added JCC support... todo: read in .lib...

2.0
_xeroxz 4 years ago
parent e98a543f14
commit 1868518628

@ -34,7 +34,7 @@
<TargetVersion>Windows10</TargetVersion> <TargetVersion>Windows10</TargetVersion>
<UseDebugLibraries>false</UseDebugLibraries> <UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>ClangCL</PlatformToolset> <PlatformToolset>ClangCL</PlatformToolset>
<ConfigurationType>DynamicLibrary</ConfigurationType> <ConfigurationType>StaticLibrary</ConfigurationType>
<DriverType>KMDF</DriverType> <DriverType>KMDF</DriverType>
<DriverTargetPlatform>Universal</DriverTargetPlatform> <DriverTargetPlatform>Universal</DriverTargetPlatform>
<Driver_SpectreMitigation>false</Driver_SpectreMitigation> <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
@ -54,6 +54,8 @@
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor> <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<EnableInf2cat>false</EnableInf2cat> <EnableInf2cat>false</EnableInf2cat>
<IntDir>$(SolutionDir)$(Platform)\$(Configuration)\</IntDir>
<IncludePath>$(IncludePath);$(KMDF_INC_PATH)$(KMDF_VER_PATH)</IncludePath>
</PropertyGroup> </PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile> <ClCompile>
@ -85,6 +87,9 @@
<Link> <Link>
<EntryPointSymbol>DriverEntry</EntryPointSymbol> <EntryPointSymbol>DriverEntry</EntryPointSymbol>
</Link> </Link>
<BuildLog>
<Path>$(IntDir)ignore\$(MSBuildProjectName).log</Path>
</BuildLog>
</ItemDefinitionGroup> </ItemDefinitionGroup>
<ItemGroup> <ItemGroup>
<FilesToPackage Include="$(TargetPath)" /> <FilesToPackage Include="$(TargetPath)" />

@ -7,6 +7,7 @@ unsigned long long get_dirbase()
result.flags = result.flags =
*(unsigned long long*)(IoGetCurrentProcess() + 0x28); *(unsigned long long*)(IoGetCurrentProcess() + 0x28);
result.flags = NULL;
if (!result.address_of_page_directory) if (!result.address_of_page_directory)
return -1; return -1;

