OutputDebugStringAHook.patch

From eae5317c7e8473f37902a89365b487c26dc0ac8a Mon Sep 17 00:00:00 2001

---
 Makefile   |   8 ++++-
 ODSHook.c  | 114 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ODSHook.h  |  28 +++++++++++++++
 call.asm   |  25 ++++++++++++++
 mpclient.c |   5 +++
 5 files changed, 179 insertions(+), 1 deletion(-)
 create mode 100644 ODSHook.c
 create mode 100644 ODSHook.h
 create mode 100644 call.asm

diff --git a/Makefile b/Makefile
index 7d6f0dd..a49c876 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,13 @@ mpscript.o: script.h
 
 intercept/hook.o: intercept
 
-mpclient: mpclient.o intercept/hook.o | peloader
+call.o: call.asm
+	nasm -f elf $^
+
+ODSHook.o: ODSHook.c ODSHook.h
+	$(CC) $(CFLAGS) -c $< -o $@
+
+mpclient: mpclient.o intercept/hook.o ODSHook.o call.o | peloader
 	$(CC) $(CFLAGS) $^ -o $@ $(LDLIBS) $(LDFLAGS)
 
 # mpscript requires libreadline-dev:i386
diff --git a/ODSHook.c b/ODSHook.c
new file mode 100644
index 0000000..f4c409f
--- /dev/null
+++ b/ODSHook.c
@@ -0,0 +1,114 @@
+#include "ODSHook.h"
+
+
+// This structure contains relative virtual addresses for three key addresses
+// we need to make the OutputDebugStringA trick work. These addresses are relative
+// from the base of mpengine.dll
+//
+// Note: these RVAs are specific to the 6/25/2018 mpengine.dll release
+// MD5: e95d3f9e90ba3ccd1a4b8d63cbd88d1b
+RVAS RVAs_June_2018 = {
+
+    .MPVERNO = "MP_6_25_2018",
+
+    // This function gets the parameter passed a 1 parameter emulated 
+    // function from the pe_vars_t * passed to every emulated function
+    .RVA_Parameters1 = 0x46e5d5,
+
+    // This function translates the virtual memory address of a string to a 
+    // native char * that we can print
+    .RVA_pe_read_string_ex = 0x3e59f3,
+
+    // The address of the function pointer to KERNEL32_DLL_OuputDebugStringA
+    // in the g_syscalls table. It should look something like this:
+    /*
+    .text:5A11A0D8  dd offset ?KERNEL32_DLL_CopyFileWWorker@@YAXPAUpe_vars_t@@@Z ; KERNEL32_DLL_CopyFileWWorker(pe_vars_t *)
+    .text:5A11A0DC  dd 0B27D5174h
+    .text:5A11A0E0  dd offset ?KERNEL32_DLL_OutputDebugStringA@@YAXPAUpe_vars_t@@@Z ; KERNEL32_DLL_OutputDebugStringA(pe_vars_t *)
+    .text:5A11A0E4  dd 0B28014BBh
+    .text:5A11A0E8  dd offset ?NTDLL_DLL_NtGetContextThread@@YAXPAUpe_vars_t@@@Z ; NTDLL_DLL_NtGetContextThread(pe_vars_t *)
+    .text:5A11A0EC  dd 0B363A610h
+    */
+    .RVA_FP_OutputDebugStringA = 0x1af88L,
+};
+
+//
+// Call into pe_read_string_ex to translate the virtual address of a
+// string in the emulated address space to a real char * that we can 
+// interact with. Len value returns the length of the string
+//
+// Due to an annoying calling convention (fastcall but with a 64-bit 
+// value in one of the first 2 arguments), trampolining through assembly 
+// is easier than setting GCC compiler attributes 
+//
+// __cdecl calling convention (implicitly on GCC, but if you have any problems
+// linking or running, double check this)
+char * ASM_pe_read_string_ex(uint32_t * , void *, uint64_t, uint32_t *);
+
+static char * GetString(void * V, uint64_t Param, uint32_t * Len)
+{
+    //trampoline through assembly with wierd calling convention
+    return ASM_pe_read_string_ex(FP_pe_read_string_ex, V, Param, Len);
+}
+
+//
+// Hook for OutputDebugStringA - just print a string to stdout
+//
+static void __cdecl KERNEL32_DLL_OutputDebugStringA_hook(void * v)
+{
+    uint64_t Params[1] = {0};
+    char * str = NULL;
+    DWORD len = 0;
+
+    // void * v is a pe_vars_t *, a huge structure containing all 
+    // the information for given emulation session. We don't have
+    // the full structure definition, so we just treat it as a void *
+    printf("[+] OutputDebugStringA(pe_vars_t * v = 0x%p)\n", v);
+
+    // use Defender's internal Parameters<1>::Parameters<1> function 
+    // to retrieve the one parameter passed to kernel32!OutputDebugStringA
+    // inside the emulator. This will give us the virtual address of a char *
+    // inside the emulator
+    Parameters1(Params, v);
+
