I read about memory enclaves, and I found it an interesting feature to hide some data, so, here I am.
I wasn't able to find anything on the API required, but the MSDN documentation has [no source code on usage], I know that I have to call the following:
IsEnclaveTypeSupported
: to make sure I can continue.CreateEnclave
: to return the base address of the enclave created, although I struggled with this one too, but this question helped me.LoadEnclaveData
: to add the data to our created enclave.InitializeEnclave
: to activate the enclave.based on Windows Internal book (part 1), to
execute
I have to run theEENTER
assembly instruction, which also I didn't find information on, but I thinkCallEnclave
with the base address of the enclave can do the job.
Anyways, I'm stuck at step 3, my LoadEnclaveData
is returning error code 87
, which is ERROR_INVALID_PARAMETER
.
I'm only copying NOP
s (0x90) to the address, just to see it through the debugger that is running.
Here is the code:
LPVOID lpAddress ;
ENCLAVE_CREATE_INFO_VBS VBS = { 0 };
VBS.Flags = 0;
HANDLE hProcess = GetCurrentProcess();
lpAddress = CreateEnclave(
hProcess,
NULL,
2097152,
NULL,
ENCLAVE_TYPE_VBS,
&VBS,
sizeof(ENCLAVE_CREATE_INFO_VBS),
NULL
);
printf("[-] GetLastError : %d \n", GetLastError());
printf("[+] %-20s : 0x%-016p\n", "lpAddress addr", (void*) lpAddress);
unsigned char buffer[] = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 , 0x90 , 0x90 };
LoadEnclaveData(
hProcess,
lpAddress,
&buffer,
sizeof(buffer),
PAGE_READWRITE,
NULL,
0,
0,
0
);
printf("[-] GetLastError : %d \n", GetLastError());
Based on MSDN's LoadEnclaveData
documentation, they didn't specify what to do with lpPageInformation
, so I think it is the problem, but they said The lpPageInformation parameter is not used.
So I recheck a couple of parameters, and I found out that nSize
must be a whole-number multiple of the page size.
So I got confused, what to do now?
In case anyone is sure about executing a buffer in an enclave, please let me know.
And BTW, the thing in choosing the title is killing me, [I wasted more time on that than writing this].