Author Topic: Windows Research Kernel  (Read 11283 times)

guga

  • Moderator
  • Member
  • *****
  • Posts: 826
  • Assembly is a state of art.
    • RosAsm
Windows Research Kernel
« on: July 01, 2014, 02:27:44 AM »
For those (like me) who would like to see the source code of kernel and their internal structures, equates, functions etc...Here is the link of Windows Research Kernel (WRK) from M$
http://www.microsoft.com/education/facultyconnection/articles/articledetails.aspx?cid=2416&c1=en-us&c2=0

It is worthfull dl it.
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

Gunther

  • Member
  • *****
  • Posts: 3518
  • Forgive your enemies, but never forget their names
Re: Windows Research Kernel
« Reply #1 on: July 01, 2014, 02:29:48 AM »
Hi Gustavo,

good link. Thank you for providing it.  :t

Gunther
Get your facts first, and then you can distort them.

guga

  • Moderator
  • Member
  • *****
  • Posts: 826
  • Assembly is a state of art.
    • RosAsm
Re: Windows Research Kernel
« Reply #2 on: July 01, 2014, 02:44:14 AM »
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

guga

  • Moderator
  • Member
  • *****
  • Posts: 826
  • Assembly is a state of art.
    • RosAsm
Re: Windows Research Kernel
« Reply #3 on: July 01, 2014, 03:18:47 AM »
Btw...I created a PDF containing the M$ documentation related to this Set of Kernel Apis.I compiled all docs from Windows Research Kernel file and uploaded on RosAsm board here
http://rosasm.freeforums.org/windows-research-kernel-t168.html

Couldn´t upload it in here due to the limitations of file size.
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

Gunther

  • Member
  • *****
  • Posts: 3518
  • Forgive your enemies, but never forget their names
Re: Windows Research Kernel
« Reply #4 on: July 01, 2014, 05:23:16 AM »
Gustavo,

that's interesting material. You've had much effort compiling the entire stuff.

Gunther
Get your facts first, and then you can distort them.

guga

  • Moderator
  • Member
  • *****
  • Posts: 826
  • Assembly is a state of art.
    • RosAsm
Re: Windows Research Kernel
« Reply #5 on: July 01, 2014, 05:58:10 AM »
Indeed, this material is very good and also contradicts what M$ have being releasing on their own docs.

On a discussion i had with Dave here http://masm32.com/board/index.php?topic=3345.0 i was trying to figure it out what a hell NtCreateSection was doing in memory, since my debuggers were showing me something different from what M$ docs said. The 1st member of the structure (which i named as: SectionHandle) was proving to me that it is not at all just a handle as M$ docs said, but a member of a unknown structure.

After several tests i ended concluding that it is, in fact, part of a structure and not a simple variable where the handle is outputed.

Today, i finally found some documentation of the functions i´m analyzing and rewriting.

http://forum.vingrad.ru/topic-236938.html

As the source code shows, the "SectionHandle" (SnapSection) is related to a structure called "SNAPSHOTSTATE", whose members i have no idea what they are, so far.

What i´m doing is rebuilding CreateToolhelp32Snapshot Api to make it works on WinNT4 and also to have another source of reference material for those unknown internal Apis.

Btw....is someone knows where can i find the sources from the forum i posted above, please post it here, because the needed source is not in any of mine files of the Kernel Source code, neither the WDM SDK  :(

So, if anyone knows where are these sources:
Code: [Select]
NTSTATUS
ThpAllocateSnapshotSection(
    OUT PHANDLE SnapSection,
    IN DWORD dwFlags,
    IN DWORD th32ProcessID,
    PUCHAR RawProcess,
    PRTL_DEBUG_INFORMATION RawModule,
    PRTL_DEBUG_INFORMATION RawDebugInfo)
(....)
   ULONG ThreadCount = 0;
    SnapShotSize = sizeof(SNAPSHOTSTATE);
    Offset1 = 0;
    //
    // calculate the required snapshot size
    //
    if ((dwFlags & TH32CS_SNAPPROCESS) || (dwFlags & TH32CS_SNAPTHREAD)) {
        do {
            ProcessCount++;
            ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)&RawProcess[Offset1];
            Offset1 += ProcessInfo->NextEntryOffset;
            ThreadCount += ProcessInfo->NumberOfThreads;
        } while (ProcessInfo->NextEntryOffset != 0

Please, let me know...or post the link here. I wold like to take a look at them.
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

guga

  • Moderator
  • Member
  • *****
  • Posts: 826
  • Assembly is a state of art.
    • RosAsm
Re: Windows Research Kernel
« Reply #6 on: July 01, 2014, 06:19:19 AM »
Wahooooooooooooo...I found it... I already have the leaked Windows2000 Source code here. Now it will be easier analyse this  :biggrin:

The structure is defined as:
Code: [Select]
/*
 snapshot structure

 This is mapped onto the beginning of the memory we use to hold the information.

