November 6, 2016 at 18:31Microsoft will provide antivirus control over the activity of the Linux subsystem on Windows 10
In previous posts of our corporate blog, we touched several times on the topic of supporting the Linux subsystem on Windows 10 (WSL), and also described the features of its technical implementation. A beta version of this subsystem was delivered to users in the off mode as part of the Windows 10 Redstone 1 (Anniversary Update) update in August this year.
Recently, Microsoft began to announce changes in the Windows kernel that will help AV drivers work correctly with the processes of the Linux subsystem, in the context of which ELF executable files are launched.
It is known that before the appearance of callback function mechanisms to control various operations in kernel mode, the authors of firewall and antivirus drivers used intercepts of API calls in the KiServiceTable system call table , which could be detected using the KeServiceDescriptorTable variable exported by the kernel . With the advent of new already documented API calls for registering callback functions, developers switched to their use. In addition, 64-bit versions of Windows did not allow just intercepting KiServiceTable services from the very beginning.
Fig. WSL file system architecture. It can be seen that LXCore.sys emulates various Linux objects using the functions of the Windows kernel.
One of the main operations that is controlled by antiviruses or HIPS is the creation of processes and threads. A driver can register a callback function using PsSetCreateProcessNotifyRoutineEx , as well as PsSetCreateThreadNotifyRoutine . After that, when creating processes or threads in a process, the driver will receive a notification about this operation. Microsoft has upgraded these features by adding the PsSetCreateProcessNotifyRoutineEx2 and PsSetCreateThreadNotifyRoutineEx APIs . These kernel APIs will help drivers track activity within Linux subsystem processes.
" Microsoft has published information about the implementation of VFS in the Linux subsystem on Windows 10
" Microsoft has revealed the technical aspects of implementing the Linux subsystem on Windows 10
" Microsoft has confirmed rumors about the integration of the Linux subsystem in Windows 10
" The inclusion of the Linux subsystem in Windows 10
Recently, Microsoft began to announce changes in the Windows kernel that will help AV drivers work correctly with the processes of the Linux subsystem, in the context of which ELF executable files are launched.
It is known that before the appearance of callback function mechanisms to control various operations in kernel mode, the authors of firewall and antivirus drivers used intercepts of API calls in the KiServiceTable system call table , which could be detected using the KeServiceDescriptorTable variable exported by the kernel . With the advent of new already documented API calls for registering callback functions, developers switched to their use. In addition, 64-bit versions of Windows did not allow just intercepting KiServiceTable services from the very beginning.
Fig. WSL file system architecture. It can be seen that LXCore.sys emulates various Linux objects using the functions of the Windows kernel.
One of the main operations that is controlled by antiviruses or HIPS is the creation of processes and threads. A driver can register a callback function using PsSetCreateProcessNotifyRoutineEx , as well as PsSetCreateThreadNotifyRoutine . After that, when creating processes or threads in a process, the driver will receive a notification about this operation. Microsoft has upgraded these features by adding the PsSetCreateProcessNotifyRoutineEx2 and PsSetCreateThreadNotifyRoutineEx APIs . These kernel APIs will help drivers track activity within Linux subsystem processes.
Type = PsCreateProcessNotifySubsystems; //новый тип уведомлений
Status = PsSetCreateProcessNotifyRoutineEx2(Type, Callback,TRUE); //новая API
void Callback (_In_ HANDLE ParentId, _In_ HANDLE ProcessId, _Inout_opt_ PPS_CREATE_NOTIFY_INFO CreateInfo) {
if (CreateInfo->Flags.IsSubsystemProcess == 0) {
/* Код оригинального обработчика callback */
} else {
Type = ProcessSubsystemInformation;
Status = NtQueryInformationProcess(ProcessHandle, Type, &Subsystem, sizeof(Subsystem), NULL);
if (Subsystem == SubsystemInformationTypeWSL) {
/* Новый код для обработки создания процессов WSL */
}
}
}
Type = PsCreateThreadNotifySubsystems; //новый тип уведомлений
Status = PsSetCreateThreadNotifyRoutineEx(Type, Callback); //новая API
void Callback (_In_ HANDLE ProcssId, _In_ HANDLE ThreadId, _In_ BOOLEAN Create) {
Type = ThreadSubsystemInformation;
Status = NtQueryInformationThread(ThreadHandle, Type, &Subsystem, sizeof(Subsystem), NULL);
if (Subsystem == SubsystemInformationTypeWin32) {
/* Код оригинального обработчика callback */
} else if (Subsystem == SubsystemInformationTypeWSL) {
/* Новый код для обработки создания процессов WSL */
}
}
" Microsoft has published information about the implementation of VFS in the Linux subsystem on Windows 10
" Microsoft has revealed the technical aspects of implementing the Linux subsystem on Windows 10
" Microsoft has confirmed rumors about the integration of the Linux subsystem in Windows 10
" The inclusion of the Linux subsystem in Windows 10
