DownWithUp's Github Site

An Example of Vibe Malware Analysis

Sun, 03 May 2026 00:00:00 +0000

Introduction

While talking with a friend he recently mentioned having found a suspicious process running on his server. It was strange because he had gotten high network activity warnings a few days prior and then there was a process named softirq eating up almost 100% of the server’s CPU. Thankfully he had a copy of the server’s state and I was able to get a copy. Turns out there were actually three very suspicious binaries. This presented an interesting opportunity to try something like “vibe reversing” which I’ve been interested in testing. I used IDAPro-MCP with OpenAI’s codex agent using GPT-5.4. While it would be interesting to 100% understand this malware, the real goal of this post is to see how well AI can analyze it.

AWStrace: Another Windows Strace

Sun, 29 Mar 2026 00:00:00 +0000

Introduction

There have been a lot of open source atteptms to creating something like strace for Windows. Many have drawbacks or specific/customized setup requirements. This is simply my attempt to make a quick system call tracer that’s easy to use and doesn’t require any complex setup. The code AWStrace is here.

Previous Work

Here are some of the previous attempts at making an strace for Windows:

NtTrace: Debugger Engine COM Objects - Software Breakpoints https://github.com/rogerorr/NtTrace
stracent: IAT patching. Pressuembly redirecting to some type of logging - https://github.com/ipankajg/stracent
STrace: Kernel module and DTrace - https://github.com/mandiant/STrace

I’m sure there are many others I’ve missed.

Example of Windows Warbird Encryption/Decryption

Sun, 23 Apr 2023 00:00:00 +0000

Everything in this post was done on a Windows 10 22H2 machine. Kernel version was: 10.0.19041.2486

Introduction

Microsoft Warbird is an undocumented encryption technology generally used for things relating to software licensing (DRM) and security mechanisms. There has been some, but not much, previous open source research. Some links which provide further insight:

In addition, Alex Ionescu talked about Warbird in depth during this presentation.

The Warbird technology is appears to be designed to be integrated at compile time, and could function either as an obfuscation approach on the existing code, or as some type of “enclave” block encryptor. This second approach is what this post will dive into.

What is NtPssCaptureVaSpaceBulk

Fri, 14 May 2021 16:51:46 +0000

The API

Just a quick post about something I found quite interesting. In Windows 10 version 2004+ (according to this) there is a new system call which caught my attention: NtPssCaptureVaSpaceBulk. Specifically the caputing “bulk” referenced in the name made me think it could be useful. Looking at the API in the kernel, I quickly noticed several calls using the PsProcessType type as the first parameter, so I looked at the prototype of NtQueryVirtualMemory and went from there. My Google searching skills discovered that there is no offical prototype for this function, and so my final definition looks like this:

The Win32k Import Mystery

Thu, 12 Nov 2020 16:51:46 +0000

The Crash

This all began when I was playing around with the PE file format and ended up tinkering with the loading process of drivers. Upon loading a particularly simple driver the OS crashed with the following error:

The stack clearly shows the bugcheck occuring within the driver loading process.

I instantly suspected that the issue was with the imports as the driver I loaded only imported functions from Win32k.

When Downloads Lead to LPE

Wed, 25 Mar 2020 16:51:46 +0000

Observations

In the world of privlige escalation, 3rd party elevated service programs are espically interesting to look at. One such program is Sophos’ HitmanPro.Alert (HMPA). This program is designed to work with an additional AV product to provide “advanced” detection and prevention capabilities against malware and exploits.

However, this HMPA became interesting when I observed this message in my kernel debugger:

Just from this message there are a couple of issues I had to research. Are downloads really over HTTP? What does an update look like (full exe or just dll plugin)? Is the directory really a low privileged controlled directory? Using Wireshark I was able to identify that the downloads were really HTTP (they use URLDownloadToFile). Secondly, using a proxy I was able to get a file to appear in user’s temp directory. The “update” is just the full hmpalert.exe (yes, the one that is downloaded when you first install). Depending on which flag was used in the command line /service for the service, /tray for the tray icon and user interactive version, etc… But they are all the same executable.

Creating Fake Drivers

Fri, 24 Jan 2020 16:51:46 +0000

Research

Drivers commanly use IOCTLs for communication from user and kernel mode, but what really goes on behind the scene. DeviceIoControl is the API responsible for sending an IRP_MJ_DEVICE_CONTROL request (along with an IOCTL and buffers of data) to a driver. The driver specifies the address of the funciton that then handles these requests. This is done through the array DRIVER_OBJECT.MajorFunction[]. Continuing to trace back, the DRIVER_OBJECT comes from the DriverEntry which is the entry point on a WDM driver. It’s clear that the DRIVER_OBJECT needed for IOCTL communication comes from the kerenl, but where? Following at NtLoadDriver eventually leads to IopLoadDriver which calls ObCreateObject with IoDriverObjectType as the OBJECT_TYPE. It’s worth noting that driver objects can be viewed in the NT object manager under the “Driver” subdirectory with tools such as WinObjEx.

