Integrity experiments
This commit is contained in:
momo5502
parent
5f6b9f3bfe
commit
63d2acbde6
@ -5,8 +5,10 @@
|
||||
#include "steam/steam.hpp"
|
||||
#include <utils/hook.hpp>
|
||||
|
||||
#include "utils/finally.hpp"
|
||||
#include "utils/string.hpp"
|
||||
#include "utils/hardware_breakpoint.hpp"
|
||||
#include "utils/io.hpp"
|
||||
|
||||
#define ProcessDebugPort 7
|
||||
#define ProcessDebugObjectHandle 30 // WinXP source says 31?
|
||||
@ -390,10 +392,13 @@ namespace arxan
|
||||
loaded = true;
|
||||
}
|
||||
|
||||
const std::pair<uint8_t*, size_t>& get_text_section()
|
||||
const std::vector<std::pair<uint8_t*, size_t>>& get_text_sections()
|
||||
{
|
||||
static const std::pair<uint8_t*, size_t> text = []() -> std::pair<uint8_t*, size_t>
|
||||
static const std::vector<std::pair<uint8_t*, size_t>> text = [
|
||||
]() -> std::vector<std::pair<uint8_t*, size_t>>
|
||||
{
|
||||
std::vector<std::pair<uint8_t*, size_t>> texts;
|
||||
|
||||
const utils::nt::library game{};
|
||||
for (const auto& section : game.get_section_headers())
|
||||
{
|
||||
@ -402,69 +407,249 @@ namespace arxan
|
||||
|
||||
if (name == ".text"s)
|
||||
{
|
||||
return {game.get_ptr() + section->VirtualAddress, section->Misc.VirtualSize};
|
||||
texts.emplace_back(game.get_ptr() + section->VirtualAddress, section->Misc.VirtualSize);
|
||||
}
|
||||
}
|
||||
|
||||
return {nullptr, 0};
|
||||
return texts;
|
||||
}
|
||||
();
|
||||
|
||||
return text;
|
||||
}
|
||||
|
||||
bool was_in_text(const ULONG_PTR addr)
|
||||
bool was_in_texts(const ULONG_PTR addr)
|
||||
{
|
||||
return addr >= reinterpret_cast<ULONG_PTR>(get_text_section().first) && addr <= reinterpret_cast<ULONG_PTR>(
|
||||
get_text_section().first +
|
||||
get_text_section().second);
|
||||
const auto& texts = get_text_sections();
|
||||
for (const auto& text : texts)
|
||||
{
|
||||
if (addr >= reinterpret_cast<ULONG_PTR>(text.first) && addr <= reinterpret_cast<ULONG_PTR>(text.first +
|
||||
text.second))
|
||||
{
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
void protect_text()
|
||||
void protect_texts()
|
||||
{
|
||||
DWORD old_protect{};
|
||||
VirtualProtect(get_text_section().first, get_text_section().second, PAGE_EXECUTE_READ, &old_protect);
|
||||
const auto& texts = get_text_sections();
|
||||
for (const auto& text : texts)
|
||||
{
|
||||
DWORD old_protect{};
|
||||
VirtualProtect(text.first, text.second, PAGE_EXECUTE_READ, &old_protect);
|
||||
}
|
||||
}
|
||||
|
||||
void unprotect_text()
|
||||
void unprotect_texts()
|
||||
{
|
||||
DWORD old_protect{};
|
||||
VirtualProtect(get_text_section().first, get_text_section().second, PAGE_EXECUTE_READWRITE, &old_protect);
|
||||
const auto& texts = get_text_sections();
|
||||
for (const auto& text : texts)
|
||||
{
|
||||
DWORD old_protect{};
|
||||
VirtualProtect(text.first, text.second, PAGE_EXECUTE_READWRITE, &old_protect);
|
||||
}
|
||||
}
|
||||
|
||||
struct integrity_handler_context
|
||||
{
|
||||
uint32_t* computed_checksum;
|
||||
uint32_t* original_checksum;
|
||||
};
|
||||
|
||||
struct integrity_handler_data
|
||||
{
|
||||
uint64_t address;
|
||||
uint64_t checksum_address;
|
||||
