qilingframework/qiling
1
0
Fork 0
mirror of https://github.com/qilingframework/qiling.git synced 2026-10-12 02:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update fncc decorator

Browse Source
This commit is contained in:
Dliv3
2019-10-10 22:28:16 +08:00
parent a234cb405d
commit 747b3219ff
13 changed files with 749 additions and 518 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/rootfs/x86_windows/bin/ConsoleApplication1_x86.exe
BIN
View File
Binary file not shown.
examples/rootfs/x86_windows/bin/ConsoleApplication2_x86.exe
BIN
View File
Binary file not shown.
qiling/os/windows/dlls/advapi32.py
+117 -116
View File
@@ -17,55 +17,6 @@ from qiling.os.windows.handle import *
from qiling.os.windows.const import *
# SC_HANDLE OpenSCManagerA(
# LPCSTR lpMachineName,
# LPCSTR lpDatabaseName,
# DWORD dwDesiredAccess
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_OpenSCManagerA(ql, address):
lpMachineName, lpDatabaseName, dwDesiredAccess = ql.get_params(3)
ql.nprint('0x%0.2x: OpenSCManagerA(0x%0.2x, 0x%0.2x, 0x%0.2x)' %
(address, lpMachineName, lpDatabaseName, dwDesiredAccess))
# SC_HANDLE OpenServiceA(
# SC_HANDLE hSCManager,
# LPCSTR lpServiceName,
# DWORD dwDesiredAccess
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_OpenServiceA(ql, address):
hSCManager, lpServiceName, dwDesiredAccess = ql.get_params(3)
ql.nprint('0x%0.2x: OpenServiceA(0x%0.2x, 0x%0.2x, 0x%0.2x)' %
(address, hSCManager, lpServiceName, dwDesiredAccess))
# BOOL ChangeServiceConfig2A(
# SC_HANDLE hService,
# DWORD dwInfoLevel,
# LPVOID lpInfo
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_ChangeServiceConfig2A(ql, address):
ret = 1
hService, dwInfoLevel, lpInfo = ql.get_params(3)
ql.nprint('0x%0.2x: ChangeServiceConfig2A(0x%0.2x, 0x%0.2x, 0x%0.2x) = %d' %
(address, hService, dwInfoLevel, lpInfo, ret))
return ret
# BOOL CloseServiceHandle(
# SC_HANDLE hSCObject
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_CloseServiceHandle(ql, address):
ret = 1
hSCObject = ql.get_params(1)
ql.nprint('0x%0.2x: CloseServiceHandle(0x%0.2x) = %d' % (address, hSCObject, ret))
return ret
# LSTATUS RegOpenKeyExA(
# HKEY hKey,
# LPCSTR lpSubKey,
@@ -73,23 +24,28 @@ def hook_CloseServiceHandle(ql, address):
# REGSAM samDesired,
# PHKEY phkResult
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=5)
def hook_RegOpenKeyExA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpSubKey": STRING,
"ulOptions": DWORD,
"samDesired": POINTER,
"phkResult": POINTER
})
def hook_RegOpenKeyExA(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpSubKey, ulOptions, samDesired, phkResult = ql.get_params(5)
s_lpSubKey = read_cstring(ql, lpSubKey)
hKey = params["hKey"]
s_lpSubKey = params["lpSubKey"]
phkResult = params["phkResult"]
if hKey not in REG_KEYS:
ret = 2
return 2
else:
s_hKey = REG_KEYS[hKey]
params["hKey"] = s_hKey
if not ql.registry_manager.exists(s_hKey + "\\" + s_lpSubKey):
ret = 2
ql.nprint('0x%0.2x: RegOpenKeyExA(%s, "%s", 0x%0.2x, 0x%0.2x, 0x%0.2x) = %d' % \
(address, s_hKey, s_lpSubKey, ulOptions, samDesired, phkResult, ret))
return 2
# new handle
if ret == ERROR_SUCCESS:
@@ -108,23 +64,26 @@ def hook_RegOpenKeyExA(ql, address):
# LPCWSTR lpSubKey,
# PHKEY phkResult
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_RegOpenKeyW(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpSubKey": WSTRING,
"phkResult": POINTER
})
def hook_RegOpenKeyW(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpSubKey, phkResult = ql.get_params(3)
s_lpSubKey = w2cstring(read_wstring(ql, lpSubKey))
hKey = params["hKey"]
s_lpSubKey = w2cstring(params["lpSubKey"])
phkResult = params["phkResult"]
if not (hKey in REG_KEYS):
ret = 2
return 2
else:
s_hKey = REG_KEYS[hKey]
params["hKey"] = s_hKey
if not ql.registry_manager.exists(s_hKey + "\\" + s_lpSubKey):
ret = 2
ql.nprint('0x%0.2x: RegOpenKeyW(%s, "%s", 0x%0.2x) = %d' % \
