7.1 & 7.2 Fin

Finished 7.1 VirtualMemory and 7.2 Privileges.
ntlywxb · Feb 2, 2020 · 4e18ac3 · 4e18ac3
1 parent 25a23a2
commit 4e18ac3
Show file tree

Hide file tree

Showing 11 changed files with 60 additions and 35 deletions.
diff --git a/Chapter 1 - Introduction/1.0 Introduction.pdf b/Chapter 1 - Introduction/1.0 Introduction.pdf
diff --git a/Chapter 1 - Introduction/1.1 HowTo.pdf b/Chapter 1 - Introduction/1.1 HowTo.pdf
diff --git a/Chapter 1 - Introduction/1.2 Setup.pdf b/Chapter 1 - Introduction/1.2 Setup.pdf
diff --git a/Chapter 7 - Windows/7.0 Windows.md b/Chapter 7 - Windows/7.0 Windows.md
@@ -1,29 +1,30 @@
 # CURRENTLY IN DEVELOPMENT (Chapter 7 - Windows)
+This chapter will cover some of the basic inner workings of the Windows OS. Most of the topics will only be covered on a basic level and only the necessary information will be covered. There is a lot to the Windows OS, far too much to put into this course. If you want to know more details, the "Windows Internals" books are a fantastic resource. And remember when I said there's a lot to know, there's a part 1 and part 2 to those books, each being about 600-700 pages with a slightly below average font size.
 
-## [7.1  VirtualMemory](7.1%20VirtualMemory.md) is finished.
-
-## This lesson is currently in development and is **NOT** ready.
-
-This chapter will discuss some of the inner workings of Microsoft Windows. The chapter will focus on what is relevant to the field of reverse engineering. We'll cover things such as processes, memory, threads, the kernel, data structures, and more.
-
-* ### [Chapter 7 - Windows](7.0%20Windows.md)
-    * [7.0 Windows](7.0%20Windows.md)
-    * [7.1 VirtualMemory](7.1%20VirtualMemory.md)
+## This chapter is currently in development and is **NOT** ready.
 
+# Finished Lessons:
+* [7.1 VirtualMemory](7.1%20VirtualMemory.md)
+* [7.2 Privileges](7.1%20Privileges.md)
 
 # TODO (No order):
 * SEH
-* Rings
 * Kernel
 * Structures (P/T/EB/IB) + PCR & PRCB
 * PE Layout
 
-# Done (may be revised):
-* Virtual addresses.
-
+### Smaller Topics:
+  * COM
+  * ABI
+  * WoW
 
 More later, that's all that is planned for now.
 
+* ### [Chapter 7 - Windows](7.0%20Windows.md)
+    * [7.0 Windows](7.0%20Windows.md)
+    * [7.1 VirtualMemory](7.1%20VirtualMemory.md)
+    * [7.2 Privileges](7.1%20Privileges.md)
+    * [7.3 Architecture](7.1%20Architecture.md)
 
 [<- Previous Lesson](../Chapter%206%20-%20DLL/../Chapter%206%20-%20DLL/6.10%20FinalNotes.md)  
 [Next Lesson ->](7.1%20VirtualMemory.md)  

diff --git a/Chapter 7 - Windows/7.1 VirtualMemory.md b/Chapter 7 - Windows/7.1 VirtualMemory.md
@@ -1,7 +1,7 @@
 # 7.1 Virtual Memory
 You're probably aware that a computer has **physical memory**, also known as RAM. But how is this memory accessed? Well, with addresses of course! Unfortunately, it's not that simple. 
 * If multiple processes are running on the system, you need some way to specify the memory regions for each process. 
-* You also start to run into issues with space. What do you do if you only have 4GB of physical memory but the processes running want 6GB?
+* You also start to run into issues with space. What do you do if you only have 4GB of physical memory but the processes running need 6GB?
 * If programs aren't loaded into the same address space every time they run, then hard-coded addresses won't work.
 * What about fragmentation? If a small program exits and there isn't enough room for a new process in that now free memory region, that's just wasted space. Even if a process is small enough to fit in that space, unless it's the same size, there will still be unused memory.
 
