*** You need to agree the "Legal" part at the end of this page before using ***

WinBlox Distribution Info

Version Number of this Package

2005.03.11

Up-to-date Information from Project Website

Files

WinBlox Intro

You know the problem of today's anti-virus/malware/rootkit/penetration companies? They make unbelievable, extremely complicated and misdirecting shit. They advertise their products as if they are selling cigarette - providing information useless enough to make researchers sick.

What I expect is not some magic solution solving all types of attacks(because such solution does not exist). I need tools that do one thing and do it well. So WinBlox is born. WinBlox is user-mode WINAPI-level and open-source tool for controlling the behavior of applications running on Windows workstations.

WinBlox is an ideal tool for hardening the security of Windows systems:

Fear and Doubt

1. WinBlox works in user mode, so it cannot stop kernel-mode rootkit.
Right. There is only one true way to solve rootkit - format the whole harddrive. Don't expect anything in the system to stop attacker's code when it is already running with the highest privilege.
2. I cannot trust WinBlox.
Trust yourself. WinBlox source code files are so tiny that you can review all source code in 2 hours or less.
3. I don't need WinBlox, because I already have FIREWALL/ANTIVIRUS
Right. You don't need it, becaue you are not wise enough.
4. I don't need WinBlox, because I use Linux and I understand Linux well.
Right. You don't need it. Glad to hear this.

Usage

Here is one classic example:

If you input "mms://google.com/" in the latest build of win32 Mozilla, you will see a dialog like this:
An external application must be launched to handle mms: links. requested link:
mms://google.com/
If you were not expecting this request it may be an attempt to exploit a weakness in that other program. Cancel this request unless you are sure it is not malicious.
[Launch application] [Cancel]
It's some kind of mechanism preventing external programs from being executed - pretty simple and valuable. With the help of WinBlox, you can have the same type of mechanism in IE in a matter of seconds - just add the following line in the configuration file named WBLIST.TXT:
Internet application is about to launch external program in a non-RPC way. $record.confirm.^.*@execute_program:.*\\(iexplore\.exe|mozilla\.exe) > .* ==> .*
And run CONSOLE.EXE, then it's done. You don't need admin privilege to do this. And there is absolutely no change made to your system registry, and no file other than one log file within WinBlox directory will be written(of course this means CONSOLE.EXE needs to be executed again after logoff or reboot). Now, input "mms://google.com/" in IE, and you will see a dialog like this:
WinBlox has detected an operation that requires your confirmation. Press NO to cancel it.
Internet application is about to launch external program in a non-RPC way.
__________
c:\program files\internet explorer\iexplore.exe > "c:\program files\internet explorer\iexplore.exe"
__________
User Account: user
Request Type: execute_program
Parameters: c:\program files\windows media player\wmplayer.exe --> "c:\program files\windows media player\wmplayer.exe" "mms://google.com/"
[YES] [NO]
Press "NO" and Windows Media Player will not be executed.

Let me explain the meaning of configuration:

More about WinBlox Project

Latest source code, document, binary dist, contact, etc - http://umbrella.name/upid/winblox

Legal

WinBlox - control the behavior of applications running on Windows workstations
Copyright (C) 2005  liudieyu@umbrella.name

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.