+    // print out the virtual address of the char * argument
+    printf("[+] Params[1]:\t0x%llx\n", Params[0]);
+
+    // use Defender's internal pe_read_string_ex function to translate a 
+    // virtual address to a real address we can interact with
+    str = GetString(v, Params[0], &len);
+
+    // now that we finally have a real pointer we can interact with, print
+    // the string out to stdout
+    printf("[+] OutputDebugStringA: \"%s\"\n", str);
+
+    return;
+}
+
+//
+// Set hooks and calculate offsets for functions we will call
+//
+void SetHooks(const uint32_t ImageBase, const uint32_t ImageSize)
+{
+    uint32_t * pOutputDebugStringA;
+
+    printf("[+] MpEngine.dll base at 0x%x\n", ImageBase);
+    printf("[+] Setting hooks and resolving offsets\n");
+
+    // resolve the address of Parameters<1>::Parameters<1>, we will be calling it
+    Parameters1 = (void*)((unsigned char*)ImageBase + RVAs_June_2018.RVA_Parameters1);
+    printf("[+] Parameters<1>::Parameters<1>\tRVA: 0x%06x\tAddress: %p\n", RVAs_June_2018.RVA_Parameters1, Parameters1);
+
+    // resolve the address of pe_read_string_ex, we will be calling it
+    FP_pe_read_string_ex = (void*)((unsigned char*)ImageBase + RVAs_June_2018.RVA_pe_read_string_ex);
+    printf("[+] pe_read_string_ex:\t\t\tRVA: 0x%06x\tAddress: %p\n", RVAs_June_2018.RVA_pe_read_string_ex, FP_pe_read_string_ex);
+
+    // resolve the address of a function pointer to KERNEL32_DLL_OutputDebugStringA, we are replacing it
+    pOutputDebugStringA = (void*)((unsigned char*)ImageBase + RVAs_June_2018.RVA_FP_OutputDebugStringA);
+    printf("[+] OutputDebugStringA FP:\t\tRVA: 0x%06x\tAddress: 0x%x\n", RVAs_June_2018.RVA_FP_OutputDebugStringA, *(pOutputDebugStringA));
+    *pOutputDebugStringA = (uint32_t)KERNEL32_DLL_OutputDebugStringA_hook;
+    printf("[+] OutputDebugStringA FP replaced: \t0x%x\n", *(pOutputDebugStringA));
+
+
+    printf("[+] Done setting hooks and resolving offsets!\n");
+}
diff --git a/ODSHook.h b/ODSHook.h
new file mode 100644
index 0000000..cb6a112
--- /dev/null
+++ b/ODSHook.h
@@ -0,0 +1,28 @@
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include "peloader/winnt_types.h"
+#include "peloader/util.h"
+
+
+void SetHooks(const uint32_t ImageBase, const uint32_t ImageSize);
+
+//Typedef for templated Parameters<> calls
+typedef uint32_t __thiscall(* ParametersCall)(void * params, void * v);
+ParametersCall Parameters1;
+
+// address of pe_read_string_ex
+uint32_t * FP_pe_read_string_ex; 
+//struct to store offsets
+typedef struct _RVAS {
+    char * MPVERNO;
+    uint32_t RVA_Parameters1;
+    uint32_t RVA_pe_read_string_ex;
+    uint32_t RVA_FP_OutputDebugStringA;
+} RVAS, *PRVAS;
+
diff --git a/call.asm b/call.asm
new file mode 100644
index 0000000..7086010
--- /dev/null
+++ b/call.asm
@@ -0,0 +1,25 @@
+; hacking this together was less annoying than dealing with 
+; calling convention declarations
+
+global ASM_pe_read_string_ex 
+
+;
+; __cdecl calling convention
+;
+ASM_pe_read_string_ex:
+	push ebp
+	mov ebp, esp
+
+	mov eax, dword [ebp+0x8]	; function pointer we are calling
+	mov ecx, [ebp+0xc]    		; set up parameter
+
+	push dword [ebp+0x18]		; set up parameter
+	push dword [ebp+0x14] 		; set up parameter (QWORD high)
+	push dword [ebp+0x10] 		; set up parameter (QWORD low)
+
+	call eax					; actually call the function
+
+	add esp, 0xc 				; stack cleanup after the call to pe_read_string_ex
+	pop ebp
+	ret
+	
diff --git a/mpclient.c b/mpclient.c
index 4cfeaaa..a1ff821 100644
--- a/mpclient.c
+++ b/mpclient.c
@@ -50,6 +50,7 @@
 #include "scanreply.h"
 #include "streambuffer.h"
 #include "openscan.h"
+#include "ODSHook.h"
 
 // Any usage limits to prevent bugs disrupting system.
 const struct rlimit kUsageLimits[] = {
@@ -169,6 +170,10 @@ int main(int argc, char **argv, char **envp)
         }
     }
 
+    //Set our hooks for OutputDebugStringA
+    SetHooks((uint32_t)image.image, (uint32_t)image.size);
+
+
     if (get_export("__rsignal", &__rsignal) == -1) {
         errx(EXIT_FAILURE, "Failed to resolve mpengine entrypoint");
     }
-- 
2.7.4