diff options
Diffstat (limited to 'miasm2/os_dep')
| -rw-r--r-- | miasm2/os_dep/win_32_structs.py | 35 | ||||
| -rw-r--r-- | miasm2/os_dep/win_api_x86_32_seh.py | 149 |
2 files changed, 106 insertions, 78 deletions
diff --git a/miasm2/os_dep/win_32_structs.py b/miasm2/os_dep/win_32_structs.py index 993fc79c..e76eb0a9 100644 --- a/miasm2/os_dep/win_32_structs.py +++ b/miasm2/os_dep/win_32_structs.py @@ -114,6 +114,39 @@ class PEB(MemStruct): ] +class EXCEPTION_REGISTRATION_RECORD(MemStruct): + """ + +0x00 Next : struct _EXCEPTION_REGISTRATION_RECORD * + +0x04 Handler : Ptr32 Void + """ + + fields = [ + ("Next", Ptr("<I", Self())), + ("Handler", Ptr("<I", Void())), + ] + + +class EXCEPTION_RECORD(MemStruct): + """ + DWORD ExceptionCode; + DWORD ExceptionFlags; + struct _EXCEPTION_RECORD *ExceptionRecord; + PVOID ExceptionAddress; + DWORD NumberParameters; + ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; + """ + EXCEPTION_MAXIMUM_PARAMETERS = 15 + + fields = [ + ("ExceptionCode", Num("<I")), + ("ExceptionFlags", Num("<I")), + ("ExceptionRecord", Ptr("<I", Self())), + ("ExceptionAddress", Ptr("<I", Void())), + ("NumberParameters", Num("<I")), + ("ExceptionInformation", Ptr("<I", Void())), + ] + + class NT_TIB(MemStruct): """ @@ -128,7 +161,7 @@ class NT_TIB(MemStruct): """ fields = [ - ("ExceptionList", Ptr("<I", Void())), + ("ExceptionList", Ptr("<I", EXCEPTION_REGISTRATION_RECORD)), ("StackBase", Ptr("<I", Void())), ("StackLimit", Ptr("<I", Void())), ("SubSystemTib", Ptr("<I", Void())), diff --git a/miasm2/os_dep/win_api_x86_32_seh.py b/miasm2/os_dep/win_api_x86_32_seh.py index da8df7d7..cfd83729 100644 --- a/miasm2/os_dep/win_api_x86_32_seh.py +++ b/miasm2/os_dep/win_api_x86_32_seh.py @@ -29,7 +29,8 @@ from miasm2.core.utils import pck32, upck32 import miasm2.arch.x86.regs as x86_regs from miasm2.os_dep.win_32_structs import LdrDataEntry, ListEntry, \ - TEB, NT_TIB, PEB, PEB_LDR_DATA, ContextException + TEB, NT_TIB, PEB, PEB_LDR_DATA, ContextException, \ + EXCEPTION_REGISTRATION_RECORD, EXCEPTION_RECORD # Constants Windows EXCEPTION_BREAKPOINT = 0x80000003 @@ -539,15 +540,14 @@ def ctxt2regs(jitter, ctxt_ptr): jitter.cpu.SS = ctxt.ss -def fake_seh_handler(jitter, except_code): +def fake_seh_handler(jitter, except_code, previous_seh=None): """ Create an exception context @jitter: jitter instance @except_code: x86 exception code + @previous_seh: (optional) last SEH address when multiple SEH are used """ - global seh_count - regs = jitter.cpu.get_gpreg() log.warning('Exception at %x %r', jitter.cpu.EIP, seh_count) seh_count += 1 @@ -560,59 +560,49 @@ def fake_seh_handler(jitter, except_code): # Save a CONTEXT regs2ctxt(jitter, context_address) + jitter.cpu.ESP = new_ESP # Get current seh (fs:[0]) - seh_ptr = upck32(jitter.vm.get_mem(tib_address, 4)) - - # Retrieve seh fields - old_seh, eh, safe_place = struct.unpack( - 'III', jitter.vm.get_mem(seh_ptr, 0xc)) + tib = NT_TIB(jitter.vm, tib_address) + seh = tib.ExceptionList.deref + if previous_seh: + # Recursive SEH + while seh.get_addr() != previous_seh: + seh = seh.Next.deref + seh = seh.Next.deref - log.info('seh_ptr %x { old_seh %x eh %x safe_place %x} ctx_addr %x', - seh_ptr, old_seh, eh, safe_place, context_address) + log.info('seh_ptr %x { old_seh %r eh %r} ctx_addr %x', + seh.get_addr(), seh.Next, seh.Handler, context_address) - jitter.cpu.ESP = new_ESP # Write exception_record - - """ - #http://msdn.microsoft.com/en-us/library/aa363082(v=vs.85).aspx - - typedef struct _EXCEPTION_RECORD { - DWORD ExceptionCode; - DWORD ExceptionFlags; - struct _EXCEPTION_RECORD *ExceptionRecord; - PVOID ExceptionAddress; - DWORD NumberParameters; - ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; - } EXCEPTION_RECORD, *PEXCEPTION_RECORD; - """ - - jitter.vm.set_mem(exception_record_address, - pck32(except_code) + pck32(0) + pck32(0) + - pck32(jitter.cpu.EIP) + pck32(0)) + except_record = EXCEPTION_RECORD(jitter.vm, exception_record_address) + except_record.memset("\x00") + except_record.ExceptionCode = except_code + except_record.ExceptionAddress = jitter.cpu.EIP # Prepare the stack jitter.push_uint32_t(context_address) # Context - jitter.push_uint32_t(seh_ptr) # SEH - jitter.push_uint32_t(exception_record_address) # ExceptRecords + jitter.push_uint32_t(seh.get_addr()) # SEH + jitter.push_uint32_t(except_record.get_addr()) # ExceptRecords jitter.push_uint32_t(return_from_exception) # Ret address # Set fake new current seh for exception log.info("Fake seh ad %x", fake_seh_address) - jitter.vm.set_mem(fake_seh_address, pck32(seh_ptr) + pck32( - 0xaaaaaaaa) + pck32(0xaaaaaabb) + pck32(0xaaaaaacc)) - jitter.vm.set_mem(tib_address, pck32(fake_seh_address)) - + fake_seh = EXCEPTION_REGISTRATION_RECORD(jitter.vm, fake_seh_address) + fake_seh.Next.val = tib.ExceptionList.val + fake_seh.Handler = 0xaaaaaaaa + tib.ExceptionList.val = fake_seh.get_addr() dump_seh(jitter) - log.info('Jumping at %x', eh) + # Remove exceptions jitter.vm.set_exception(0) jitter.cpu.set_exception(0) # XXX set ebx to nul? jitter.cpu.EBX = 0 - return eh + log.info('Jumping at %r', seh.Handler) + return seh.Handler.val def dump_seh(jitter): @@ -620,24 +610,18 @@ def dump_seh(jitter): Walk and dump the SEH entries @jitter: jitter instance """ - log.info('Dump_seh. Tib_address: %x', tib_address) - cur_seh_ptr = upck32(jitter.vm.get_mem(tib_address, 4)) - indent = 1 + cur_seh_ptr = NT_TIB(jitter.vm, tib_address).ExceptionList loop = 0 - while True: + while cur_seh_ptr and jitter.vm.is_mapped(cur_seh_ptr.val, + len(cur_seh_ptr)): if loop > MAX_SEH: log.warn("Too many seh, quit") return - if not jitter.vm.is_mapped(cur_seh_ptr, 8): - break - prev_seh, eh = struct.unpack('II', jitter.vm.get_mem(cur_seh_ptr, 8)) - log.info('\t' * indent + 'seh_ptr: %x { prev_seh: %x eh %x }', - cur_seh_ptr, prev_seh, eh) - if prev_seh == 0: - break - cur_seh_ptr = prev_seh - indent += 1 + err = cur_seh_ptr.deref + log.info('\t' * (loop + 1) + 'seh_ptr: %x { prev_seh: %r eh %r }', + err.get_addr(), err.Next, err.Handler) + cur_seh_ptr = err.Next loop += 1 @@ -647,11 +631,8 @@ def set_win_fs_0(jitter, fs=4): @jitter: jitter instance @fs: segment selector value """ - - regs = jitter.cpu.get_gpreg() - regs['FS'] = 0x4 - jitter.cpu.set_gpreg(regs) - jitter.cpu.set_segm_base(regs['FS'], FS_0_AD) + jitter.cpu.FS = fs + jitter.cpu.set_segm_base(fs, FS_0_AD) segm_to_do = set([x86_regs.FS]) return segm_to_do @@ -660,34 +641,48 @@ def return_from_seh(jitter): """Handle the return from an exception handler @jitter: jitter instance""" - # Get current context + # Get object addresses + seh_address = upck32(jitter.vm.get_mem(jitter.cpu.ESP + 0x4, 4)) context_address = upck32(jitter.vm.get_mem(jitter.cpu.ESP + 0x8, 4)) - log.info('Context address: %x', context_address) - jitter.cpu.ESP = upck32(jitter.vm.get_mem(context_address + 0xc4, 4)) - log.info('New esp: %x', jitter.cpu.ESP) - - # Rebuild SEH - old_seh = upck32(jitter.vm.get_mem(tib_address, 4)) - new_seh = upck32(jitter.vm.get_mem(old_seh, 4)) - log.info('Old seh: %x New seh: %x', old_seh, new_seh) - jitter.vm.set_mem(tib_address, pck32(new_seh)) + # Get registers changes + log.info('Context address: %x', context_address) + status = jitter.cpu.EAX + ctxt2regs(jitter, context_address) + + # Rebuild SEH (remove fake SEH) + tib = NT_TIB(jitter.vm, tib_address) + seh = tib.ExceptionList.deref + log.info('Old seh: %x New seh: %x', seh.get_addr(), seh.Next.val) + tib.ExceptionList.val = seh.Next.val dump_seh(jitter) - if jitter.cpu.EAX == 0x0: + # Handle returned values + if status == 0x0: # ExceptionContinueExecution - ctxt_ptr = context_address - log.info('Seh continues Context: %x', ctxt_ptr) - - # Get registers changes - # ctxt_str = jitter.vm.get_mem(ctxt_ptr, 0x2cc) - ctxt2regs(jitter, ctxt_ptr) + log.info('SEH continue') jitter.pc = jitter.cpu.EIP log.info('Context::Eip: %x', jitter.pc) - elif jitter.cpu.EAX == -1: - raise NotImplementedError("-> seh try to go to the next handler") - - elif jitter.cpu.EAX == 1: + elif status == 1: # ExceptionContinueSearch - raise NotImplementedError("-> seh, gameover") + log.info("Delegate to the next SEH handler") + # exception_base_address: context_address - 0xfc + # -> exception_record_address: exception_base_address + 0xe8 + exception_record = EXCEPTION_RECORD(jitter.vm, + context_address - 0xfc + 0xe8) + + pc = fake_seh_handler(jitter, exception_record.ExceptionCode, + seh_address) + jitter.pc = pc + + else: + # https://msdn.microsoft.com/en-us/library/aa260344%28v=vs.60%29.aspx + # But the type _EXCEPTION_DISPOSITION may take 2 others values: + # - ExceptionNestedException = 2 + # - ExceptionCollidedUnwind = 3 + raise ValueError("Valid values are ExceptionContinueExecution and " + "ExceptionContinueSearch") + + # Jitter's breakpoint compliant + return True |