(address, s_hKey, s_lpSubKey, phkResult, ret))
return 2
# new handle
if ret == ERROR_SUCCESS:
@@ -147,12 +106,25 @@ def hook_RegOpenKeyW(ql, address):
# LPBYTE lpData,
# LPDWORD lpcbData
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=6)
def hook_RegQueryValueExA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpValueName": STRING,
"lpReserved": POINTER,
"lpType": POINTER,
"lpData": POINTER,
"lpcbData": POINTER
})
def hook_RegQueryValueExA(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpValueName, lpReserved, lpType, lpData, lpcbData = ql.get_params(6)
hKey = params["hKey"]
s_lpValueName = params["lpValueName"]
lpType = params["lpType"]
lpData = params["lpData"]
lpcbData = params["lpcbData"]
s_hKey = ql.handle_manager.get(hKey).regkey
s_lpValueName = read_cstring(ql, lpValueName)
params["hKey"] = s_hKey
# read reg_type
if lpType != 0:
@@ -165,27 +137,26 @@ def hook_RegQueryValueExA(ql, address):
# error key
if reg_type is None or value is None:
ret = 2
return 2
else:
# set lpData
length = ql.registry_manager.write_reg_value_into_mem(value, reg_type, lpData)
# set lpcbData
ql.mem_write(lpcbData, ql.pack(length))
ql.nprint('0x%0.2x: RegQueryValueExA(%s, "%s", 0x%0.2x, 0x%0.2x, 0x%0.2x, 0x%0.2x) = %d' % \
(address, s_hKey, s_lpValueName, lpReserved, lpType, lpData, lpcbData, ret))
return ret
# LSTATUS RegCloseKey(
# HKEY hKey
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_RegCloseKey(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE
})
def hook_RegCloseKey(ql, address, params):
ret = ERROR_SUCCESS
hKey = ql.get_params(1)
hKey = params["hKey"]
ql.handle_manager.delete(hKey)
ql.nprint('0x%0.2x: RegCloseKey(0x%0.2x) = %d' % (address, hKey, ret))
return ret
@@ -194,24 +165,27 @@ def hook_RegCloseKey(ql, address):
# LPCSTR lpSubKey,
# PHKEY phkResult
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_RegCreateKeyA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpSubKey": STRING,
"phkResult": POINTER
})
def hook_RegCreateKeyA(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpSubKey, phkResult = ql.get_params(3)
s_lpSubKey = read_cstring(ql, lpSubKey)
hKey = params["hKey"]
s_lpSubKey = params["lpSubKey"]
phkResult = params["phkResult"]
if not (hKey in REG_KEYS):
ret = 2
return 2
else:
s_hKey = REG_KEYS[hKey]
params["hKey"] = s_hKey
if not ql.registry_manager.exists(s_hKey + "\\" + s_lpSubKey):
ret = ERROR_SUCCESS
ql.registry_manager.create(s_hKey + "\\" + s_lpSubKey)
ql.nprint('0x%0.2x: RegCreateKeyA(%s, "%s", 0x%0.2x) = %d' % \
(address, s_hKey, s_lpSubKey, phkResult, ret))
# new handle
if ret == ERROR_SUCCESS:
new_handle = Handle(regkey=s_hKey+"\\"+s_lpSubKey)
@@ -231,18 +205,27 @@ def hook_RegCreateKeyA(ql, address):
# LPCSTR lpData,
# DWORD cbData
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=5)
def hook_RegSetValueA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpSubKey": STRING,
"dwType": DWORD,
"lpData": STRING,
"cbData": DWORD
})
def hook_RegSetValueA(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpSubKey, dwType, lpData, cbData = ql.get_params(5)
hKey = params["hKey"]
s_lpSubKey = params["lpSubKey"]
dwType = params["dwType"]
s_lpData = params["lpData"]
cbData = params["cbData"]
s_hKey = ql.handle_manager.get(hKey).regkey
s_lpSubKey = read_cstring(ql, lpSubKey)
s_lpData = read_cstring(ql, lpData)
params["hKey"] = s_hKey
ql.registry_manager.write(s_hKey, s_lpSubKey, dwType, s_lpData)
ql.nprint('0x%0.2x: RegSetValueA(%s, "%s", 0x%0.2x, "%s", 0x%0.2x) = %d' % \
(address, s_hKey, s_lpSubKey, dwType, s_lpData, cbData, ret))
return ret
@@ -254,18 +237,28 @@ def hook_RegSetValueA(ql, address):
# const BYTE *lpData,
# DWORD cbData
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=6)
def hook_RegSetValueExW(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpValueName": WSTRING,
"Reserved": DWORD,
"dwType": DWORD,
