[Autogenerated] back in our Windows 11 machine.
Let's go to process Explorer here.
Now we know already that these folks see a color is used to indicate
protected processes and in fact protected processes.
Light as well.
Most processes in fact today are protected with the light kind of way,
so to speak.
They have these Signer and that's the model.
That is mostly preferred.
But again protected.
Just means protected.
But to see the exact type of protection,
we can add another column to process, explore which simply is called protection.
Once you add that column we can see exactly the protection used
by the particular process Or for instance,
CSS Rss is using PS protected sign Irwin TCB light.
So it says really these two numbers in a text form first we have
the Signer which is win TCB that's level six.
And then light means this is the PPL model rather than
the protected initial model from vista.
You can of course also sort by protection.
We can see the entire set of protected processes here that exist in the system.
You'll notice that some of them are not really shown as protect Bye.
They are protected.
And that's because process explorer is not able to read the actual details about
the type of protection but they are protected nonetheless.
And they're protected even in the most powerful way using
using wind system and protected model.
So the number 72 here behind the scenes but it does
recognize that these are protected anyway.
You can see here that something like Windows defender,
which running msN PNG that Windows defender.
You can see it's level is signer anti malware light,
essentially the number 31 as shown in the previous slide,
you can see that there is another part here for a defender that's a
survey that it's a networking component that it's using.
And you can see it's also protected by this level.
So you can grab any one of these protected processes and see the
level that it's signed with and for all of them,
you can see essentially the same thing in terms of list of DLS,
we see absolutely nothing by the way,
if you double click here and look at the threads of this particular process,
you see only very generic names here for the faction names because again,
it's not possible to _________ these threats.
These are also sometimes referred to as protected threats.
You can see that some details of these threats are not even available,
such as the higher priority memory priority and cycles.
And if I try to double click any one of these threats or press
the stop button will get an error because process Explorer is
not able to open a powerful enough handle to the threat to get
call stack information.
Again, this is something that the new process Explorer,
the updated one that has not been released yet at the time of this
recording will be able to do by utilizing its driver.
Let's see what's going on in terms of protected processes from the
Colonel debugger perspective so I'm going to launch my win debug preview
with elevated permissions so I can able to connect to the local kernel
here as we've done before and what you want to do here is to look at
some details that might be interesting to look at from protective
processes perspective.
So let's grab one of these processes just to see what that looks like.
So here's the CSR assess process that has the process 864.
Let me look for that process so you can provide the X six for value here
as the process I d and I'm doing that in decimal because that's the
number that is being shown by process Explorer.
It will find me this process.
So let's grab the address of this process Now.
If I just use the normal process command,
it doesn't show by default the protection status of the process
simply doesn't think that this is important enough.
So in order to actually see that we have to go deeper into the process data
structure by using the normal DT command for example.
And we can of course lead the entire set of members.
Just look for the appropriate member.
But we can use another feature of the,
of the D T command that you can hone in a particular field of interest.
Member name that you know exists and there is a member name called protection
and you can do even slightly better than that by adding a dot this indicates
that if protection is in itself a structure or union,
it will be expanded automatically.
If we try that we can see that the value here is indeed 61 as we expect.
That's the wind signer level for wind TCB,
that's level six and one means PPL that's the light model.
So this means this process is indeed protected.
So protection is only really from this perspective.
This also means that I can see the list of DLS in the current
debugger without any particular restriction.
All I need to do here is just use the process command the dot process
command to switch to this process and force loading of user mode symbols
and use the normal L M command once I do that we get kernel modules here
but also the user mode models here are his Siri Siri says and all its DLS
noticed this is the executable.
These are various dealers county loaded into CS Rss,
which we can verify of course using the cyst Explorer tool,
you'll notice the addresses here are using that address.
Is there somewhere in the lower 128 terabytes of memory and so again,
protected processes are only protected from using outside and are
never really protected from the Kernel side.
Any kind of component can view protected processes just like
it views any other process for that matter.
In fact we can even do something a bit more perhaps uh daring than that.
We can change the protection level from the debugger debugger
availability here because we can change the memory in current space
and the process will cease to be protected.
So let's see that.
So here's process Explorer,
let's look at CSR Ss here for now this 8 64 process that the process has not
been showing us any DLS and we're in always on top mode here.
So let's see what happens if I change this protection to zero.
So I need to do what I need to do is to grab the address of the process again,
I'm going to use the edit bite command because I just need to change a single
bite there and we need to of course add the offset of where the protection
member is and this is this opposite offset right here.
You have to be careful here.
Otherwise,
if you change the wrong value might cause some something wrong
to happen and perhaps even _____ the system.
But let's try to be careful here and hope for the
best and then just write zero here.
This is some time referred to as D.
Com with the K as direct kernel object manipulation.
So normally of course you can't do that from user mode unless you
are able to leverage some vulnerable driver.
Perhaps that can do your bidding.
But now we have a local kernel debugger here available to us.
So we can definitely change any others that we want.
So let's see what happens once we do that here goes and you notice the
list of dealers immediately appears in Process Explorer because Process
Explorer tries to update its view every second,
that's its default update interval and tries to open the handle
once again to be able to show dealers and it's fair that it fails
uh many times and then suddenly it succeeded because the process is
really no longer protected.
Now the color of the process here will still be with the folks a call
because process bro doesn't expect protection to be able to be turned off
because normally this is really impossible.
You'll notice by the way that other processes such as
another CSR says here or SBC host or whatever,
they're still protected in the normal way.
This was just done for a very specific process which is a particular CSR
says we have chosen here to work with and of course we can resume More
put the process to be protected back by specifying the value 61 once
again or any value for that matter.
It will be protected either way.
But let's just restore that to the normal value and you'll
see that the dealers all now go away.
So now process explorer is not able anymore to open
handle to the process with with enough access to get a
list of DLS in the process really.
The point here is that from user mode doesn't matter your your
user if you're running with the privileges,
it doesn't really matter.
You can't open a handle in invasive way to a protected process.
Many of them you can't even kill,
so you can't even get the process to permanent access
masks for most of these processes.
But from the current side of things,
there's really nothing stopping you from doing that
because there's really nothing there.
From the current perspective,
protective processes are just like normal processes and
there is no restriction there whatsoever.