From 661b73df47caae2cc62a9a2f7b85eb925ff1f80b Mon Sep 17 00:00:00 2001 From: auth12 <67507608+auth12@users.noreply.github.com> Date: Sun, 4 Jul 2021 01:15:09 +0100 Subject: initial commit --- .gitignore | 45 +++++ .gitmodules | 9 + modules/linuxpe | 1 + modules/phnt | 1 + modules/spdlog | 1 + sysmap.sln | 31 +++ sysmap/src/context.h | 8 + sysmap/src/include.h | 28 +++ sysmap/src/io.h | 41 ++++ sysmap/src/main.cpp | 59 ++++++ sysmap/src/mapper/apiset.h | 41 ++++ sysmap/src/mapper/pe.h | 118 +++++++++++ sysmap/src/mapper/process.h | 458 ++++++++++++++++++++++++++++++++++++++++++ sysmap/src/mapper/syscalls.h | 116 +++++++++++ sysmap/src/mapper/util.h | 52 +++++ sysmap/sysmap.vcxproj | 163 +++++++++++++++ sysmap/sysmap.vcxproj.filters | 48 +++++ sysmap/sysmap.vcxproj.user | 6 + 18 files changed, 1226 insertions(+) create mode 100644 .gitignore create mode 100644 .gitmodules create mode 160000 modules/linuxpe create mode 160000 modules/phnt create mode 160000 modules/spdlog create mode 100644 sysmap.sln create mode 100644 sysmap/src/context.h create mode 100644 sysmap/src/include.h create mode 100644 sysmap/src/io.h create mode 100644 sysmap/src/main.cpp create mode 100644 sysmap/src/mapper/apiset.h create mode 100644 sysmap/src/mapper/pe.h create mode 100644 sysmap/src/mapper/process.h create mode 100644 sysmap/src/mapper/syscalls.h create mode 100644 sysmap/src/mapper/util.h create mode 100644 sysmap/sysmap.vcxproj create mode 100644 sysmap/sysmap.vcxproj.filters create mode 100644 sysmap/sysmap.vcxproj.user diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3bb30db --- /dev/null +++ b/.gitignore @@ -0,0 +1,45 @@ +#Auto generated files +.vs/* +sysmap/obj/* + +#Visual studio files +*.tlog + +# Prerequisites +*.d + +# Compiled Object files +*.slo +*.lo +*.o +*.obj +*.ipch +*.suo +*.db + +# Precompiled Headers +*.gch +*.pch + +# Compiled Dynamic libraries +*.so +*.dylib +*.dll + +# Fortran module files +*.mod +*.smod + +# Compiled Static libraries +*.lai +*.la +*.a +*.lib + +# Executables +*.exe +*.out +*.app +.DS_Store +*.sqlite +*.pdb diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..5f79fb2 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,9 @@ +[submodule "modules/spdlog"] + path = modules/spdlog + url = https://github.com/gabime/spdlog.git +[submodule "modules/linuxpe"] + path = modules/linuxpe + url = https://github.com/can1357/linux-pe.git +[submodule "modules/phnt"] + path = modules/phnt + url = https://github.com/processhacker/phnt.git diff --git a/modules/linuxpe b/modules/linuxpe new file mode 160000 index 0000000..db2b7af --- /dev/null +++ b/modules/linuxpe @@ -0,0 +1 @@ +Subproject commit db2b7af6e6beae1bc391ff8f8e5c97b963dc3258 diff --git a/modules/phnt b/modules/phnt new file mode 160000 index 0000000..190fbb0 --- /dev/null +++ b/modules/phnt @@ -0,0 +1 @@ +Subproject commit 190fbb00f1d3f541441ee0bc6f220ee9eff5e64a diff --git a/modules/spdlog b/modules/spdlog new file mode 160000 index 0000000..21413e5 --- /dev/null +++ b/modules/spdlog @@ -0,0 +1 @@ +Subproject commit 21413e599a8bae53bb8e49360849bfae32334a72 diff --git a/sysmap.sln b/sysmap.sln new file mode 100644 index 0000000..e6074a1 --- /dev/null +++ b/sysmap.