uint32_t checksum;
|
||||
uint32_t frame_offset;
|
||||
|
||||
std::string to_string() const
|
||||
{
|
||||
return utils::string::va("%llX,%llX,%X,%X", this->address, this->checksum_address, this->checksum,
|
||||
this->frame_offset);
|
||||
}
|
||||
|
||||
static integrity_handler_data from_string(const std::string& line)
|
||||
{
|
||||
integrity_handler_data res{};
|
||||
sscanf_s(line.data(), "%llX,%llX,%X,%X", &res.address, &res.checksum_address, &res.checksum,
|
||||
&res.frame_offset);
|
||||
|
||||
return res;
|
||||
}
|
||||
};
|
||||
|
||||
std::unordered_map<uint64_t, integrity_handler_data> integrity_handlers;
|
||||
|
||||
void load_handlers()
|
||||
{
|
||||
std::string data{};
|
||||
if (!utils::io::read_file("integrity.txt", &data)) return;
|
||||
|
||||
const auto lines = utils::string::split(data, '\n');
|
||||
for (const auto& line : lines)
|
||||
{
|
||||
if (line.empty())continue;
|
||||
auto handler = integrity_handler_data::from_string(line);
|
||||
integrity_handlers[operator"" _g(handler.address)] = handler;
|
||||
}
|
||||
}
|
||||
|
||||
void write_handlers()
|
||||
{
|
||||
std::string txt{};
|
||||
for (auto& h : integrity_handlers)
|
||||
{
|
||||
txt += h.second.to_string();
|
||||
txt += "\n";
|
||||
}
|
||||
|
||||
utils::io::write_file("integrity.txt", txt);
|
||||
}
|
||||
|
||||
LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info)
|
||||
{
|
||||
/*static thread_local struct
|
||||
static thread_local struct
|
||||
{
|
||||
bool needs_protect_change = false;
|
||||
bool had_single_step = false;
|
||||
} analysis_context;*/
|
||||
} analysis_context{};
|
||||
|
||||
if (info->ExceptionRecord->ExceptionCode == STATUS_INVALID_HANDLE)
|
||||
{
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}
|
||||
|
||||
/*if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP)
|
||||
if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP && false)
|
||||
{
|
||||
auto dr6_clear = utils::finally([info]
|
||||
{
|
||||
info->ContextRecord->Dr6 = 0;
|
||||
});
|
||||
|
||||
//utils::thread::suspend_other_threads();
|
||||
//restore_debug_functions();
|
||||
//MessageBoxA(0, "SS", 0, 0);
|
||||
OutputDebugStringA("SINGLESTEP!\n");
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}*/
|
||||
static uint64_t addr = 0;
|
||||
/*if (info->ContextRecord->Rip == 0x15E4EBF6B_g)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("Lul: %X | %X", (uint32_t)info->ContextRecord->Rax,
|
||||
(uint32_t)info->ContextRecord->Rdx));
|
||||
|
||||
/*if (info->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION)
|
||||
{
|
||||
utils::thread::suspend_other_threads();
|
||||
restore_debug_functions();
|
||||
MessageBoxA(nullptr, utils::string::va("AV at: %llX %llX",
|
||||
info->ContextRecord->Rip, reverse_g(info->ContextRecord->Rip)),
|
||||
nullptr, 0);
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}*/
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}*/
|
||||
|
||||
/*if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP)
|
||||
static const std::unordered_map<uint64_t, std::pair<uint32_t, bool>> lulul = {
|
||||
{0x15AF356A9_g, {0x58, true}},
|
||||
{0x15BC7D9D4_g, {0x54, false}}, // ?
