (@Oddvarmoe<\/a> has a very good into post<\/a> about it and you should have a glance before you continue reading below). <\/p>\n\n\n\n

I was curious how it works under the hood, and this post is about it. What motivated me to look at it in a first place was the fact that I saw a potential to abuse it to spawn arbitrary processes via svchost.exe \/ werfault.exe combo – with them acting as ancestor\/parent processes to our program of choice e.g.:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I was curious if I could do it _without_ setting up Registry Settings under HKLM. If it worked, we would have yet another evasion possibility.<\/p>\n\n\n\n

The function triggering this activity is called RtlReportSilentProcessExit<\/em> and it is called from ntdll.dll<\/em> before programs terminate.<\/p>\n\n\n\n

If SilentProcessExit<\/em> Registry settings are set up properly for the exiting program (either via gflags.exe<\/em> tool, or manually), the aforementioned API will ‘talk’ to WER Service. As a result, the latter will launch a predefined Monitoring program<\/code> as per the SilentProcessExit <\/em>Registry settings (if configured). <\/p>\n\n\n\n

I speculated, that if I can find out how the RtlReportSilentProcessExit <\/em>API works, and in particular, how it talks to the WER service, I will be able to either force it to launch my program of choice, or at least rip its code to ‘talk’ to the WER service myself, and most importantly (and hopefully) – w\/o the SilentProcessExit <\/em>Registry Settings in place.<\/p>\n\n\n\n

After a lot of spelunking, I realized a few things:<\/p>\n\n\n\n