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.31402.337 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "sysmap", "sysmap\sysmap.vcxproj", "{BF998D5B-57F5-42EB-B644-2B38EC4CC048}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Debug|x64.ActiveCfg = Debug|x64 + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Debug|x64.Build.0 = Debug|x64 + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Debug|x86.ActiveCfg = Debug|Win32 + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Debug|x86.Build.0 = Debug|Win32 + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Release|x64.ActiveCfg = Release|x64 + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Release|x64.Build.0 = Release|x64 + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Release|x86.ActiveCfg = Release|Win32 + {BF998D5B-57F5-42EB-B644-2B38EC4CC048}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {699B3DD4-B2CD-4599-8072-353A0DFED075} + EndGlobalSection +EndGlobal diff --git a/sysmap/src/context.h b/sysmap/src/context.h new file mode 100644 index 0000000..cb604eb --- /dev/null +++ b/sysmap/src/context.h @@ -0,0 +1,8 @@ +#pragma once + +struct mapper_context_t { + std::vector local_modules; + std::string win_path; +}; + +extern mapper_context_t g_ctx; \ No newline at end of file diff --git a/sysmap/src/include.h b/sysmap/src/include.h new file mode 100644 index 0000000..ebd4953 --- /dev/null +++ b/sysmap/src/include.h @@ -0,0 +1,28 @@ +#pragma once + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +using namespace std::chrono_literals; + +using u8 = uint8_t; +using u16 = uint16_t; +using u32 = uint32_t; +using u64 = uint64_t; \ No newline at end of file diff --git a/sysmap/src/io.h b/sysmap/src/io.h new file mode 100644 index 0000000..b498065 --- /dev/null +++ b/sysmap/src/io.h @@ -0,0 +1,41 @@ +#pragma once + +#include +#include +#include +#include + +enum log_lvl { + trace = 0, + debug, + info, + warn, + error, + critical +}; + +namespace io { + template + void log(std::string_view msg, Args... params) { + spdlog::log(static_cast(T), msg.data(), std::forward(params)...); + } + + static std::vector read_file(std::string_view name) { + std::ifstream file(name.data(), std::ios::binary); + if (!file.good()) { + return {}; + } + + std::vector out; + + file.seekg(0, std::ios::end); + std::streampos length = file.tellg(); + file.seekg(0, std::ios::beg); + + out.resize(length); + + file.read((char*)out.data(), length); + + return out; + } +}; \ No newline at end of file diff --git a/sysmap/src/main.cpp b/sysmap/src/main.cpp new file mode 100644 index 0000000..871be35 --- /dev/null +++ b/sysmap/src/main.cpp @@ -0,0 +1,59 @@ +#include "include.h" +#include "io.h" +#include "mapper/util.h" +#include "mapper/pe.h" + +#include "context.h" + +#include "mapper/syscalls.h" +#include "mapper/apiset.h" + +#include "mapper/process.h" + +mapper_context_t g_ctx; +syscalls_t g_syscalls; +apiset_t g_apiset; + + +int main(int argc, char* argv[]) { + std::vector args; + + for (int i = 1; i < argc; ++i) { + args.emplace_back(argv[i]); + } + + if (args.size() < 2) { + io::log("Invalid arguments specified."); + return 0; + } + + spdlog::set_pattern("[%^%l%$] %v"); + + for (auto& arg : args) { + if (arg == "--debug") { + spdlog::set_level(spdlog::level::debug); + } + } + + g_ctx.local_modules = std::move(util::get_modules()); + + auto ntdll = g_ctx.local_modules[1]; + + g_ctx.win_path = ntdll.full_path.substr(0, ntdll.full_path.size() - ntdll.name.size()); + + g_syscalls.init(); + + process::process_x64_t proc; + if (NT_SUCCESS(proc.attach(args[0]))) { + io::log("attached!"); + + proc.modules = proc.get_modules(); + + proc.map(io::read_file(args[1])); + + proc.close(proc.handle); + } + + std::cin.get(); + return 0; +} \ No newline at end of file diff --git a/sysmap/src/mapper/apiset.h b/sysmap/src/mapper/apiset.h new file mode 100644 index 0000000..2797f8f --- /dev/null +++ b/sysmap/src/mapper/apiset.h @@ -0,0 +1,41 @@ +#pragma once + +struct apiset_t { + std::unordered_map> apiset_map; + + apiset_t() { + auto map = util::get_teb()->ProcessEnvironmentBlock->ApiSetMap; + auto map_ptr = uintptr_t(map); + + for (size_t i = 0; i < map->Count; i++) { + auto hash_entry = reinterpret_cast(map_ptr + map->HashOffset + (i * sizeof(API_SET_HASH_ENTRY))); + + auto namespace_entry = reinterpret_cast(map_ptr + map->EntryOffset + (hash_entry->Index * sizeof(API_SET_NAMESPACE_ENTRY))); + + std::wstring name(reinterpret_cast(map_ptr + namespace_entry->NameOffset), namespace_entry->NameLength / sizeof(wchar_t)); + + auto val_entry = reinterpret_cast(map_ptr + namespace_entry->ValueOffset); + + for (size_t j = 0; j < namespace_entry->ValueCount; j++, val_entry++) { + std::wstring val(reinterpret_cast(map_ptr + val_entry->ValueOffset), val_entry->ValueLength / sizeof(wchar_t)); + if (val.empty()) { + continue; + } + + apiset_map[util::to_multibyte(name)].emplace_back(util::to_multibyte(val)); + } + } + } + + std::string resolve(std::string_view mod) { + for (auto& [api, host] : apiset_map) { + if (mod.find(api) != std::string::npos) { + return host.front().compare(mod.data()) != 0 ? host.front() : host.back(); + } + } + + return mod.data(); + } +}; + +extern apiset_t g_apiset; \ No newline at end of file diff --git a/sysmap/src/mapper/pe.h b/sysmap/src/mapper/pe.h new file mode 100644 index 0000000..9841cb2 --- /dev/null +++ b/sysmap/src/mapper/pe.h @@ -0,0 +1,118 @@ +#pragma once + +#include + +namespace pe { + struct export_data_t { + uintptr_t func_rva; + std::string f_mod; + std::string f_func; + }; + + struct image_t { + uintptr_t base; + std::unordered_map exports; + std::vector sections; + + image_t() : base{ 0 } { } + image_t(uintptr_t b) : base{ b } { + auto image = reinterpret_cast(b); + + auto nt = image->get_nt_headers(); + + for (auto &sec : nt->sections()) { + sections.emplace_back(sec); + } + + auto export_dir = b + nt->optional_header.data_directories.export_directory.rva; + auto export_size = nt->optional_header.data_directories.export_directory.size; + + auto exp = reinterpret_cast(export_dir); + + if (exp->num_functions == 0) return; + + auto names = reinterpret_cast(b + exp->rva_names); + auto funcs = reinterpret_cast(b + exp->rva_functions); + auto ords = reinterpret_cast(b + exp->rva_name_ordinals); + + if (!names || !funcs || !ords) return; + + for (size_t i{}; i < exp->num_names; i++) { + std::string name = reinterpret_cast(b + names[i]); + + export_data_t ret; + + ret.func_rva = funcs[ords[i]]; + + uintptr_t proc_addr = b + funcs[ords[i]]; + if (proc_addr > export_dir && proc_addr < export_dir + export_size) { + std::string forwarded_name = reinterpret_cast(proc_addr); + + size_t delim = forwarded_name.find('.'); + if (delim == std::string::npos) continue; + + ret.f_mod = forwarded_name.substr(0, delim + 1); + ret.f_mod.append("dll"); + + std::transform(ret.f_mod.begin(), ret.f_mod.end(), ret.f_mod.begin(), ::tolower); + + ret.f_func = forwarded_name.substr(delim + 1); + } + + + exports[name] = ret; + } + } + }; + + struct import_data_t { + std::string name; + uintptr_t rva; + }; + + struct raw_image_t { + win::nt_headers_x64_t* nt; + + std::unordered_map> imports; + std::unordered_map> relocs; + std::vector sections; + + raw_image_t(std::vector& buffer) { + auto image = reinterpret_cast(buffer.data()); + + nt = image->get_nt_headers(); + + for (auto& sec : nt->sections()) { + sections.emplace_back(sec); + } + + auto import_rva = nt->optional_header.data_directories.import_directory.rva; + + auto desc = image->rva_to_ptr(import_rva); + + for (uint32_t i = 0; i < desc->rva_name; i = desc->rva_name, ++desc) { + std::string mod = image->rva_to_ptr(desc->rva_name); + + auto thunk = image->rva_to_ptr(desc->rva_original_first_thunk); + + for (uint32_t index = 0; thunk->address; index += sizeof(u64), ++thunk) { + auto named_import = image->rva_to_ptr(thunk->address); + + if (!thunk->is_ordinal) { + std::transform(mod.begin(), mod.end(), mod.begin(), ::tolower); + + imports[mod].emplace_back(import_data_t{ reinterpret_cast(named_import->name), desc->rva_first_thunk + index }); + } + } + } + + auto reloc_dir = image->rva_to_ptr(nt->optional_header.data_directories.basereloc_directory.rva); + + for (auto* block = &reloc_dir->first_block; block->base_rva; block = block->next()) { + for (auto& entry : *block) { + relocs[block->base_rva].emplace_back(entry); + } + } + } + }; +}; \ No newline at end of file diff --git a/sysmap/src/mapper/process.h b/sysmap/src/mapper/process.h new file mode 100644 index 0000000..77f7185 --- /dev/null +++ b/sysmap/src/mapper/process.h @@ -0,0 +1,458 @@ +#pragma once + + +namespace process { + struct process_info_t { + std::string name; + u16 pid; + }; + + struct process_iterator { + void* buf = nullptr; + + void* get_next() { + static ptrdiff_t offset = offsetof(SYSTEM_PROCESS_INFORMATION, NextEntryOffset); + + auto next_entry = *reinterpret_cast(uintptr_t(buf) + offset); + + if (next_entry == 0) { + return nullptr; + } + + buf = reinterpret_cast(uintptr_t(buf) + next_entry); + + return buf; + } + }; + + std::vector get_processes() { + std::vector buf; + std::vector out; + + static auto nt_query = g_syscalls.get("NtQuerySystemInformation"); + + ULONG size; + while (nt_query(SystemProcessInformation, &buf[0], static_cast(buf.size()), &size) == STATUS_INFO_LENGTH_MISMATCH) { + buf.resize(size); + }; + + process_iterator iter{ buf.data() }; + + void* ptr = iter.buf; + while (ptr) { + auto pi = reinterpret_cast(ptr); + + std::wstring s{ pi->ImageName.Buffer, pi->ImageName.Length / sizeof(wchar_t) }; + if (s.empty()) { + ptr = iter.get_next(); + + continue; + } + + out.emplace_back(process_info_t{ util::to_multibyte(s), reinterpret_cast(pi->UniqueProcessId) }); + + ptr = iter.get_next(); + } + + return out; + } + + struct process_x64_t { + process_info_t info; + HANDLE handle; + + std::vector modules; + + NTSTATUS open_handle() { + static auto nt_open = g_syscalls.get("NtOpenProcess"); + CLIENT_ID cid = { HANDLE(info.pid), 0 }; + OBJECT_ATTRIBUTES oa; + oa.Length = sizeof(oa); + oa.Attributes = 0; + oa.RootDirectory = 0; + oa.SecurityDescriptor = 0; + oa.ObjectName = 0; + oa.SecurityQualityOfService = 0; + + auto ret = nt_open(&handle, PROCESS_ALL_ACCESS, &oa, &cid); + + io::log("NtOpenProcess on {}, returned {:x}.", info.pid, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS attach(std::string_view process_name) { + auto processes = get_processes(); + auto it = std::find_if(processes.begin(), processes.end(), [&](process_info_t& info) { + return process_name.compare(info.name) == 0; + }); + + while (it == processes.end()) { + std::this_thread::sleep_for(3s); + + processes = get_processes(); + + it = std::find_if(processes.begin(), processes.end(), [&](process_info_t& info) { + return process_name.compare(info.name) == 0; + }); + } + + info = *it; + + return open_handle(); + } + + NTSTATUS read(uintptr_t addr, void* buf, size_t size) { + static auto nt_read = g_syscalls.get("NtReadVirtualMemory"); + + auto ret = nt_read(handle, reinterpret_cast(addr), buf, size, nullptr); + + //io::log("NtReadVirtualMemory at {:x}, buf {:x}, size {:x}, returned {:x}.", addr, uintptr_t(buf), size, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS write(uintptr_t addr, void* buf, size_t size) { + static auto nt_write = g_syscalls.get("NtWriteVirtualMemory"); + + auto ret = nt_write(handle, reinterpret_cast(addr), buf, size, nullptr); + io::log("NtWriteVirtualMemory at {:x}, buf {:x}, size {:x}, returned {:x}.", addr, uintptr_t(buf), size, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS protect(uintptr_t addr, size_t size, uint32_t