*/
typedef struct tagSNAPSHOTSTATE {
    /* item list counts */
    ULONG    HeapListCount;
    ULONG    ProcessCount;
    ULONG    ModuleCount;
    ULONG    ThreadCount;
    /* item list head pointers */
    PHEAPLIST32         HeapListHead;
    PPROCESSENTRY32W    ProcessListHead;
    PMODULEENTRY32W     ModuleListHead;
    PTHREADENTRY32      ThreadListHead;
    /* item list current indexes */
    ULONG   HeapListIndex;
    ULONG   ProcessListIndex;
    ULONG   ModuleListIndex;
    ULONG   ThreadListIndex;
    /* data begins here... */
    UCHAR    DataBegin;
}SNAPSHOTSTATE;
typedef SNAPSHOTSTATE * PSNAPSHOTSTATE;
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

dedndave

  • Member
  • *****
  • Posts: 8752
  • Still using Abacus 2.0
    • DednDave
Re: Windows Research Kernel
« Reply #7 on: July 01, 2014, 09:19:26 AM »
a lot of that information can be found here

http://undocumented.ntinternals.net

anta40

  • Member
  • ***
  • Posts: 293
Re: Windows Research Kernel
« Reply #8 on: July 01, 2014, 11:16:30 AM »
For those (like me) who would like to see the source code of kernel and their internal structures, equates, functions etc...Here is the link of Windows Research Kernel (WRK) from M$
http://www.microsoft.com/education/facultyconnection/articles/articledetails.aspx?cid=2416&c1=en-us&c2=0

It is worthfull dl it.

Hi guga,

I'm not sure why the page won't open for me. Firefox said "The server at www.facultyresourcecenter.com is taking too long to respond."
But anyway, it's nice to know that the Windows Research Kernel is now publicly available.
Years ago, it was only available (legally) for those who were the member of MSDN AA program.

Gunther

  • Member
  • *****
  • Posts: 3518
  • Forgive your enemies, but never forget their names
Re: Windows Research Kernel
« Reply #9 on: July 01, 2014, 05:58:42 PM »
Dave,

a lot of that information can be found here

http://undocumented.ntinternals.net

your link doesn't work for me.

Gunther
Get your facts first, and then you can distort them.

dedndave

  • Member
  • *****
  • Posts: 8752
  • Still using Abacus 2.0
    • DednDave
Re: Windows Research Kernel
« Reply #10 on: July 01, 2014, 09:55:23 PM »
try this, Gunther
you may have to have an updated version of java
or - perhaps look at an older archive

http://web.archive.org/web/20140326223518/http://undocumented.ntinternals.net/

Gunther

  • Member
  • *****
  • Posts: 3518
  • Forgive your enemies, but never forget their names
Re: Windows Research Kernel
« Reply #11 on: July 01, 2014, 10:21:38 PM »
Thank you, Dave.  :t

Gunther
Get your facts first, and then you can distort them.

guga

  • Moderator
  • Member
  • *****
  • Posts: 826
  • Assembly is a state of art.
    • RosAsm
Re: Windows Research Kernel
« Reply #12 on: July 02, 2014, 02:38:38 AM »
Gunther, if you want i uploaded the contents of the whole site, plus, the chm containing the functions etc, and another source in pdf format

here http://rosasm.freeforums.org/undocumented-windowsnt-t170.html
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com

Gunther

  • Member
  • *****
  • Posts: 3518
  • Forgive your enemies, but never forget their names
Re: Windows Research Kernel
« Reply #13 on: July 02, 2014, 03:14:48 AM »
Gustavo,

Ah, the RosAsm forum. Thank you for the link.  :t

Gunther
Get your facts first, and then you can distort them.

guga

  • Moderator
  • Member
  • *****
  • Posts: 826
  • Assembly is a state of art.
    • RosAsm
Re: Windows Research Kernel
« Reply #14 on: July 02, 2014, 03:33:44 AM »
Yeah...I´m posting in RosAsm forum some of the file,s because here we have a limitation of size, and some of the files extends the limit.

One of the files, have 20 Mb (This one, i uploaded in mega.co :)


For example, i found an excellent article about PE insecurity here http://www.reversinglabs.com/advisory/pecoff.html, but i coldnt´upload the pdfs due to the limitation. So i created a subforum devoted to ebooks in RosAsm forum that can handle bigger uploads.
Coding in Assembly requires a mix of:
80% of brain, passion, intuition, creativity
10% of programming skills
10% of alcoholic levels in your blood.

My Code Sites:
http://rosasm.freeforums.org
http://winasm.tripod.com