{"id":1212,"date":"2016-03-13T03:47:28","date_gmt":"2016-03-13T03:47:28","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=1212"},"modified":"2016-03-13T03:47:56","modified_gmt":"2016-03-13T03:47:56","slug":"detours-trampolines-and-code-caves","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2016\/03\/detours-trampolines-and-code-caves\/","title":{"rendered":"Detours, Trampolines, and Code Caves"},"content":{"rendered":"

Howdy fellow RE folk!<\/p>\n

Today I’d like to cover the basics of detours, trampolines, and code caves. <\/p>\n

Traditionally, if one wanted to expand functionality to a program, they have to look for whats called a ‘code cave’, which is just a contiguous piece of (executable) memory. You replace a piece of code (typically a function prologue) with a long jump to your code. Of course its never easy to do this – if the Import Address Table doesn’t have the reference to the function \/ dll pair, calling a function will fail. If you wanted to do this statically, you would have to modify the IAT (pain in the ass BTW) to include the functions you’re calling. This isn’t always feasible, especially with packed programs and other programs which depend on check sums. That said, its best to do this sort of thing at run time. <\/p>\n

For those of you wondering how to do this statically, I figured out how to do modify the IAT in C#. You never know if you’ll need this code:<\/p>\n

<\/p>\n

\n
private<\/span> void<\/span> AddToIAT(byte<\/span>[] codestuff, string<\/span> path)\r\n{\r\n    PeHeaderReader lolpe = new<\/span> PeHeaderReader(this<\/span>.tbfilehere.Text);\r\n    UInt32 ImportDirectoryRVA = lolpe.OptionalHeader32.ImportTable.VirtualAddress; \/\/ RVA<\/span>\r\n    FileStream fs = new<\/span> FileStream(path, FileMode.Open);\r\n    BinaryWriter bw = new<\/span> BinaryWriter(fs);\r\n    BinaryReader br = new<\/span> BinaryReader(fs);\r\n    fs.Seek(0x3c, SeekOrigin.Begin); \/\/ go to the value of e_lfanew<\/span>\r\n    int<\/span> my_e_lfanew = br.ReadInt32();\r\n    UInt32 joe = RvaToOffsetJoe(lolpe, ImportDirectoryRVA) + (UInt32)my_e_lfanew;\r\n    \/\/ try seeking to the imports area first dumbass or better yet, importdirectoryVA + the <\/span>\r\n\t\/\/ length of the last entry (lolpe.OptionalHeader32.ImportTable.Size;)<\/span>\r\n\r\n    fs.Seek(RvaToOffsetJoe(lolpe, ImportDirectoryRVA), SeekOrigin.Begin); \r\n    bw.Write(ImportDirectoryRVA + 40);\r\n    bw.Write(0);\r\n    bw.Write(0);\r\n    bw.Write(ImportHintNameTableRVA(lolpe) + 14);\r\n    bw.Write(ImportDirectoryRVA);\r\n    bw.Write(new<\/span> byte<\/span>[20]); \r\n    bw.Write(ImportHintNameTableRVA(lolpe));\r\n    int<\/span> size = 48;\r\n\tif<\/span> (lolpe.FileHeader.Machine != 0x014C) \/\/ if not 32 bit<\/span>\r\n\t{\r\n\tsize += 4;\r\n\tbw.Write(0);\r\n\t}\r\n\tbw.Write(0);\r\n\r\n\tfor<\/span> (int<\/span> i = (int<\/span>)(ImportHintNameTableRVA(lolpe) - \r\n\t(ImportDirectoryRVA + size)); i > 0; i--)\r\n\t{\r\n\tbw.Write((byte<\/span>)0);\r\n\t}\r\n\r\n    bw.Write((ushort<\/span>)0);\r\n    bw.Write(System.Text.Encoding.ASCII.GetBytes("FatalAppExitA"<\/span>));\r\n    bw.Write(0);\r\n    bw.Write(System.Text.Encoding.ASCII.GetBytes("kernel32.dll"<\/span>));\r\n    bw.Write((ushort<\/span>)0);\r\n    fs.Close();\r\n}\r\n\r\n\t\r\nUInt32 RvaToOffsetJoe(PeHeaderReader lolpe, UInt32 Rva)\r\n{\r\n\tint<\/span> o;\r\n\tint<\/span> secx = lolpe.FileHeader.NumberOfSections;\r\n\tfor<\/span>(o=0;o<secx;o++)\r\n\t{\r\n\t\tif<\/span> (Rva >= lolpe.ImageSectionHeaders[o].VirtualAddress && Rva\r\n\t\t< lolpe.ImageSectionHeaders[o].VirtualAddress + \r\n\t\tMath.Max(lolpe.ImageSectionHeaders[o].VirtualSize, lolpe.ImageSectionHeaders[o].SizeOfRawData))\r\n\t\t{\r\n\t\treturn<\/span> (UInt32)(Rva - lolpe.ImageSectionHeaders[o].VirtualAddress) + \r\n\t\t(lolpe.ImageSectionHeaders[o].PointerToRawData);\r\n\t\t}\r\n\t\r\n\t}\r\n    throw<\/span> new<\/span> Exception("Failed to convert RVA"<\/span>);\r\n}\r\n<\/pre>\n<\/div>\n
\"1453959088604\"<\/a><\/p>\n
How would this be done dynamically? Many video game trainers do this kind of work. You’re basically obtaining the base address and calculating the offset of code in memory and performing peeks and pokes (Read\/WriteProcessMemory) to modify program code. Unfortunately, this means you have to roll your own implementation system, essentially re-inventing the wheel. I ain’t about to do that. Enter detours.<\/p>\n
The egg-heads at Microsoft have shared with us the Detours library<\/a>. The library provides a way to patch binaries live in memory without the use of a debugger and all in glorious C. I’m all for that. How it works is it employs the use of ‘trampolines’ that patch the first 5 bytes of a target api or sub procedure or function pointer to perform a long ‘jmp’ to controlled code. The code of your choosing is patched, and when you return, the bytes are restored. Sounds simple enough right? Its much easier when you can just call a library function to do this for you. One of my friends is like “joe, just roll your own” and I hate re-inventing the wheel. <\/p>\n
\"1457578413917\"<\/a><\/p>\n
Here’s a very basic program (compiled to a dll) that illustrates the use of the detours library:<\/p>\n
<\/p>\n
\n
#include "stdafx.h"<\/span>\r\n#include <windows.h><\/span>\r\n#include <detours.h><\/span>\r\n#pragma comment(lib, "detours.lib")<\/span>\r\n\r\n\r\n\/\/ Target pointer for the uninstrumented Sleep API.<\/span>\r\nstatic<\/span> VOID(WINAPI * TrueSleep)(DWORD dwMilliseconds) = Sleep;\r\n\/\/ Detour function that replaces the Sleep API.<\/span>\r\nVOID WINAPI AltSleep(DWORD dwMilliseconds)\r\n{\r\n\tFatalAppExitA(0, "I HATE SLEEPZ!"<\/span>);\r\n}\r\n\r\n\/\/ DllMain function attaches and detaches the AltSleep detour to the<\/span>\r\n\/\/ Sleep target function.  The Sleep target function is referred to<\/span>\r\n\/\/ through the TrueSleep target pointer.<\/span>\r\nextern<\/span> "C"<\/span> __declspec<\/span>(dllexport) void<\/span> DoNothingAlready(void<\/span>)\r\n{\r\n\tDWORD ayylmao = 20345;\r\n\t_asm\r\n\t{\r\n\t\txor eax, eax\r\n\t\t\txor ecx, ecx\r\n\t\t\tmov eax, ayylmao\r\n\t\t\tmov ecx, 0\r\n\t\ttestd:\r\n\t\tfnop\r\n\t\t\tinc ecx\r\n\t\t\tcmp eax, ecx\r\n\t\t\tjnz testd\r\n\t\t\tpop ebx\r\n\t\t\tnop\r\n\t}\r\n\treturn<\/span>;\r\n}\r\n\r\nBOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)\r\n{\r\n\tif<\/span> (DetourIsHelperProcess()) {\r\n\t\treturn<\/span> TRUE;\r\n\t}\r\n\r\n\tif<\/span> (dwReason == DLL_PROCESS_ATTACH) {\r\n\t\tDetourRestoreAfterWith();\r\n\r\n\t\tDetourTransactionBegin();\r\n\t\tDetourUpdateThread(GetCurrentThread());\r\n\t\tDetourAttach(&(PVOID&)TrueSleep, AltSleep);\r\n\t\tDetourTransactionCommit();\r\n\t}\r\n\telse<\/span> if<\/span> (dwReason == DLL_PROCESS_DETACH) {\r\n\t\tDetourTransactionBegin();\r\n\t\tDetourUpdateThread(GetCurrentThread());\r\n\t\tDetourDetach(&(PVOID&)TrueSleep, AltSleep);\r\n\t\tDetourTransactionCommit();\r\n\t}\r\n\treturn<\/span> TRUE;\r\n}\r\n<\/pre>\n<\/div>\n
