Skip to content

Commit 68510bc

Browse files
author
devseed
committed
prepare for x64
1 parent 6a5c6fd commit 68510bc

4 files changed

Lines changed: 109 additions & 28 deletions

File tree

‎src/memdll/Makefile‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,15 @@ libwinpe: libwinpe.c
6464
rm -rf $(PREFIX)/*.exp
6565

6666
win_injectmemdll_shellcodestub: win_injectmemdll.c libwinpe
67-
python $@.py $< $(PREFIX)/libwinpe$(ARCH_POSTFIX)$(DLL_EXT) $(PREFIX)/_$<
67+
python $@.py $< \
68+
$(PREFIX)/libwinpe$(ARCH_POSTFIX)$(DLL_EXT)\
69+
$(PREFIX)/_$(ARCH_POSTFIX)$<
6870

6971
win_injectmemdll: win_injectmemdll_shellcodestub libwinpe
7072
@echo \#\#building $@ ...
71-
$(CC) $(PREFIX)/_$@.c -o $(PREFIX)/$@$(ARCH_POSTFIX)$(EXE_EXT)\
73+
$(CC) $(PREFIX)/_$(ARCH_POSTFIX)$@.c \
74+
-o $(PREFIX)/$@$(ARCH_POSTFIX)$(EXE_EXT)\
7275
-llibwinpe$(ARCH_POSTFIX) \
7376
$(CFLAGS) $(LDFLAGS) $(INCS) $(LIBS) $(LIBDIRS)
74-
rm -rf $(PREFIX)/_$<
7577

7678
.PHONY: all clean prepare libwinpe win_injectmemdll

‎src/memdll/win_injectmemdll.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
a tool to attach a dll inside a pe file
3-
v0.1, developed by devseed
3+
v0.2, developed by devseed
44
*/
55

66
#include <stdio.h>
@@ -135,7 +135,7 @@ int main(int argc, char *argv[])
135135
if(argc < 3)
136136
{
137137
printf("usage: win_injectmemdll exepath dllpath [outpath]\n");
138-
printf("v0.1, developed by devseed\n");
138+
printf("v0.2, developed by devseed\n");
139139
return 0;
140140
}
141141

‎src/memdll/win_injectmemdll_shellcodestub.py‎

Lines changed: 54 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,56 @@ def gen_oepshellcode32():
6060

6161
def gen_oepshellcode64():
6262
ks = Ks(KS_ARCH_X86, KS_MODE_64)
63+
code_str = f"""
64+
// for relative address, get the base of addr
65+
call geteip;
66+
lea rbx, [rax-5];
67+
push rcx;
68+
push rdx;
69+
push r8;
70+
push r9;
71+
72+
// bind iat
73+
lea r8, [rbx + exegetprocessaddress];
74+
mov r8, [r8]; // iat
75+
mov r8, [r8]; // iat->addr
76+
lea rdx, [rbx + exeloadlibrarya];
77+
mov rdx, [rdx]; // iat
78+
mov rdx, [rdx]; // iat->addr
79+
lea rcx, [rbx + dllbase]; // dllbase addr
80+
mov rcx, [rcx]; // dllbase value
81+
call [rbx + memiatbind];
82+
83+
// call dll oep, for dll entry
84+
xor r8, r8; // lpvReserved
85+
xor rdx, rdx;
86+
inc rdx; // fdwReason, DLL_PROCESS_ATTACH
87+
lea rcx, [rbx + dllbase];
88+
mov rcx, [rcx]; // hinstDLL
89+
call [rbx+dlloepva];
90+
91+
// jmp to origin oep
92+
pop r9;
93+
pop r8;
94+
pop rdx;
95+
pop rcx;
96+
jmp [rbx+exeoepva];
97+
98+
geteip:
99+
mov rax, [rsp]
100+
ret
101+
102+
exeoepva: nop;nop;nop;nop;nop;nop;nop;nop;
103+
dllbase: nop;nop;nop;nop;nop;nop;nop;nop;
104+
dlloepva: nop;nop;nop;nop;nop;nop;nop;nop;
105+
memiatbind: nop;nop;nop;nop;nop;nop;nop;nop;
106+
exeloadlibrarya: nop;nop;nop;nop;nop;nop;nop;nop;
107+
exegetprocessaddress: nop;nop;nop;nop;nop;nop;nop;nop;
108+
"""
109+
print("gen_oepshellcode64", code_str)
110+
payload, _ = ks.asm(code_str)
111+
print("payload: ", [hex(x) for x in payload])
112+
return payload
63113
pass
64114

65115
def inject_shellcodestubs(srcpath, libwinpepath, targetpath):
@@ -71,7 +121,7 @@ def inject_shellcodestubs(srcpath, libwinpepath, targetpath):
71121
memiatshellcode = \
72122
pedll.get_content_from_virtual_address(
73123
memiatfunc.address, 0x200)
74-
memiatshellcode = memiatshellcode[:memiatshellcode.index(0xC3)+1] # retn
124+
# memiatshellcode = memiatshellcode[:memiatshellcode.index(0xC3)+1] # retn
75125

