Skip to content

Commit bf022c6

Browse files
author
devseed
committed
v0.3.3, add support for aslr
1 parent 1c171b4 commit bf022c6

5 files changed

Lines changed: 148 additions & 76 deletions

File tree

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
A tool to parse and load module in memory, as well as attach a DLL in EXE.
33
Most of the functions are inline, so that it can also be used in shellcode.
44

5-
This project is tested on `windows xp `, `windows 7`, `windows 10`, `windows 11`,
6-
also the attached exe file packed by upx is tested.
5+
This project is tested on `windows xp `, `windows 7`, `windows 10`, `windows 11`, `linux wine`
6+
also the attached exe file packed by `upx` is tested.
77

88
## compile
99

@@ -138,4 +138,4 @@ See `winpe.h` for parsing and loading PE structure in detail.
138138
## todo
139139
140140
* ~~TLS initialize support~~ finished, but not tested, because I didn't find DLL with TLS example.
141-
* support ASLR
141+
* ~~support ASLR~~ finished

‎src/memdll/libwinpe.def‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,16 @@ EXPORTS
44
winpe_findkernel32
55
winpe_findloadlibrarya
66
winpe_findspace
7+
winpe_findmodulea
78
winpe_imagebaseval
9+
winpe_imagesizeval
810
winpe_memFreeLibrary
911
winpe_memFreeLibraryEx
1012
winpe_memGetProcAddress
1113
winpe_memLoadLibrary
1214
winpe_memLoadLibraryEx
1315
winpe_membindiat
16+
winpe_membindtls
1417
winpe_memfindexp
1518
winpe_memfindiat
1619
winpe_memforwardexp

‎src/memdll/win_injectmemdll.c‎

Lines changed: 32 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
A tool to attach a dll inside a pe file
3-
v0.3.2, developed by devseed
3+
v0.3.3, developed by devseed
44
55
history:
66
see win_injectmemdll_shellcodestub.py
@@ -26,8 +26,8 @@ unsigned char g_findloadlibrarya_code[] = {0x90};
2626
unsigned char g_findgetprocaddress_code[] = {0x90};
2727

2828
void _makeoepcode(void *shellcode,
29-
size_t shellcodebase, size_t exeimagebase, size_t dllimagebase,
30-
DWORD exeoeprva, DWORD dlloeprva)
29+
size_t shellcoderva, size_t dllrva,
30+
DWORD orgexeoeprva, DWORD orgdlloeprva)
3131
{
3232
// bind the pointer to buffer
3333
size_t oepinit_end = sizeof(g_oepinit_code);
@@ -38,22 +38,22 @@ void _makeoepcode(void *shellcode,
3838
size_t findgetprocaddress_start = findloadlibrarya_start + FUNC_SIZE;
3939

4040
// fill the address table
41-
size_t *pexeoepva = (size_t*)(g_oepinit_code + oepinit_end - 8*sizeof(size_t));
42-
size_t *pdllbase = (size_t*)(g_oepinit_code + oepinit_end - 7*sizeof(size_t));
43-
size_t *pdlloepva = (size_t*)(g_oepinit_code + oepinit_end - 6*sizeof(size_t));
44-
size_t *pmemreloc = (size_t*)(g_oepinit_code + oepinit_end - 5*sizeof(size_t));
45-
size_t *pmembindiat = (size_t*)(g_oepinit_code + oepinit_end - 4*sizeof(size_t));
46-
size_t *pmembindtls = (size_t*)(g_oepinit_code + oepinit_end - 3*sizeof(size_t));
41+
size_t *pexeoeprva = (size_t*)(g_oepinit_code + oepinit_end - 8*sizeof(size_t));
42+
size_t *pdllbrva = (size_t*)(g_oepinit_code + oepinit_end - 7*sizeof(size_t));
43+
size_t *pdlloeprva = (size_t*)(g_oepinit_code + oepinit_end - 6*sizeof(size_t));
44+
size_t *pmemrelocrva = (size_t*)(g_oepinit_code + oepinit_end - 5*sizeof(size_t));
45+
size_t *pmembindiatrva = (size_t*)(g_oepinit_code + oepinit_end - 4*sizeof(size_t));
46+
size_t *pmembindtlsrva = (size_t*)(g_oepinit_code + oepinit_end - 3*sizeof(size_t));
4747
size_t *pfindloadlibrarya = (size_t*)(g_oepinit_code + oepinit_end - 2*sizeof(size_t));
4848
size_t *pfindgetprocaddress = (size_t*)(g_oepinit_code + oepinit_end - 1*sizeof(size_t));
49-
*pexeoepva = exeimagebase + exeoeprva;
50-
*pdllbase = dllimagebase;
51-
*pdlloepva = dllimagebase + dlloeprva;
52-
*pmemreloc = shellcodebase + memreloc_start;
53-
*pmembindiat = shellcodebase + membindiat_start;
54-
*pmembindtls = shellcodebase + membindtls_start;
55-
*pfindloadlibrarya = shellcodebase + findloadlibrarya_start;
56-
*pfindgetprocaddress = shellcodebase + findgetprocaddress_start;
49+
*pexeoeprva = orgexeoeprva;
50+
*pdllbrva = dllrva;
51+
*pdlloeprva = dllrva + orgdlloeprva;
52+
*pmemrelocrva = shellcoderva + memreloc_start;
53+
*pmembindiatrva = shellcoderva + membindiat_start;
54+
*pmembindtlsrva = shellcoderva + membindtls_start;
55+
*pfindloadlibrarya = shellcoderva + findloadlibrarya_start;
56+
*pfindgetprocaddress = shellcoderva + findgetprocaddress_start;
5757