Note the dummy external function ‘DoNothingAlready’ in the dll. You need at least 1 export present for this to work. <\/p>\n
The program I’m going to be modifying is my old keygen solution from an older project. I’ll be catching the Sleep API within the ‘GetKey’ function and replacing it with a call to ‘FatalAppExitA’.<\/p>\n
<\/p>\n
\n
#include <windows.h><\/span>\r\n#include <stdio.h><\/span>\r\n#define LoWord(l) ((WORD)(l))<\/span>\r\n#define HiWord(l) ((WORD)(((DWORD)(l) >> 16) & 0xFFFF)) <\/span>\/\/ pelles doesnt support hi \/ lo words <\/span>\r\n\/\/ which just splits and shifts the double word. whatever. <\/span>\r\nunsigned<\/span> long<\/span> GenKey(DWORD);\r\n\r\nint<\/span> main(int<\/span> argc, char<\/span> *argv[])\r\n{\r\n\tchar<\/span> root[MAX_PATH] = "C:\\\\"<\/span>;\r\n\tchar<\/span> volname[MAX_PATH];\r\n\tDWORD serial, maxname, flags;\r\n\tchar<\/span> fsName[128];\r\n\tDWORD fsNameLength;\tfsNameLength = sizeof<\/span>(fsName)-1;\r\n\tGetVolumeInformation(root, volname, MAX_PATH,&serial, &maxname, &flags, fsName, fsNameLength);\r\n\tprintf("Name of System: %s\\r\\n"<\/span>,fsName);\r\n\tif<\/span>(volname[0] == '\\0'<\/span>) \/\/ lol null<\/span>\r\n\t{\r\n\tprintf("No Volume name present\\r\\n"<\/span>);\r\n\t}\r\n\telse<\/span>\r\n\t{\r\n\tprintf("Volume Name: %s\\r\\n"<\/span>,volname);\r\n\t}\r\n\tprintf("Volume Serial Number: %x\\r\\n"<\/span>,serial);\r\n\tprintf("Your Special key: %x\\r\\n"<\/span>,GenKey(serial));\r\n\tSleep(50000);\r\n\tsystem("pause"<\/span>);\r\n\treturn<\/span> 0;\r\n}\r\n\r\nunsigned<\/span> long<\/span> GenKey(DWORD serial)\r\n{\r\nSleep(100000);\r\nDWORD seed1 = 4096;\r\nDWORD seed2 = HiWord(serial);\r\nDWORD retme = seed1 ^ serial * seed2;\r\nreturn<\/span> retme;\r\n}\r\n<\/pre>\n<\/div>\n
How do we get our dll to run inside this program? Basic dll injection wont work, so we have to use a special API to launch the process along side our dll to make this run.<\/p>\n
Our launcher employs the ‘DetourCreateProcessWithDllEx’ function from the detours lib to launch our special dll and program side by side:<\/p>\n
<\/p>\n
\n
#include "stdafx.h"<\/span>\r\n#include <Windows.h><\/span>\r\n#include <detours.h><\/span>\r\n#pragma comment(lib,"detours.lib")<\/span>\r\n\r\nint<\/span> _tmain(int<\/span> argc, _TCHAR* argv[])\r\n{\r\n\tif<\/span> (argc < 3)\r\n\t{\r\n\t\tprintf("Error, usage is %s 'target process' 'dll'\\r\\n"<\/span>, argv[0]);\r\n\t\treturn<\/span> 1;\r\n\t}\r\n\t_TCHAR *prog = argv[1];\r\n\t\r\n\tSTARTUPINFO si;\r\n\tPROCESS_INFORMATION pi;\r\n\r\n\tZeroMemory(&si, sizeof<\/span>(si));\r\n\tZeroMemory(&pi, sizeof<\/span>(pi));\r\n\tsi.cb = sizeof<\/span>(si);\r\n\tsi.dwFlags = STARTF_USESHOWWINDOW;\r\n\tsi.wShowWindow = SW_SHOW;\r\n\tif<\/span> (!DetourCreateProcessWithDllEx(prog,\r\n\t\tNULL, NULL, NULL, TRUE,\r\n\t\tCREATE_DEFAULT_ERROR_MODE | CREATE_SUSPENDED,\r\n\t\tNULL, NULL, &si, &pi,\r\n\t\t"ayy.dll"<\/span>, NULL))\r\n\t{\r\n\t\tMessageBox(0, L"failed"<\/span>, 0, 0);\r\n\t\treturn<\/span> 1;\r\n\t}\r\n\telse<\/span>\r\n\t{\r\n\t\tResumeThread(pi.hThread);\r\n\r\n\t\tWaitForSingleObject(pi.hProcess, INFINITE);\r\n\r\n\t\tCloseHandle(&si);\r\n\t\tCloseHandle(&pi);\r\n\t}\r\n\r\n\t\r\n\treturn<\/span> 0;\r\n}\r\n<\/pre>\n<\/div>\n
Here’s a quick video of this in action:<\/p>\n