You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
507 lines
19 KiB
507 lines
19 KiB
#include <unpacker.hpp>
|
|
|
|
namespace engine
|
|
{
|
|
unpack_t::unpack_t( const std::vector< std::uint8_t > &packed_bin )
|
|
: bin( packed_bin ), uc_ctx( nullptr ), heap_offset( 0ull ), pack_section_offset( 0ull )
|
|
{
|
|
win_img = reinterpret_cast< win::image_t<> * >( bin.data() );
|
|
img_base = win_img->get_nt_headers()->optional_header.image_base;
|
|
img_size = win_img->get_nt_headers()->optional_header.size_image;
|
|
std::printf( "> image base = 0x%p, image size = 0x%x\n", img_base, img_size );
|
|
}
|
|
|
|
unpack_t::~unpack_t( void )
|
|
{
|
|
if ( uc_ctx )
|
|
uc_close( uc_ctx );
|
|
|
|
for ( auto &ptr : uc_hooks )
|
|
if ( ptr )
|
|
delete ptr;
|
|
}
|
|
|
|
bool unpack_t::init( void )
|
|
{
|
|
uc_err err;
|
|
if ( ( err = uc_open( UC_ARCH_X86, UC_MODE_64, &uc_ctx ) ) )
|
|
{
|
|
std::printf( "> uc_open err = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
if ( ( err = uc_mem_map( uc_ctx, IAT_VECTOR_TABLE, PAGE_4KB, UC_PROT_ALL ) ) )
|
|
{
|
|
std::printf( "> uc_mem_map iat vector table err = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
if ( ( err = uc_mem_map( uc_ctx, STACK_BASE, STACK_SIZE, UC_PROT_ALL ) ) )
|
|
{
|
|
std::printf( "> uc_mem_map stack err, reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
if ( ( err = uc_mem_map( uc_ctx, img_base, img_size, UC_PROT_ALL ) ) )
|
|
{
|
|
std::printf( "> map memory failed, reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
// init iat vector table full of 'ret' instructions...
|
|
auto c3_page = malloc( PAGE_4KB );
|
|
{
|
|
memset( c3_page, 0xC3, PAGE_4KB );
|
|
|
|
if ( ( err = uc_mem_write( uc_ctx, IAT_VECTOR_TABLE, c3_page, PAGE_4KB ) ) )
|
|
{
|
|
std::printf( "> failed to init iat vector table...\n" );
|
|
free( c3_page );
|
|
return false;
|
|
}
|
|
}
|
|
free( c3_page );
|
|
|
|
map_bin.resize( img_size );
|
|
memcpy( map_bin.data(), bin.data(), // copies pe headers (includes section headers)
|
|
win_img->get_nt_headers()->optional_header.size_headers );
|
|
|
|
win::section_header_t *sec_begin = win_img->get_nt_headers()->get_sections(),
|
|
*sec_end = sec_begin + win_img->get_nt_headers()->file_header.num_sections;
|
|
|
|
std::for_each( sec_begin, sec_end, [ & ]( const win::section_header_t &sec_header ) {
|
|
memcpy( map_bin.data() + sec_header.virtual_address, bin.data() + sec_header.ptr_raw_data,
|
|
sec_header.size_raw_data );
|
|
} );
|
|
|
|
auto basereloc_dir = win_img->get_directory( win::directory_id::directory_entry_basereloc );
|
|
auto reloc_dir = reinterpret_cast< win::reloc_directory_t * >( basereloc_dir->rva + map_bin.data() );
|
|
win::reloc_block_t *reloc_block = &reloc_dir->first_block;
|
|
|
|
// apply relocations to all sections...
|
|
while ( reloc_block->base_rva && reloc_block->size_block )
|
|
{
|
|
std::for_each( reloc_block->begin(), reloc_block->end(), [ & ]( win::reloc_entry_t &entry ) {
|
|
switch ( entry.type )
|
|
{
|
|
case win::reloc_type_id::rel_based_dir64:
|
|
{
|
|
auto reloc_at =
|
|
reinterpret_cast< std::uintptr_t * >( entry.offset + reloc_block->base_rva + map_bin.data() );
|
|
|
|
*reloc_at = img_base + ( ( *reloc_at ) - img_base );
|
|
break;
|
|
}
|
|
default:
|
|
break;
|
|
}
|
|
} );
|
|
|
|
reloc_block = reloc_block->next();
|
|
}
|
|
|
|
// iat hook specific function...