PCRE LICENCE ------------ PCRE is a library of functions to support regular expressions whose syntax and semantics are as close as possible to those of the Perl 5 language. Written by: Philip Hazel University of Cambridge Computing Service, Cambridge, England. Phone: +44 1223 334714. Copyright (c) 1997-2001 University of Cambridge Permission is granted to anyone to use this software for any purpose on any computer system, and to redistribute it freely, subject to the following restrictions: 1. This software is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 2. The origin of this software must not be misrepresented, either by explicit claim or by omission. In practice, this means that if you use PCRE in software that you distribute to others, commercially or otherwise, you must put a sentence like this Regular expression support is provided by the PCRE library package, which is open source software, written by Philip Hazel, and copyright by the University of Cambridge, England. somewhere reasonably visible in your documentation and in any relevant files or online help data or similar. A reference to the ftp site for the source, that is, to ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/ should also be given in the documentation. However, this condition is not intended to apply to whole chains of software. If package A includes PCRE, it must acknowledge it, but if package B is software that includes package A, the condition is not imposed on package B (unless it uses PCRE independently). 3. Altered versions must be plainly marked as such, and must not be misrepresented as being the original software. 4. If PCRE is embedded in any software that is released under the GNU General Purpose Licence (GPL), or Lesser General Purpose Licence (LGPL), then the terms of that licence shall supersede any condition above with which it is incompatible. The documentation for PCRE, supplied in the "doc" directory, is distributed under the same terms as the software itself. End
============================================================================== END-USER LICENSE AGREEMENT FOR MICROSOFT PRE-RELEASE SOFTWARE ------------------------------------------------------------------------------ Microsoft Research Detours Package Version 1.5 (non-commercial version) IMPORTANT--READ CAREFULLY: This Microsoft End-User License Agreement ("EULA") is a legal agreement between you (either an individual or a single entity) and Microsoft Corporation for the Microsoft software identified above, which includes computer software and may include associated media, printed materials, and "online" or electronic documentation (collectively, the "SOFTWARE"). By installing, copying, or otherwise using the SOFTWARE, you agree to be bound by the terms of this EULA. If you do not agree to the terms of this EULA; you may not install, copy or otherwise use the SOFTWARE. ------------------------------------------------------------------------------ SOFTWARE LICENSE The SOFTWARE is protected by copyright laws and international copyright treaties, as well as other intellectual property laws and treaties. The SOFTWARE is licensed, not sold. 1. GRANT OF LICENSE. This EULA grants you the following limited, non-exclusive, non-transferable, non-assignable license: a. SOFTWARE. You may install and use the SOFTWARE, in source and object code form, on an unlimited number of computers on your premises for the sole purposes of (i) analyzing Win32 applications and extending Win32 system functionality for application or system binary files for academic and/or internal research purposes and (ii) internal evaluation and testing the SOFTWARE and/or providing feedback to Microsoft. b. Sample Code. You may also use and modify the SOFTWARE source code version of the portions of the SOFTWARE identified as "Samples" in REDIST.TXT or elsewhere in the SOFTWARE ("Sample Code") for the sole purposes of designing, developing, and testing your applications. For purposes of this EULA, "modifications" means enhancements to the functionality of the Sample Code. c. Redistributable Code. You may reproduce and distribute the object code form of any portion of the SOFTWARE, along with any modifications to the Sample Code ("collectively "Redistributable Code") solely in conjunction with, and as part of, your academic research and/or non-commercial application ("Permitted Application"); provided that you comply with the following: * If you redistribute any portion of the Redistributable Code, you agree that: (i) you will only distribute the Redistributable Code in conjunction with, and as part of, your Permitted Application which adds significant functionality to the Redistributable Code; (ii) you will not distribute the Redistributable Code in any commercial product or for profit; (iii) you will not use Microsoft's name, logo, or trademarks to market your Permitted Application; (iv) you will include a valid copyright notice on your Permitted Application; (v) you will not permit further redistribution of the Redistributable Code; and (vi) you will indemnify, hold harmless, and defend Microsoft from and against any claims or lawsuits, including attorneys' fees, that arise or result from the use or distribution of your Permitted Application. * In addition to the foregoing terms, if you distribute any portion of the Redistributable Code, you also agree to provide reasonable feedback to Microsoft, including but not limited to usability, bug reports and test results, with respect to SOFTWARE testing. All bug reports, test results and other feedback made by you shall be the property of Microsoft and may be used by Microsoft for any purpose it sees fit. Due to the nature of the development work, Microsoft is not certain as to when errors or discrepancies in the SOFTWARE may be corrected. d. Reserved Rights. Microsoft and its suppliers retain title and all ownership rights to the SOFTWARE. All rights not expressly granted are reserved to Microsoft. 2. COPYRIGHT. All rights, title, and copyrights in and to the SOFTWARE and any copies of the SOFTWARE are owned by Microsoft or its suppliers. The SOFTWARE is protected by copyright laws and international treaty provisions. Therefore, you must treat the SOFTWARE like any other copyrighted material. 