"lpData": WSTRING,
"cbData": DWORD
})
def hook_RegSetValueExW(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpSubKey, Reserved, dwType, lpData, cbData = ql.get_params(6)
hKey = params["hKey"]
s_lpValueName = w2cstring(params["lpValueName"])
dwType = params["dwType"]
s_lpData = w2cstring(params["lpData"])
cbData = params["cbData"]
s_hKey = ql.handle_manager.get(hKey).regkey
s_lpSubKey = w2cstring(read_wstring(ql, lpSubKey))
s_lpData = w2cstring(read_wstring(ql, lpData))
params["hKey"] = s_hKey
ql.registry_manager.write(s_hKey, s_lpSubKey, dwType, s_lpData)
ql.registry_manager.write(s_hKey, s_lpValueName, dwType, s_lpData)
ql.nprint('0x%0.2x: RegSetValueA(%s, "%s", 0x%0.2x, 0x%0.2x, "%s", 0x%0.2x) = %d' % \
(address, s_hKey, s_lpSubKey, Reserved, dwType, s_lpData, cbData, ret))
return ret
@@ -273,33 +266,41 @@ def hook_RegSetValueExW(ql, address):
# HKEY hKey,
# LPCSTR lpSubKey
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=2)
def hook_RegDeleteKeyA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpSubKey": STRING,
})
def hook_RegDeleteKeyA(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpSubKey = ql.get_params(2)
hKey = params["hKey"]
s_lpSubKey = params["lpSubKey"]
s_hKey = ql.handle_manager.get(hKey).regkey
s_lpSubKey = read_cstring(ql, lpSubKey)
params["hKey"] = s_hKey
ql.registry_manager.delete(s_hKey, s_lpSubKey)
ql.nprint('0x%0.2x: RegDeleteKeyA(%s, "%s") = %d' % \
(address, s_hKey, s_lpSubKey, ret))
return ret
return ret
# LSTATUS RegDeleteValueW(
# HKEY hKey,
# LPCWSTR lpValueName
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=2)
def hook_RegDeleteValueW(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hKey": HANDLE,
"lpValueName": WSTRING,
})
def hook_RegDeleteValueW(ql, address, params):
ret = ERROR_SUCCESS
hKey, lpSubKey = ql.get_params(2)
hKey = params["hKey"]
s_lpValueName = w2cstring(params["lpValueName"])
s_hKey = ql.handle_manager.get(hKey).regkey
s_lpSubKey = w2cstring(read_wstring(ql, lpSubKey))
params["hKey"] = s_hKey
ql.registry_manager.delete(s_hKey, s_lpSubKey)
ql.registry_manager.delete(s_hKey, s_lpValueName)
ql.nprint('0x%0.2x: RegDeleteValueW(%s, "%s") = %d' % \
(address, s_hKey, s_lpSubKey, ret))
return ret
return ret
qiling/os/windows/dlls/kernel32.py
+310 -226
View File
@@ -18,22 +18,20 @@ from qiling.os.windows.memory import align
from qiling.os.windows.thread import *
from qiling.os.windows.handle import *
from qiling.exception import *
import sys
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_SetUnhandledExceptionFilter(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpTopLevelExceptionFilter": DWORD
})
def hook_SetUnhandledExceptionFilter(ql, address, params):
ret = 0x4
lpTopLevelExceptionFilter = ql.get_params(1)
ql.nprint('0x%0.2x: SetUnhandledExceptionFilter(0x%x) = 0x%x'
% (address, lpTopLevelExceptionFilter, ret))
return ret
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_ExitProcess(ql, address):
uExitcode = ql.get_params(1)
ql.nprint('0x%0.2x: ExitProcess(0x%0.2x)' % (address, uExitcode))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"uExitCode": DWORD
})
def hook_ExitProcess(ql, address, params):
ql.uc.emu_stop()
ql.RUN = False
@@ -41,10 +39,10 @@ def hook_ExitProcess(ql, address):
# __analysis_noreturn VOID FatalExit(
# int ExitCode
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_FatalExit(ql, address):
ExitCode = ql.get_params(1)
print('0x%0.2x: FatalExit(0x%0.2x)' % (address, ExitCode))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"ExitCode": INT
})
def hook_FatalExit(ql, address, params):
ql.uc.emu_stop()
ql.RUN = False
@@ -52,18 +50,21 @@ def hook_FatalExit(ql, address):
# VOID WINAPI GetStartupInfo(
# _Out_ LPSTARTUPINFO lpStartupInfo
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_GetStartupInfoA(ql, address):
lpStartupInfo = ql.get_params(1)