|
||||
{0x15BC4905F_g, {0x64, true}},
|
||||
{0x15B2D7326_g, {0x64, true}},
|
||||
{0x15B4ABC16_g, {0x5C, true}},
|
||||
|
||||
{0x15EF9A75B_g, {0x54, true}},
|
||||
{0x15E5FD1E9_g, {0x58, true}},
|
||||
{0x15CA3965D_g, {0x58, true}},
|
||||
{0x15F3397B2_g, {0x64, true}},
|
||||
{0x15DCB1A2C_g, {0x50, true}},
|
||||
{0x15F6B4001_g, {0x5C, true}},
|
||||
{0x15BE521F1_g, {0x5C, true}},
|
||||
|
||||
{0x15F6AE373_g, {0x54, true}},
|
||||
{0x15C4CACB2_g, {0x54, true}},
|
||||
{0x15EF6AF3F_g, {0x5C, true}},
|
||||
{0x15BB1DAB8_g, {0x5C, true}},
|
||||
{0x15D1C5569_g, {0x50, false}}, // -> 15EAE384F, 15EA9C476
|
||||
{0x15BF469D7_g, {0x5C, true}},
|
||||
{0x15F9801A6_g, {0x60, false}}, // -> 15C2B8D85, 15D93EF1E
|
||||
{0x15B5C48A3_g, {0x60, true}},
|
||||
{0x15E49ABC2_g, {0x64, true}},
|
||||
//{0x_g, {0x0, true}},
|
||||
|
||||
// OLD
|
||||
|
||||
{0x15C0EDE96_g, {0x58, false}}, // -> 15D390285, 15CE36ADD, 15BDEC8E2
|
||||
{0x15F0643FD_g, {0x58, false}}, // -> 14219FDD3, 15E4EBF68, 15C02F8BD -> 4FF3DF01
|
||||
{0x142306BD9_g, {0x50, false}}, // -> 15B923CD2, 15B7F5204, 15EFBB4C9
|
||||
|
||||
{0x15BEA0BE8_g, {0x60, false}}, // -> 15B2FB386, 15D0379AC
|
||||
{0x15CC4E93C_g, {0x60, false}}, // -> 15CCDC12E, 15DB862E9
|
||||
{0x15C2BB16B_g, {0x50, false}}, // -> 15EEC0E00, 15F5CA333
|
||||
{0x15C34F5BB_g, {0x58, false}}, // -> 15D7FFF48, 15CAAB671
|
||||
{0x15EA91E38_g, {0x50, false}}, // -> 15E54D475, 15F5C90B6 -> 4B7F42B5
|
||||
|
||||
{0x15C998E3C_g, {0x5C, false}}, // ?
|
||||
{0x15EA018CD_g, {0x5C, false}}, // ?
|
||||
{0x15C591543_g, {0x54, false}}, // ?
|
||||
{0x15F9ADF78_g, {0x6C, false}}, // ?
|
||||
|
||||
{0x15D5F91F7_g, {0x58, false}}, // <- 0x15F0643FD
|
||||
{0x15D5F91E4_g, {0x58, false}}, // <- 0x15F0643FD
|
||||
};
|
||||
|
||||
if (!addr && lulul.contains(info->ContextRecord->Rip) && lulul.at(info->ContextRecord->Rip).second)
|
||||
{
|
||||
addr = info->ContextRecord->Rbp + lulul.at(info->ContextRecord->Rip).first;
|
||||
|
||||
OutputDebugStringA(utils::string::va("Begin Trace: %llX -> %llX", info->ContextRecord->Rip, addr));
|
||||
utils::hardware_breakpoint::deactivate_all(*info->ContextRecord);
|
||||
activate(addr, 4, utils::hardware_breakpoint::read_write, *info->ContextRecord);
|
||||
//activate(0x15E4EBFAA_g, 1, utils::hardware_breakpoint::execute, *info->ContextRecord);
|
||||
|
||||
//info->ContextRecord->Rax = 0xC3;
|
||||
//utils::hook::nop(0x15E4EBFA6_g, 4);
|
||||
//utils::hook::nop(0x15EA17E28_g, 4);
|
||||
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}
|
||||
else if (!lulul.contains(info->ContextRecord->Rip))
|
||||
{
|
||||
if (addr)
|
||||
{
|
||||
static std::unordered_set<uint64_t> aaa;
|
||||
if (aaa.emplace(info->ContextRecord->Rip).second)
|
||||
{
|
||||
/*if (info->ContextRecord->Rip == 0x14219FDD3_g)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("OOO: %X - %llX | %llX",
|
||||
*(uint32_t*)addr, info->ContextRecord->Rcx,
|
||||
0x1421E54A7_g + info->ContextRecord->Rcx * 4));
|
||||
*(uint32_t*)addr = 0x4FF3DF01;
|
||||
//info->ContextRecord->Rax = 0x4FF3DF01;
|
||||
utils::hardware_breakpoint::deactivate_all(*info->ContextRecord);
|
||||
}*/
|
||||
if (info->ContextRecord->Rip == 0x15E4EBF68_g)
|
||||
{
|
||||
auto other = info->ContextRecord->Rbx + info->ContextRecord->Rcx * 4;
|
||||
OutputDebugStringA(utils::string::va("Singlestep: %llX | %X | %X | %llX",
|
||||
info->ContextRecord->Rip,
|
||||
*(uint32_t*)addr, *(uint32_t*)other, other));
|
||||
utils::hardware_breakpoint::deactivate_all(*info->ContextRecord);
|
||||
}
|
||||
else