3. DESCRIPTION OF OTHER RIGHTS AND LIMITATIONS. a. Limitations on Reverse Engineering, Decompilation, and Disassembly. You may not reverse-engineer, decompile, or disassemble the object code portions of the SOFTWARE, except and only to the extent such activity is expressly permitted by applicable law notwithstanding this limitation. b. Pre-Release Code, Non-Commercial Use. The SOFTWARE contains PRERELEASE CODE that is not at the level of performance and compatibility of a final, generally available, product offering. The SOFTWARE may not operate correctly and may be substantially modified prior to first commercial shipment, if any. Microsoft is not obligated to make this or any later version of the SOFTWARE commercially available. The SOFTWARE is "Not for Commercial Use" and may only be used for the purposes described in Section 1. You may not use the SOFTWARE in a live operating environment where it may be relied upon to perform in the same manner as a commercially released product or with data that has not been sufficiently backed up. c. Termination. Without prejudice to any other rights, Microsoft may terminate this EULA if you fail to comply with the terms and conditions of this EULA. In such event, you must destroy all copies of the SOFTWARE and all of its component parts. d. Not For Resale Software. You may not sell, resell, or otherwise transfer for value, the SOFTWARE. e. Rental. You may not rent, lease or lend the SOFTWARE. 4. EXPORT RESTRICTIONS. This SOFTWARE either contains no encryption or has been reviewed and released from the normal US restrictions on encryption, and has been made freely available to the interested public. It therefore has been classified as published software that is publicly available and not subject to U.S. export controls (15 CFR Sec 734.7). 5. U.S. GOVERNMENT RESTRICTED RIGHTS. All SOFTWARE provided to the U.S. Government pursuant to solicitations issued on or after December 1, 1995 is provided with the commercial license rights and restrictions described elsewhere herein. All SOFTWARE provided to the U.S. Government pursuant to solicitations issued prior to December 1, 1995 is provided with "Restricted Rights" as provided for in FAR, 48 CFR 52.227-14 (JUNE 1987) or DFAR, 48 CFR 252.227-7013 (OCT 1988), as applicable. ------------------------------------------------------------------------------ MISCELLANEOUS If you acquired this product in the United States, this EULA is governed by the laws of the State of Washington. If you acquired this product in Canada, this EULA is governed by the laws of the Province of Ontario, Canada. Each of the parties hereto irrevocably attorns to the jurisdiction of the courts of the Province of Ontario and further agrees to commence any litigation that may arise hereunder in the courts located in the Judicial District of York, Province of Ontario. If this product was acquired outside the United States, local law may apply. Should you have any questions concerning this EULA, or if you desire to contact Microsoft for any reason, please send email to detours@microsoft.com or write: Microsoft Corporation, Research, One Microsoft Way, Redmond, WA 98052-6399. ------------------------------------------------------------------------------ NO WARRANTIES. Microsoft expressly disclaims any warranty for the SOFTWARE. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SOFTWARE AND ANY RELATED DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. THE ENTIRE RISK ARISING OUT OF USE OR PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU. LIMITATION OF LIABILITY. Microsoft's entire liability and your exclusive remedy under this EULA shall not exceed five dollars (US$5.00). NO LIABILITY FOR DAMAGES. To the maximum extent permitted by applicable law, in no event shall Microsoft or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profit, business interruption, loss of business information, or any other pecuniary loss) arising out of the use of, or inability to use, this Microsoft product, even if Microsoft has been advised of the possibility of such damages. Because some states/jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. ============================================================================== Si vous avez acquis votre produit Microsoft au CANADA, la garantie limite'e suivante vous concerne: ------------------------------------------------------------------------------ GARANTIE LIMITE'E EXCLUSION DE GARANTIES. Microsoft exclut expresse'ment toute garantie relativement au PRODUIT LOGICIEL. DANS TOUTE LA MESURE PERMISE PAR LA LE'GISLATION APPLICABLE, LE PRODUIT LOGICIEL ET TOUTE AUTRE DOCUMENTATION S'Y RAPPORTANT SONT FOURNIS " TELS QUELS " SANS AUCUNE GARANTIE OU CONDITION QUELLE QU'ELLE SOIT, EXPRESSE OU IMPLICITE, LE'GALE OU CONVENTIONNELLE, E'CRITE OU VERBALE, Y COMPRIS, SANS LIMITATION, LES GARANTIES LE'GALES OU CONDITIONS DE QUALITE' MARCHANDE, D'APTITUDE `A UN USAGE PARTICULIER, OU D'ABSENCE DE CONTREFACON. VOUS ASSUMEZ TOUS LES RISQUES DE'COULANT DE L'UTILISATION ET DE LA PERFORMANCE DU PRODUIT LOGICIEL. RESPONSABILITE' LIMITE'E. La seule obligation de Microsoft et votre recours exclusif concernant ce contrat n'exc`ederont pas cinq dollars (US$5.00). ABSENCE DE RESPONSABILITE' POUR LES DOMMAGES. Microsoft ou ses fournisseurs ne pourront e^tre tenus responsables en aucune circonstance de tout dommage quel qu'il soit (y compris mais non de facon limitative les dommages directs ou indirects cause's par la perte de be'ne'fices commerciaux, l'interruption des affaires, la perte d'information commerciale ou toute autre perte pe'cuniaire) re'sultant de l'utilisation ou de l'impossibilite' d'utilisation de ce produit, et ce, me^me si la socie'te' Microsoft a e'te' avise'e de l'e'ventualite' de tels dommages. Certains e'tats/juridictions ne permettent pas l'exclusion ou la limitation de responsabilite' relative aux dommages indirects ou conse'cutifs, et la limitation ci-dessus peut ne pas s'appliquer `a votre e'gard. La pre'sente Convention est re'gie par les lois de la province d'Ontario, Canada. Chacune des parties `a la Convention reconnai^t irre'vocablement la compe'tence des tribunaux de la province d'Ontario et consent `a instituer tout litige qui pourrait de'couler de la Convention aupr`es des tribunaux situe's dans le district judiciaire de York, province d'Ontario. Au cas o`u vous auriez des questions concernant cette licence ou que vous de'siriez vous mettre en rapport avec Microsoft pour quelque raison que ce soit, veuillez contacter la succursale Microsoft desservant votre pays, dont l'adresse est fournie dans ce produit, ou e'crire `a: Microsoft Corporation, Research, One Microsoft Way, Redmond, Washington 98052-6399. ==============================================================================