Hacker News Reader

Comment by user_7832 | Hacker News Reader

Tangential: Are there any good methods for windows/windows software? Hyper V is fine for small code, but if you want to install a program everytime it gets old really fast. I wouldn't want to trust random files off the internet either.

View on HN

You can turn off win32k calls for a process if you don't need gui. You can also run the process with a lower privilege access token to reduce file access and some kernel access.

I'd love to see one to block more kernel calls than just win32k. The best method I've come up with is to create a shared memory buffer to a seperate interface process and then unmount ntdll.dll by marking its pages `page_noaccess`. Thanks to win32 weirdness you can still allocate memory into the process without nt calls from the interface process as VirtualAllocEx, VirtualAlloc2, VirtualProtectEx, VirtualFreeEx, VirtualQueryEx, NtAllocateVirtualMemory, NtFreeVirtualMemory, etc take a process handle as an argument. This kinda requires writing a userspace kernel and your own standard library though.

MS please give me a better method to lock down kernel access beyond nowin32k. Hyperv doesn't work for consumer apps as half the consumer versions of windows don't have it.

Windows has a fairly capable sandbox called app isolation levels:

https://learn.microsoft.com/en-us/windows/win32/secauthz/app...

Look at how Chrome does it if you want to learn more. The API is classic Win32 unfortunately: extremely complicated, under-documented and full of razor sharp edges. The way Chrome does it also requires custom installer logic. But, it does exist.

Why do you say the way Chrome does it requires custom installer logic? Electron is able to use Chromium's sandbox for renderer processes without imposing any installer requirements as far as I know.

That's a good question, I'm not sure how Electron does it. Chrome sets things up at install time with special permissions on its own files so the sandboxed processes can read them.

Ah, OK. Honestly, it wouldn't surprise me if Electron made it work by weakening the sandboxing. Someone should look into that though before we assume that's the case.

Correct me if I'm wrong, but ntdll isn't magic. An attacker could just use raw syscall machine code, although they would need to pay close attention to the OS version.

The goal to my madness was producing a binary without interrupts in any region of executable memory. Assuming W^X protection holds that should be pretty airtight. I was also assuming I controlled the compiler

There is windows sandbox: https://learn.microsoft.com/en-us/windows/security/applicati...

Not available on the home edition of windows though.

Years ago I was a heavy user of Sandboxie. But those were simpler times and malware was far less advanced than it is now. No idea how good of a protection it provides there days.

https://en.wikipedia.org/wiki/Sandboxie

Yes, a non-secure way of sandboxing is/was to hook OS functions. Hooking is used still today to modify the behaviour of existing apps and testing apps under custom virtual environments.

We develop on of this that it us used in this Microsoft product[1].

[1] https://learn.microsoft.com/en-us/fslogix/overview-what-is-f...

Virtual Box

Reply on news.ycombinator.com