sR6uWE

More documents

Recommendations

Info

IPC: MESSAGE 0X0C1000Possible Format of hBrokerShareMem Shared MemorySize Field CommentUINT32 0x00009C9C Size of hBrokerSharedMem memoryUINT32 ui32ProtectedViewPID Sandbox Process-IDUINT32UINT32LPVOIDui32ProtectedViewTIDuiProtectedViewEIPlpProtectedViewPEPTID of faulting thread in sandbox.Copied from hSandboxSharedMem offset 0x0C.EIP of faulting instruction in sandbox.Copied from hSandboxSharedMem offset 0x10.Exception pointers in sandbox.Copied from hSandboxSharedMem offset 0x14.………HANDLE hSandboxProcess Sandbox process handleWCHAR[0x104] wzModulesList List of modules loaded in sandbox, separated by NullWCHAR[0x400]UINT32WCHAR[0xFF]WCHAR[0xFF]WCHAR[0xFF]wzWerSubmitFilesListui32CrashParamFlagwzEventTypewzParam0wzParam9………List of files to submit to WER with CWatsonReport::AddFilesToReport(), separated by ‘|’:• Sandbox-directory + wzAdditionalWerFileName• %Temp% + “winword.exe.OsrHost.dmp.dat”• %Temp% + “winword.exe.OsrHost.cvr.dat”………If Null, next 11 fields are ignored.Copied from hSandboxSharedMem offset 0x8470pwzEventType in WerReportCreate()Copied from hSandboxSharedMem offset 0x8474pwzValue for WER_P0 in WerReportSetParameter()Copied from hSandboxSharedMem offset 0x8672………pwzValue for WER_P9 in WerReportSetParameter()Copied from hSandboxSharedMem offset 0x9860………Labs.mwrinfosecurity.com | © MWR Labs 34
WER ServerIPC: MESSAGE 0X0C1000Windows Error ReportingLevel 1 Error Data“I want more information”files.cabLevel 2 Error DataDeleteLabs.mwrinfosecurity.com | © MWR Labs 35
Page 1 and 2: UNDERSTANDING THE MICROSOFT OFFICE
Page 3 and 4: Outline• Introduction• Sandbox
Page 5 and 6: INTRODUCTION• Sandboxing 101- Wik
Page 7 and 8: MS OFFICE 2013 PROTECTED-VIEW SANDB
Page 9 and 10: OperatingINTERNALS: ARCHITECTUREBro
Page 11 and 12: INTERNALS: ARCHITECTURE• Elevatio
Page 13 and 14: OperatingINTERNALS: ARCHITECTUREBro
Page 15 and 16: INTERNALS: INITIALIZATIONMSO.sub_00
Page 17 and 18: INTERNALS: INITIALIZATIONLowIntegri
Page 19 and 20: INTERNALS: RESTRICTIONSFile Locatio
Page 21 and 22: INTERNALS: RESTRICTIONS• Capabili
Page 25 and 26: IPC: INTERNAL OBJECTSThreadMgr Obje
Page 27 and 28: IPC: MESSAGE FORMATMessage HeaderMe
Page 29 and 30: IPC: MESSAGE 0X001000• No message
Page 31 and 32: IPC: MESSAGE 0X091000Message Body f
Page 33: IPC: MESSAGE 0X0C1000• Windows Er
Page 37 and 38: IPC: MESSAGE 0X0C1000• Issue 2: D
Page 39 and 40: IPC: MESSAGE 0X0C1000• DemoLabs.m
Page 41 and 42: IPC: MESSAGE 0X0F1000• “Microso
Page 45 and 46: MS OFFICE 2016: SANDBOX INTERNALS
Page 47 and 48: MS OFFICE 2016: IPC 0X161000• New
Page 51 and 52: REFERENCES• Yason, Mark Vincent.

sR6uWE

Create successful ePaper yourself

Delete template?

Save as template?