ql.nprint('0x%0.2x: GetStartupInfo(0x%0.2x)' % (address, lpStartupInfo))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpStartupInfo": POINTER
})
def hook_GetStartupInfoA(ql, address, params):
pass
# HMODULE GetModuleHandleA(
# LPCSTR lpModuleName
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_GetModuleHandleA(ql, address):
lpModuleName = ql.get_params(1)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpModuleName": STRING
})
def hook_GetModuleHandleA(ql, address, params):
lpModuleName = params["lpModuleName"]
if lpModuleName == 0:
ret = ql.PE.PE_IMAGE_BASE
else:
@@ -71,37 +72,42 @@ def hook_GetModuleHandleA(ql, address):
ret = ql.PE.dlls[lpModuleName.lower()]
else:
ret = 0
ql.nprint('0x%0.2x: GetModuleHandleA(0x%0.2x) = 0x%x' % (address, lpModuleName, ret))
return ret
# HMODULE GetModuleHandleA(
# LPCSTR lpModuleName
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_GetModuleHandleW(ql, address):
lpModuleName = ql.get_params(1)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpModuleName": STRING
})
def hook_GetModuleHandleW(ql, address, params):
lpModuleName = params["lpModuleName"]
if lpModuleName == 0:
ret = ql.PE.PE_IMAGE_BASE
else:
raise QlErrorNotImplemented("not implemented")
ql.nprint('0x%0.2x: GetModuleHandleW(0x%0.2x) = 0x%x' % (address, lpModuleName, ret))
return ret
# WinExec(cmd, nShow)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=2)
def hook_WinExec(ql, address):
pCmd, nshow = ql.get_params(2)
cmd = read_cstring(ql, pCmd)
ql.nprint('0x%0.2x: WinExec(\'%s\', %d)' % (address, cmd, nshow))
# UINT WinExec(
# LPCSTR lpCmdLine,
# UINT uCmdShow
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpCmdLine": STRING,
"uCmdShow": UINT
})
def hook_WinExec(ql, address, params):
return 33
# GetVersion()
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetVersion(ql, address):
ret = 0
ql.nprint('0x%0.2x: GetVersion() = %d' % (address, ret))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetVersion(ql, address, params):
ret = 0x0004
ret = ret << 16
ret = ret | 0x0004
return ret
@@ -110,22 +116,25 @@ def hook_GetVersion(ql, address):
# SIZE_T dwInitialSize,
# SIZE_T dwMaximumSize
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_HeapCreate(ql, address):
flOptions, dwInitialSize, dwMaximumSize = ql.get_params(3)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"flOptions": DWORD,
"dwInitialSize": SIZE_T,
"dwMaximumSize": SIZE_T
})
def hook_HeapCreate(ql, address, params):
dwInitialSize = params["dwInitialSize"]
addr = ql.heap.mem_alloc(dwInitialSize)
ql.nprint('0x%0.2x: HeapCreate(0x%x, 0x%x, 0x%x) = 0x%x' % (address, flOptions, dwInitialSize, dwMaximumSize, addr))
return addr
# NOT_BUILD_WINDOWS_DEPRECATE BOOL GetVersionExA(
# LPOSVERSIONINFOA lpVersionInformation
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_GetVersionExA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpVersionInformation": POINTER
})
def hook_GetVersionExA(ql, address, params):
ret = 1
lpVersionInformation = ql.get_params(1)
ql.nprint('0x%0.2x: GetVersionExA(0x%x) = 0x%x' % (address, lpVersionInformation, ret))
return ret
@@ -134,12 +143,13 @@ def hook_GetVersionExA(ql, address):
# LPSTR lpBuffer,
# DWORD nSize
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_GetEnvironmentVariableA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpName": STRING,
"lpBuffer": POINTER,
"nSize": DWORD
})
def hook_GetEnvironmentVariableA(ql, address, params):
ret = 0
lpName, lpBuffer, nSize = ql.get_params(3)
s_lpName = read_cstring(ql, lpName)
ql.nprint('0x%0.2x: GetEnvironmentVariableA("%s", 0x%x, 0x%x) = 0x%x' % (address, s_lpName, lpBuffer, nSize, ret))
return ret
@@ -148,11 +158,13 @@ def hook_GetEnvironmentVariableA(ql, address):
# DWORD dwFlags,
# SIZE_T dwBytes
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_HeapAlloc(ql, address):
hHeap, dwFlags, dwBytes = ql.get_params(3)
