An overview of the LFH Mitigation Observations Conclusion Bruno - PowerPoint PPT Presentation

An overview of the LFH Bruno Pujos Introduction How it works Windows An overview of the LFH Mitigation Observations Conclusion Bruno Pujos July 20, 2014

Plan An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation 1 Introduction Observations Conclusion

The LFH? An overview of the LFH Bruno Pujos Introduction How it works Windows • Low Fragmentation Heap: Front End allocator Mitigation • Userland (sorry, no kernel this time. . . ) Observations Conclusion • Windows 8/8.1 32bit • Why talk about it? • Some details were left out to keep it simple

General Memory Management An overview of the LFH Bruno Pujos Introduction How it works Windows Mitigation Observations Conclusion

A little bit of history An overview of the LFH Bruno Pujos Introduction How it works • LFH released with Windows XP (2001) but not Windows Mitigation enabled by default Observations • The Look-Aside-List was another Front End allocator Conclusion at that time • Since Vista, no more LAL, and LFH is enabled by default

Plan An overview of the LFH Bruno Pujos 1 Introduction Introduction How it works 2 How it works Windows Mitigation Structures Observations Allocation Conclusion Free Windows Mitigation 3 Observations 4 Conclusion 5

Plan An overview of the LFH Bruno Pujos Introduction How it works Structures How it works 2 Allocation Free Structures Windows Allocation Mitigation Free Observations Conclusion

Plan An overview of the LFH Bruno Pujos Introduction How it works Structures How it works 2 Allocation Free Structures Windows Allocation Mitigation Free Observations Conclusion

General Overview An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

General Overview An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

_HEAP & _LFH_HEAP An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

General Overview An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

_HEAP_BUCKET An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

General Overview An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

_HEAP_LOCAL_SEGMENT_INFO An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

General Overview An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

Subsegment & UserBlocks An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

Plan An overview of the LFH Bruno Pujos Introduction How it works Structures How it works 2 Allocation Free Structures Windows Allocation Mitigation Free Observations Conclusion

Allocation Workflow An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH activation & Back-end An overview of the LFH Bruno Pujos Introduction How it works • RtlpAllocateHeap(_HEAP *Heap, int Flags, int Size, Structures Allocation unsigned int RoundedSize, _LIST_ENTRY *ListHint, Free int *RetCode) Windows Mitigation • HEAP_NO_SERIALIZE Observations • Heap->CompatibilityFlags & 0x20000000: activation Conclusion of the LFH needed • RtlpPerformHeapMaintenance(_HEAP *Heap)

LFH activation & Back-end An overview of the LFH Allocation of size < 0x4000 Bruno Pujos • if the LFH is not activated: set the CompatibilityFlags Introduction • if the LFH is not activated for this size: How it works Structures • add 0x21 in the Heap->FrontEndHeapUsageData[] Allocation Free • if 0x10 consecutive allocations or Windows Heap->FrontEndHeapUsageData[] > 0xff00: activate Mitigation for the next allocation of the same size Observations Conclusion Activation for a given size • set Heap->FrontEndHeapUsageData[] to the BucketIndex • set Heap->FrontEndHeapStatusBitmap[] to 1 (activated)

Allocation Workflow An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Allocation An overview of the LFH Bruno Pujos Introduction How it works Structures • size <= 0x4000 Allocation Free • HEAP_NO_SERIALIZE Windows Mitigation • Heap->FrontEndHeapStatusBitmap == 1 Observations • RtlpLowFragHeapAllocFromContext(_LFH_HEAP Conclusion *LFH, unsigned short BucketIndex, int Size, char Flags)

LFH Allocation Workflow An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Initialisation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Initialisation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Initialisation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Initialisation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Randomization An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Randomization An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Randomization An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows • RtlpLowFragHeapRandomData Mitigation • LowFragHeapDataSlot (in the TEB) Observations Conclusion

LFH Allocation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Allocation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Cache An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Cache An overview of the LFH Bruno Pujos Introduction How it works Structures • Check the cache Allocation Free • Try to allocate UserBlocks and/or Subsegment Windows Mitigation • Fail if RtlAllocateHeap fails Observations • Update RtlpLowFragHeapRandomData in Conclusion Subsegment allocation

LFH Cache An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Allocation Workflow An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

Plan An overview of the LFH Bruno Pujos Introduction How it works Structures How it works 2 Allocation Free Structures Windows Allocation Mitigation Free Observations Conclusion

Free Workflow An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

Free Back-end An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free • RtlpFreeHeap(_HEAP *Heap, int Flags, Windows _HEAP_ENTRY *Header, void *Chunk) Mitigation Observations • Decrement the counter in Conclusion Heap->FrontEndHeapUsageData[]

Free Workflow An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Free An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation • No longer handled by RtlpLowFragHeapFree Free Windows • Same algorithm idea in Windows 8 and 8.1 Mitigation Observations • Header->UnusedBytes & 0x80 Conclusion • Always returns true

LFH Free Workflow An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Free Initialisation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion

LFH Free Initialisation An overview of the LFH Bruno Pujos Introduction How it works Structures Allocation Free Windows Mitigation Observations Conclusion