Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Problems in Windows 10 DLL profile generation #792

Open
pwnosaur opened this issue May 29, 2023 · 2 comments
Open

Problems in Windows 10 DLL profile generation #792

pwnosaur opened this issue May 29, 2023 · 2 comments
Labels
bug Something isn't working

Comments

@pwnosaur
Copy link

pwnosaur commented May 29, 2023

This issue is regarding the profile generation from drakpdb & pdbconv , I have been trying numerous times to generate profiles for modules or DLLs from Windows 10 , but they always fail due to the unhandled leaf type, after some searching, I understand this is because of Microsoft allowing C++ types into modules such as win32k.sys and other DLLs/modules , yet I can't find a proper way to generate the profiles for the required DLLs. I tried checking out DIA , but still unable to get grasp on how to use it to build a profile.

I have tried different Windows 10 builds & version :

  • 21H2
  • 2004
  • 1903
  • 1809
  • 1709

I'm trying to build profiles for the dlls to be able to use drakvuf plugins (ole32 for filetracer , etc ... ), if there are pre-existing profiles for a specific version would be greatif someone could share those and I will use them with the appropriate windows version.

Also if anyone has an idea why I'm encountring this issue although I've tried using the recommended windows 10 2004 , hopefully the answers shared in this issue might help and be sort of guide for anyone who encounters the same issue.

@BonusPlay
Copy link
Collaborator

We are aware that drakpdb (component used in drakvuf-sandbox to generate profiles for DLLs) has been broken for some time now (probably something change in the PDB format / microsoft API). We are looking for a replacement for this module.

As a temporary workaround, I can suggest manual intervention and performing steps from https://drakvuf.com under Optional: Generate usermode profiles section. Generated JSONs should work.

@pwnosaur
Copy link
Author

pwnosaur commented Jun 1, 2023

As a temporary workaround, I can suggest manual intervention and performing steps from https://drakvuf.com under Optional: Generate usermode profiles section. Generated JSONs should work.

Well that does not work either, even on older versions as I mentioned , which is why I'm confused , if it's pdb format issue then this should be with newer versions of pdbs and dlls , I'm actually trying it with older versions of windows 10,
more specifically versions 2004 and prior versions (1903 , 1709) , these versions should work fine.

Traceback (most recent call last):
  File "volatility3/framework/symbols/windows/pdbconv.py", line 1081, in <module>
    converted_json = convertor.get_json()
  File "volatility3/framework/symbols/windows/pdbconv.py", line 505, in get_json
    self.read_necessary_streams()
  File "volatility3/framework/symbols/windows/pdbconv.py", line 214, in read_necessary_streams
    self.read_tpi_stream()
  File "volatility3/framework/symbols/windows/pdbconv.py", line 222, in read_tpi_stream
    type_references = self._read_info_stream(2, "TPI", self.types)
  File "volatility3/framework/symbols/windows/pdbconv.py", line 285, in _read_info_stream
    output, consumed = self.consume_type(module, offset, length)
  File "volatility3/framework/symbols/windows/pdbconv.py", line 829, in consume_type
    raise TypeError(f"Unhandled leaf_type: {leaf_type}")
TypeError: Unhandled leaf_type: 4105

--guid 18a8956bbc94bca6a7e9baed59c73e881 -p ole32.pdb -o ole32.json

Same issue happens with win32k.sys , apparently @tklengyel encountered a similar issue with win32k.sys with Windows 10 1903 , yet was there anyone able to create profiles for ole32 or other dlls ? ole32 is required for filetracer , and some other profiles are required for other plugins to work properly.

@BonusPlay BonusPlay added the bug Something isn't working label Jul 10, 2023
@psrok1 psrok1 changed the title DLL Profiles Problems in Windows 10 DLL profile generation Jul 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants