i dont think granting SeTcbPrivilege would allow you to attach to System Process
basically doing at 00:00 \\drive\\path\\exe schedules a task as system and i dont think starting ollydbg/windbg/ like wise would allow you attach to system process
basically system process is not a process at all it is a collection of threads that has System Privilege
and as such you cant find a system.exe anywhere (NO IMAGE PATH) iirc PsCreateInitialSytem_some_name_whatever function in nt(os\pa\mpa)
starts this System Process during PhaseInitilaisation if i remember correctly
see i have SeTcbPrivilege below still i wont be able to attach to System Process
Code:
C:\Documents and Settings\admi\Desktop>ntrights -u admi +r SeTcbPrivilege
Granting SeTcbPrivilege to admi ... successful
C:\Documents and Settings\admi\Desktop>showpriv.exe SeTcbPrivilege
2 account(s) with the SeTcbPrivilege user right:
VPC\admi
The LookupAccountSid() API returned error 0x00000534All accounts enumerated
C:\Documents and Settings\admi\Desktop>"c:\Program Files\Debugging Tools for Win
dows (x86)\cdb.exe" -pn System
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Cannot debug pid 4, NTSTATUS 0xC0000022
"{Access Denied} A process has requested access to an object, but has not b
een granted those access rights."
Debuggee initialization failed, NTSTATUS 0xC0000022
"{Access Denied} A process has requested access to an object, but has not b
een granted those access rights."
C:\Documents and Settings\admi\Desktop>
and neither would using kd give access to System process
C:\Documents and Settings\admi\Desktop>"c:\Program Files\Debugging Tools for Win
dows (x86)\ntsd.exe" -d -pn System
C:\Documents and Settings\admi\Desktop>
kd> g
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Cannot debug pid 4, NTSTATUS 0xC0000022
"{Access Denied} A process has requested access to an object, but has not been granted those access rights."
Debuggee initialization failed, NTSTATUS 0xC0000022
"{Access Denied} A process has requested access to an object, but has not been granted those access rights."
nor would attaching from kd work
Code:
kd> !bpid -a -s 4
Finding winlogon.exe (-1)...
Waiting for winlogon.exe to break. This can take a couple of minutes...
Break instruction exception - code 80000003 (first chance)
Stepping to g_AttachProcessId check...
Break into process 4 set. The next break should be in the desired process.
Stopping in winlogon.exe
kd> kb
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0141fe8c 7c927e71 00000000 00000001 00079500 0x1030f2d
0141fed8 7c928325 01030ed0 00000000 00000001 ntdll!RtlpWaitOrTimerCallout+0x73
0141fef8 7c927aa2 00079500 7c97b440 00e41888 ntdll!RtlpAsyncTimerCallbackCompletion+0x1c
0141ff40 7c927ae3 7c928309 00079500 00000000 ntdll!RtlpWorkerCallout+0x70
0141ff60 7c927ba5 00000000 00079500 00e41888 ntdll!RtlpExecuteWorkerRequest+0x1a
0141ff74 7c927b7c 7c927ac9 00000000 00079500 ntdll!RtlpApcCallout+0x11
0141ffb4 7c80b713 00000000 00000000 00000000 ntdll!RtlpWorkerThread+0x87
0141ffec 00000000 7c910230 00000000 00000000 0x7c80b713
kd> bl
kd> g
Microsoft (R) Windows User-Mode Debugger Version 5.1.2600.0
Copyright (c) Microsoft Corporation. All rights reserved.
Cannot debug pid 4, NTSTATUS 0xC0000022
"<Unable to get error code text>"
Debuggee initialization failed, NTSTATUS 0xC0000022
"<Unable to get error code text>"
if you are wondering whats this bpid magic here is a flow of how it works (in thi output ntsd is old in system 32 dir in target use latest ntsd from debugging tools dir
for production usage)
Code:
kd> !bpid -a -s 0n1636
Finding winlogon.exe (0)...
Waiting for winlogon.exe to break. This can take a couple of minutes...
Break instruction exception - code 80000003 (first chance)
Stepping to g_AttachProcessId check...
Break into process 664 set. The next break should be in the desired process.
Stopping in winlogon.exe
kd> kb
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0141fe8c 7c927e71 00000000 00000001 00079500 0x1030f2d
0141fed8 7c928325 01030ed0 00000000 00000001 ntdll!RtlpWaitOrTimerCallout+0x73
0141fef8 7c927aa2 00079500 7c97b440 00e41888 ntdll!RtlpAsyncTimerCallbackCompletion+0x1c
0141ff40 7c927ae3 7c928309 00079500 00000000 ntdll!RtlpWorkerCallout+0x70
0141ff60 7c927ba5 00000000 00079500 00e41888 ntdll!RtlpExecuteWorkerRequest+0x1a
0141ff74 7c927b7c 7c927ac9 00000000 00079500 ntdll!RtlpApcCallout+0x11
0141ffb4 7c80b713 00000000 00000000 00000000 ntdll!RtlpWorkerThread+0x87
0141ffec 00000000 7c910230 00000000 00000000 0x7c80b713
kd> u 0x1030f2d
01030f2d 85c0 test eax,eax
01030f2f 740d je 01030f3e
01030f31 50 push eax
01030f32 e88cfdffff call 01030cc3
01030f37 83259844070100 and dword ptr ds:[1074498h],0
01030f3e 33c0 xor eax,eax
01030f40 c9 leave
01030f41 c20800 ret 8
kd> ub 0x1030f2d
01030f10 ff75fc push dword ptr [ebp-4]
01030f13 ff15c8160001 call dword ptr ds:[10016C8h]
01030f19 a194440701 mov eax,dword ptr ds:[01074494h]
01030f1e 85c0 test eax,eax
01030f20 7406 je 01030f28
01030f22 50 push eax
01030f23 e8b0feffff call 01030dd8
01030f28 a198440701 mov eax,dword ptr ds:[01074498h]
kd> g
Microsoft (R) Windows User-Mode Debugger Version 5.1.2600.0
Copyright (c) Microsoft Corporation. All rights reserved.
*** wait with pending attach
Loaded dbghelp extension DLL
The call to LoadLibrary(ext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded exts extension DLL
The call to LoadLibrary(uext) failed with error 2.
Please check your debugger configuration and/or network access
Loaded ntsdexts extension DLL
WARNING: SRV*Z:\symbols\* is not accessible, ignoring
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
ModLoad: 00400000 00404000 C:\Documents and Settings\admi\Desktop\msgbox.exe
ModLoad: 7c900000 7c9af000 C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f6000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 7e410000 7e4a1000 C:\WINDOWS\system32\user32.dll
ModLoad: 77f10000 77f59000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\uxtheme.dll
ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f03000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77fe0000 77ff1000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll
Break instruction exception - code 80000003 (first chance)
eax=7ffdf000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c90120e esp=008bffcc ebp=008bfff4 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\ntdll.dll -
ntdll!DbgBreakPoint:
7c90120e cc int 3
0:001> kb
kb
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
008bfff4 00000000 00000000 00000008 0007ae5c ntdll!DbgBreakPoint
0:001> ~*kb
~*kb
0 id: 664.6c8 Suspend: 1 Teb 7ffde000 Unfrozen
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\user32.dll -
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0012faac 7e4249c4 000e00e2 00000000 00000001 ntdll!KiFastSystemCallRet
0012fad4 7e43a956 7e410000 001434e0 00000000 user32!GetCursorFrameInfo+0x1cc
0012fd94 7e43a2bc 0012fef0 00000000 ffffffff user32!SoftModalMessageBox+0x677
0012fee4 7e4663fd 0012fef0 00000028 00000000 user32!MessageBoxIndirectA+0x23a
0012ff3c 7e4664a2 00000000 00143058 00143098 user32!MessageBoxTimeoutW+0x7a
0012ff70 7e450877 00000000 00403019 00403000 user32!MessageBoxTimeoutA+0x9c
0012ff90 7e45082f 00000000 00403019 00403000 user32!MessageBoxExA+0x1b
*** WARNING: Unable to verify checksum for C:\Documents and Settings\admi\Desktop\msgbox.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Documents and Settings\admi\Desktop\msgbox.exe
0012ffac 00401013 00000000 00403019 00403000 user32!MessageBoxA+0x45
0012fff0 00000000 00401000 00000000 78746341 msgbox+0x1013
. 1 id: 664.3ec Suspend: 1 Teb 7ffdd000 Unfrozen
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
008bfff4 00000000 00000000 00000008 0007ae0c ntdll!DbgBreakPoint
0:001>
Bookmarks