new_protection, uint32_t* old_protection) { + static auto nt_protect = g_syscalls.get("NtProtectVirtualMemory"); + + void* addr_cast = reinterpret_cast(addr); + auto ret = nt_protect(handle, &addr_cast, &size, new_protection, (PULONG)old_protection); + + io::log("NtProtectVirtualMemory at {:x}, size {:x}, new_protection {:x}, old_protection {:x}, returned {:x}.", addr, size, new_protection, *old_protection, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS query_info(PROCESSINFOCLASS inf, void* dat, size_t size) { + static auto nt_info = g_syscalls.get("NtQueryInformationProcess"); + + auto ret = nt_info(handle, inf, dat, static_cast(size), nullptr); + + io::log("NtQueryInformationProcess with {:x}, dat {:x}, size {:x}, returned {:x}.", (int)inf, uintptr_t(dat), size, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS alloc(uintptr_t* out, size_t size, uint32_t type, uint32_t protection) { + static auto nt_alloc = g_syscalls.get("NtAllocateVirtualMemory"); + + void* base = nullptr; + auto ret = nt_alloc(handle, &base, 0, &size, type, protection); + *out = uintptr_t(base); + + io::log("NtAllocateVirtualMemory allocated at {:x}, size {:x}, type {:x}, protection {:x}, returned {:x}.", *out, size, type, protection, ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS close(HANDLE handle) { + static auto nt_close = g_syscalls.get("NtClose"); + + auto ret = nt_close(handle); + io::log("NtClose on {:x}, returned {:x}.", uintptr_t(handle), ret & 0xFFFFFFFF); + + return ret; + } + + NTSTATUS get_peb(uintptr_t* out) { + PROCESS_BASIC_INFORMATION info; + auto status = query_info(ProcessBasicInformation, &info, sizeof(info)); + + *out = uintptr_t(info.PebBaseAddress); + + return status; + } + + std::vector get_modules() { + uintptr_t peb_ptr{ 0 }; + get_peb(&peb_ptr); + + PEB peb; + read(peb_ptr, &peb, sizeof(peb)); + + uintptr_t head = uintptr_t(peb.Ldr) + offsetof(PEB_LDR_DATA, InLoadOrderModuleList); + + LIST_ENTRY64 entry; + read(head, &entry, sizeof(entry)); + + LDR_DATA_TABLE_ENTRY ldr_entry; + std::vector ret; + + for (auto i = entry.Flink; i != head;) { + read(i, &ldr_entry, sizeof(ldr_entry)); + + i = uintptr_t(ldr_entry.InLoadOrderLinks.Flink); + + std::wstring ws; + ws.resize(ldr_entry.BaseDllName.Length); + + read(uintptr_t(ldr_entry.BaseDllName.Buffer), &ws[0], ws.size()); + + auto name = util::to_multibyte(ws); + + std::transform(name.begin(), name.end(), name.begin(), ::tolower); + + ret.emplace_back(util::module_data_t{ name, uintptr_t(ldr_entry.DllBase), ldr_entry.SizeOfImage }); + } + + return ret; + } + + uintptr_t get_module_export(util::module_data_t* module_info, std::string_view func) { + std::vector mapped_module(module_info->size); + + auto status = read(module_info->base, mapped_module.data(), mapped_module.size()); + if (!NT_SUCCESS(status)) { + return {}; + } + + pe::image_t img(uintptr_t(mapped_module.data())); + + return img.exports[func.data()].func_rva; + } + + auto get_module_exports(util::module_data_t* module_info) -> std::unordered_map { + if (!module_info->base) { + return {}; + } + + std::vector mapped_module(module_info->size); + + auto status = read(module_info->base, mapped_module.data(), mapped_module.size()); + if (!NT_SUCCESS(status)) { + return {}; + } + + pe::image_t img(uintptr_t(mapped_module.data())); + + return img.exports; + } + + util::module_data_t map_module(std::string_view name) { + auto resolved_name = g_apiset.resolve(name); + auto it = std::find_if(modules.begin(), modules.end(), [&](util::module_data_t& data) { + return data.name == resolved_name; + }); + + if (it != modules.end()) { + return *it; + } + + auto file = io::read_file(g_ctx.win_path.append(resolved_name)); + if (file.empty()) { + io::log("failed to read {}", resolved_name); + return {}; + } + + pe::raw_image_t image(file); + auto nt = image.nt; + + std::vector mapped_image(nt->optional_header.size_image); + + std::memcpy(&mapped_image[0], &file[0], nt->optional_header.size_headers); + for (auto& sec : image.sections) { + std::memcpy(&mapped_image[sec.virtual_address], &file[sec.ptr_raw_data], sec.size_raw_data); + } + + uintptr_t allocation_base{ 0 }; + auto status = alloc(&allocation_base, mapped_image.size(), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + if (!NT_SUCCESS(status)) { + io::log("failed to allocate memory for {}", resolved_name); + return {}; + } + + io::log("mapping {} to {:x}", resolved_name, allocation_base); + + io::log("fixing {} relocations...", resolved_name); + + auto delta = allocation_base - nt->optional_header.image_base; + if (delta > 0) { + for (auto& [block_rva, entries] : image.relocs) { + for (auto& e : entries) { + if (e.type == win::rel_based_high_low || e.type == win::rel_based_dir64) { + *reinterpret_cast(&mapped_image[block_rva + e.offset]) += delta; + } + } + } + } + + io::log("resolving {} imports...", resolved_name); + for (auto& [mod, funcs] : image.imports) { + auto mod_data = map_module(mod); + auto exports = get_module_exports(&mod_data); + + for (auto& f : funcs) { + auto exp_data = exports[f.name]; + + uintptr_t proc_addr{ 0 }; + if (!exp_data.f_mod.empty()) { + auto f_mod_data = map_module(exp_data.f_mod); + + proc_addr = f_mod_data.base + get_module_export(&f_mod_data, exp_data.f_func); + + io::log("{}!{}->{}!{}->{:x}", mod, f.name, exp_data.f_mod, exp_data.f_func, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + + continue; + } + + proc_addr = mod_data.base + exports[f.name].func_rva; + + io::log("{}!{}->{:x}", mod, f.name, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + } + } + + + io::log("writing {} image...", resolved_name); + status = write(allocation_base, mapped_image.data(), mapped_image.size()); + if (!NT_SUCCESS(status)) { + io::log("failed to write mapped image for {}", resolved_name); + return {}; + } + + io::log("fixing {} section permissions...", resolved_name); + for (auto& sec : image.sections) { + uintptr_t addr = allocation_base + sec.virtual_address; + uint32_t prot; + if (sec.characteristics.mem_execute) { + prot = PAGE_EXECUTE; + + if (sec.characteristics.mem_read) { + prot = PAGE_EXECUTE_READ; + } + + if (sec.characteristics.mem_write) { + prot = PAGE_EXECUTE_READWRITE; + } + } + else { + prot = PAGE_NOACCESS; + if (sec.characteristics.mem_read) { + prot = PAGE_READONLY; + } + + if (sec.characteristics.mem_write) { + prot = PAGE_READWRITE; + } + } + + uint32_t old_protection; + status = protect(addr, sec.size_raw_data, prot, &old_protection); + if (!NT_SUCCESS(status)) { + io::log("failed to set section permissions on {} for {}", sec.name.to_string(), resolved_name); + continue; + } + } + + io::log("successfully mapped {}", resolved_name); + + return util::module_data_t{ resolved_name, allocation_base, mapped_image.size() }; + } + + util::module_data_t map(std::vector file) { + pe::raw_image_t image(file); + auto nt = image.nt; + + std::vector mapped_image(nt->optional_header.size_image); + + for (auto& sec : image.sections) { + std::memcpy(&mapped_image[sec.virtual_address], &file[sec.ptr_raw_data], sec.size_raw_data); + } + + uintptr_t allocation_base{ 0 }; + auto status = alloc(&allocation_base, mapped_image.size(), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + if (!NT_SUCCESS(status)) { + io::log("failed to allocate memory for target image"); + return {}; + } + + io::log("mapping target image to {:x}", allocation_base); + + const u16 headers_size = 4096; + + io::log("fixing target image