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("Singlestep: %llX | %X",
|
||||
info->ContextRecord->Rip, *(uint32_t*)addr));
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
static std::unordered_set<uint64_t> bbb;
|
||||
if (!lulul.contains(info->ContextRecord->Rip) && bbb.emplace(info->ContextRecord->Rip).second)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("Singlestep: %llX", info->ContextRecord->Rip));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}
|
||||
|
||||
|
||||
if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP)
|
||||
{
|
||||
if (!analysis_context.needs_protect_change)
|
||||
{
|
||||
@ -478,7 +663,7 @@ namespace arxan
|
||||
info->ContextRecord->EFlags &= 0x0100;
|
||||
}
|
||||
|
||||
protect_text();
|
||||
protect_texts();
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
}
|
||||
|
||||
@ -491,7 +676,7 @@ namespace arxan
|
||||
}
|
||||
|
||||
const auto addr = info->ExceptionRecord->ExceptionInformation[1];
|
||||
if (!was_in_text(addr))
|
||||
if (!was_in_texts(addr))
|
||||
{
|
||||
return EXCEPTION_CONTINUE_SEARCH;
|
||||
}
|
||||
@ -500,13 +685,81 @@ namespace arxan
|
||||
analysis_context.had_single_step = info->ContextRecord->EFlags & 0x0100;
|
||||
info->ContextRecord->EFlags |= 0x0100;
|
||||
|
||||
OutputDebugStringA(utils::string::va("Switch at: %llX -> %llX (%llX -> %llX)", addr, reverse_g(addr),
|
||||
info->ContextRecord->Rip, reverse_g(info->ContextRecord->Rip)));
|
||||
const auto data = *reinterpret_cast<uint32_t*>(info->ContextRecord->Rip);
|
||||
if ((data & 0xFFFFFF) == 0x8A0489 && !integrity_handlers.contains(info->ContextRecord->Rip))
|
||||
{
|
||||
auto checksum = static_cast<uint32_t>(info->ContextRecord->Rax);
|
||||
auto offset = static_cast<int64_t>(info->ContextRecord->Rcx);
|
||||
if (offset != 0)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("OFFSET: %X\n", offset));
|
||||
}
|
||||
|
||||
unprotect_text();
|
||||
std::vector<uint32_t> discoveries{};
|
||||
|
||||
for (uint32_t stack = 0x30; stack < 0x80; stack += 8)
|
||||
{
|
||||
auto* value_ptr = *(uint32_t**)(info->ContextRecord->Rbp + stack);
|
||||
auto* _addr = &value_ptr[offset];
|
||||
if (IsBadReadPtr(_addr, 4) || *_addr != checksum)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
discoveries.push_back(stack);
|
||||
}
|
||||
|
||||
if (discoveries.size() != 2)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va(
|
||||
"!!! Unknown handler: %llX - Checksum: %X | rbp: %llX - offset: %X | discoveries: %zX",
|
||||
info->ContextRecord->Rip,
|
||||
checksum, info->ContextRecord->Rbp, offset, discoveries.size()));
|
||||
|
||||
for (auto discovery : discoveries)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va(
|
||||
"%X --> %llX",
|
||||
discovery, *(uint32_t**)(info->ContextRecord->Rbp + discovery) + offset));
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
uint32_t* value_ptrs[] = {
|
||||
*(uint32_t**)(info->ContextRecord->Rbp + discoveries[0]) + offset,
|
||||
*(uint32_t**)(info->ContextRecord->Rbp + discoveries[1]) + offset
|
||||
};
|
||||
|
||||
auto diff_0 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[0]);
|
||||
auto diff_1 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[1]);
|
||||
|
||||
auto store_index = diff_0 < diff_1 ? 0 : 1;
|
||||
auto other_index = 1 - store_index;
|
||||
|
||||
OutputDebugStringA(utils::string::va(
|
||||
"Handler: %llX\t| Checksum: %X\t| Checksum in memory: %llX\t(%X)\t| Calculated checksum location: %llX\t(%X)",
|
||||
info->ContextRecord->Rip,
|
||||
checksum, value_ptrs[other_index], discoveries[other_index], value_ptrs[store_index],
|
||||