5858
// copy to the target
5959
memcpy(shellcode ,
@@ -109,7 +109,6 @@ int injectdll_mem(const char *exepath,
109109
((void*)mempe + pDosHeader->e_lfanew);
110110
PIMAGE_FILE_HEADER pFileHeader = &pNtHeader->FileHeader;
111111
PIMAGE_OPTIONAL_HEADER pOptHeader = &pNtHeader->OptionalHeader;
112-
imgbase_exe = pOptHeader->ImageBase;
113112

114113
// append section header to exe
115114
size_t align = sizeof(size_t) > 4 ? 0x10000: 0x1000;
@@ -123,14 +122,13 @@ int injectdll_mem(const char *exepath,
123122
winpe_appendsecth(mempe_exe, &secth);
124123

125124
// adjust dll addr and append shellcode, iatbind is in runing
126-
size_t shellcodebase = imgbase_exe + secth.VirtualAddress;
127-
size_t dllimagebase = shellcodebase + SHELLCODE_SIZE + padding;
128-
size_t exeimagebase = winpe_imagebaseval(mempe_exe, 0);
129-
DWORD dlloeprva = winpe_oepval(mempe_dll, 0);
130-
DWORD exeoeprva = winpe_oepval(mempe_exe, secth.VirtualAddress);
131-
_makeoepcode(shellcode, shellcodebase,
132-
exeimagebase, dllimagebase, exeoeprva, dlloeprva);
133-
winpe_memreloc(mempe_dll, dllimagebase);
125+
size_t shellcoderva = secth.VirtualAddress;
126+
size_t dllrva = shellcoderva + SHELLCODE_SIZE + padding;
127+
DWORD orgdlloeprva = winpe_oepval(mempe_dll, 0); // origin orgdlloeprva
128+
DWORD orgexeoeprva = winpe_oepval(mempe_exe, secth.VirtualAddress);
129+
_makeoepcode(shellcode, shellcoderva, dllrva, orgexeoeprva, orgdlloeprva);
130+
// reloc while runing
131+
// winpe_memreloc(mempe_dll, dllrva);
134132

135133
// write data to new exe
136134
FILE *fp = fopen(outpath, "wb");
@@ -161,8 +159,14 @@ void test_getfunc(HMODULE hmod, const char *funcname)
161159

162160
void test_exp()
163161
{
164-
// test loadlibrary, getprocaddress
165162
HMODULE hmod = NULL, hmod2 = NULL, hmod3 = NULL;
163+
// test winpe_findmodulea
164+
hmod = GetModuleHandleA(NULL);
165+
hmod2 = winpe_findmodulea(NULL);
166+
assert(hmod!=NULL && hmod==hmod2);
167+
printf("winpe_findmodulea(NULL) %p passed!\n", hmod2);
168+
169+
// test loadlibrary, getprocaddress
166170
hmod = LoadLibraryA("kernel32.dll");
167171
hmod2 = winpe_findkernel32();
168172
hmod3 = winpe_findmodulea("kernel32.dll");
@@ -208,7 +212,7 @@ int main(int argc, char *argv[])
208212
if(argc < 3)
209213
{
210214
printf("usage: win_injectmemdll exepath dllpath [outpath]\n");
211-
printf("v0.3.2, developed by devseed\n");
215+
printf("v0.3.3, developed by devseed\n");
212216
return 0;
213217
}
214218
char outpath[MAX_PATH];

