A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about user-mode development.
 #25305  by Brock
 Sat Feb 21, 2015 12:58 am
I am currently rewriting IPC functionality for cross-process and cross-session stuff in usermode. I understand the pros and cons of the currently available IPC methods and am looking to continue support of limited user accounts (LUA) so my solution can't involve enabling privileges that are not in a limited user's access token by default, since they aren't assigned they can't be adjusted by the process with minimal access rights. I currently realize unidirectional IPC through mailslots, this is fine and does what I need since it's for the local computer only and never needs any network travel so the fact that mailslots use UDP (which is connectionless and considered unreliable) doesn't concern me. The advantage of ancient mailslots is that there is no need for interprocess synchronization such as a mutex, semaphore or event since the receiving (server) process receives a private copy of the data during ReadFile operation making the work mostly effortless to implement and hassle free.

What does concern me however is reliable connection-oriented bidirectional communication. I am currently using full duplex pipes which work, however I am a little skeptical of them for a few reasons and just figured it would not hurt to ask for another opinion for alternate options. Does anyone have any suggestions as to what some other reliable options are? I'd use memory mapped files backed by the pagefile however in order to "see" the section in other sessions it needs to have a name in the Global namespace, which requires the enabling of SeCreateGlobalPrivilege so this is a no-go and deal breaker for what I require. LPC and (A)LPC looked promising however they are using mapped views for "large" messages internally and I've a feeling this will not work either for my specifications/requirements (untested since old LPC code I wrote years ago, though). My final solution must allow for 32-bit <-> 64-bit process communication. Thoughts anyone?

* Edit *
Also, should have mentioned this... If the proposed solution can avoid direct disk access (such as a DLL with a "shared" section to achieve this) I am extremely interested in hearing what anyone has to say, all the better. I know it's a tall order but I'd like to see if there is a true alternative to pipes is all when it comes to full duplex communication. Originally, I actually designed a top-level protocol to incorporate reliability into mailslots and needless to say it worked, but "it worked" means little to computer scientists since it left a lot to be desired when it came to benchmarking performance with 2-way communication. Main issue was doing this without admin rights, since forcing mailslots to play the role of client and server reliably was never the design or functional intention of Microsoft, since mailslots are one-way transport IPC mechanisms. In case you've noticed by now, I truly don't like the idea of pipes, since I am injected into processes such as Csrss (before it became a "protected process" in Windows 8.1) I try to avoid hanging, be it my fault or some other program. I think at this point if I am reduced to using sockets and TCP over loopback I will have to kill myself, the idea of having winsock loaded in critical processes doesn't sit well with me from a stability perspective

Best Regards,
Brock
 #25310  by t4L
 Sun Feb 22, 2015 3:30 pm
I had a problem just like that a few years ago when I have to notify usermode process from kernel mode driver callbacks. At first I used LPC but then I switch back to my custom mapped sections pair with synchronization primitives (event or interlocked polling). Pipes in fact are just wrappers around these so I guess you have the best options.
 #25312  by Brock
 Sun Feb 22, 2015 9:17 pm
Hi t4l,

Yeah, it's a bit harder to achieve when such limitations are imposed such as having no admin rights or help from a driver, which I require for my implementation. I just might have to stick with pipes for this request-reply relationship, if I have any luck using LPC on WOW64 processes I'll share my results, I have a feeling I will not be able to do this without elevated privileges though, but it's untested on my end. Seems this programmer mentions that there are problems with translating the PORT_MESSAGE header for WOW64 when doing this stuff on 64-bit Windows. He provides good information however. He mentions the short and long/large LPC message types for sharing data, what isn't mentioned is that not all LPC messages have data, in some cases for notification purposes only (like a signal) no data is present, just the PORT_MESSAGE header. Thanks for replying

http://www.zezula.net/en/prog/lpc.html

Best Regards,
Brock
 #25314  by t4L
 Mon Feb 23, 2015 4:40 pm
I tried in vain to make it work for wow64 processes with x64 kernel mode driver, however nothing worked even I changed the port structure structure aligned in various way (obviously since LPC PORT_MESSAGE structures are different between wow64 and native processes).

My 2 cents is you should stick with your old working method. Good luck hunting.
-t4L
 #25316  by Brock
 Mon Feb 23, 2015 8:55 pm
Agree with you, I plan on sticking with old/ancient methods that work without any special privileges etc. This might be interesting to you, considering you mentioned trying to do this with WOW64, seems that the WINE project has this working and WOW64 processes use the 64-bit structure directly.

https://github.com/wine-mirror/wine/blo ... sts/port.c

Best Regards,
Brock
 #25320  by Brock
 Tue Feb 24, 2015 7:43 am
Nice link, I do recall this thread vaguely now that I look back myself. I had swept my eyes over this before without question. OP/Alex of that thread is a friend, seems he doesn't frequent this board much these days though. Thanks for the link and reminder

Best Regards,
Brock