so being inside csrss on xp i decided to take a look a little more at the functions it uses to manages processes and threads and also investigating the ApiNameTables just a little bit more....I've got pointers to csrrootprocess and can walk em easily and can get pointers to the CSR_SERVERDLL structs relativly easily as well..but while splelunking I came accross some very 'intersting' functions...



so I do have quite a few 'options' to explore ..though its definitly time to try and locate where these functions are used in reactos..and then in olly...Defining my own objects Inserting them into other processes sounds intersting enough let alone duplicating the handle table..0o

So 'Process Duplication' is a knock off of the 'dual mapping' which I Think g3niun3 touched on this a little a while back in a crackme or something like that..using it as a distraction to the reverser..so after client is loaded its first command is to suspend all 'other' running threads in the process. My Next Step is to map out chunks of code of main exe,its current threads and there current locations, thier stack data, and then finally thier ObjectTables..having this info available would allow for greater tasks to be accomplished..so lets start by reimplementing SinSrvLocateClientByPid() so that it has access to csrss's processes and threads list.. :]

For those who have not looked at CsrWalker by ep_xoff its a good time to read this great piece of code
Even though orkblutt technically beat this code, the ideas and methods are easily adaptable..

So first thing we need is the address of CsrRootProcess which is of the struct CSR_PROCESS of which the best I've found is by Alex Ionescu located here..http://doxygen.reactos.org/d8/dc3/server_8h_source.html

so to find CsrRootProcess

you should see if(x86) something similar to


So after retrieving I can loop (most)Processes and Threads so we now have our processes CSRSS_PROCESS struct and now the mischief can commence with calling the (Base\Win\Csr)Srv Api's more on this is coming.. soon..but next up is lets say we want to 'hook' a certain function of these 'now' vaguely documented api tables..we need the address of CSR_SERVER_DLL.. this can be found here.



here is a snip (THIS CODE WILL NOT WORK ANYWHERE OTHER THEN INSIDE CSRSS!)



Well I guess I have to continue in order for ppl to know what I am actually on about..
This is still about duplicating a suspended process and dumping the exact duplicate from memory using either a injected client, or through the more intersting methods, such as a trampoline right after the return from wait to check for connection requests or use a much more untouched on method, but more on that later.
I plan to duplicate the Image of a running process to a Mapped Section dump it with as much supporting and and documented information as is needed for easy analyse, but the means are much more intersting then the ends.. :}

First lets examine the structure of a CSR_SERVER_DLL (kayaker's not so legthy version..)


There are some definite intersting fields listed in this structure. NewProcessCallback or ShutdownProcessCallback being of interest in this particular case, if we are hooking the structs in memory, which we are not going to do this time we are going to fill out our own CSR_SERVER_DLL structure and build a Dll loaded into csrss.

So as we've seen earlier I can suppend processes and threads in many different ways, I can also check the handles of each thread and whether there GUI or not all from Csrss.. and not have to do any injection of any code or dll..So its coming together very slowly with the aditional GUI to consider and this new restructuring of code to include both interactions,but the benefits and possibilities for action are vastly improved by this little beast of a structure..more to come on the mechanisms that call these api's and when they are called...

much more to come tommorow.