discoveries[store_index]));
|
||||
|
||||
integrity_handler_data h{};
|
||||
h.address = reverse_g(info->ContextRecord->Rip);
|
||||
h.checksum = checksum;
|
||||
h.checksum_address = reverse_g(value_ptrs[other_index]);
|
||||
h.frame_offset = discoveries[store_index];
|
||||
|
||||
integrity_handlers[info->ContextRecord->Rip] = h;
|
||||
write_handlers();
|
||||
}
|
||||
}
|
||||
/* OutputDebugStringA(utils::string::va("Switch at: %llX -> %llX (%llX -> %llX)", addr,
|
||||
reverse_g(addr),
|
||||
info->ContextRecord->Rip,
|
||||
reverse_g(info->ContextRecord->Rip)));*/
|
||||
|
||||
unprotect_texts();
|
||||
return EXCEPTION_CONTINUE_EXECUTION;
|
||||
//restore_debug_functions();
|
||||
}*/
|
||||
}
|
||||
|
||||
return EXCEPTION_CONTINUE_SEARCH;
|
||||
}
|
||||
@ -556,295 +809,6 @@ namespace arxan
|
||||
return get_thread_context_hook.invoke<BOOL>(thread_handle, context);
|
||||
}
|
||||
|
||||
uint64_t get_integrity_data_qword(const uint8_t* address)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("8 bytes -> %p", address));
|
||||
const auto og_data = utils::hook::query_original_data(address, 8);
|
||||
return *reinterpret_cast<const uint64_t*>(og_data.data());
|
||||
}
|
||||
|
||||
uint32_t get_integrity_data_dword(const uint8_t* address)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("4 bytes -> %p", address));
|
||||
const auto og_data = utils::hook::query_original_data(address, 4);
|
||||
return *reinterpret_cast<const uint32_t*>(og_data.data());
|
||||
}
|
||||
|
||||
uint8_t get_integrity_data_byte(const uint8_t* address)
|
||||
{
|
||||
OutputDebugStringA(utils::string::va("1 bytes -> %p", address));
|
||||
const auto og_data = utils::hook::query_original_data(address, 1);
|
||||
return og_data[0];
|
||||
}
|
||||
|
||||
void patch_check_type_1_direct()
|
||||
{
|
||||
auto patch_addr = [](uint8_t* addr)
|
||||
{
|
||||
// Skip false positives
|
||||
// Prefixed 0x41 encodes a different instruction
|
||||
if (addr[-1] == 0x41)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
||||
{
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
a.call_aligned(get_integrity_data_dword);
|
||||
|
||||
a.mov(rcx, qword_ptr(rsp, 128));
|
||||
a.mov(ecx, eax);
|
||||
a.mov(qword_ptr(rsp, 128), rcx);
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.embedUInt8(addr[3]);
|
||||
a.embedUInt8(addr[4]);
|
||||
a.embedUInt8(addr[5]);
|
||||
|
||||
a.jmp(addr + 5);
|
||||
}));
|
||||
};
|
||||
|
||||
// mov [rbp+??h], eax
|
||||
auto checks = "8B 00 89 45 ??"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
patch_addr(addr);
|
||||
}
|
||||
|
||||
// xor eax, [rbp+??h]
|
||||
checks = "8B 00 33 45 ??"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
patch_addr(addr);
|
||||
}
|
||||
}
|
||||
|
||||
void patch_check_type_1_indirect()
|
||||
{
|
||||
auto patch_addr = [](uint8_t* addr)
|
||||
{
|
||||
const auto rex_prefixed = *addr == 0x48;
|
||||
const auto jump_target = utils::hook::follow_branch(addr + (rex_prefixed ? 3 : 2));
|
||||
|
||||
utils::hook::jump(addr, utils::hook::assemble([addr, jump_target, rex_prefixed](utils::hook::assembler& a)
|
||||
{
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
|
||||
if (rex_prefixed)
|
||||
{
|
||||
a.call_aligned(get_integrity_data_dword);
|
||||
|
||||
a.mov(rcx, qword_ptr(rsp, 128));
|
||||
a.mov(ecx, eax);
|
||||
a.mov(qword_ptr(rsp, 128), rcx);
|
||||
}
|
||||
else
|
||||
{
|
||||
a.mov(qword_ptr(rsp, 128), rax);
|
||||
}
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.jmp(jump_target);
|
||||
}));
|
||||
};
|
||||
|
||||
// mov rax, [rax]; jmp ...
