metasploit-framework/lib/metasm/samples/peldr.rb

#    This file is part of Metasm, the Ruby assembly manipulation suite
#    Copyright (C) 2006-2009 Yoann GUILLOT
#
#    Licence is LGPL, see LICENCE in the top-level directory

#
# Map a PE file under another OS using DynLdr, API imports are redirected to ruby callback for emulation
#

require 'metasm'

class PeLdr
	attr_accessor :pe, :load_address
	DL = Metasm::DynLdr

	# load a PE file, setup basic IAT hooks (raises "unhandled lib!import")
	def initialize(file, hooktype=:iat)
		if file.kind_of? Metasm::PE
			@pe = file
		elsif file[0, 2] == 'MZ' and file.length > 0x3c
			@pe = Metasm::PE.decode(file)
		else	# filename
			@pe = Metasm::PE.decode_file(file)
		end
		@load_address = DL.memory_alloc(@pe.optheader.image_size)
		raise 'malloc' if @load_address == 0xffff_ffff
		
		puts "map sections" if $DEBUG
		DL.memory_write(@load_address, @pe.encoded.data[0, @pe.optheader.headers_size].to_str)
		@pe.sections.each { |s|
			DL.memory_write(@load_address+s.virtaddr, s.encoded.data.to_str)
		}
		
		puts "fixup sections" if $DEBUG
		off = @load_address - @pe.optheader.image_base
		@pe.relocations.to_a.each { |rt|
			base = rt.base_addr
			rt.relocs.each { |r|
				if r.type == 'HIGHLOW'
					ptr = @load_address + base + r.offset
					old = DL.memory_read(ptr, 4).unpack('V').first
					DL.memory_write_int(ptr, old + off)
				end
			}
		}

		@iat_cb = {}
		@eat_cb = {}
		case hooktype
		when :iat
			puts "hook IAT" if $DEBUG
			@pe.imports.to_a.each { |id|
				ptr = @load_address + id.iat_p
				id.imports.each { |i|
					n = "#{id.libname}!#{i.name}"
					cb = DL.callback_alloc_c('void x(void)') { raise "unemulated import #{n}" }
					DL.memory_write_int(ptr, cb)
					@iat_cb[n] = cb
					ptr += 4
				}
			}
		when :eat, :exports
			puts "hook EAT" if $DEBUG
			ptr = @load_address + @pe.export.func_p
			@pe.export.exports.each { |e|
				n = e.name || e.ordinal
				cb = DL.callback_alloc_c('void x(void)') { raise "unemulated export #{n}" }
				DL.memory_write_int(ptr, cb - @load_address)	# RVA
				@eat_cb[n] = cb
				ptr += 4
			}
		end
	end

	# reset original expected memory protections for the sections
	# the IAT may reside in a readonly section, so call this only after all hook_imports
	def reprotect_sections
		@pe.sections.each { |s|
			p = ''
			p << 'r' if s.characteristics.include? 'MEM_READ'
			p << 'w' if s.characteristics.include? 'MEM_WRITE'
			p << 'x' if s.characteristics.include? 'MEM_EXECUTE'
			DL.memory_perm(@load_address + s.virtaddr, s.virtsize, p)
		}
	end

	# add a specific hook for an IAT function
	# accepts a function pointer in proto
	# exemple: hook_import('KERNEL32.dll', 'GetProcAddress', '__stdcall int f(int, char*)') { |h, name| puts "getprocaddr #{name}" ; 0 }
	def hook_import(libname, impname, proto, &b)
		@pe.imports.to_a.each { |id|
			next if id.libname != libname
			ptr = @load_address + id.iat_p
			id.imports.each { |i|
				if i.name == impname
					DL.callback_free(@iat_cb["#{libname}!#{impname}"])
					if proto.kind_of? Integer
						cb = proto
					else
						cb = DL.callback_alloc_c(proto, &b)
						@iat_cb["#{libname}!#{impname}"] = cb
					end
					DL.memory_write_int(ptr, cb)
				end
				ptr += 4
			}
		}
	end

