Comments (13)
Hi, would like to give this enhancement a shot.
To be on the same page:
- i guess this targets especially window console apps ?
- i see 2 ways:
- either patching the file, by using some kind of resource editor ... ofc the file signature will be broken so windows UAC might not like this
- installing a hook that loads does a LoadLibrary(user32.dll) in the process space
Integration with fluffi might come a bit later once i have POC :)
from fluffi.
Hey,
thank you for your help!
A little information about the background of this task: What we basically need this for is running Windows service binaries in dynamorio. There are two ways to do so: 1) Start the target with drrun 2) use the AppInit_DLLs method.
In certain scenarios we need to use AppInit_DLLs. This method, however only works if the target process loads the user32.dll at its very startup.
And here comes the problem: Some Windows binaries (mostly Windows services, but also others) do not do so. They are not using any of user32.dll's functionaliry and therefore do not load it.
To overcome this, we need to change the binaries in a way that they statically load the user32.dll. Breaking the binaries signature is fine at this point, as our test systems don't check it anyways.
Injecting the user32.dll into the process once it is loaded won't work in our scenario, as it would be too late in the process (dynamorio wont work).
So my idea was to write a little program / script that parses the Import Directory Table (IDT), and the Import Address Table (IAT), and adds an entry for the user32.dll (preferably at the beginning, so it is loaded first).
If you are going to write this script please:
- Use python 3 or c/c++ (I would prefer the latter, as the Windows API comes with all the code to parse PE headers)
- Try coding it without adding a dependency to a third party library (if possible) - we already have tons of dependencies
- Support x64 and x86
Alternatively, you could also look for a freeware / opensource tool that does the job for us, and write a tutorial about it ;)
from fluffi.
Thanks for the overview, i prefer also c++ :), also i've done something similar before (processing the PE file and changing some stuff there) so i have a bit of experience in this area !
from fluffi.
Should i try to import all exported functions from user32.dll? ¯_(ツ)_/¯ ... there are quite a lot !
from fluffi.
As I understand the AppInit_DLL technique, one (any) should be enough.
from fluffi.
It looks like InitializeLpkHooks needs to be exported. However LoadappInitDll is in other dll
However it looks like before calling this user32.dll (ClientThreadSetup) set ups some stuff, and those function calls might not work from the context of a windows service, as a service normally does not have a "desktop" so this means further code is necessary in order to aquire those handles when running from a service.
Will try to do a test to see if this work !
from fluffi.
Ok, so this is the solution i ended up with.
All in all it has a dependency on PE Bliss lib (https://github.com/BackupGGCode/portable-executable-library)
I decided to use it because it can be linked statically, there should not be any license problems, it can be included easily in any project as static project (so it shouldn't be needed to be downloaded on build like the other dependencies')
If needed i can continue also on my little tool to inject the dll, basically its needed to copy the import directory section to a new section and there also add the injected dll ... but i don't see any advantage having it over PE Bliss (basically this is how i found Pe Bliss as i was thinking on making a nice PE image class with all the objects and then stumble upon this lib 🥇 )
from fluffi.
does this work for both x86 an x64?
from fluffi.
yes it should ... i tested only on 32 with my service, but i can make a quick test also on 64 just need to rebuild my service again :))
from fluffi.
yes that, would be great :) Your solution looks quite neat btw.
Correct me if I'm wrong: What you do is
- Read the Import Section
- Add a new import to it
- Create a new section
- Write the modified Import Section to the new section
- Overwrite the PE's pointer for Import Section to point to the new section
Is that correct?
from fluffi.
y, that kind of sums it up ...
from fluffi.
Y its ok 👍
from fluffi.
great work! I will integrate this into FLUFFI master as soon as I can spare some time :)
from fluffi.
Related Issues (20)
- Implement noCov runner
- Preselet Architecture in Managed Instances view
- Fuzzcmp: Identify and patch inlined compare function HOT 1
- Remove option "Add target files to Fuzzjob" (make it what always happens) HOT 1
- Show IP address of system in system overview HOT 1
- Fuzzcmp: Add ability to patch statically linked compare functions
- Fuzzcmp: Add support for common compare functions HOT 1
- FUN setup: Some required external binaries are no longer available HOT 2
- openssl dependency build runs out of memory
- Switch to newer powershell update package
- Web: Cannot configure number of LocalManagers HOT 1
- Web: improve pagination for lm logs
- Race condition when generating agent nice names
- Rsync to ramdisk seems too eager when Linux worker node restarts
- DashSync Issues HOT 1
- Address django CVE alert HOT 2
- Running no. of Local Managers are not consistent HOT 1
- Compilation fails after dynamorio update
- Default Siemens security policy
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fluffi.