|
||||
auto checks = "48 8B 00 E9"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
patch_addr(addr);
|
||||
}
|
||||
|
||||
// mov eax, [rax]; jmp ...
|
||||
checks = "8B 00 E9"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
patch_addr(addr);
|
||||
}
|
||||
}
|
||||
|
||||
void patch_check_type_2_direct()
|
||||
{
|
||||
const auto checks = "0F B6 00 0F B6 C0"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
||||
{
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
a.call_aligned(get_integrity_data_byte);
|
||||
|
||||
a.mov(rcx, qword_ptr(rsp, 128));
|
||||
a.movzx(ecx, al);
|
||||
a.mov(qword_ptr(rsp, 128), rcx);
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.movzx(eax, al);
|
||||
a.jmp(addr + 6);
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
void patch_check_type_2_indirect()
|
||||
{
|
||||
const auto checks = "0F B6 00 E9"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
const auto jump_target = utils::hook::follow_branch(addr + 3);
|
||||
|
||||
utils::hook::jump(addr, utils::hook::assemble([jump_target](utils::hook::assembler& a)
|
||||
{
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
a.call_aligned(get_integrity_data_byte);
|
||||
|
||||
a.mov(rcx, qword_ptr(rsp, 128));
|
||||
a.movzx(ecx, al);
|
||||
a.mov(qword_ptr(rsp, 128), rcx);
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.jmp(jump_target);
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
void patch_check_type_4_direct()
|
||||
{
|
||||
const auto checks = "48 8B 04 10 48 89 45 20"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
||||
{
|
||||
a.mov(rax, qword_ptr(rax, rdx));
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
a.call_aligned(get_integrity_data_qword);
|
||||
a.mov(qword_ptr(rsp, 128), rax);
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.mov(qword_ptr(rbp, 0x20), rax);
|
||||
a.jmp(addr + 8);
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
void patch_check_type_4_indirect()
|
||||
{
|
||||
const auto checks = "48 8B 04 10 E9"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
const auto jump_target = utils::hook::follow_branch(addr + 4);
|
||||
|
||||
utils::hook::jump(addr, utils::hook::assemble([jump_target](utils::hook::assembler& a)
|
||||
{
|
||||
a.mov(rax, qword_ptr(rax, rdx));
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
a.call_aligned(get_integrity_data_qword);
|
||||
a.mov(qword_ptr(rsp, 128), rax);
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.jmp(jump_target);
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
void patch_check_type_5_direct()
|
||||
{
|
||||
const auto checks = "0F B6 00 88 02"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
// Skip false positives
|
||||
// Prefixed 0x41 encodes a different instruction
|
||||
if (addr[-1] == 0x41)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
||||
{
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
a.call_aligned(get_integrity_data_byte);
|
||||
|
||||
a.mov(rcx, qword_ptr(rsp, 128));
|
||||
a.movzx(ecx, al);
|
||||
a.mov(qword_ptr(rsp, 128), rcx);
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.mov(byte_ptr(rdx), al);
|
||||
a.jmp(addr + 5);
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void patch_check_type_5_indirect()