	# add a specific hook in the export table
	# exemple: hook_export('ExportedFunc', '__stdcall int f(int, char*)') { |i, p| blabla ; 1 }
	def hook_export(name, proto, &b)
		ptr = @load_address + @pe.export.func_p
		@pe.export.exports.each { |e|
			n = e.name || e.ordinal
			if n == name
				DL.callback_free(@eat_cb[name])
				if proto.kind_of? Integer
					cb = proto
				else
					cb = DL.callback_alloc_c(proto, &b)
					@eat_cb[name] = cb
				end
				DL.memory_write_int(ptr, cb - @load_address)	# RVA
			end
			ptr += 4
		}
	end

	# run the loaded PE entrypoint
	def run_init
		ptr = @pe.optheader.entrypoint
		if ptr != 0
			ptr += @load_address
			DL.raw_invoke(ptr, [@load_address, 1, 1], 1)
		end
	end

	# similar to DL.new_api_c for the mapped PE
	def new_api_c(proto)
		proto += ';'    # allow 'int foo()'
		cp = DL.host_cpu.new_cparser
		cp.parse(proto)
		cp.toplevel.symbol.each_value { |v|
			next if not v.kind_of? Metasm::C::Variable      # enums
			if e = pe.export.exports.find { |e_| e_.name == v.name and e_.target }
				DL.new_caller_for(cp, v, v.name.downcase, @load_address + pe.label_rva(e.target))
			end
		}

		cp.numeric_constants.each { |k, v|
			n = k.upcase
			n = "C#{n}" if n !~ /^[A-Z]/
			DL.const_set(n, v) if not DL.const_defined?(n) and v.kind_of? Integer
		}
	end

	# maps a TEB/PEB in the current process, sets the fs register to point to it
	def self.setup_teb
		@@teb = DL.memory_alloc(4096)
		@@peb = DL.memory_alloc(4096)
		populate_teb
		populate_peb
		fs = allocate_ldt_entry_teb
		DL.new_func_c('__fastcall void set_fs(int i) { asm("mov fs, ecx"); }') { DL.set_fs(fs) }
	end

	# fills a fake TEB structure
	def self.populate_teb
		DL.memory_write(@@teb, 0.chr*4096)
		set = lambda { |off, val| DL.memory_write_int(@@teb+off, val) }
		# the stack will probably never go higher than that whenever in the dll...
		set[0x4, DL.new_func_c('int get_sp(void) { asm("mov eax, esp  and eax, ~0xfff"); }') { DL.get_sp }]	# stack_base
		set[0x8, 0x10000]	# stack_limit
		set[0x18, @@teb]	# teb
		set[0x30, @@peb]	# peb
	end

	def self.populate_peb
		DL.memory_write(@@peb, 0.chr*4096)
		set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) }
	end

	def self.teb ; @@teb ; end
	def self.peb ; @@peb ; end

	# allocate an LDT entry for the teb, returns a value suitable for the fs selector
	def self.allocate_ldt_entry_teb
		entry = 1
		# ldt_entry base_addr size_in_pages
		# 32bits:1 type:2 (0=data) readonly:1 limit_in_pages:1 seg_not_present:1 usable:1
		struct = [entry, @@teb, 1, 0b1_0_1_0_00_1].pack('VVVV')
		Kernel.syscall(123, 1, DL.str_ptr(struct), struct.length)	# __NR_modify_ldt
		(entry << 3) | 7
	end

	setup_teb
end

# generate a fake PE which exports stuff found in k32/ntdll
# so that other lib may directly scan this PE with their own getprocaddr
class FakeWinAPI < PeLdr
	attr_accessor :win_version
	attr_accessor :exports

	def initialize(elist=nil)
		@exports = []
		@win_version = { :major => 5, :minor => 1, :build => 2600, :sp => 'Service pack 3', :sp_major => 3, :sp_minor => 0 }