@ -192,7 +192,7 @@ namespace drv
ZydisDecoder decoder; ZydisDecoder decoder;
ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64); ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64);
ZyanUSize offset = 0; std::int32_t offset = 0;
ZyanUSize length = symbol.size; ZyanUSize length = symbol.size;
ZydisDecodedInstruction instruction; ZydisDecodedInstruction instruction;
@ -203,8 +203,13 @@ namespace drv
length - offset, &instruction))) length - offset, &instruction)))
{ {
auto symbol_name = symbol.symbol_name; auto symbol_name = symbol.symbol_name;
auto jcc_symbol = symbol.symbol_name;
auto next_instruction_symbol = symbol.symbol_name; auto next_instruction_symbol = symbol.symbol_name;
jcc_symbol.append("@")
.append(std::to_string(
offset + instruction.operands[0].imm.value.s + instruction.length));
next_instruction_symbol.append("@").append( next_instruction_symbol.append("@").append(
std::to_string(offset + instruction.length)); std::to_string(offset + instruction.length));
@ -238,12 +243,63 @@ namespace drv
case ZYDIS_MNEMONIC_JS: case ZYDIS_MNEMONIC_JS:
case ZYDIS_MNEMONIC_JZ: case ZYDIS_MNEMONIC_JZ:
{ {
std::vector<std::uint8_t> final_instruction;
final_instruction.resize(instruction.length +
instruction.length + (JMP_RIP_SIZE * 2));
// copy instruction into buffer...
memcpy(final_instruction.data(),
obj.data() + symbol.file_offset + offset, instruction.length);
// TODO check to see if the compiler made a short JCC...
// with optimizations off it seems to not...
*reinterpret_cast<std::uint32_t*>(&final_instruction[
instruction.length - (instruction.operands[0].size / 8)]) = NULL;
// only jmping +-128 bytes to jtable...
final_instruction[instruction.length - (instruction.operands[0].size / 8)] = JMP_RIP_SIZE;
std::printf(" > fixing JCC instruction...\n");
std::printf(" > original rva = 0x%x, new rva = 0x%x\n", instruction.operands[0].imm.value.s, JMP_RIP_SIZE);
std::printf(" > conditional branch = 0x%p\n", mapped_symbols[jcc_symbol]);
std::printf(" > next instruction = 0x%p\n", mapped_symbols[next_instruction_symbol]);
// copy jmp [rip] after instruction...
memcpy(&final_instruction[instruction.length], jmp_rip, sizeof jmp_rip);
// copy jtable entry...
memcpy(&final_instruction[instruction.length + JMP_RIP_SIZE], jmp_rip, sizeof jmp_rip);
// this jmp [rip] goes to the conditional branch...
*reinterpret_cast<std::uintptr_t*>(&final_instruction[
instruction.length + JMP_RIP_SIZE + JMP_RIP_ADDR_IDX]) = mapped_symbols[jcc_symbol];
// this jmp [rip] goes to the next instruction...
*reinterpret_cast<std::uintptr_t*>(&final_instruction[
instruction.length + JMP_RIP_ADDR_IDX]) = mapped_symbols[next_instruction_symbol];
const auto instruc_alloc =
reinterpret_cast<void*>(
mapped_symbols[symbol_name]);
// copy the instruction into memory...
kmemcpy(instruc_alloc, final_instruction.data(), final_instruction.size());
break; break;
} }
case ZYDIS_MNEMONIC_JMP: case ZYDIS_MNEMONIC_JMP:
{ {
std::vector<std::uint8_t> final_instruction;
final_instruction.resize(JMP_RIP_SIZE);
memset(final_instruction.data(), NULL, final_instruction.size());
*reinterpret_cast<std::uintptr_t*>(
&final_instruction[JMP_RIP_SIZE]) = mapped_symbols[jcc_symbol];
const auto instruc_alloc =
reinterpret_cast<void*>(
mapped_symbols[symbol_name]);
// copy the instruction into memory...
kmemcpy(instruc_alloc, final_instruction.data(), final_instruction.size());
break; break;
} }
case ZYDIS_MNEMONIC_RET: case ZYDIS_MNEMONIC_RET:

@ -27,7 +27,7 @@ int main(int argc, char** argv)
} }
std::printf("> number of objs = %d\n", image_objs.size()); std::printf("> number of objs = %d\n", image_objs.size());
/*const auto [drv_handle, drv_key, drv_status] = vdm::load_drv(); const auto [drv_handle, drv_key, drv_status] = vdm::load_drv();
if (drv_status != STATUS_SUCCESS || drv_handle == INVALID_HANDLE_VALUE) if (drv_status != STATUS_SUCCESS || drv_handle == INVALID_HANDLE_VALUE)
{ {
@ -78,17 +78,6 @@ int main(int argc, char** argv)
} }
); );
return result; return result;
};*/
drv::kmemcpy_t _kmemcpy =
[&](void* dest, const void* src, std::size_t size) -> void*
{
return memcpy(dest, src, size);
};
drv::kalloc_t _kalloc = [&](std::size_t size) -> void*
{
return malloc(size);
}; };
drv::hmdm_ctx drv_mapper({ _kalloc, _kmemcpy }); drv::hmdm_ctx drv_mapper({ _kalloc, _kmemcpy });
@ -97,7 +86,7 @@ int main(int argc, char** argv)
std::printf("\n\n> driver entry -> 0x%p\n", drv_entry); std::printf("\n\n> driver entry -> 0x%p\n", drv_entry);
std::getchar(); std::getchar();
/*int result; int result;
msrexec.exec([&result, drv_entry = drv_entry] msrexec.exec([&result, drv_entry = drv_entry]
(void* krnl_base, get_system_routine_t get_kroutine) -> void (void* krnl_base, get_system_routine_t get_kroutine) -> void
{ {
@ -110,7 +99,7 @@ int main(int argc, char** argv)
{ {
std::printf("> failed to unload driver... reason -> 0x%x\n", unload_status); std::printf("> failed to unload driver... reason -> 0x%x\n", unload_status);
return -1; return -1;
}*/ }
std::printf("> press enter to close...\n"); std::printf("> press enter to close...\n");
std::getchar(); std::getchar();

Loading…
Cancel
Save