|
||||
{
|
||||
const auto checks = "0F B6 00 E9"_sig;
|
||||
for (auto* addr : checks)
|
||||
{
|
||||
// Skip false positives
|
||||
// Prefixed 0x41 encodes a different instruction
|
||||
if (addr[-1] == 0x41)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
const auto jump_target = utils::hook::follow_branch(addr + 4);
|
||||
|
||||
utils::hook::jump(addr, utils::hook::assemble([jump_target](utils::hook::assembler& a)
|
||||
{
|
||||
a.push(rax);
|
||||
a.pushad64();
|
||||
|
||||
a.mov(rcx, rax);
|
||||
a.call_aligned(get_integrity_data_byte);
|
||||
|
||||
a.mov(rcx, qword_ptr(rsp, 128));
|
||||
a.movzx(ecx, al);
|
||||
a.mov(qword_ptr(rsp, 128), rcx);
|
||||
|
||||
a.popad64();
|
||||
a.pop(rax);
|
||||
|
||||
a.jmp(jump_target);
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
NTSTATUS NTAPI get_proc_address_stub(const HMODULE module_handle, const PANSI_STRING function_name,
|
||||
const WORD oridinal,
|
||||
PVOID* function_address, const BOOL b_value,
|
||||
@ -884,6 +848,8 @@ namespace arxan
|
||||
hide_being_debugged();
|
||||
scheduler::loop(hide_being_debugged, scheduler::pipeline::async);
|
||||
|
||||
load_handlers();
|
||||
|
||||
create_thread_hook.create(CreateThread, create_thread_stub);
|
||||
create_mutex_ex_a_hook.create(CreateMutexExA, create_mutex_ex_a_stub);
|
||||
|
||||
@ -917,6 +883,7 @@ namespace arxan
|
||||
// TODO: Remove as soon as real hooking works
|
||||
auto* get_cmd_import = utils::nt::library{}.get_iat_entry("kernel32.dll", "GetCommandLineA");
|
||||
if (get_cmd_import) utils::hook::set(get_cmd_import, get_command_line_a_stub);
|
||||
|
||||
//zw_terminate_process_hook.create(ntdll.get_proc<void*>("ZwTerminateProcess"), zw_terminate_process_stub);
|
||||
//zw_terminate_process_hook.move();
|
||||
|
||||
@ -929,46 +896,78 @@ namespace arxan
|
||||
{
|
||||
//restore_debug_functions();
|
||||
/*
|
||||
patch_check_type_1_direct();
|
||||
patch_check_type_1_indirect();
|
||||
patch_check_type_2_direct();
|
||||
patch_check_type_2_indirect();
|
||||
patch_check_type_4_direct();
|
||||
patch_check_type_4_indirect();
|
||||
patch_check_type_5_direct();
|
||||
patch_check_type_5_indirect();
|
||||
MessageBoxA(0, "done", 0, 0);
|
||||
*/
|
||||
|
||||
//protect_text();
|
||||
|
||||
/*auto tid = GetCurrentThreadId();
|
||||
std::thread([tid]()
|
||||
std::thread([]()
|
||||
{
|
||||
MessageBoxA(0, 0, 0, 0);
|
||||
//utils::hook::set<uint8_t>(0x1423339C0_g, 0xC3);
|
||||
utils::hardware_breakpoint::activate(0x1423339C0_g, 4,
|
||||
utils::hardware_breakpoint::read_write, tid);
|
||||
}).detach();*/
|
||||
protect_texts();
|
||||
}).detach();
|
||||
|
||||
|
||||
auto tid = GetCurrentThreadId();
|
||||
//activate(0x15D5F922A_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
//activate(0x15BCA4A2A_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
//activate(0x15C4BC192_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
//activate(0x15DA1FBA1_g, 1, utils::hardware_breakpoint::execute, tid); // <--
|
||||
|
||||
//activate(0x15DB61C4A_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
//activate(0x15BE5BC6D_g, 1, utils::hardware_breakpoint::execute, tid); // <--
|
||||
|
