wdk - How to find the service name corresponding to a svchost process in my WFP driver's ALE Callout? - Stack Overflow

admin管理员组

文章数量:1430609

In my WFP driver, I register a callout for the FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer

Now in my callout, in case the process that made the connection was svchost, I want to extract the SID of the service, or service name (the goal is to find the service name at the end, using service's SID or not). This is because a single svchost process can have multiple services, and I want to know which service caused this connection. I am accessing the token similar to below,

token = (PTOKEN_ACCESS_INFORMATION)inFixedValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID].value.tokenAccessInformation->data

originalSid = token->SidHash->SidAttr->Sid;

...

UNICODE_STRING sidString;
status = RtlConvertSidToUnicodeString(&sidString, originalSid, TRUE);

I tried to extract the SID from the FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID using RtlConvertSidToUnicodeString hoping it would be the service's SID, but it gives me the user's SID instead.

So my question is, in my callout or afterwards, in case an svchost process makes a connection, how can I find it's corresponding service name?

The windows firewall, which is WFP based seems to be able to get the service name of a connection, because you can have service-based rules in the firewall.

And some open source projects have user mode codes similar to below:

   public ServiceNameFilterCondition(string serviceName)
            : base(ConditionKeys.FWPM_CONDITION_ALE_USER_ID, FieldMatchType.FWP_MATCH_EQUAL, $"O:SYG:SYD:(A;;CCRC;;;{GetServiceSidFromName(serviceName)})")
        {
        }

So it seems like they are assuming ALE_USER_ID should contain service SID? For example

In my WFP driver, I register a callout for the FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer

Now in my callout, in case the process that made the connection was svchost, I want to extract the SID of the service, or service name (the goal is to find the service name at the end, using service's SID or not). This is because a single svchost process can have multiple services, and I want to know which service caused this connection. I am accessing the token similar to below,

token = (PTOKEN_ACCESS_INFORMATION)inFixedValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID].value.tokenAccessInformation->data

originalSid = token->SidHash->SidAttr->Sid;

...

UNICODE_STRING sidString;
status = RtlConvertSidToUnicodeString(&sidString, originalSid, TRUE);

I tried to extract the SID from the FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID using RtlConvertSidToUnicodeString hoping it would be the service's SID, but it gives me the user's SID instead.

So my question is, in my callout or afterwards, in case an svchost process makes a connection, how can I find it's corresponding service name?

The windows firewall, which is WFP based seems to be able to get the service name of a connection, because you can have service-based rules in the firewall.

And some open source projects have user mode codes similar to below:

   public ServiceNameFilterCondition(string serviceName)
            : base(ConditionKeys.FWPM_CONDITION_ALE_USER_ID, FieldMatchType.FWP_MATCH_EQUAL, $"O:SYG:SYD:(A;;CCRC;;;{GetServiceSidFromName(serviceName)})")
        {
        }

So it seems like they are assuming ALE_USER_ID should contain service SID? For example https://github/pylorak/TinyWall

• wdk
• windows-kernel
• kmdf
• wfp

Share Improve this question Follow edited Nov 28, 2024 at 12:04 OneAndOnly asked Nov 28, 2024 at 10:11 OneAndOnlyOneAndOnly 1,05622 gold badges1919 silver badges4141 bronze badges 2

• learn.microsoft/en-us/sql/relational-databases/security/… community.osr/t/… ... – OneAndOnly Commented Nov 28, 2024 at 10:45
• @RemyLebeau ... I'm not sure why we are still wasting time talking when you can google pcsxcetrasupport3.wordpress/2013/09/08/… community.osr/t/… – OneAndOnly Commented Nov 28, 2024 at 10:59

Add a comment  | 

1 Answer 1

Sorted by: Reset to default -1

A single instance of svchost can run multiple services at a time, so there is not 1 single service name.

You will have to enumerate all of the running services and identify the ones that belong to the same PID that you already have. You can use EnumServicesStatusEx() for that task.

本文标签：