		# if you know the exact list you need, put it there (much faster)
		if not elist
			elist = Metasm::WindowsExports::EXPORT.map { |k, v| k if v =~ /kernel32|ntdll/i }.compact
			elist |= ['free', 'malloc', 'memset', '??2@YAPAXI@Z', '_initterm', '_lock', '_unlock', '_wcslwr', '_wcsdup', '__dllonexit']
		end

		src = ".libname 'emu_winapi'\ndummy: int 3\n" + elist.map { |e| ".export #{e.inspect} dummy" }.join("\n")
		super(Metasm::PE.assemble(Metasm::Ia32.new, src).encode_string(:lib), :eat)	# put 'nil' instead of :eat if all exports are emu

		@heap = {}
		malloc = lambda { |sz| str = 0.chr*sz ; ptr = DL.str_ptr(str) ; @heap[ptr] = str ; ptr }

		lasterr = 0

		# kernel32
		hook_export('CloseHandle', '__stdcall int f(int)') { |a| 1 }
		hook_export('DuplicateHandle', '__stdcall int f(int, int, int, void*, int, int, int)') { |*a| DL.memory_write_int(a[3], a[1]) ; 1 }
		hook_export('EnterCriticalSection', '__stdcall int f(void*)') { 1 }
		hook_export('GetCurrentProcess', '__stdcall int f(void)') { -1 }
		hook_export('GetCurrentProcessId', '__stdcall int f(void)') { Process.pid }
		hook_export('GetCurrentThreadId', '__stdcall int f(void)') { Process.pid }
		hook_export('GetEnvironmentVariableW', '__stdcall int f(void*, void*, int)') { |name, resp, sz|
			next 0 if name == 0
			s = DL.memory_read_wstrz(name)
			s = s.unpack('v*').pack('C*') rescue nil
puts "GetEnv #{s.inspect}" if $VERBOSE
			v = ENV[s].to_s
			if resp and v.length*2+2 <= sz
				DL.memory_write(resp, (v.unpack('C*') << 0).pack('v*'))
				v.length*2	# 0 if not found
			else
				v.length*2+2
			end
		}
		hook_export('GetLastError', '__stdcall int f(void)') { lasterr }
		hook_export('GetProcAddress', '__stdcall int f(int, char*)') { |h, v|
			v = DL.memory_read_strz(v) if v >= 0x10000
puts "GetProcAddr #{'0x%x' % h}, #{v.inspect}" if $VERBOSE
			@eat_cb[v] or raise "unemulated getprocaddr #{v}"
		}
		hook_export('GetSystemInfo', '__stdcall void f(void*)') { |ptr|
			DL.memory_write(ptr, [0, 0x1000, 0x10000, 0x7ffeffff, 1, 1, 586, 0x10000, 0].pack('V*'))
			1
		}
		hook_export('GetSystemTimeAsFileTime', '__stdcall void f(void*)') { |ptr|
			v = ((Time.now - Time.mktime(1971, 1, 1, 0, 0, 0) + 370*365.25*24*60*60) * 1000 * 1000 * 10).to_i
			DL.memory_write(ptr, [v & 0xffffffff, (v >> 32 & 0xffffffff)].pack('VV'))
			1
		}
		hook_export('GetTickCount', '__stdcall int f(void)') { (Time.now.to_i * 1000) & 0xffff_ffff }
		hook_export('GetVersion', '__stdcall int f(void)') { (@win_version[:build] << 16) | (@win_version[:major] << 8) | @win_version[:minor]  }
		hook_export('GetVersionExA', '__stdcall int f(void*)') { |ptr|
			sz = DL.memory_read(ptr, 4).unpack('V').first
			data = [@win_version[:major], @win_version[:minor], @win_version[:build], 2, @win_version[:sp], @win_version[:sp_major], @win_version[:sp_minor]].pack('VVVVa128VV')
			DL.memory_write(ptr+4, data[0, sz-4])
			1
		}
		hook_export('HeapAlloc', '__stdcall int f(int, int, int)') { |h, f, sz| malloc[sz] }
		hook_export('HeapCreate', '__stdcall int f(int, int, int)') { 1 }
		hook_export('HeapFree', '__stdcall int f(int, int, int)') { |h, f, p| @heap.delete p ; 1 }
		hook_export('InterlockedCompareExchange', '__stdcall int f(int*, int, int)'+
			'{ asm("mov eax, [ebp+16]  mov ecx, [ebp+12]  mov edx, [ebp+8]  lock cmpxchg [edx], ecx"); }')
		hook_export('InterlockedExchange', '__stdcall int f(int*, int)'+
			'{ asm("mov eax, [ebp+12]  mov ecx, [ebp+8]  lock xchg [ecx], eax"); }')
		hook_export('InitializeCriticalSectionAndSpinCount', '__stdcall int f(int, int)') { 1 }
		hook_export('InitializeCriticalSection', '__stdcall int f(void*)') { 1 }
		hook_export('LeaveCriticalSection', '__stdcall int f(void*)') { 1 }
		hook_export('QueryPerformanceCounter', '__stdcall int f(void*)') { |ptr|
			v = (Time.now.to_f * 1000 * 1000).to_i
			DL.memory_write(ptr, [v & 0xffffffff, (v >> 32 & 0xffffffff)].pack('VV'))
			1
		}
		hook_export('SetLastError', '__stdcall int f(int)') { |i| lasterr = i ; 1 }
		hook_export('TlsAlloc', '__stdcall int f(void)') { 1 }