|
|
for ( auto import_dir = reinterpret_cast< win::import_directory_t * >(
|
|
win_img->get_directory( win::directory_id::directory_entry_import )->rva + map_bin.data() );
|
|
import_dir->rva_name; ++import_dir )
|
|
{
|
|
for ( auto iat_thunk =
|
|
reinterpret_cast< win::image_thunk_data_t<> * >( import_dir->rva_first_thunk + map_bin.data() );
|
|
iat_thunk->address; ++iat_thunk )
|
|
{
|
|
if ( iat_thunk->is_ordinal )
|
|
continue;
|
|
|
|
auto iat_name = reinterpret_cast< win::image_named_import_t * >( iat_thunk->address + map_bin.data() );
|
|
|
|
if ( iat_hooks.find( iat_name->name ) != iat_hooks.end() )
|
|
iat_thunk->function = iat_hooks[ iat_name->name ].first + IAT_VECTOR_TABLE;
|
|
}
|
|
}
|
|
|
|
// map the entire map buffer into unicorn-engine since we have set everything else up...
|
|
if ( ( err = uc_mem_write( uc_ctx, img_base, map_bin.data(), map_bin.size() ) ) )
|
|
{
|
|
std::printf( "> failed to write memory... reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
// setup unicorn-engine hooks on IAT vector table, sections with 0 raw size/ptr, and an invalid memory
|
|
// handler...
|
|
|
|
uc_hooks.push_back( new uc_hook );
|
|
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(), UC_HOOK_CODE, &engine::unpack_t::iat_dispatcher, this,
|
|
IAT_VECTOR_TABLE, IAT_VECTOR_TABLE + PAGE_4KB ) ) )
|
|
{
|
|
std::printf( "> uc_hook_add error, reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
uc_hooks.push_back( new uc_hook );
|
|
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(),
|
|
UC_HOOK_MEM_READ_UNMAPPED | UC_HOOK_MEM_WRITE_UNMAPPED | UC_HOOK_MEM_FETCH_UNMAPPED |
|
|
UC_HOOK_INSN_INVALID,
|
|
&engine::unpack_t::invalid_mem, this, true, false ) ) )
|
|
{
|
|
std::printf( "> uc_hook_add error, reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
// execution break points on all sections that are executable but have no physical size on disk...
|
|
std::for_each( sec_begin, sec_end, [ & ]( win::section_header_t &header ) {
|
|
if ( !header.ptr_raw_data && !header.size_raw_data && header.characteristics.mem_execute &&
|
|
header.characteristics.mem_write && !header.is_discardable() )
|
|
{
|
|
uc_hooks.push_back( new uc_hook );
|
|
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(), UC_HOOK_CODE | UC_HOOK_MEM_WRITE,
|
|
&engine::unpack_t::unpack_section_callback, this,
|
|
header.virtual_address + img_base,
|
|
header.virtual_address + header.virtual_size + img_base ) ) )
|
|
{
|
|
std::printf( "> failed to add hook... reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
pack_section_offset = header.virtual_address + header.virtual_size;
|
|
}
|
|
else if ( header.characteristics.mem_execute )
|
|
{
|
|
uc_hooks.push_back( new uc_hook );
|
|
if ( ( err = uc_hook_add( uc_ctx, uc_hooks.back(), UC_HOOK_CODE, &engine::unpack_t::code_exec_callback,
|
|
this, header.virtual_address + img_base,
|
|
header.virtual_address + header.virtual_size + img_base ) ) )
|
|
{
|
|
std::printf( "> failed to add hook... reason = %d\n", err );
|
|
return false;
|
|
}
|
|
}
|
|
} );
|
|
|
|
return true;
|
|
}
|
|
|
|
bool unpack_t::unpack( std::vector< std::uint8_t > &output )
|
|
{
|
|
uc_err err;
|
|
auto nt_headers = win_img->get_nt_headers();
|
|
std::uintptr_t rip = nt_headers->optional_header.entry_point + img_base, rsp = STACK_BASE + STACK_SIZE;
|
|
|
|
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RSP, &rsp ) ) )
|
|
{
|
|
std::printf( "> uc_reg_write error, reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RIP, &rip ) ) )
|
|
{
|
|
std::printf( "> uc_reg_write error, reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
std::printf( "> beginning execution at = 0x%p\n", rip );
|
|
|
|
if ( ( err = uc_emu_start( uc_ctx, rip, 0ull, 0ull, 0ull ) ) )
|
|
{
|
|
std::printf( "> error starting emu... reason = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
output.resize( img_size );
|
|
if ( ( err = uc_mem_read( uc_ctx, img_base, output.data(), output.size() ) ) )
|
|
{
|
|
std::printf( "> uc_mem_read failed... err = %d\n", err );
|
|
return false;
|
|
}
|
|
|
|
auto output_img = reinterpret_cast< win::image_t<> * >( output.data() );
|
|
auto sections = output_img->get_nt_headers()->get_sections();
|
|
auto section_cnt = output_img->get_file_header()->num_sections;
|
|
|
|
// { section virtual address -> vector of section offset to reloc }
|
|
std::map< std::uint32_t, std::vector< std::uint16_t > > new_relocs;
|
|
|
|
// search executable sections for MOV RAX, 00 00 00 00 00 00 00 00...
