[Autogenerated] let's take a look at some of the aspects of the loader.
So first let's start with this known DLL edge list.
Where can you find that list.
So what I need to do here is to open the registry editor,
let me just open edit the default registry editor.
Windows has and let me show you where that list of non DLS
reside so we need to go to H key local machine,
this is a machine wide setting and then go to system current control,
set control and under control.
There is a session manager key and this key is used by the session manager
process sMS S dot e x E and here you should find known DLS,
here they are.
This is the list of all known dealers.
You can see,
we see the names there and these dealers are going to be
mapped early in the boot process of Windows.
In fact SMS s is the one doing that.
So these dealers will always be mapped first and
then later on when they're needed.
Goodbye, executable or other dealers,
they're going to be grabbed from those already open section
objects that are mapping these deals.
The actual section objects can be viewed by different tools called
window BJ and we'll do that in the future course.
So that's one thing the next thing to look at is those dependencies
I'm going to run a total P which is one of my IP viewer or at least
one of my tools that is used to view pes.
So if I go ahead and open something like a Notepad Let me go to C.
Windows system 32 look for Notepad but of course could be anything and
we can see here some details about the PE itself,
the portable executable itself.
One of the things here that we see is the imports.
So the imports are all these dependencies that already stored as part of
the P and these are the dependencies the loader is going to search for in
order for the process to be fully working.
Otherwise we'll get that error message box and the process will terminate.
So if a sort here we can see that we have this normal kind of deal.
S such as, you know, 32 G d i 32 common control 32.
These are sort of normal dealers and then you see other dealers which
look a bit weird and these are known as API sets.
So this API set is a mechanism that allows indirection in the sense
that Microsoft can replace an implementation and put it in a different
DLL without breaking existing applications.
So what happens before API sets?
If you have a function such as create file,
great file was implemented in the kernel 32 dot Dll.
However, if Microsoft wanted to change that implementation,
that would be very difficult to do because building
applications or applications that already exist,
they expect create file to be part of current 32 dot Dll but now
we can provide this idea of an indirection.
The API set is like an interface, it's it consists of several functions.
So for example,
this one consists of a set of these four functions and so it
doesn't really specify where these are.
Ac actually implemented, just going to give them that kind of name,
which is this interface, which is the pseudo Dll here,
it's not a true DLL at run time,
the loader has a mapping that points to the real implementation file on this
particular version of Windows and this makes it easier to make changes in the
implementation DLL without affecting existing clients.
So you can see user 32 G D I 32 common control.
One thing that you might not see here,
which is kind of weird is kernel 32 this is where create file
normally is implemented and if you use an earlier version of
Notepad in Windows stand for instance,
you will see kernel 32 as part of this deal dependencies but now things have
changed as you can see here in Windows 11 and somewhere here there is some
interface or API said to be more precise that points to create file function
because we know that definitely um note that needs to call this function
that's kind of necessary.
So we need to kind of search,
I don't have such functionality in imports in these tools just yet.
So it should be here somewhere and probably find that under
something related to files or something like that,
but it is here somewhere.
And so here it is, here's create file W.
Of course we're talking about the fact that we have two functions,
create file A and w.
We know that already.
And note that technically uses create file W and this is
part of this interface which of course makes sense and uses
other functions such as read, file and write file.
So all these dependencies here,
we can see the real DLL and one of these real dealers which is not
used with API sets at least not by no better here,
we can see the actual functions imported from that DLL.
It's not the entire set of fun functions implemented in this G D 32 dot
these are just the functions Notepad is is using,
it needs those if I want, I can technically open let me open a new window.
G 32 itself and if I do that we'll see that there's imports
here because G D I 32 also has its own dependencies such as
anti Dll and win 32 you in fact and has also some other
dependencies based on some API sets,
but it also has exports because it's a DLL and DLS typically export functions.
So this is the full list of functions exported from G d I 32 dot Dll only a
small subset of that is actually being used by Notepad here.
So this is what we see here in the imports of API and these are the DLS
and these API sets the loader is supposed to locate.
Now can we see the list that maps API sets two implementations.
So technically we can do that because it's stored on a system wide basis,
in fact in the file um but here's a more perhaps interesting way of seeing
that we can do that by launching another instance debugger and attaching or
launching a notepad or whatever process we feel like.
And before we do that we need to set up something called loader snaps,
loader snaps is a way to get more insight into the inner
workings of the loader and so to do that,
we're going to use a tool called G Flags.
