New subject: [Bug 45119] Multiple applications from Google sandbox-attacksurface-analysis-tools v1.1.x (targeting native API) need 'ntdll.NtGetNextProcess' implementation

2 May 2018


      https://bugs.winehq.org/show_bug.cgi?id=45119
Bug ID: 45119
           Summary: Multiple applications from Google
                    sandbox-attacksurface-analysis-tools (targeting native
                    API) need 'ntdll.NtGetNextProcess' implementation
           Product: Wine
           Version: 3.7
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ntdll
          Assignee: wine-bugs@winehq.org
          Reporter: focht@gmx.net
      Distribution: ---
Hello folks,
required by various .NET-based apps from
https://github.com/google/sandbox-attacksurface-analysis-tools
--- quote ---
sandbox-attacksurface-analysis-tools
(c) Google Inc. 2015, 2016, 2017, 2018
Developed by James Forshaw
This is a small suite of tools to test various properties of sandboxes on
Windows. Many of the checking
tools take a -p flag which is used to specify the PID of a sandboxed process.
The tool will impersonate
the token of that process and determine what access is allowed from that
location. Also it's recommended
to run these tools as an administrator or local system to ensure the system can
be appropriately enumerated.
CheckExeManifest: Check for specific executable manifest flags.
CheckNetworkAccess: Check access to network stack.
NewProcessFromToken: Create a new process based on existing token.
TokenView: View and manipulate various process token values.
NtApiDotNet: A basic managed library to access NT system calls and objects.
NtObjectManager: A powershell module which uses NtApiDotNet to expose the NT
object manager.
ViewSecurityDescriptor: View the security descriptor from an SDDL string or an
inherited object.
--- quote ---
It's actually a pretty neat "testsuite" for native API, Wine could benefit from
it. I've already found 20+ bugs within one hour of playing with this (missing
exports, stubs, incomplete + incorrect impl. etc.).
Will create more tickets as time/mood permits ;-)
Prerequisite:
* 32-bit WINEPREFIX
* .NET Framework 4.5 -> 'winetricks -q dotnet45'
--- snip ---
$ wine ./TokenViewer.exe
...
Unhandled Exception: System.EntryPointNotFoundException: Unable to find an
entry point named 'NtGetNextProcess' in DLL 'ntdll.dll'.
   at NtApiDotNet.NtSystemCalls.NtGetNextProcess(SafeKernelObjectHandle
ProcessHandle, ProcessAccessRights DesiredAccess, AttributeFlags
HandleAttributes, Int32 Flags, SafeKernelObjectHandle& NewProcessHandle)
   at NtApiDotNet.NtProcess.GetFirstProcess(ProcessAccessRights desired_access)
   at NtApiDotNet.NtProcess.GetProcesses(ProcessAccessRights desired_access,
Boolean from_system_info)
   at TokenViewer.MainForm.RefreshProcessList(String filter, Boolean
hideUnrestricted)
   at TokenViewer.MainForm..ctor()
   at TokenViewer.Program.Main(String[] args)
--- snip ---
https://github.com/mirror/processhacker/blob/master/2.x/trunk/phlib/include/...
--- snip ---
#if !(PHNT_VERSION >= PHNT_WS03)
typedef NTSTATUS (NTAPI *_NtGetNextProcess)(
    _In_ HANDLE ProcessHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ ULONG HandleAttributes,
    _In_ ULONG Flags,
    _Out_ PHANDLE NewProcessHandle
    );
...
--- snip ---
$ sha1sum Release-v1.1.14.7z 
8cd7991e675a995a3d67ef0aca2a8bf0e1512f6a  Release-v1.1.14.7z
$ du -sh Release-v1.1.14.7z 
384K    Release-v1.1.14.7z
$ wine --version
wine-3.7-50-g8dca6c35e1
Regards
-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 45119] New: Multiple applications from Google sandbox-attacksurface-analysis-tools ( targeting native API) need 'ntdll.NtGetNextProcess' implementation