{"action":"created","issue":{"url":"https://api.github.com/repos/frida/frida-core/issues/50","labels_url":"https://api.github.com/repos/frida/frida-core/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/frida/frida-core/issues/50/comments","events_url":"https://api.github.com/repos/frida/frida-core/issues/50/events","html_url":"https://github.com/frida/frida-core/issues/50","id":115340575,"number":50,"title":"Frida is failing with processes running in Low Integrity Level","user":{"login":"poxyran","id":2087196,"avatar_url":"https://avatars.githubusercontent.com/u/2087196?v=3","gravatar_id":"","url":"https://api.github.com/users/poxyran","html_url":"https://github.com/poxyran","followers_url":"https://api.github.com/users/poxyran/followers","following_url":"https://api.github.com/users/poxyran/following{/other_user}","gists_url":"https://api.github.com/users/poxyran/gists{/gist_id}","starred_url":"https://api.github.com/users/poxyran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poxyran/subscriptions","organizations_url":"https://api.github.com/users/poxyran/orgs","repos_url":"https://api.github.com/users/poxyran/repos","events_url":"https://api.github.com/users/poxyran/events{/privacy}","received_events_url":"https://api.github.com/users/poxyran/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-05T18:06:03Z","updated_at":"2015-11-05T22:16:57Z","closed_at":null,"body":"Frida is failing with processes running in Low Integrity Level\r\n\r\nI'm trying to implement a script in Python to work with a process running in Low Integrity Level under Windows 7 SP0 x86.The specific process is IE, Internet Explorer, the child not the broker. When I run the script (frida-process-low-il-test.py), I get the following error:\r\n\r\n{{{\r\nC:\\Users\\defcon\\Documents>python frida-process-low-il-test.py 2892\r\nTraceback (most recent call last):\r\n  File \"frida-process-low-il-test.py\", line 27, in <module>\r\n    main(target_process)\r\n  File \"frida-process-low-il-test.py\", line 9, in main\r\n    session = frida.attach(target_process)\r\n  File \"C:\\Python27\\lib\\site-packages\\frida\\__init__.py\", line 55, in attach\r\n    return get_local_device().attach(target)\r\n  File \"C:\\Python27\\lib\\site-packages\\frida\\core.py\", line 87, in attach\r\n    return Session(self._impl.attach(self._pid_of(target)))\r\nfrida.ProcessNotRespondingError: timed out while waiting for session to establish\r\n}}}\r\n\r\nBut if I run it against other process, for example, notepad, I get the following result:\r\n\r\n{{{\r\nC:\\Users\\defcon\\Documents>python frida-process-low-il-test.py 1544\r\n[+] Received msg from process: Hello from my process\r\n[!] Press <Enter> at any time to detach from instrumented program.\r\n}}}\r\n\r\nI was talking with @oleavr and we think it is a problem with the named pipe's permissions. It seems that frida can inject the library into the process running with Low IL but then the process can't write to the pipe. This make sense because the idea to have a process running in Low IL is to isolate it from processes with more privileges to avoid privilege escalations. In fact, if I disable UAC (User Account Control), IE child process will run with High IL and frida client would be able to write to the pipe.\r\n\r\nThis is considered as the expected behavior according to the \"Communication between low-integrity and higher-integrity processes\" in this article from MSDN: https://msdn.microsoft.com/en-us/library/bb625960.aspx\r\n\r\nHowever, I'm in a situation where I need to communicate with a process running with Low IL. Even though it is not a good idea to allow a process running in Low IL to write to a named pipe it would be a good idea to add a parameter (for xample: child_could_write_pipe=True) to allow this behavior. I would use it like this:\r\n\r\n{{{\r\nsession = frida.attach(target_process, child_could_write_pipe=True)\r\n}}}\r\n\r\nAccording to the previous link, in order to allow this behavior over named pipes \"the creator explicitly sets the mandatory label on the pipe to allow access to lower-integrity processes\". \r\n\r\nI was experimenting with the SetLowLabelToFile() function mentioned on that article but without luck.\r\n\r\nLooking for some more detailed information, I found this: http://blogs.msdn.com/b/cjacks/archive/2006/10/24/modifying-the-mandatory-integrity-level-for-a-securable-object-in-windows-vista.aspx which takes me to the AddMandatoryAce API which seems to be the answer to the problem.\r\n\r\nI'm attaching a script to reproduce the issue. Just run IE or any other process with Low IL and then attach to it like 'python frida-process-low-il-test.py <Process PID>'.\r\n\r\nI'm also attaching the pipe-windows.c (this file goes to frida-core\\lib\\pipe) with the modified SetLowLabelToFile (in my case the function is called SetLowLabelToPipe()) and the compiled _frida.pyd (for Python 2.7 x86).\r\n\r\nYou can get the files here (github doesn't allow me to upload the files right here): https://www.dropbox.com/s/4tmwofru9hd9kp2/frida-low-il.zip?dl=0\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/frida/frida-core/issues/comments/154212692","html_url":"https://github.com/frida/frida-core/issues/50#issuecomment-154212692","issue_url":"https://api.github.com/repos/frida/frida-core/issues/50","id":154212692,"user":{"login":"oleavr","id":735197,"avatar_url":"https://avatars.githubusercontent.com/u/735197?v=3","gravatar_id":"","url":"https://api.github.com/users/oleavr","html_url":"https://github.com/oleavr","followers_url":"https://api.github.com/users/oleavr/followers","following_url":"https://api.github.com/users/oleavr/following{/other_user}","gists_url":"https://api.github.com/users/oleavr/gists{/gist_id}","starred_url":"https://api.github.com/users/oleavr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oleavr/subscriptions","organizations_url":"https://api.github.com/users/oleavr/orgs","repos_url":"https://api.github.com/users/oleavr/repos","events_url":"https://api.github.com/users/oleavr/events{/privacy}","received_events_url":"https://api.github.com/users/oleavr/received_events","type":"User","site_admin":false},"created_at":"2015-11-05T22:16:57Z","updated_at":"2015-11-05T22:16:57Z","body":"w00t, awesome! Feel like submitting a PR?"}}