		# ntdll
		readustring = lambda { |p| DL.memory_read(*DL.memory_read(p, 8).unpack('vvV').values_at(2, 0)) }
		hook_export('RtlEqualUnicodeString', '__stdcall int f(void*, void*, int)') { |s1, s2, cs|
			s1 = readustring[s1]
			s2 = readustring[s2]
puts "RtlEqualUnicodeString #{s1.unpack('v*').pack('C*').inspect}, #{s2.unpack('v*').pack('C*').inspect}, #{cs}" if $VERBOSE
			if cs == 1
				s1 = s1.downcase
				s2 = s2.downcase
			end
			s1 == s2 ? 1 : 0
		}
		hook_export('MultiByteToWideChar', '__stdcall int f(int, int, void*, int, void*, int)') { |cp, fl, ip, is, op, os|
			is = DL.memory_read_strz(ip).length if is == 0xffff_ffff
			if os == 0
				is
			elsif os >= is*2	# not sure with this..
				DL.memory_write(op, DL.memory_read(ip, is).unpack('C*').pack('v*'))
				is
			else 0
			end

		}
		hook_export('LdrUnloadDll', '__stdcall int f(int)') { 0 }

		# msvcrt
		hook_export('free', 'void f(int)') { |i| @heap.delete i ; 0}
		hook_export('malloc', 'int f(int)') { |i| malloc[i] }
		hook_export('memset', 'char* f(char* p, char c, int n) { while (n--) p[n] = c; return p; }')
		hook_export('??2@YAPAXI@Z', 'int f(int)') { |i| raise 'fuuu' if i > 0x100000 ; malloc[i] } # at some point we're called with a ptr as arg, may be a peldr bug
		hook_export('__dllonexit', 'int f(int, int, int)') { |i, ii, iii| i }
		hook_export('_initterm', 'void f(void (**p)(void), void*p2) { while(p < p2) { if (*p) (**p)(); p++; } }')
		hook_export('_lock', 'void f(int)') { 0 }
		hook_export('_unlock', 'void f(int)') { 0 }
		hook_export('_wcslwr', '__int16* f(__int16* p) { int i=-1; while (p[++i]) p[i] |= 0x20; return p; }')
		hook_export('_wcsdup', 'int f(__int16* p)') { |p|
			cp = DL.memory_read_wstrz(p) + "\0\0"
			p = DL.str_ptr(cp)
			@heap[p] = cp
			p
		}
	end

	def hook_export(*a, &b)
		@exports |= [a.first]
		super(*a, &b)
	end

	# take another PeLdr and patch its IAT with functions from our @exports (eg our explicit export hooks)
	def intercept_iat(ldr)
		ldr.pe.imports.to_a.each { |id|
			id.imports.each { |i|
				next if not @exports.include? i.name or not @eat_cb[i.name]
				ldr.hook_import(id.libname, i.name, @eat_cb[i.name])
			}
		}
	end
end

