def sc_64_AllocRWX(address, rwx_qword):
dll = "KERNEL32.DLL\x00".encode("utf-16-le")
api = "VirtualAlloc\x00"
AllocRWX64_sc = x64.MultipleInstr()
map(AllocRWX64_sc.__iadd__, [
shellcraft.amd64.pushstr(dll),
x64.Mov("RCX", "RSP"),
shellcraft.amd64.pushstr(api),
x64.Mov("RDX", "RSP"),
x64.Call(":FUNC_GETPROCADDRESS64"),
x64.Mov("R10", "RAX"),
x64.Mov("RCX", address),
x64.Mov("RDX", 0x1000),
x64.Mov("R8", MEM_COMMIT | MEM_RESERVE),
x64.Mov("R9", PAGE_EXECUTE_READWRITE),
x64.Sub("RSP", 0x30),
x64.And("RSP", -32),
x64.Call("R10"),
x64.Mov('RAX', rwx_qword),
x64.Mov("RCX", address),
x64.Mov(x64.mem('[RCX]'), 'RAX'),
x64.Call("RCX"),
windows.native_exec.nativeutils.GetProcAddress64,
])
return AllocRWX64_sc.get_code()
def sc_64_LoadLibrary(dll_path):
dll = bytes("KERNEL32.DLL\x00".encode("utf-16-le"))
api = b"LoadLibraryA\x00"
if PY3 and isinstance(dll_path, str):
dll_path = bytes(dll_path.encode())
LoadLibrary64_sc = x64.MultipleInstr()
LoadLibrary64_sc += shellcraft.amd64.pushstr(dll)
LoadLibrary64_sc += x64.Mov("RCX", "RSP")
LoadLibrary64_sc += shellcraft.amd64.pushstr(api)
LoadLibrary64_sc += x64.Mov("RDX", "RSP")
LoadLibrary64_sc += x64.Call(":FUNC_GETPROCADDRESS64")
LoadLibrary64_sc += x64.Mov("R10", "RAX")
LoadLibrary64_sc += shellcraft.amd64.pushstr(dll_path)
LoadLibrary64_sc += x64.Mov("RCX", "RSP")
LoadLibrary64_sc += x64.Sub("RSP", 0x30)
LoadLibrary64_sc += x64.And("RSP", -32)
LoadLibrary64_sc += x64.Call("R10")
LoadLibrary64_sc += x64.Label(":HERE")
LoadLibrary64_sc += x64.Jmp(":HERE")
LoadLibrary64_sc += windows.native_exec.nativeutils.GetProcAddress64
return LoadLibrary64_sc.get_code()
def sc_64_WinExec(exe):
dll = bytes("KERNEL32.DLL\x00".encode("utf-16-le"))
api = b"WinExec\x00"
if PY3 and isinstance(exe, str):
exe = bytes(exe.encode())
WinExec64_sc = x64.MultipleInstr()
WinExec64_sc += shellcraft.amd64.pushstr(dll)
WinExec64_sc += x64.Mov("RCX", "RSP")
WinExec64_sc += shellcraft.amd64.pushstr(api)
WinExec64_sc += x64.Mov("RDX", "RSP")
WinExec64_sc += x64.Call(":FUNC_GETPROCADDRESS64")
WinExec64_sc += x64.Mov("R10", "RAX")
WinExec64_sc += shellcraft.amd64.pushstr(exe)
WinExec64_sc += x64.Mov("RCX", "RSP")
WinExec64_sc += x64.Sub("RSP", 0x30)
WinExec64_sc += x64.And("RSP", -32)
WinExec64_sc += x64.Call("R10")
WinExec64_sc += x64.Label(":HERE")
WinExec64_sc += x64.Jmp(":HERE")
WinExec64_sc += windows.native_exec.nativeutils.GetProcAddress64 # Dirty infinite loop
#WinExec64_sc +=# x64.Ret(),
return WinExec64_sc.get_code()
def register_kernel_call(self):
# expect in buffer: the address to call and all dword to push on the stack
CCall_IOCTL = x64.MultipleInstr()
