Tracing The Pain Away Module 3 - Syscalls

Syscall tracing with x64dbg.

References

• WOW64 Syscall Tracing With x64dbg
  https://www.patreon.com/posts/syscall-tracing-103115555

• x64 Syscall Table
  j00ru.vexillium.org/syscalls/nt/64/

• x32 Syscall Table
  j00ru.vexillium.org/syscalls/nt/32/
  

Lab 2 - Syscalls

In this lab we move our focus lower in the the windows stack and trace syscalls. This is the lowest userland interface with the kernel and impossible to escape regardless of how obfuscated the code is. You are provided with two binaries, the first of which uses the NTDLL API, and the second which uses an indirect syscall.

Debugging Syscalls: NTDLL

The lab2ntdll.exe binary bypasses the higher layer windows APIs and instead uses the NtQueryAttributesFile function in NTDLL. 

• If you attempt to use the breakpoints from Lab1 you will observe that they are bypassed.
  

• Open lab2ntdll.exe in x64dbg and run until the binary entrypoint.
  

• In the Symbols tab locate the function NtQueryAttributesFile in the ntdll module and place a breakpoint on it.
  

• Run the debugger until your breakpoint is hit and observe the API arguments on the stack.
  
  Note that the low level NTDLL functions use complex structures for arguments as they are more flexible than the higher level APIs. In this case you will need to look up the arguments for NtQueryAttributesFile: https://learn.microsoft.com/en-us/windows/win32/devnotes/ntqueryattributesfile  
  
  The following struct can be used as a reference for  OBJECT_ATTRIBUTES
  
  
  

• Locate the file path (ObjectName) in the struct.
  
  💡 Remember Follow DWORD in dump is the command in x64dbg to dereference a pointer.
  

Debugging Syscalls: Indirect Syscall

The lab2syscall.exe binary implements that same NtQueryAttributesFile file check as the first binary only instead of calling the function in NTDLL it uses an indirect syscall — it jumps though another NTDLL syscall instruction using the NtQueryAttributesFile syscall number. 

Your goal is to locate the indirect syscall, intercept it, and identify the file path that is checked. We recommend using a breakpoint on the heaven’s gate WOW64 transition.

• Open lab2syscall.exe in x64dbg and run until the binary entrypoint.
  

• In the Symbols tab locate the function NtQueryAttributesFile in the ntdll and double click to navigate to it.
  

• Note the syscall number for NtQueryAttributesFile. It will be moved into the EAX register at the start of the call.
  

• Use the NtQueryAttributesFile implementation to locate the Wow64Transition (this will be in the Wow64SystemServiceCall).
  

• Place a breakpoint on the jump to the Wow64Transition. You will now break on every 32-bit syscall in the process. The EAX register will contain the syscall number at the Wow64Transition.
  

• Run though the process breaking on each syscall and looking up the syscall numbers until you find the call to NtQueryAttributesFile.
  
  💡 You can use the following to setup automatic lookup and logging of the syscalls with a conditional breakpoint.
  
  Break Condition: 0
  Log Text: SYSCALL: {syscall.name(eax)}
  
  💡 You can also use a conditional breakpoint to halt the debugger when the NtQueryAttributesFile syscall is called. 
  
  Break Condition: streq(syscall.name(eax), “NtQueryAttributesFile”)
  

• Use the arguments and struct definitions from the first binary to identify the file path.