@@ -64,6 +64,6 @@ Here are some other resources that deal with virtual memory:
 
 
 [<- Previous Lesson](7.0%20Windows.md)  
-[Next Lesson ->]()  
+[Next Lesson ->](7.2%20Privileges.md)  
 
 [Chapter Home](7.0%20Windows.md) 
diff --git a/Chapter 7 - Windows/7.2 Architecture.md b/Chapter 7 - Windows/7.2 Architecture.md
diff --git a/Chapter 7 - Windows/7.WIP Privileges.md → Chapter 7 - Windows/7.2 Privileges.md b/Chapter 7 - Windows/7.WIP Privileges.md → Chapter 7 - Windows/7.2 Privileges.md
@@ -1,21 +1,29 @@
-# 7.WIP Privileges
+# 7.2 Privileges
 To protect critical OS components, data, and processes, there are two privilege modes the processor can run under. These two modes are **user-mode** and **kernel-mode**. User code runs in user-mode, and OS code (this includes drivers) runs in kernel-mode.
 
-> You may have heard of four different privilege levels described as rings. User-mode is privilege level/ring 3 and kernel-mode is privilege level/ring 0. Rings 1 and 2 are not used by Windows.
+> You may have heard of four different privilege levels described as rings (numbered 0 to 3). User-mode is privilege level/ring 3 and kernel-mode is privilege level/ring 0. Rings 1 and 2 are not used by Windows.
 
 ## Kernel-Mode
 **Kernel-mode** allows the processor to essentially do whatever it wants by allowing access to any code on the system. User-mode processes can only access the kernel through strictly defined interfaces. Kernel mode is a necessity in an OS to keep user-mode processes in check. Kernel-mode processes share the same virtual address space. Pages within the kernel-mode virtual address space are only accessible from kernel-mode. User-mode pages are accessible from both kernel-mode and user-mode.
 
 ## User-Mode to Kernel-Mode
-Sometimes a user-mode process needs to access kernel-mode functionality. This happens very often such as when rendering windows or graphics. When a user-mode process calls a system service special instructions are executed that switch the thread to kernel-mode. Once the service finishes, the thread is switched back to user-mode.
+Sometimes a user-mode process needs to access kernel-mode functionality. This happens very often such as when rendering windows or graphics. When a user-mode process calls a system service, special instructions are executed that switch the thread to kernel-mode. Once the service finishes, the thread is switched back to user-mode.
 
 ## Hypervisor
-With the boom of virtualization, there was a need for a way to run high-performance OS guests efficiently. To facilitate this virtualization, hypervisors are used. **Hypervisors** allow for the separation and isolation of all system components including virtual memory, physical memory, USB devices, and more. Hypervisors have more privileges than kernel-mode applications due to their ability to virtualize and isolate components. Because of this, Windows uses the hypervisor for security, this is known as **virtualization-based security (VBS)**. Some of the components in VBS are **Hyper Guard**, **Credential Guard**, **Application Guard**, **Host Guardian**, **Shielded Fabric**, and more. I won't explain all of these components, but I will briefly explain two of them.
+With the boom of virtualization, there was a need for a way to run high-performance OS guests efficiently. To facilitate this virtualization, hypervisors are used. **Hypervisors** allow for the separation and isolation of all system components including virtual memory, physical memory, USB devices, and more. Hypervisors have more privileges and abilities than kernel-mode applications due to their ability to virtualize and isolate components. Because of this, Windows uses the hypervisor for security, this is known as *virtualization-based security* (VBS). Some of the components in VBS are the Hyper Guard, Credential Guard, Application Guard, Host Guardian, Shielded Fabric, and more. I won't explain all of these components, but I will briefly explain two of them.
 * **Hyper Guard** - Protects important kernel and hypervisor related data structures and code.
 * **Application Guard** - Stronger sandbox for Microsoft Edge.
 
-The hypervisor also implements **Virtual Trust Levels (VTLs)**. VTLs are ordered differently than processor privilege levels (rings). VTL 0 has less privileges than VTL 1. The OS runs in VTL 0, and VBS runs in VTL 1. This puts VBS at a higher privilege level than kernel-mode and therefore cannot be touched by kernel-mode. User-mode and kernel-mode run within VTLs.
+The hypervisor also implements **Virtual Trust Levels (VTLs)**. 
+> VTLs are ordered differently than processor privilege levels (rings). VTL 0 has less privileges than VTL 1. 
+
+The OS runs in VTL 0, and VBS runs in VTL 1. This gives VBS more privilege than kernel-mode and therefore cannot be touched by kernel-mode. You can think of user-mode and kernel-mode as running within VTLs, and the hypervisor managing the permissions for all VTLs.
 
 Hypervisors are extremely complex and there's plenty to learn about them. The explanation I've provided is very brief and basic. Still, this is more than you will need to know when it comes to reversing, so if you didn't understand all of it, don't worry. I do encourage you to learn more about hypervisors because they are very interesting and vital to security.
 