if $0 == __FILE__
	dl = Metasm::DynLdr

	l = PeLdr.new('dbghelp.dll')
	#dl.memory_write(l.load_address + 0x33b10, "\x90\xcc")	# break on SymInitializeW

	puts 'dbghelp@%x' % l.load_address if $VERBOSE

	wapi = FakeWinAPI.new %w[CloseHandle DuplicateHandle EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetLastError GetProcAddress GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetVersion GetVersionExA HeapAlloc HeapCreate HeapFree InterlockedCompareExchange InterlockedExchange InitializeCriticalSectionAndSpinCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetLastError TlsAlloc RtlEqualUnicodeString MultiByteToWideChar free malloc memset ??2@YAPAXI@Z __dllonexit _initterm _lock _unlock _wcslwr _wcsdup GetModuleHandleA LoadLibraryA NtQueryObject NtQueryInformationProcess LdrUnloadDll]
	puts 'wapi@%x' % wapi.load_address if $VERBOSE
	
	wapi.hook_export('GetModuleHandleA', '__stdcall int f(char*)') { |ptr|
		s = dl.memory_read_strz(ptr) if ptr
		case s
		when /kernel32|ntdll/i; wapi.load_address
		else 0
		end
	}
	wapi.hook_export('LoadLibraryA', '__stdcall int f(char*)') { |ptr|
		s = dl.memory_read_strz(ptr)
		case s
		when /kernel32|ntdll/i; wapi.load_address
		else puts "LoadLibrary #{s.inspect}" ; 0
		end
	}
	wapi.hook_export('NtQueryObject', '__stdcall int f(int, int, void*, int, int*)') { |h, type, resp, sz, psz|
puts "NtQueryObject #{h}, #{type}, #{sz}" if $VERBOSE
		if h == 42 and type == 2 and sz >= 24
			dl.memory_write(resp, [14, 16, resp+8].pack('vvV') + "Process\0".unpack('C*').pack('v*'))
			dl.memory_write_int(psz, 24) if psz
			0
		else
			0x8000_0000
		end
	}
	wapi.hook_export('NtQueryInformationProcess', '__stdcall int f(int, int, void*, int, int*)') { |h, type, resp, sz, psz|
puts "NtQueryInformationProcess #{h}, #{type}, #{sz}" if $VERBOSE
		if h == 42 and type == 0
			# reservd peb res res ptr_to_pid
			peb = 0xdead0000
			dl.memory_write(resp, [42, peb, 0, 0, resp, 0].pack('V*'))
			dl.memory_write_int(psz, 24) if psz
			0
		else
			0x8000_0000
		end
	}
#puts wapi.exports.join(' ')	# generate arglist for FakeWinAPI.new
# TODO hook the resolv function of dbghelp to list what it checks

	wapi.intercept_iat(l)


	l.reprotect_sections

	l.new_api_c <<EOS
#define SYMOPT_CASE_INSENSITIVE         0x00000001
#define SYMOPT_UNDNAME                  0x00000002
#define SYMOPT_DEFERRED_LOADS           0x00000004
#define SYMOPT_NO_CPP                   0x00000008
#define SYMOPT_LOAD_LINES               0x00000010
#define SYMOPT_OMAP_FIND_NEAREST        0x00000020
#define SYMOPT_LOAD_ANYTHING            0x00000040
#define SYMOPT_IGNORE_CVREC             0x00000080
#define SYMOPT_NO_UNQUALIFIED_LOADS     0x00000100
#define SYMOPT_FAIL_CRITICAL_ERRORS     0x00000200
#define SYMOPT_EXACT_SYMBOLS            0x00000400
#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS   0x00000800
#define SYMOPT_IGNORE_NT_SYMPATH        0x00001000
#define SYMOPT_INCLUDE_32BIT_MODULES    0x00002000
#define SYMOPT_PUBLICS_ONLY             0x00004000
#define SYMOPT_NO_PUBLICS               0x00008000
#define SYMOPT_AUTO_PUBLICS             0x00010000
#define SYMOPT_NO_IMAGE_SEARCH          0x00020000
#define SYMOPT_SECURE                   0x00040000
#define SYMOPT_NO_PROMPTS               0x00080000
#define SYMOPT_DEBUG                    0x80000000