So G Flags is one of the tools in the debugging tools for windows package.
So I'm going to search for that and launch the 64-bit version of course.
So once I do that,
I'm required to elevate and we get this tool which has a very basic UI
that's going to be good enough for our purposes,
it also has a command line interface by the way and talk about the G
Flags tool in more detail in the future course,
but for now let's just see if we can get more insight about the
inner workings of the loader using G Flags.
So one thing I can do is configure aspect of an executable by pressing this
image file to tab and typing an executable name including the extension but
just the executable name not the full path.
It never works with path.
Any executable happens to have this name is going to have a
certain settings which I'm going to provide now,
once I type it in to press the tab key and then all these options light up.
What I'm going to do here is to check this option called show loader snaps.
This actually adds value in the registry in the key that is known
as image file execution options something we won't be looking at
in this course but will look at that in the future course and then
you can click apply or Ok.
And that setting is there and it applies from now on to new instances
of note but that might be created after we set up the note but the XC
here with short loader snaps in G Flags,
there's 11 thing we we need to do and that's to
launch the classic note but the note,
the store Notepad which doesn't actually um respect
the loader flags in the same way.
So I'm going to go to where the image file execution options key is.
In fact we've seen that in the previous scores,
it's going to be under software and then Microsoft and then a Windows.
Nt and then current version and finally image file execution options here.
We can look up Notepad you can see the thing that was added by G Flags
is this global flag value that has a value of two,
this is a bit that represents this show loader snaps option,
I'm going to change that to zero,
not to have the filter that we direct to the store application here and
then I'm going to run another instance of my debugger and let's do a
launch and executable let me find Notepad he already found that
previously but you can browse and find Notepad we don't need any special
arguments and just click ok,
once we do that we can see that the output is much richer than previously
we've seen when we looked at Notepad you can see here,
this is the effect of show loader snaps show loader snaps shows you all the
activities or at least most of the activities of the loader as in this case
part of starting a new process but in fact we can see that kind of activity
later on when we do certain other operations.
So first you can see here some aspects of this redirection of API sets,
it says this API set which represents an abstract set of functions is
actually implemented in this DLL so this was done by an API set,
redirection by the way the API set is also stored in the process,
environment block if you want,
you might try to find it in there somewhere so you can see
all these redirections happening here.
This is where these functions are truly implemented,
so this is done as part of the process of loading,
you can also see the binding that is done by the loaders as it looks for
functions that are needed by the executable and perhaps other DLS that
are loaded and have their own dependencies.
So you can see there's a location or locating procedures by name and
essentially calling something like get address behind the scenes,
but not really just interpreting the information that is provided by
the P so you can see lots of details here giving you some hint as to
the inner workings of the loader at this point we have been uh stopped
here in the initial breakpoint very early in the process lifetime if I
do it okay here, we can see that we're still in anti dll,
we're still part of the loader and the main entry point of the
executable hasn't been invoked just yet,
if you continue running with G you can see more things are
happening while Notepad actually loads and then if I go ahead
and do something like open in the menu,
you'll see that more stuff is happening because more details are
loaded and more locating is happening and redirection,
all that stuff is done by the loader.
So this idea of loader snaps is a nice way to learn more about the inner
workings of the loader because it provides all these extra details when
debugger is attached only when the debugger is attached once you're done and
don't want to see these things anymore, you have to turn it off.
And so you can do that with the flags by going back to the UI here and
clicking show loader snaps to uncheck it and click apply again.
And so uh well apparently there's some error here which is kind
of weird error number five is access denied.
So maybe is taken here by by reg edit for some reason but
this shouldn't really be a problem.
So normally let's just uh see if we can exit note that maybe that
would be easier or maybe there's a bug in G flags.
So okay, let's just try it again, click cancer.
Let's run G Flags again if this problem persists.
So if I go ahead and type note that X again and press tab we can
see the settings that are part of the registry.
Of course we can just delete this option from the registry and that's it.
But let's try it with the Ui again.
Apparently it fails.
I'm not sure why it shouldn't really fail because we are running
elevated here so it shouldn't really be a problem.
Um but I guess it is what it is.
So this is probably a bug that is manifesting itself in windows 11.
So if I go ahead and remove global flag or just put that with a value of zero.
Let's just remove it and I run this again.
Let me launch another debugger instance here and launch the same Notepad you
see now that we're back to normal output that doesn't contain any information
or any internal information by the inner workings of the loader because we
have we have turned off loader snaps.