|
|
std::for_each( sections, sections + section_cnt, [ & ]( win::section_header_t &header ) {
|
|
if ( header.characteristics.mem_execute )
|
|
{
|
|
auto result = output.data() + header.virtual_address;
|
|
|
|
do
|
|
{
|
|
result = reinterpret_cast< std::uint8_t * >( xtils::um_t::get_instance()->sigscan(
|
|
result,
|
|
header.virtual_size -
|
|
( reinterpret_cast< std::uintptr_t >( result ) -
|
|
( header.virtual_address + reinterpret_cast< std::uintptr_t >( output.data() ) ) ),
|
|
MOV_RAX_0_SIG, MOV_RAX_0_MASK ) );
|
|
|
|
if ( result )
|
|
{
|
|
result += 2; // advance ahead of the 0x48 0xB8...
|
|
|
|
// offset from section begin...
|
|
auto reloc_offset =
|
|
( reinterpret_cast< std::uintptr_t >( result ) ) -
|
|
reinterpret_cast< std::uintptr_t >( output.data() + header.virtual_address );
|
|
|
|
new_relocs[ ( header.virtual_address + reloc_offset ) & ~0xFFFull ].push_back( reloc_offset );
|
|
}
|
|
|
|
} while ( result );
|
|
}
|
|
|
|
header.ptr_raw_data = header.virtual_address;
|
|
header.size_raw_data = header.virtual_size;
|
|
} );
|
|
|
|
// determines if a relocation block exists for a given page...
|
|
static const auto has_reloc_page = [ & ]( std::uint32_t page ) -> bool {
|
|
auto img = reinterpret_cast< win::image_t<> * >( output.data() );
|
|
auto sections = img->get_nt_headers()->get_sections();
|
|
auto section_cnt = img->get_file_header()->num_sections;
|
|
|
|
auto basereloc_dir = img->get_directory( win::directory_id::directory_entry_basereloc );
|
|
auto reloc_dir = reinterpret_cast< win::reloc_directory_t * >( basereloc_dir->rva + output.data() );
|
|
win::reloc_block_t *reloc_block = &reloc_dir->first_block;
|
|
|
|
while ( reloc_block->base_rva && reloc_block->size_block )
|
|
{
|
|
if ( reloc_block->base_rva == page )
|
|
return true;
|
|
|
|
reloc_block = reloc_block->next();
|
|
}
|
|
|
|
return false;
|
|
};
|
|
|
|
// calc size to add new reloc info...
|
|
std::size_t resize_cnt = 0ull;
|
|
for ( const auto &[ reloc_rva, relocs ] : new_relocs )
|
|
if ( !has_reloc_page( reloc_rva ) )
|
|
resize_cnt += sizeof( win::reloc_block_t ) + ( relocs.size() * sizeof( win::reloc_entry_t ) );
|
|
|
|
// last block needs to contain 0 for block_rva and size_block...
