[kerpow1]

Hi, I haven't started researching as yet or debugging however there seems to be a different way in which 8.1/10 can query a process protected via obRegisterCallbacks or a module hidden from VAD. Process Hacker is one tool that seems to be able to query process/module on 8.1/10 only (x64) even when the driver is disabled...

Has anyone noticed this change, is it an operating system change or something different? I will post any finding I get.

thanks

[Vrtule]

According to the documentation for the VirtualQueryEx routine that may be used to find where PE images are mapped within the target process, you need only the PROCESS_QUERY_INFORMATION access right to get the information. AFAIR this access right cannot be blocked by the OB Filtering Model.

https://msdn.microsoft.com/en-us/librar ... s.85).aspx

[kerpow1]

Thanks but I am restricting PROCESS_QUERY_INFORMATION to the process that my module sits inside, protected by VAD. So I am confused how this tool can still query.

[Vrtule]

According to this
https://msdn.microsoft.com/en-us/librar ... s.85).aspx
you cannot remove the PROCESS_QUERY_INFORMATION access right. If you do so, the change has no effect. For each object type, there is defined a set of access rights that cannot be removed via the ObRegisterCallback method.

[kerpow1]

You can restrict whatever is a member of open process really. Process_query is so it works in Windows 7 and 8 but ms have maybe denied this change in 8.1 and 10 but I just need to figure out if that's right and any solution. Thanks

[Vrtule]

Well, a simple experiment tells you this. Just open a handle to the target process and check its access rights. You will see what rights are really removed by the OB callback.

[kerpow1]

well it seems 8.1/10 tools can still query memory, 8 and earlier this is not the case. so in terms of vad hiding the tools cannot query the module object but can scan filepath and see strings etc. Solution to this is fill text section with null afterwards, well its the only solution that is working in my case currently.