CCall_IOCTL += x64.Mov('RAX', self.IO_STACK_INPUT_BUFFER_LEN)
CCall_IOCTL += x64.Cmp('RAX', 0)
CCall_IOCTL += x64.Jz(":FAIL") # Need at least the function to call
CCall_IOCTL += x64.Mov('R15', 4 * 8) # Size to pop on the stack at the end (4 * push RDI)
CCall_IOCTL += x64.Mov('R10', self.IO_STACK_INPUT_BUFFER)
CCall_IOCTL += x64.Label(':PUSH_NEXT_ARG')
CCall_IOCTL += x64.Cmp('RAX', (8 * 5))
CCall_IOCTL += x64.Jbe(":SETUP_REG_ARGS")
CCall_IOCTL += x64.Sub('RAX', 8)
INPUT_BUFFER_NEXT_ARG = x64.create_displacement(base='R10', index='RAX')
CCall_IOCTL += x64.Mov('RBX', INPUT_BUFFER_NEXT_ARG)
CCall_IOCTL += x64.Push('RBX')
CCall_IOCTL += x64.Add('R15', 8) # Add at Size to pop on the stack at the end
CCall_IOCTL += x64.Jmp(':PUSH_NEXT_ARG')
CCall_IOCTL += x64.Label(":SETUP_REG_ARGS")
# Could be done in a loop
# But do I really want to generate x86 in a loop..
CCall_IOCTL += x64.Cmp('RAX', (8 * 5))
CCall_IOCTL += x64.Jz(":SETUP_4_ARGS")
CCall_IOCTL += x64.Cmp('RAX', (8 * 4))
CCall_IOCTL += x64.Jz(":SETUP_3_ARGS")
CCall_IOCTL += x64.Cmp('RAX', (8 * 3))
CCall_IOCTL += x64.Jz(":SETUP_2_ARGS")
CCall_IOCTL += x64.Cmp('RAX', (8 * 2))
CCall_IOCTL += x64.Jz(":SETUP_1_ARGS")
CCall_IOCTL += x64.Jmp(":SETUP_0_ARGS")
CCall_IOCTL += x64.Label(":SETUP_4_ARGS")
CCall_IOCTL += x64.Mov('R9', x64.mem('[R10 + 0x20]'))
CCall_IOCTL += x64.Label(":SETUP_3_ARGS")
CCall_IOCTL += x64.Mov('R8', x64.mem('[R10 + 0x18]'))
CCall_IOCTL += x64.Label(":SETUP_2_ARGS")
CCall_IOCTL += x64.Mov('RDX', x64.mem('[R10 + 0x10]'))
CCall_IOCTL += x64.Label(":SETUP_1_ARGS")
CCall_IOCTL += x64.Mov('RCX', x64.mem('[R10 + 8]'))
CCall_IOCTL += x64.Label(":SETUP_0_ARGS")
CCall_IOCTL += x64.Mov('RAX', x64.mem('[R10]'))
# Fix Reserve space (calling convention)
CCall_IOCTL += x64.Push('RDI')
CCall_IOCTL += x64.Push('RDI')
CCall_IOCTL += x64.Push('RDI')
CCall_IOCTL += x64.Push('RDI')
CCall_IOCTL += x64.Call('RAX')
CCall_IOCTL += x64.Mov('RDX', self.IRP_OUTPUT_BUFFER)
CCall_IOCTL += x64.Mov(x64.mem('[RDX]'), 'RAX')
CCall_IOCTL += x64.Xor('RAX', 'RAX')
CCall_IOCTL += x64.Add('RSP', 'R15')
CCall_IOCTL += x64.Ret()
CCall_IOCTL += x64.Label(":FAIL")
CCall_IOCTL += x64.Mov('RAX', 0x0C000000D)
CCall_IOCTL += x64.Ret()
self.upgrade_driver_add_new_ioctl_handler(DU_KCALL_IOCTL, CCall_IOCTL.get_code())
def sc_64_LoadLibrary(dll_path):
dll = "KERNEL32.DLL\x00".encode("utf-16-le")
api = "LoadLibraryA\x00"
LoadLibrary64_sc = x64.MultipleInstr()
map(LoadLibrary64_sc.__iadd__, [
shellcraft.amd64.pushstr(dll),
x64.Mov("RCX", "RSP"),
shellcraft.amd64.pushstr(api),
x64.Mov("RDX", "RSP"),
x64.Call(":FUNC_GETPROCADDRESS64"),
x64.Mov("R10", "RAX"),
