eurecom-s3/loaders-models

Loader Models

Windows

The Windows loader is made of two distinct components, residing respectively in kernel- and user-space. The entry point of kernel-space part of the loader is the MiCreateImageFileMap in ntkrnlmp.exe, while the user-space portion starts with the LdrpInitializeProcess in ntdll.dll.
We modeled three versions of the Windows loader:

• Windows XP
• Windows 7
• Windows 10

For each version, we provide a model for the kernel-space portion of the loader (MiCreateImageFileMap.lmod) and one for the user-space one (LdrpInitializeProcess.lmod).
Moreover, we created two models (one for Windows XP and one for Windows 7/10) for the memory mapping operations that the Windows loader performs when loading a PE file. They can be found in this directory.
These models use of the standard PE data types defined in the this C header file.

Antivirus tools

ClamAV

The model for the PE-specific parser of ClamAV is here.
We also provide a model for the memory mapping operation by which ClamAV translates virtual address in the process memorr space into offsets in the original PE file

Yara

A model of the memory mapping operation performed by yara can be found here. Yara also enforces very few constraints while parsing PE files, which encoded this model.

Reverse-Engineering tools

radare2

Similarly to the case of yara, for radare2 we provide a model of the memory map operation, and a basic one of the very few constraints enforced on PE files.

Linux (preliminary wip)

Kernel-space

A model for the load_elf_binary function of the Linux kernel (version 5.5) (defined in fs/binfmt_elf.c) can be found here.

glibc

A model for the glibc_open_verify_32 function of glibc can be found here.

ReacOS (preliminary wip)

Model for the PeFmtCreateSection function in ntoskrnl/mm/section.c