Qualcomm Service Vulnerability

Tue, 04 Jun 2019 16:51:46 +0000

Discovery

Qualcomm has a serivce program named AdminService.exe which runs on Windows machines with the Qualcomm Atheros QCA61x4 Bluethooth device. Other devices possibly have this service. You can download the entire service and driver package here. In a real world situation, the package would be installed by Windows.

So, what is wrong with this AdminService? Well, services can receive control codes from other applications. This is done with the ControlService API. Looking at the MSDN documentation the control codes after 128 (up to 255) are used by 3rd party services for their own purposes. This is what originally piqued my interest. I figured that custom control codes might preform privileged operations and these could possibly be exploited. By chance, AdminService.exe (service name AtherosSvc) handles a bunch of custom control codes. I went down each control code case until I found code 133 (0x85). Like many of the other codes, 133 posts a message to another thread. The message code for 133 is 24162 (0x5E62). This case in the thread’s GetMessage loop calls OutputDebugString with “Enter case CUSTOM_THREAD_EVENT_REG_MODIFY”.

Vulnerabilities In Similar Software

Tue, 19 Mar 2019 16:51:46 +0000

SoftEther VPN is a VPN program by the university of Tsukba in Japan. Users can use the client program to connect to servers, or use theserver program to host servers. The Server Manager for Windows used a driver named See.sys for low level operations. This driver (See.sys) was actually part of SoftEther’s github repository which can be found here.

The driver is based off the old WinPcap driver which had an issue (CVE-2007-3681) with malfourmed IRP Parameters. Here are More Details. When a user program sends an IOCTL to a driver it is packaged, along with buffers, sizes, and other information inside of an IRP. IRPs have a field that named UserBuffer. This is the output buffer in a DeviceIoControl call. When a device is created with DO_DIRECT_IO (as this one does) there is no Irp->AssociatedIrp.SystemBuffer, so output data is usually copied to the UserBuffer. The issue is that no checks are preformed on the UserBuffer by the IO Manager. Obviously, a ProbeForWrite could be used on IRP.UserBuffer, but the programmers of WinPcap didn’t. The WinPcap driver had this issue fixed quite a while ago, but the See.sys driver, based on the WinPcap driver, was forgotten.

The Search For Drivers

Tue, 18 Dec 2018 16:51:46 +0000

Lately I’ve been digging into driver exploitation in Windows. One of the hardest parts is actually finding the drivers to decompile, debug, and experiment with. This led me to look for easy to find drivers. I found Driver Easy.

Driver Easy seems to have a large database of drivers, and I thought I could access them for experimentation purposes. I discovered that the files are retrieved by HTTP requests but the data is encrypted. Coincidentally the program is a .NET and therefore extremely easy to open up and peek at the inner workings.

Spoofing the Windows 10's Task Manager

Sat, 03 Mar 2018 16:51:46 +0000

Observant Windows 10 users will notice that some of the new metro apps can only run as a single instance. Examples include Settings and Task Manager. Attempting to open another instance of these processes will result in the already opened one being focused.

I focused on Task Manager. Initially, I began looking for calls to either mutexes or semaphores, which can (if a name argument is passed) be stored in the Windows’s object manager. Calls to create a mutex or semaphore with a name that already exists will return ERROR_ALREADY_EXISTS. In one such instance CreateMutexW used the wide string: Local\\TM.750ce7b0-e5fd-454f-9fad-2f66513dfa1bTerminal Having another process create a mutex with this same name will result in ERROR_ALREADY_EXISTS being returned whenever the second process calls CreateMutexW. The second process, in this case, would be Task Manager

Mon, 01 Jan 0001 00:00:00 +0000

DownWithUp's Github Website

CVE Security Posts

The discoveries listed here are provided without any warranty

About CVE-2020-9540 | Sophos HitmanPro.Alert's 3.7.12 service insecure downloads:
HitmanPro.Alert, versions 3.7.12 and earlier, download files over http as a normal user, then are run as SYSTEM. The connection is proxyable.
Security Risk Level:
CVSS (v3.0) = 7.2 High
Possible Solution(s) / Fixe(s):
Use HTTPS or download via the privileged process which would not allow normal users to proxy.
Exploit Code / Vulnerable Software Source(s) [In Stockpile] :
Github PoC Link
Reported to Sophos's bug bounty and coordinated public disclosure. Future releases are patched.

CVEs & Vulnerabilities

Mon, 01 Jan 0001 00:00:00 +0000

A collection of my vulnerability research and published disclosures.

CVEs

CVE-2021-1892

Qualcomm WLAN Driver Privilege Escalation
The Qcamain10x64.sys WLAN driver uses the insecure “UserBuffer” member of the IRP allowing attackers to specify arbitrary addresses for usermode buffers.

Security Risk Level: CVSS (v3.0) = 7.2 High
Possible Solution(s) / Fixe(s):
- Use buffered IO
Exploit Code / Vulnerable Software Source(s) [In Stockpile]: [Private]
Reported to Qualcomm
https://docs.qualcomm.com/securitybulletin/april-2021-bulletin.html

CVE-2020-9540

Sophos HitmanPro.Alert’s 3.7.12 service insecure downloads
HitmanPro.Alert, versions 3.7.12 and earlier, download files over http as a normal user, then are run as SYSTEM. The connection is proxyable.