relocations..."); + + auto delta = allocation_base - nt->optional_header.image_base; + if (delta > 0) { + for (auto& [block_rva, entries] : image.relocs) { + for (auto& e : entries) { + if (e.type == win::rel_based_high_low || e.type == win::rel_based_dir64) { + *reinterpret_cast(&mapped_image[block_rva + e.offset]) += delta - headers_size; + } + } + } + } + + io::log("resolving target image imports..."); + for (auto& [mod, funcs] : image.imports) { + auto mod_data = map_module(mod); + auto exports = get_module_exports(&mod_data); + + for (auto& f : funcs) { + auto exp_data = exports[f.name]; + + uintptr_t proc_addr{ 0 }; + if (!exp_data.f_mod.empty()) { + auto f_mod_data = map_module(exp_data.f_mod); + + proc_addr = f_mod_data.base + get_module_export(&f_mod_data, exp_data.f_func); + + io::log("{}!{}->{}!{}->{:x}", mod, f.name, exp_data.f_mod, exp_data.f_func, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + + continue; + } + + proc_addr = mod_data.base + exports[f.name].func_rva; + + io::log("{}!{}->{:x}", mod, f.name, proc_addr); + + *reinterpret_cast(&mapped_image[f.rva]) = proc_addr; + } + } + + + io::log("writing target image..."); + status = write(allocation_base, mapped_image.data() + headers_size, mapped_image.size() - headers_size); + if (!NT_SUCCESS(status)) { + io::log("failed to write mapped image"); + return {}; + } + + static std::vector shellcode = { 0x48, 0x83, 0xEC, 0x28, 0x48, 0xB9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0xC2,0x01, 0x00, 0x00, 0x00, 0x4D, 0x31, 0xC0, + 0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD0, 0x48, 0x83, 0xC4, 0x28, 0xC3 }; + + *reinterpret_cast(&shellcode[6]) = allocation_base; + *reinterpret_cast(&shellcode[26]) = allocation_base + nt->optional_header.entry_point - headers_size; + + uintptr_t shellcode_base; + alloc(&shellcode_base, shellcode.size(), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); + + io::log("writing shellcode at {:x}...", shellcode_base); + + write(shellcode_base, shellcode.data(), shellcode.size()); + + CreateRemoteThread(handle, 0, 0, (LPTHREAD_START_ROUTINE)shellcode_base, 0, 0, 0); + + io::log("mapped target image"); + + return util::module_data_t{ "", allocation_base, mapped_image.size() }; + } + }; +} \ No newline at end of file diff --git a/sysmap/src/mapper/syscalls.h b/sysmap/src/mapper/syscalls.h new file mode 100644 index 0000000..d7b917d --- /dev/null +++ b/sysmap/src/mapper/syscalls.h @@ -0,0 +1,116 @@ +#pragma once + +struct syscalls_t { + void* call_table; + std::vector stub; + + std::unordered_map syscalls; + + syscalls_t() : call_table{nullptr} {} + + void init() { + auto ntdll_base = g_ctx.local_modules[1].base; + auto ntdll = pe::image_t(ntdll_base); + + u32 max_index = 0; + for (auto& [name, exp_data] : ntdll.exports) { + auto fn = reinterpret_cast(ntdll_base + exp_data.func_rva); + auto size = get_size(fn); + + if (!is_valid(fn, size)) { + continue; + } + + if (stub.empty()) { + for (size_t i = 0; i < size; i++) { + if (fn[i] == x64::test_imm8) { // skip and + i += 9; + continue; + } + + stub.emplace_back(fn[i]); + } + } + + u32 idx = get_idx(fn, size); + + if (idx > max_index) + max_index = idx; + + syscalls[name] = idx; + } + + size_t table_size = stub.size() * (max_index + 1); + + call_table = VirtualAlloc(0, table_size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); + + if (!call_table) { + io::log("failed to allocated syscall call table."); + return; + } + + io::log("syscall call table allocated at {:x}.", uintptr_t(call_table)); + + std::memset(call_table, x64::nop, table_size); + + for (auto& [hash, index] : syscalls) { + uintptr_t func_dest = uintptr_t(call_table) + (index * stub.size()); + std::memcpy(reinterpret_cast(func_dest), stub.data(), stub.size()); + + *reinterpret_cast(func_dest + 4) = index; + } + + DWORD old; + VirtualProtect(call_table, table_size, PAGE_EXECUTE, &old); + } + + template< typename T = void* > + __forceinline T get(std::string_view fn) { + return reinterpret_cast(uintptr_t(call_table) + (syscalls[fn.data()] * stub.size())); + } + + + uint16_t get_idx(u8 *fn, size_t size) { + for (size_t i = 0; i < size; i++) { + auto op = fn[i]; + if (op == x64::mov_imm16) { + return *reinterpret_cast(&fn[i + 1]); + } + } + + return 0; + } + + size_t get_size(const u8* func) { + for (size_t i = 0; i < 64; i++) { + auto op = func[i]; + if (op == x64::retn) { + return i + 1; + } + } + + return 0; + } + + bool is_valid(u8* func, size_t size) { + // mov r10, rcx + u32 a = func[0] + func[1] + func[2]; + if (a != 0x1a8) { + return false; + } + + for (size_t i = 0; i < size; i++) { + auto cur = func[i]; + auto next = func[i + 1]; + + // syscall + if (cur == 0x0f && next == 0x05) { + return true; + } + } + + return false; + } +}; + +extern syscalls_t g_syscalls; \ No newline at end of file diff --git a/sysmap/src/mapper/util.h b/sysmap/src/mapper/util.h new file mode 100644 index 0000000..f50192b --- /dev/null +++ b/sysmap/src/mapper/util.h @@ -0,0 +1,52 @@ +#pragma once + +namespace util { + struct module_data_t { + std::string name; + uintptr_t base; + size_t size; + std::string full_path; + }; + + std::string to_multibyte(std::wstring_view str) { + return std::filesystem::path(str.data()).string(); + } + + std::wstring to_wide(std::string_view str) { + return std::filesystem::path(str.data()).wstring(); + } + + TEB* get_teb() { + return reinterpret_cast(__readgsqword(0x30)); + } + + std::vector get_modules() { + std::vector ret{}; + + auto* list = &get_teb()->ProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList; + + for (auto i = list->Flink; i != list; i = i->Flink) { + auto entry = CONTAINING_RECORD(i, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); + if (!entry) + continue; + + auto name = util::to_multibyte(entry->BaseDllName.Buffer); + std::transform(name.begin(), name.end(), name.begin(), tolower); + + auto full_path = util::to_multibyte(entry->FullDllName.Buffer); + + ret.emplace_back(module_data_t{name, uintptr_t(entry->DllBase), entry->SizeOfImage, full_path}); + } + + return ret; + } +}; + +namespace x64 { + enum inst : uint8_t { + retn = 0xC3, + mov_imm16 = 0xB8, + nop = 0x90, + test_imm8 = 0xF6 + }; +}; \ No newline at end of file diff --git a/sysmap/sysmap.vcxproj b/sysmap/sysmap.vcxproj new file mode 100644 index 0000000..a42f5d0 --- /dev/null +++ b/sysmap/sysmap.vcxproj @@ -0,0 +1,163 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {bf998d5b-57f5-42eb-b644-2b38ec4cc048} + sysmap + 10.0.18362.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + $(SolutionDir)bin\$(Platform)\$(Configuration)\ + obj\$(Platform)\$(Configuration)\ + $(SolutionDir)modules\phnt\;$(SolutionDir)modules\linuxpe\includes\;$(SolutionDir)modules\spdlog\include\;$(IncludePath) + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + MultiThreaded + + + Console + true + true + true + RequireAdministrator + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/sysmap/sysmap.vcxproj.filters b/sysmap/sysmap.vcxproj.filters new file mode 100644 index 0000000..0d19da0 --- /dev/null +++ b/sysmap/sysmap.vcxproj.filters @@ -0,0 +1,48 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + Header Files + + + \ No newline at end of file diff --git a/sysmap/sysmap.vcxproj.user b/sysmap/sysmap.vcxproj.user new file mode 100644 index 0000000..966b4ff --- /dev/null +++ b/sysmap/sysmap.vcxproj.user @@ -0,0 +1,6 @@ + + + + true + + \ No newline at end of file -- cgit v1.2.3