experiments's Introduction

Experiments

Repository of various experiments / PoC.

debugging-secure-kernel: PoC gdb debugging the Windows 10 secure kernel, on top of QEMU KVM
dns: Experiments regarding DNS / Certificate transparency / Homoglyphs
Attack Surface Reduction: Demystifying Windows Attack Surface Reduction internals
VDM: Windows Defender's VDM Format (signatures database)
Primary Group ID: Analysis of security checks made on primaryGroupID AD attribute changes
Unpacking with Windows Defender: Re-using the unpackers built into Windows Defender

experiments's Issues

Document LUA binary chunk extraction procedure

Could you please document your process to extract the Lua binary chunks? Once you identify the header, how do you know how big they are?

Thank you!

Following "Diffing updates" pseudo code does not generate a valid Signature DB

Following the instructions from: https://github.com/commial/experiments/tree/master/windows-defender/VDM does not seem to generate a valid merged signature DB.
While I did not find the specific versions you've mentioned (1.335.1651.0 and 1.335.1657.0), I did find the following versions which had the same base version (1.355.x.x):

If I understand the pseudo code, it is as follows:

extract RMDX resource data from mpavbase.vdm DLLs
extract the base signature DB by decompressing the zlib stream from RMDX data (streamBeginOffset: baseRMDX[0x18:0x1C], decompressedSize: baseRMDX[0x1C:0x20]).
extract RMDX resource data from mpavdlta.vdm DLLs
extract the delta signature DB by decompressing the zlib stream from RMDX data (streamBeginOffset: dltaRMDX[0x18:0x1C], decompressedSize: dltaRMDX[0x1C:0x20]).
extract SIGNATURE_TYPE_DELTA_BLOB data from delta signature DB
starting from offset of 8 bytes start reading database merging instructions as follows:
1. X = read 2 bytes (little endian)
2. copyBytesSize = X & 0x3FFF
3. if (X & 0x8000) != 0:
  1. baseSignatureDbOffset = read 4 bytes (little endian)
  2. appendedData = baseSignatureDb[baseSignatureDbOffset : baseSignatureDbOffset + copyBytesSize]
4. else:
  1. appendedData = read copyBytesSize bytes
5. mergedSinatureDB.append(appendedData)