def __set_rva_delta(self, header_offset): """ :param header_offset: :return: This class returns nothing. It is meant to check if it is possible to write the new header between the last header and the first section. """ #The header is smaller than this but this is adjusted and therefore padded to file alignment. The next section starts right after current_size_of_headers = MultiByteHandler.get_dword_given_offset( self.binary_data, header_offset + Win32BinaryOffsetsAndSizes.OFFSET_TO_SIZE_OF_HEADERS) new_size_of_headers_unpadded = current_size_of_headers + Win32BinaryOffsetsAndSizes.SIZE_OF_SECTION_HEADER padding_for_new_header = Win32BinaryUtils.compute_padding_size_for_file_alignment( self.binary_data, header_offset, new_size_of_headers_unpadded) self.header_padding = padding_for_new_header new_size_of_headers = new_size_of_headers_unpadded + padding_for_new_header #I have to check if the RAW size of the header crosses the RVA for the text section. For now, i can ignore. However i need to pad the header. rva_for_first_section = MultiByteHandler.get_dword_given_offset( self.binary_data, header_offset + Win32BinaryOffsetsAndSizes.OFFSET_TO_BEGINNING_OF_SECTION_HEADERS + Win32BinaryOffsetsAndSizes. OFFSET_TO_SECTION_RVA_WITHIN_SECTION_HEADER) if new_size_of_headers > rva_for_first_section: print( "Added section crossing RVA for first section. This mode will not work. Leaving..." ) sys.exit(1) ''' #virtual_rva_delta = Win32BinaryUtils.compute_padding_size_for_section_alignment(self.binary_data, header_offset, new_size_of_headers) #self.rva_delta = new_size_of_headers + virtual_rva_delta - rva_for_first_section ''' return
def __file_align_shell_code(self, header_offset, jump_displacement): non_padded_shell_code = self.shell_code_generator.get_base_shell_code( jump_displacement) padding_size = Win32BinaryUtils.compute_padding_size_for_file_alignment( self.binary_data, header_offset, len(non_padded_shell_code)) padded_shell_code = self.shell_code_generator.get_padded_shell_code( padding_size) self.shell_code = padded_shell_code
def __file_align_shellcode(self, header_offset, raw_offset_of_header_of_section_containing_entrypoint, entrypoint_raw_section_size, jump_displacement): """ :param header_offset: :param raw_offset_of_header_of_section_containing_entrypoint: :param entrypoint_raw_section_size: :param jump_displacement: this is the difference between the RVA for the shellcode and the rva for the endpoint. This is used to create shellcode with a negative jump, i.e., the shellcode executes and then jumps to the entrypoint. :return: This function is used to create a parametrized and padded shellcode. """ default_shell_code = self.shell_code_generator.get_base_shell_code(jump_displacement) raw_offset_of_entrypoint_section = MultiByteHandler.get_dword_given_offset(self.binary_data, raw_offset_of_header_of_section_containing_entrypoint + Win32BinaryOffsetsAndSizes.OFFSET_TO_SECTION_RAW_OFFSET_WITHIN_SECTION_HEADER) minimum_raw_offset_for_next_section = raw_offset_of_entrypoint_section + entrypoint_raw_section_size + len(default_shell_code) padding_size = Win32BinaryUtils.compute_padding_size_for_file_alignment(self.binary_data, header_offset, minimum_raw_offset_for_next_section) padded_shell_code = self.shell_code_generator.get_padded_shell_code(padding_size) self.shell_code = padded_shell_code
def __adjust_windows_specific_headers(self, header_offset, new_section_rva, new_section_virtual_size): # SizeOfImage size_of_image_offset = header_offset + Win32BinaryOffsetsAndSizes.OFFSET_TO_SIZE_OF_IMAGE potentially_unaligned_size_of_image = new_section_rva + new_section_virtual_size aligned_size_of_image = potentially_unaligned_size_of_image + Win32BinaryUtils.compute_padding_size_for_section_alignment( self.binary_data, header_offset, potentially_unaligned_size_of_image) MultiByteHandler.set_dword_given_offset(self.binary_data, size_of_image_offset, aligned_size_of_image) # SifeOfHeaders size_of_headers_offset = header_offset + Win32BinaryOffsetsAndSizes.OFFSET_TO_SIZE_OF_HEADERS current_size_of_headers = MultiByteHandler.get_dword_given_offset( self.binary_data, size_of_headers_offset) updated_size_of_headers = current_size_of_headers + Win32BinaryOffsetsAndSizes.SIZE_OF_SECTION_HEADER padding = Win32BinaryUtils.compute_padding_size_for_file_alignment( self.binary_data, header_offset, updated_size_of_headers) MultiByteHandler.set_dword_given_offset( self.binary_data, size_of_headers_offset, updated_size_of_headers + padding)