‎src/memdll/win_injectmemdll_shellcodestub.py‎

Lines changed: 109 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
"""
22
this file is for automaticly generate some shellcodes stub informations
3-
v0.3.2, developed by devseed
3+
v0.3.3, developed by devseed
44
"""
55
import re
66
import sys
@@ -11,51 +11,85 @@ def gen_oepinit_code32():
1111
ks = Ks(KS_ARCH_X86, KS_MODE_32)
1212
code_str = f"""
1313
// for relative address, get the base of addr
14-
call geteip;
14+
call getip;
1515
lea ebx, [eax-5];
1616
17+
// get the imagebase
18+
mov eax, 0x30; // to avoid relative addressing
19+
mov edi, dword ptr fs:[eax]; //peb
20+
mov edi, [edi + 0ch]; //ldr
21+
mov edi, [edi + 14h]; //InMemoryOrderLoadList, this
22+
mov edi, [edi -8h + 18h]; //this.DllBase
23+
1724
// get loadlibrarya, getprocaddress
18-
call [ebx + findloadlibrarya];
25+
mov eax, [ebx + findloadlibrarya];
26+
add eax, edi;
27+
call eax;
1928
mov [ebx + findloadlibrarya], eax;
20-
call [ebx + findgetprocaddress];
29+
mov eax, [ebx + findgetprocaddress];
30+
add eax, edi;
31+
call eax;
2132
mov [ebx + findgetprocaddress], eax;
2233
34+
// reloc
35+
mov eax, [ebx + dllrva];
36+
add eax, edi;
37+
push eax;
38+
push eax;
39+
mov eax, [ebx + memrelocrva];
40+
add eax, edi;
41+
call eax;
42+
2343
// bind iat
24-
push [ebx + findgetprocaddress]; // arg3, getprocaddress
25-
push [ebx + findloadlibrarya]; // arg2, loadlibraryas
26-
push [ebx + dllbase]; // arg1, dllbase value
27-
call [ebx + membindiat];
28-
add esp, 0xc;
44+
mov eax, [ebx + findgetprocaddress];
45+
push eax; // arg3, getprocaddress
46+
mov eax, [ebx + findloadlibrarya];
47+
push eax; // arg2, loadlibraryas
48+
mov eax, [ebx + dllrva];
49+
add eax, edi;
50+
push eax; // arg1, dllbase value
51+
mov eax, [ebx + membindiatrva];
52+
add eax, edi
53+
call eax;
2954
3055
// bind tls
31-
xor edx, edx;
32-
inc edx; // arg2, reason for tls
33-
push edx;
34-
push [ebx + dllbase] // arg1, dllbase
35-
call [ebx + membindtls]
36-
add esp, 0x8;
37-
56+
xor eax, eax;
57+
inc eax;
58+
push eax; // arg2, reason for tls
59+
mov eax, [ebx + dllrva]
60+
add eax, edi;
61+
push eax; // arg1, dllbase
62+
mov eax, [ebx + membindtlsrva];
63+
add eax, edi;
64+
call eax;
65+
3866
// call dll oep, for dll entry
3967
xor eax, eax;
4068
push eax; // lpvReserved
41-
inc eax;
69+
inc eax;
4270
push eax; // fdwReason, DLL_PROCESS_ATTACH
43-
push [ebx + dllbase]; // hinstDLL
44-
call [ebx+dlloepva];
71+
mov eax, [ebx + dllrva];
72+
add eax, edi;
73+
push eax; // hinstDLL
74+
mov eax, [ebx + dlloeprva];
75+
add eax, edi;
76+
call eax;
4577
4678
// jmp to origin oep
47-
jmp [ebx+exeoepva];
79+
mov eax, [ebx+exeoeprva];
80+
add eax, edi;
81+
jmp eax;
4882
49-
geteip:
83+
getip:
5084
mov eax, [esp]
5185
ret
5286
53-
exeoepva: nop;nop;nop;nop;
54-
dllbase: nop;nop;nop;nop;
55-
dlloepva: nop;nop;nop;nop;
56-
memreloc: nop;nop;nop;nop;
57-
membindiat: nop;nop;nop;nop;
58-
membindtls: nop;nop;nop;nop;
87+
exeoeprva: nop;nop;nop;nop;
88+
dllrva: nop;nop;nop;nop;
89+
dlloeprva: nop;nop;nop;nop;
90+
memrelocrva: nop;nop;nop;nop;
91+
membindiatrva: nop;nop;nop;nop;
92+
membindtlsrva: nop;nop;nop;nop;
5993
findloadlibrarya: nop;nop;nop;nop;
6094
findgetprocaddress: nop;nop;nop;nop;
6195
"""
@@ -68,57 +102,87 @@ def gen_oepinit_code64():
68102
ks = Ks(KS_ARCH_X86, KS_MODE_64)
69103
code_str = f"""
70104