|
|
if ( resize_cnt )
|
|
resize_cnt += sizeof win::reloc_block_t;
|
|
|
|
output.resize( output.size() + resize_cnt );
|
|
output_img = reinterpret_cast< win::image_t<> * >( output.data() );
|
|
|
|
auto basereloc_dir = output_img->get_directory( win::directory_id::directory_entry_basereloc );
|
|
auto reloc_dir = reinterpret_cast< win::reloc_directory_t * >( basereloc_dir->rva + output.data() );
|
|
|
|
basereloc_dir->size += resize_cnt;
|
|
for ( const auto &[ reloc_rva, relocs ] : new_relocs )
|
|
{
|
|
if ( has_reloc_page( reloc_rva ) )
|
|
continue;
|
|
|
|
win::reloc_block_t *reloc_block = &reloc_dir->first_block;
|
|
while ( reloc_block->base_rva && reloc_block->size_block )
|
|
reloc_block = reloc_block->next();
|
|
|
|
reloc_block->base_rva = reloc_rva;
|
|
reloc_block->size_block = relocs.size() * sizeof( win::reloc_entry_t ) + sizeof uint64_t;
|
|
|
|
reloc_block->next()->base_rva = 0ull;
|
|
reloc_block->next()->size_block = 0ull;
|
|
|
|
for ( auto idx = 0u; idx < relocs.size(); ++idx )
|
|
{
|
|
reloc_block->entries[ idx ].type = win::reloc_type_id::rel_based_dir64;
|
|
reloc_block->entries[ idx ].offset = relocs[ idx ];
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
|
|
void unpack_t::local_alloc_hook( uc_engine *uc_ctx, unpack_t *obj )
|
|
{
|
|
uc_err err;
|
|
std::uintptr_t rax, rdx;
|
|
|
|
if ( ( err = uc_reg_read( uc_ctx, UC_X86_REG_RDX, &rdx ) ) )
|
|
{
|
|
std::printf( "> failed to read RDX... reason = %d\n", rdx );
|
|
return;
|
|
}
|
|
|
|
auto size = ( ( rdx + PAGE_4KB ) & ~0xFFFull );
|
|
if ( ( err = uc_mem_map( uc_ctx, HEAP_BASE + obj->heap_offset, size, UC_PROT_ALL ) ) )
|
|
{
|
|
std::printf( "> failed to allocate memory... reason = %d\n", err );
|
|
return;
|
|
}
|
|
|
|
rax = HEAP_BASE + obj->heap_offset;
|
|
obj->heap_offset += size;
|
|
|
|
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &rax ) ) )
|
|
{
|
|
std::printf( "> failed to write rax... reason = %d\n", err );
|
|
return;
|
|
}
|
|
}
|
|
|
|
void unpack_t::local_free_hook( uc_engine *uc_ctx, unpack_t *obj )
|
|
{
|
|
uc_err err;
|
|
std::uintptr_t rax = 0ull;
|
|
|
|
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &rax ) ) )
|
|
{
|
|
std::printf( "> failed to write rax... reason = %d\n", err );
|
|
return;
|
|
}
|
|
}
|
|
|
|
void unpack_t::load_library_hook( uc_engine *uc_ctx, unpack_t *obj )
|
|
{
|
|
uc_err err;
|
|
std::uintptr_t rcx = 0ull;
|
|
|
|
if ( ( err = uc_reg_read( uc_ctx, UC_X86_REG_RCX, &rcx ) ) )
|
|
{
|
|
std::printf( "> uc_reg_read error, reason = %d\n", err );
|
|
return;
|
|
}
|
|
|
|
char buff[ 256 ];
|
|
uc_strcpy( uc_ctx, buff, rcx );
|
|
std::printf( "> LoadLibraryA(\"%s\")\n", buff );
|
|
|
|
auto module_base = reinterpret_cast< std::uintptr_t >( LoadLibraryA( buff ) );
|
|
|
|
auto module_size =
|
|
reinterpret_cast< win::image_t<> * >( module_base )->get_nt_headers()->optional_header.size_image;
|
|
|
|
if ( std::find( obj->loaded_modules.begin(), obj->loaded_modules.end(), module_base ) !=
|
|
obj->loaded_modules.end() )
|
|
{
|
|
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &module_base ) ) )
|
|
{
|
|
std::printf( "> failed to set rax... reason = %d\n", err );
|
|
return;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if ( ( err = uc_mem_map( uc_ctx, module_base, module_size, UC_PROT_ALL ) ) )
|
|
{
|
|
std::printf( "> failed to load library... reason = %d\n", err );
|
|
return;