shellcraft.amd64.pushstr(dll_path),
x64.Mov("RCX", "RSP"),
x64.Sub("RSP", 0x30),
x64.And("RSP", -32),
x64.Call("R10"),
x64.Label(":HERE"),
x64.Jmp(":HERE"), # Dirty infinite loop
# x64.Ret(),
windows.native_exec.nativeutils.GetProcAddress64,
])
return LoadLibrary64_sc.get_code()
def generate_syswow64_call(target, errcheck=None):
nb_args = len(target.prototype._argtypes_)
target_addr = get_syswow_ntdll_exports()[target.__name__]
argument_buffer_len = (nb_args * 8)
argument_buffer = windows.current_process.allocator.reserve_size(argument_buffer_len)
alignement_information = windows.current_process.allocator.reserve_size(8)
nb_args_on_stack = max(nb_args - 4, 0)
code_64b = x64.MultipleInstr()
# Save registers
code_64b += x64.Push('RBX')
code_64b += x64.Push('RCX')
code_64b += x64.Push('RDX')
code_64b += x64.Push('RSI')
code_64b += x64.Push('RDI')
code_64b += x64.Push('R8')
code_64b += x64.Push('R9')
code_64b += x64.Push('R10')
code_64b += x64.Push('R11')
code_64b += x64.Push('R12')
code_64b += x64.Push('R13')
# Alignment stuff :)
code_64b += x64.Mov('RCX', 'RSP')
code_64b += x64.And('RCX', 0x0f)
code_64b += x64.Mov(x64.deref(alignement_information), 'RCX')
code_64b += x64.Sub('RSP', 'RCX')
# retrieve argument from the argument buffer
if nb_args >= 1:
code_64b += x64.Mov('RCX', x64.create_displacement(disp=argument_buffer))
if nb_args >= 2:
code_64b += x64.Mov('RDX', x64.create_displacement(disp=argument_buffer + (8 * 1)))
if nb_args >= 3:
code_64b += x64.Mov('R8', x64.create_displacement(disp=argument_buffer + (8 * 2)))
if nb_args >= 4:
code_64b += x64.Mov('R9', x64.create_displacement(disp=argument_buffer + (8 * 3)))
for i in range(nb_args_on_stack):
code_64b += x64.Mov('RAX', x64.create_displacement(disp=argument_buffer + 8 * (nb_args - 1 - i)))
code_64b += x64.Push('RAX')
# reserve space for register (calling convention)
code_64b += x64.Push('R9')
code_64b += x64.Push('R8')
code_64b += x64.Push('RDX')
code_64b += x64.Push('RCX')
# Call
code_64b += x64.Mov('R13', target_addr)
code_64b += x64.Call('R13')
# Realign stack :)
code_64b += x64.Add('RSP', x64.deref(alignement_information))
# Clean stack
code_64b += x64.Add('RSP', (4 + nb_args_on_stack) * 8)
code_64b += x64.Pop('R13')
code_64b += x64.Pop('R12')
code_64b += x64.Pop('R11')
code_64b += x64.Pop('R10')
code_64b += x64.Pop('R9')
code_64b += x64.Pop('R8')
code_64b += x64.Pop('RDI')
code_64b += x64.Pop('RSI')
code_64b += x64.Pop('RDX')
code_64b += x64.Pop('RCX')
code_64b += x64.Pop('RBX')
code_64b += x64.Ret()
return try_generate_stub_target(code_64b.get_code(), argument_buffer, target, errcheck=errcheck)