// for relative address, get the base of addr
71-
call geteip;
105+
call getip;
72106
lea rbx, [rax-5];
73107
push rcx;
74108
push rdx;
75109
push r8;
76110
push r9;
77111
sub rsp, 0x28; // this is for memory 0x10 align
78112
113+
// get the imagebase
114+
mov rax, 0x60; // to avoid relative addressing
115+
mov rdi, qword ptr gs:[rax]; //peb
116+
mov rdi, [rdi + 18h]; //ldr
117+
mov rdi, [rdi + 20h]; //InMemoryOrderLoadList, this
118+
mov rdi, [rdi -10h + 30h]; //this.DllBase
119+
79120
// get loadlibrarya, getprocaddress
80-
call [rbx + findloadlibrarya];
121+
mov rax, [rbx + findloadlibrarya];
122+
add rax, rdi;
123+
call rax;
81124
mov [rbx + findloadlibrarya], rax;
82-
call [rbx + findgetprocaddress];
125+
mov rax, [rbx + findgetprocaddress];
126+
add rax, rdi;
127+
call rax;
83128
mov [rbx + findgetprocaddress], rax;
84129
130+
// reloc
131+
mov rcx, [rbx + dllrva];
132+
add rcx, rdi;
133+
mov rdx, rcx;
134+
mov rax, [rbx + memrelocrva];
135+
add rax, rdi;
136+
call rax;
137+
85138
// bind iat
86139
mov r8, [rbx + findgetprocaddress]; // arg3, getprocaddress
87140
mov rdx, [rbx + findloadlibrarya]; // arg2, loadlibraryas
88-
mov rcx, [rbx + dllbase]; // arg1, dllbase value
89-
call [rbx + membindiat];
141+
mov rcx, [rbx + dllrva];
142+
add rcx, rdi; // arg1, dllbase value
143+
mov rax, [rbx + membindiatrva];
144+
add rax, rdi
145+
call rax;
90146
91147
// bind tls
92148
xor rdx, rdx;
93149
inc rdx; // argc, reason for tls
94-
mov rcx, [rbx + dllbase] // arg1, dllbase
95-
call [rbx + membindtls]
150+
mov rcx, [rbx + dllrva]
151+
add rcx, rdi; // arg1, dllbase
152+
mov rax, [rbx + membindtlsrva];
153+
add rax, rdi;
154+
call rax;
96155
97156
// call dll oep, for dll entry
98157
xor r8, r8; // lpvReserved
99158
xor rdx, rdx;
100159
inc rdx; // fdwReason, DLL_PROCESS_ATTACH
101-
mov rcx, [rbx + dllbase]; // hinstDLL
102-
call [rbx+dlloepva];
160+
mov rcx, [rbx + dllrva];
161+
add rcx, rdi; // hinstDLL
162+
mov rax, [rbx + dlloeprva];
163+
add rax, rdi;
164+
call rax;
103165
104166
// jmp to origin oep
105167
add rsp, 0x28;
106168
pop r9;
107169
pop r8;
108170
pop rdx;
109171
pop rcx;
110-
jmp [rbx+exeoepva];
172+
mov rax, [rbx+exeoeprva];
173+
add rax, rdi;
174+
jmp rax;
111175
112-
geteip:
176+
getip:
113177
mov rax, [rsp]
114178
ret
115179
116-
exeoepva: nop;nop;nop;nop;nop;nop;nop;nop;
117-
dllbase: nop;nop;nop;nop;nop;nop;nop;nop;
118-
dlloepva: nop;nop;nop;nop;nop;nop;nop;nop;
119-
memreloc: nop;nop;nop;nop;nop;nop;nop;nop;
120-
membindiat: nop;nop;nop;nop;nop;nop;nop;nop;
121-
membindtls: nop;nop;nop;nop;nop;nop;nop;nop;
180+
exeoeprva: nop;nop;nop;nop;nop;nop;nop;nop;
181+
dllrva: nop;nop;nop;nop;nop;nop;nop;nop;
182+
dlloeprva: nop;nop;nop;nop;nop;nop;nop;nop;
183+
memrelocrva: nop;nop;nop;nop;nop;nop;nop;nop;
184+
membindiatrva: nop;nop;nop;nop;nop;nop;nop;nop;
185+
membindtlsrva: nop;nop;nop;nop;nop;nop;nop;nop;
122186
findloadlibrarya: nop;nop;nop;nop;nop;nop;nop;nop;
123187
findgetprocaddress: nop;nop;nop;nop;nop;nop;nop;nop;
124188
"""
@@ -194,4 +258,5 @@ def main():
194258
v0.3, x86 and x64 no need to use exe's LoadLibraryA
195259
v0.3.1, fix x64 attach dll crash by align stack with 0x10
196260
v0.3.2, add support for ordinal iat and tls
261+
v0.3.3, add support for aslr
197262
"""

‎util‎

Submodule util updated from 9960529 to c51dea9

0 commit comments

Comments
 (0)