Working Set Page Cache side-channel IPC PoC
Clone or download
Latest commit 8e6764a Jan 9, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
Demo More readability +reliability updates Jan 9, 2019
wsIPC tabs->spaces Jan 9, 2019
.gitignore .gitignore Jan 8, 2019
README.md Updated README Jan 9, 2019
demo.gif Demo gif Jan 7, 2019
wsIPC.sln Initial commit of wsIPC Jan 7, 2019

README.md

wsIPC

wsIPC is a Proof-of-Concept for Windows that abuses shared RO pages in the process Working Set (page cache) to build a simple covert inter-process communication channel.

Demo gif

Background

Page Cache Attacks is a recently published paper by Gruss et al. which describes a page-resolution side-channel due to process-level page caching on OSes such as Linux and Windows. Full details are in the paper.

PoC

This VS2017 solution consists of a wsIPC dynamically-linked library which implements the side channel-based communications and some demo template code to show how it's used. To run, simply start one instance of Demo.exe as the sender:

PS C:\wsIPC> .\Demo.exe send
             _______  _____
 _    _____ /  _/ _ \/ ___/
| |/|/ (_-<_/ // ___/ /__
|__,__/___/___/_/   \___/
 POC by @depletionmode
[+] wsIpc library loaded successfully @ 0x0FDE0000.
[-] Attempting to send message (ArthurMorgan[13])...
[+] ...successfully sent!

And a further instance as the receiver:

PS C:\wsIPC> .\Demo.exe recv
             _______  _____
 _    _____ /  _/ _ \/ ___/
| |/|/ (_-<_/ // ___/ /__
|__,__/___/___/_/   \___/
 POC by @depletionmode
 [+] wsIpc library loaded successfully @ 0x0FDE0000.
 [-] Attempting to read message...
 [+] ...successfully received! -> ArthurMorgan

NOTE: Windows 10 19H1 contains a mitigation for the side-channel (the Working Set ShareCount is sanitized for non-privileged processes). On 19H1+ the PoC must therefore be run elevated.

Library usage

wsIPC.dll can be dynamically loaded by any process. Usage is as simple as Send()-ing from one process and Receive()-ing from another.

typedef HRESULT(*IpcSend)(PBYTE, ULONG);
typedef HRESULT(*IpcReceive)(BYTE*, SIZE_T, SIZE_T*);

HMODULE lib = LoadLibraryA("wsIPC.dll");

IpcSend pIpcSend = (IpcSend)GetProcAddress(lib, "Send");
IpcReceive pIpcReceive = (IpcReceive)GetProcAddress(lib, "Receive");