Aaron Margosis Principal Consultant Microsoft Corporation SESSION CODE: WCL301

(*) Names of apps and vendors have been removed to protect the guilty

Process Kernel32.dllKernel32.dll CreateFileWimplementationCreateFileWimplementation Shim DLL CorrectFilePathsimplementationCorrectFilePathsimplementation App.exeApp.exe IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile IAT CreateFile

API FamilyIntercepted APIs CreateProcess Routines (4) CreateProcess[AW], WinExec, ShellExecute[AW], ShellExecuteEx[AW] Profile (Ini-File) Routines (8) GetPrivateProfileInt[AW], GetPrivateProfileSection[AW], GetPrivateProfileSectionNames[AW], GetPrivateProfileString[AW], GetPrivateProfileStruct[AW], WritePrivateProfileSection[AW], WritePrivateProfileString[AW], WritePrivateProfileStruct[AW] File Routines (22) CopyFile[AW], CopyFileEx[AW], CreateDirectory[AW], CreateDirectoryEx[AW], CreateFile[AW], DeleteFile[AW], FindFirstFile[AW], FindFirstFileEx[AW], GetBinaryType[AW], GetFileAttributes[AW], GetFileAttributesEx[AW], SetFileAttributes[AW], GetTempFileName[AW], GetLongPathName[AW], MoveFile[AW], MoveFileEx[AW], MoveFileWithProgress[AW], RemoveDirectory[AW], SetCurrentDirectory[AW], OpenFile, _lopen, _lcreat ShellLink Routines (4) IShellLink[AW]::SetPath, IShellLink[AW]::SetArguments, IShellLink[AW]::SetIconLocation, IPersistFile::Save LoadImage Routines (1) LoadImageA

What is the Springboard Series? To the IT pro, our goal is Be the definitive resource for Desktop IT pros Open, honest; show don’t tell Information at right time, right level across Adoption Lifecycle Inside of Microsoft we are A turnkey IT pro engagement platform for depth and breadth The program to mobilize MS marketing and field to focus on desktop OS IT pros DEPLOYPILOTMANAGEEXPLOREDISCOVER one-Windows TechCenter in 10 languages Virtual Roundtable Events Springboard Technical Experts Panel Event Support and Resources Straight-talk Monthly Feature Articles and Overview Guides TalkingAboutWindows Video Blogs

Sign up for Tech·Ed 2011 and save $500 starting June 8 – June 31 st You can also register at the North America 2011 kiosk located at registration Join us in Atlanta next year

Windows APIs Kernel32 Kernel32 User32 User32 Advapi32 Advapi32 OleAut32 OleAut32 … Windows APIs Kernel32 Kernel32 User32 User32 Advapi32 Advapi32 OleAut32 OleAut32 … AppY.exe v Windows loads app. Checks AppCompat DB(s). Match found: Selected API calls intercepted and modified. AppY.exe v

Problem Type Symptoms Invalid Windows version check Says “This app requires Windows XP” Admin rights issue Says “Requires admin rights”, or Fails non-elevated, works elevated (Caveat about testing elevated) Security configuration Works when Group Policy or security template setting is removed New platform Works with Windows Classic theme

Problem Type Shim Bad Windows version checks Version Lie Shims (e.g., WinXPSP3VersionLie) Writing to HKCR at runtime VirtualizeHKCRLite Unnecessary checks for “am I admin?” ForceAdminAccess Writing to WRP-protected keys and files WRPMitigationWRPDllRegisterWRPRegDeleteKey Windows thinks your app is an installer SpecificNonInstaller Writing to protected folder and registry locations CorrectFilePathsVirtualRegistry Using kernel object in global space LocalMappedObject