|
|
}
|
|
|
|
if ( ( err = uc_mem_write( uc_ctx, module_base, reinterpret_cast< void * >( module_base ), module_size ) ) )
|
|
{
|
|
std::printf( "> failed to copy module into emulator... reason = %d\n", err );
|
|
return;
|
|
}
|
|
|
|
if ( ( err = uc_reg_write( uc_ctx, UC_X86_REG_RAX, &module_base ) ) )
|
|
{
|
|
std::printf( "> failed to set rax... reason = %d\n", err );
|
|
return;
|
|
}
|
|
|
|
obj->loaded_modules.push_back( module_base );
|
|
}
|
|
}
|
|
|
|
void unpack_t::uc_strcpy( uc_engine *uc_ctx, char *buff, std::uintptr_t addr )
|
|
{
|
|
uc_err err;
|
|
char i = 0u;
|
|
auto idx = 0ul;
|
|
|
|
do
|
|
{
|
|
if ( ( err = uc_mem_read( uc_ctx, addr + idx, &i, sizeof i ) ) )
|
|
break;
|
|
|
|
} while ( ( buff[ idx++ ] = i ) );
|
|
}
|
|
|
|
bool unpack_t::iat_dispatcher( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack )
|
|
{
|
|
auto vec = address - IAT_VECTOR_TABLE;
|
|
for ( auto &[ iat_name, iat_hook_data ] : unpack->iat_hooks )
|
|
{
|
|
if ( iat_hook_data.first == vec )
|
|
{
|
|
std::printf( "> hooking import = %s\n", iat_name.c_str() );
|
|
iat_hook_data.second( uc, unpack );
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
bool unpack_t::code_exec_callback( uc_engine *uc, uint64_t address, uint32_t size, unpack_t *unpack )
|
|
{
|
|
static ZydisDecoder decoder;
|
|
static ZydisFormatter formatter;
|
|
static ZydisDecodedInstruction instr;
|
|
|
|
if ( static std::atomic< bool > once{ false }; !once.exchange( true ) )
|
|
{
|
|
ZydisDecoderInit( &decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_ADDRESS_WIDTH_64 );
|
|
ZydisFormatterInit( &formatter, ZYDIS_FORMATTER_STYLE_INTEL );
|
|
}
|
|
|
|
auto instr_ptr = reinterpret_cast< void * >( unpack->map_bin.data() + ( address - unpack->img_base ) );
|
|
if ( ZYAN_SUCCESS( ZydisDecoderDecodeBuffer( &decoder, instr_ptr, PAGE_4KB, &instr ) ) )
|
|
{
|
|
if ( instr.mnemonic == ZYDIS_MNEMONIC_CALL && instr.operands[ 0 ].type == ZYDIS_OPERAND_TYPE_REGISTER &&
|
|
instr.operands[ 0 ].reg.value == ZYDIS_REGISTER_RAX )
|
|
{
|
|
std::uintptr_t rax = 0u, rip = 0u;
|
|
uc_reg_read( uc, UC_X86_REG_RAX, &rax );
|
|
uc_reg_read( uc, UC_X86_REG_RIP, &rip );
|
|
|
|
if ( rax > unpack->img_base + unpack->img_size ) // skip calls to kernel32.dll...
|
|
{
|
|
rip += instr.length;
|
|
uc_reg_write( uc, UC_X86_REG_RIP, &rip );
|
|
}
|
|
}
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
bool unpack_t::unpack_section_callback( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value,
|
|
unpack_t *unpack )
|
|
{
|
|
if ( address == unpack->pack_section_offset + unpack->img_base )
|
|
{
|
|
std::printf( "> dumping...\n" );
|
|
uc_emu_stop( uc );
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
void unpack_t::invalid_mem( uc_engine *uc, uc_mem_type type, uint64_t address, int size, int64_t value,
|
|
unpack_t *unpack )
|
|
{
|
|
switch ( type )
|
|
{
|
|
case UC_MEM_READ_UNMAPPED:
|
|
std::printf( ">>> reading invalid memory at address = 0x%p, size = 0x%x\n", address, size );
|
|
break;
|
|
case UC_MEM_WRITE_UNMAPPED:
|
|
std::printf( ">>> writing invalid memory at address = 0x%p, size = 0x%x, val = 0x%x\n", address, size,
|
|
value );
|
|
break;
|
|
case UC_MEM_FETCH_UNMAPPED:
|
|
{
|
|
std::printf( ">>> fetching invalid instructions at address = 0x%p\n", address );
|
|
break;
|
|
}
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
} // namespace engine
|