||||
//activate(0x15B88A716_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
//activate(0x15DBD74A0_g, 1, utils::hardware_breakpoint::execute, tid); // <--
|
||||
|
||||
//activate(0x15CA2514F_g, 1, utils::hardware_breakpoint::execute, tid); // <--
|
||||
//activate(0x15CD0B431_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
|
||||
//activate(0x15B8447FF_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
//activate(0x15C74FE9C_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
|
||||
OutputDebugStringA("Trigger...");
|
||||
//activate(0x1423339C0_g, 1, utils::hardware_breakpoint::read_write, tid);
|
||||
//activate(0x15D0379D0_g, 1, utils::hardware_breakpoint::execute, tid);
|
||||
|
||||
/*
|
||||
activate(0x142AA20A1_g, 1, utils::hardware_breakpoint::read_write, tid);
|
||||
activate(0x15BDEC91F_g, 1, utils::hardware_breakpoint::read_write, tid);
|
||||
activate(0x15E4EBFA6_g, 1, utils::hardware_breakpoint::read_write, tid);
|
||||
activate(0x15EA17E28_g, 1, utils::hardware_breakpoint::read_write, tid);
|
||||
*/
|
||||
//activate(0x15B7F5209_g, 4, utils::hardware_breakpoint::read_write, tid);
|
||||
//activate(0x15EFBB508_g, 4, utils::hardware_breakpoint::read_write, tid);
|
||||
//activate(0x15D0379CC_g, 4, utils::hardware_breakpoint::read_write, tid);
|
||||
//activate(0x15D1177B8_g, 4, utils::hardware_breakpoint::read_write, tid);
|
||||
|
||||
// Some integrity check patches. More to come.
|
||||
|
||||
/*
|
||||
/*constexpr auto rdx_rbx = 0xda894890;
|
||||
constexpr auto rcx_rdx = 0xd1894890;
|
||||
constexpr auto rax_rcx = 0xc8894890;
|
||||
constexpr auto rbx_rax = 0xc3894890;
|
||||
|
||||
utils::hook::nop(0x142AA20A1_g, 4);
|
||||
utils::hook::set<uint32_t>(0x15BDEC91F_g, 0xda894890);
|
||||
utils::hook::set<uint32_t>(0x15BDEC91F_g, rdx_rbx);
|
||||
|
||||
utils::hook::nop(0x15E4EBFA6_g, 4);
|
||||
utils::hook::set<uint32_t>(0x15EA17E28_g, 0xd1894890);
|
||||
utils::hook::set<uint32_t>(0x15EA17E28_g, rcx_rdx);
|
||||
|
||||
utils::hook::nop(0x15B7F5209_g, 6);
|
||||
utils::hook::set<uint32_t>(0x15EFBB508_g, 0xc3894890);
|
||||
utils::hook::set<uint32_t>(0x15EFBB508_g, rbx_rax);
|
||||
|
||||
utils::hook::set<uint32_t>(0x15D0379CC_g, 0xda894890); // rdx, rbx
|
||||
utils::hook::set<uint32_t>(0x15D1177B8_g, 0xd1894890); // rcx, rdx
|
||||
utils::hook::set<uint32_t>(0x15BFFF30D_g, 0xda894890); // rdx, rbx
|
||||
utils::hook::set<uint32_t>(0x15DE3AAE7_g, 0xc8894890); // rax, rcx
|
||||
utils::hook::set<uint32_t>(0x15E48F80C_g, 0xc3894890); // rbx, rax
|
||||
*/
|
||||
utils::hook::set<uint32_t>(0x15D0379CC_g, rdx_rbx);
|
||||
utils::hook::set<uint32_t>(0x15D1177B8_g, rcx_rdx);
|
||||
utils::hook::set<uint32_t>(0x15BFFF30D_g, rdx_rbx);
|
||||
utils::hook::set<uint32_t>(0x15DE3AAE7_g, rax_rcx);
|
||||
utils::hook::set<uint32_t>(0x15E48F80C_g, rbx_rax);*/
|
||||
|
||||
/*std::thread([tid]()
|
||||
{
|
||||
MessageBoxA(0, 0, 0, 0);
|
||||
//utils::hook::set<uint8_t>(0x1423339C0_g, 0xC3);
|
||||
OutputDebugStringA("Logging..\n");
|
||||
activate(0x1423339C0_g, 1, utils::hardware_breakpoint::read_write, tid);
|
||||
}).detach();*/
|
||||
}
|
||||
|
||||
void pre_destroy() override
|
||||
|
||||
Loading…
Reference in New Issue
Block a user