typedef int BOOL;
typedef char CHAR;
typedef unsigned long DWORD;
typedef unsigned __int64 DWORD64;
typedef void *HANDLE;
typedef unsigned __int64 *PDWORD64;
typedef void *PVOID;
typedef unsigned long ULONG;
typedef unsigned __int64 ULONG64;
typedef const CHAR *PCSTR;
typedef CHAR *PSTR;

struct _SYMBOL_INFO {
        ULONG SizeOfStruct;
        ULONG TypeIndex;
        ULONG64 Reserved[2];
        ULONG info;
        ULONG Size;
        ULONG64 ModBase;
        ULONG Flags;
        ULONG64 Value;
        ULONG64 Address;
        ULONG Register;
        ULONG Scope;
        ULONG Tag;
        ULONG NameLen;
        ULONG MaxNameLen;
        CHAR Name[1];
};
typedef struct _SYMBOL_INFO *PSYMBOL_INFO;

typedef __stdcall BOOL (*PSYM_ENUMERATESYMBOLS_CALLBACK)(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext);
__stdcall DWORD SymGetOptions(void);
__stdcall DWORD SymSetOptions(DWORD SymOptions __attribute__((in)));
__stdcall BOOL SymInitialize(HANDLE hProcess __attribute__((in)), PSTR UserSearchPath __attribute__((in)), BOOL fInvadeProcess __attribute__((in)));
__stdcall DWORD64 SymLoadModule64(HANDLE hProcess __attribute__((in)), HANDLE hFile __attribute__((in)), PSTR ImageName __attribute__((in)), PSTR ModuleName __attribute__((in)), DWORD64 BaseOfDll __attribute__((in)), DWORD SizeOfDll __attribute__((in)));
__stdcall BOOL SymSetSearchPath(HANDLE hProcess __attribute__((in)), PSTR SearchPathA __attribute__((in)));
__stdcall BOOL SymFromAddr(HANDLE hProcess __attribute__((in)), DWORD64 Address __attribute__((in)), PDWORD64 Displacement __attribute__((out)), PSYMBOL_INFO Symbol __attribute__((in)) __attribute__((out)));
__stdcall BOOL SymEnumSymbols(HANDLE hProcess __attribute__((in)), ULONG64 BaseOfDll __attribute__((in)), PCSTR Mask __attribute__((in)), PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback __attribute__((in)), PVOID UserContext __attribute__((in)));
EOS


	puts 'run_init'
	l.run_init

	puts 'sym_init'
	dl.syminitialize(42, 0, 0)
	puts 'sym_setopt'
	dl.symsetoptions(dl.symgetoptions|dl::SYMOPT_DEFERRED_LOADS|dl::SYMOPT_NO_PROMPTS)
	puts 'sym_setsearch'
	sympath = ENV['_NT_SYMBOL_PATH'] || 'srv**/tmp/symbols*http://msdl.microsoft.com/download/symbols'
	dl.symsetsearchpath(42, sympath)

	puts 'sym_loadmod'
	tg = PeLdr.new('kernel32.dll')
	dl.symloadmodule64(42, 0, 0, 0, tg.load_address, 0)

	puts 'walk'
	symstruct = [0x58].pack('L') + 0.chr*4*19 + [512].pack('L')     # sizeofstruct, ..., nameszmax
	text = tg.pe.sections.find { |s| s.name == '.text' }
	# SymEnumSymbols
	text.rawsize.times { |o|
		sym = symstruct + 0.chr*512     # name concat'ed after the struct
		off = 0.chr*8
		if dl.symfromaddr(42, tg.load_address+text.virtaddr+o, off, sym) and off.unpack('L').first == 0
			symnamelen = sym[19*4, 4].unpack('L').first
			puts ' %x %s' % [text.virtaddr+o, sym[0x54, symnamelen].inspect]
break
		end
		puts '  %x/%x' % [o, text.rawsize] if $VERBOSE and o & 0xffff == 0
	}
	puts
end