You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix the private ALPC handle attribute layouts in phnt:
add ALPC_HANDLEFLG_INDIRECT
add ALPC_INDIRECT_HANDLE_MAX
reduce ALPC_HANDLE_ATTR32 to the 0x10 message-attribute payload layout
update ALPC_HANDLE_ATTR to model the direct/indirect union layout
remove GrantedAccess from the ALPC message handle attribute payloads
Rationale
These definitions are for the ALPC message handle attribute payload consumed by the kernel capture path, not for ALPC_MESSAGE_HANDLE_INFORMATION. The latter still has GrantedAccess, but the message attribute payload does not.
The corrected layouts match the observed native and 32-bit payload sizes used by AlpcInitializeMessageAttribute:
ALPC_HANDLE_ATTR32: 0x10 bytes
ALPC_HANDLE_ATTR: 0x18 bytes on 64-bit, 0x10 bytes on 32-bit
The indirect handle count limit is 512. User-mode probing through NtAlpcConnectPort reaches the kernel validation path and confirms:
HandleCount == 1 returns STATUS_INVALID_PARAMETER
HandleCount == 512 with a null array proceeds to array probing and returns STATUS_ACCESS_VIOLATION
Locally, the NDK ALPC tests passed on both x64 and x86.
For this phnt change, I also compiled a temporary x64/x86 layout assertion translation unit against phnt.h successfully. A full local System Informer solution build was blocked by missing VS Spectre-mitigated libraries on my machine, before reaching this header change.
Note
Some of the reverse-engineering cross-checks and validation planning for this change were assisted by Codex.
Yep. There's a large number of ALPC related types and structures that are out of date or incorrect. I've already reverse engineered everything but haven't updated the header. You might find some of my notes handy:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix the private ALPC handle attribute layouts in phnt:
ALPC_HANDLEFLG_INDIRECTALPC_INDIRECT_HANDLE_MAXALPC_HANDLE_ATTR32to the 0x10 message-attribute payload layoutALPC_HANDLE_ATTRto model the direct/indirect union layoutGrantedAccessfrom the ALPC message handle attribute payloadsRationale
These definitions are for the ALPC message handle attribute payload consumed by the kernel capture path, not for
ALPC_MESSAGE_HANDLE_INFORMATION. The latter still hasGrantedAccess, but the message attribute payload does not.The corrected layouts match the observed native and 32-bit payload sizes used by
AlpcInitializeMessageAttribute:ALPC_HANDLE_ATTR32: 0x10 bytesALPC_HANDLE_ATTR: 0x18 bytes on 64-bit, 0x10 bytes on 32-bitThe indirect handle count limit is 512. User-mode probing through
NtAlpcConnectPortreaches the kernel validation path and confirms:HandleCount == 1returnsSTATUS_INVALID_PARAMETERHandleCount == 512with a null array proceeds to array probing and returnsSTATUS_ACCESS_VIOLATIONHandleCount == 513returnsSTATUS_LPC_HANDLE_COUNT_EXCEEDEDValidation
The same ALPC definition changes were applied in KNSoft.NDK commit
211ef238a6b88561bfc83e9677872b81ecaf73a7, with unit tests covering:GrantedAccessabsence from the message attribute payloadThe NDK GitHub Actions run for that commit completed successfully:
Locally, the NDK ALPC tests passed on both x64 and x86.
For this phnt change, I also compiled a temporary x64/x86 layout assertion translation unit against
phnt.hsuccessfully. A full local System Informer solution build was blocked by missing VS Spectre-mitigated libraries on my machine, before reaching this header change.Note
Some of the reverse-engineering cross-checks and validation planning for this change were assisted by Codex.