76126
if pedll_oph.magic == lief.PE.PE_TYPE.PE32_PLUS:
77127
oepshellcode = gen_oepshellcode64()
@@ -98,7 +148,7 @@ def inject_shellcodestubs(srcpath, libwinpepath, targetpath):
98148

99149
def debug():
100150
inject_shellcodestubs("win_injectmemdll.c",
101-
"./bin/libwinpe32.dll",
151+
"./bin/libwinpe64.dll",
102152
"./bin/_win_injectmemdll.c")
103153
pass
104154

@@ -111,6 +161,6 @@ def main():
111161
pass
112162

113163
if __name__ == "__main__":
114-
debug()
115-
#main()
164+
#debug()
165+
main()
116166
pass

‎util/include/winpe.h‎

Lines changed: 48 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -333,18 +333,34 @@ size_t winpe_membindiat(void *mempe,
333333
&& pOftThunk[j].u1.Function; j++)
334334
{
335335
PROC addr = NULL;
336-
if((pOftThunk[j].u1.Ordinal >>31) != 0x1) // use name
337-
{
338-
pFuncName=(PIMAGE_IMPORT_BY_NAME)(mempe +
339-
pOftThunk[j].u1.AddressOfData);
340-
addr = pfnGetProcAddress(hmod, pFuncName->Name);
341-
342-
}
343-
else // use ordinal
344-
{
345-
addr =GetProcAddress(hmod,
346-
(LPCSTR)(pOftThunk[j].u1.Ordinal & 0x0000ffff));
347-
}
336+
if(sizeof(size_t) > 4) // x64
337+
{
338+
if((pOftThunk[j].u1.Ordinal >> 63) != 0x1) // use name
339+
{
340+
pFuncName=(PIMAGE_IMPORT_BY_NAME)(mempe +
341+
pOftThunk[j].u1.AddressOfData);
342+
addr = pfnGetProcAddress(hmod, pFuncName->Name);
343+
}
344+
else // use ordinal
345+
{
346+
addr =pfnGetProcAddress(hmod,
347+
(LPCSTR)(pOftThunk[j].u1.Ordinal & 0x000000000000ffff));
348+
}
349+
}
350+
else // x86
351+
{
352+
if((pOftThunk[j].u1.Ordinal >>31) != 0x1) // use name
353+
{
354+
pFuncName=(PIMAGE_IMPORT_BY_NAME)(mempe +
355+
pOftThunk[j].u1.AddressOfData);
356+
addr = pfnGetProcAddress(hmod, pFuncName->Name);
357+
}
358+
else // use ordinal
359+
{
360+
addr =pfnGetProcAddress(hmod,
361+
(LPCSTR)(pOftThunk[j].u1.Ordinal & 0x0000ffff));
362+
}
363+
}
348364
if(!addr) return 0;
349365
pFtThunk[j].u1.Function = (size_t)addr;
350366
iat_count++;
@@ -385,13 +401,26 @@ size_t winpe_memfindiat(void *mempe,
385401
for (int j=0; pFtThunk[j].u1.Function
386402
&& pOftThunk[j].u1.Function; j++)
387403
{
388-
if((pOftThunk[j].u1.Ordinal >>31) != 0x1) // use name
389-
{
390-
pFuncName=(PIMAGE_IMPORT_BY_NAME)(mempe +
391-
pOftThunk[j].u1.AddressOfData);
392-
if(_stricmp(pFuncName->Name, funcname)==0)
393-
return (size_t)&pFtThunk[j] - (size_t)mempe;
394-
}
404+
if(sizeof(size_t) > 4) // x64
405+
{
406+
if((pOftThunk[j].u1.Ordinal >>63) != 0x1) // use name
407+
{
408+
pFuncName=(PIMAGE_IMPORT_BY_NAME)(mempe +
409+
pOftThunk[j].u1.AddressOfData);
410+
if(_stricmp(pFuncName->Name, funcname)==0)
411+
return (size_t)&pFtThunk[j] - (size_t)mempe;
412+
}
413+
}
414+
else // x86
415+
{
416+
if((pOftThunk[j].u1.Ordinal >>31) != 0x1) // use name
417+
{
418+
pFuncName=(PIMAGE_IMPORT_BY_NAME)(mempe +
419+
pOftThunk[j].u1.AddressOfData);
420+
if(_stricmp(pFuncName->Name, funcname)==0)
421+
return (size_t)&pFtThunk[j] - (size_t)mempe;
422+
}
423+
}
395424
}
396425
}
397426
return 0;

0 commit comments

Comments
 (0)