-> Although hypervisors have more privileges than kernel-mode, hypervisors do *not* run in ring -1.
+> Although hypervisors have more privileges than kernel-mode, hypervisors do *not* run in ring -1.
+
+[<- Previous Lesson](7.1%20VirtualMemory.md)  
+[Next Lesson ->](7.3%20Architecture.md)  
+
+[Chapter Home](7.0%20Windows.md) 
diff --git a/Chapter 7 - Windows/7.3 Architecture.md b/Chapter 7 - Windows/7.3 Architecture.md
@@ -0,0 +1,24 @@
+# 7.3 Architecture - WIP
+As already discussed, Windows separates kernel-mode and user-mode. However, Windows doesn't stop there. Various other components are separated and organized in a structure-like way. Windows is built with an object-oriented design, although this is more apparent with  kernel-mode components because mostly everything there runs together. User-mode is not as object-oriented because most of the components don't work together.
+
+It's important to point out that this object-oriented design pertains to the components, not necessarily the underlying code. While the system components work in an object-oriented way, the OS is written in C which is not an *object-oriented programming* (OOP) language. This becomes apparent when looking at low-level structures (C doesn't have classes). Structures in C don't have any sort of OOP functionality. In C there is no structure inheritance, methods, constructors, etc.
+
+### Service vs Process
+It's important to know the difference between a service and a process. A Windows service is just a daemon. A daemon is a program that runs in the background and is controlled by the OS, not the user. A process is similar, except it can be started or interacted with by a user. An example of a process is the logon process. An example of a service is the user manager. You interact with the logon process by entering a username and password. You don't interact with the user manager, it manages users in the background. Defining something as a process or service can be tricky and there are often processes that you would think are services, and services you would think are processes.
+
+## Layout
+Here is a simplified view of the Windows architecture layout:  
+
+<p align="center">
+  <img height="500" img src="[ignore]/WinArch.png">
+</p>
+
+First off, notice the kernel-mode and user-mode separation. Also notice that the hypervisor is being shown in its own kernel-mode context, note however, the hypervisor runs in normal kernel-mode.
+
+### User-Mode:
+* **Environment Subsystems** - This is essentially what users and programmers are presented. Think of it as the underlying implementation of the overall environment/personality presented to the OS users and programmers. There are three main subsystems which are Windows, POSIX, and OS/2. OS/2 was last used in Windows 2000. POSIX was replaced by the *Subsystem for Unix-based Applications* (SUA) which was then replaced with *Windows Subsystem for Linux* (WSL).
+* **User Processes** - Conventional processes started and ran in user-mode.
+* **Service Processes** - These host Windows services such as the *Task Scheduler*. These usually run along with the OS, meaning it doesn't matter if a user is logged in or not. If the OS is running, they're running.
+* **System Processes** - Fixed/hard-coded processes (not services).
+
+You may notice that service and user processes run into subsystem DLLs. This is because user-mode applications don't call the native Windows OS services directly. Instead they go through subsystem DLLs. The role of these DLLs is to translate document and public function calls into the internal (typically undocumented) native system functions. Most of these functions/services are implemented in NTDLL.dll.
diff --git a/Credit.md b/Credit.md
@@ -24,4 +24,5 @@ These are people that have helped improve this course or support me via [Patreon
 * [Jinivus](https://github.com/Jinivus)
 * [hatee-hatee-hatee-ho](https://github.com/hatee-hatee-hatee-ho)
 * [FR/synestematic](https://github.com/synestematic)
-* [UndefinedMuki](https://github.com/UndefinedMuki)
+* [UndefinedMuki](https://github.com/UndefinedMuki)
+* [Barna Szalai](https://github.com/subdesign)
diff --git a/README.md b/README.md
@@ -95,4 +95,4 @@ The best way to stay up-to-date is to support me on Patreon which will give you
 
 * ### [Chapter 7 - Windows](Chapter%207%20-%20Windows) - WIP
     * [7.0 Windows](Chapter%207%20-%20Windows/7.0%20Windows.md)
-    * [7.1 Virtual Memory](Chapter%207%20-%20Windows/7.1%20VirtualMemory.md)
+    * [7.1 Virtual Memory](Chapter%207%20-%20Windows/7.1%20VirtualMemory.md)
diff --git a/_DOC/TODO.md b/_DOC/TODO.md
@@ -7,7 +7,9 @@ jcc chart + u/s
 flags
 
 ## Windows
-* Explain Windows... it's a Windows RE course this should've been done already.
+* COM
+* ABI
+* WoW
 
 #### Maybe:
 * Add more assembly instructions. (Will do as I go)