ret = ql.heap.mem_alloc(dwBytes)
ql.nprint('0x%0.2x: HeapAlloc(0x%0x, 0x%x, 0x%x) = 0x%x' % (address, hHeap, dwFlags, dwBytes, ret))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hHeap": HANDLE,
"dwFlags": DWORD,
"dwBytes": SIZE_T
})
def hook_HeapAlloc(ql, address, params):
ret = ql.heap.mem_alloc(params["dwBytes"])
return ret
@@ -162,89 +174,97 @@ def hook_HeapAlloc(ql, address):
# DWORD flAllocationType,
# DWORD flProtect
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=4)
def hook_VirtualAlloc(ql, address):
lpAddress, dwSize, flAllocationType, flProtect = ql.get_params(4)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpAddress": POINTER,
"dwSize": SIZE_T,
"flAllocationType": DWORD,
"flProtect": DWORD
})
def hook_VirtualAlloc(ql, address, params):
dwSize = params["dwSize"]
addr = ql.heap.mem_alloc(dwSize)
ql.nprint('0x%0.2x: VirtualAlloc(0x%x, 0x%x, 0x%x, 0x%x) = 0x%x' %
(address, lpAddress, dwSize, flAllocationType, flProtect, addr))
return addr
# BOOL VirtualFree(
# LPVOID lpAddress,
# SIZE_T dwSize,
# DWORD dwFreeType
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_VirtualFree(ql, address):
lpAddress, dwSize, dwFreeType = ql.get_params(3)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpAddress": POINTER,
"dwSize": SIZE_T,
"dwFreeType": DWORD
})
def hook_VirtualFree(ql, address, params):
lpAddress = params["lpAddress"]
addr = ql.heap.mem_free(lpAddress)
ql.nprint('0x%0.2x: VirtualFree(0x%x, 0x%x, 0x%x) = 0x%x' %
(address, lpAddress, dwSize, dwFreeType, addr))
return 1
# HANDLE WINAPI GetStdHandle(
# _In_ DWORD nStdHandle
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_GetStdHandle(ql, address):
nStdHandle = ql.get_params(1)
ql.nprint('0x%0.2x: GetStdHandle(0x%x) = 0x%x' % (address, nStdHandle, nStdHandle))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"nStdHandle": DWORD
})
def hook_GetStdHandle(ql, address, params):
nStdHandle = params["nStdHandle"]
return nStdHandle
# DWORD GetFileType(
# HANDLE hFile
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_GetFileType(ql, address):
hFile = ql.get_params(1)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hFile": HANDLE
})
def hook_GetFileType(ql, address, params):
hFile = params["hFile"]
FILE_TYPE_CHAR = 0x0002
if hFile == STD_INPUT_HANDLE or hFile == STD_OUTPUT_HANDLE or hFile == STD_ERROR_HANDLE:
ret = FILE_TYPE_CHAR
else:
raise QlErrorNotImplemented("not implemented")
ql.nprint('0x%0.2x: GetFileType(0x%x) = 0x%x' % (address, hFile, FILE_TYPE_CHAR))
return ret
# UINT SetHandleCount(
# UINT uNumber
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_SetHandleCount(ql, address):
uNumber = ql.get_params(1)
ql.nprint('0x%0.2x: SetHandleCount(0x%x) = %d' % (address, uNumber, uNumber))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"uNumber": UINT
})
def hook_SetHandleCount(ql, address, params):
uNumber = params["uNumber"]
return uNumber
# LPSTR GetCommandLineA(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetCommandLineA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetCommandLineA(ql, address, params):
cmdline = ql.PE.cmdline + b"\x00"
addr = ql.heap.mem_alloc(len(cmdline))
ql.uc.mem_write(addr, cmdline)
ql.nprint('0x%0.2x: GetCommandLineA() = 0x%x' % (address, addr))
return addr
# LPWCH GetEnvironmentStrings(
# );s
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetEnvironmentStrings(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetEnvironmentStrings(ql, address, params):
cmdline = b"\x00"
addr = ql.heap.mem_alloc(len(cmdline))
ql.uc.mem_write(addr, cmdline)
ql.nprint('0x%0.2x: GetEnvironmentStrings() = 0x%x' % (address, addr))
return addr
# UINT GetACP(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetACP(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetACP(ql, address, params):
ret = 437
ql.nprint('0x%0.2x: GetACP() = %d' % (address, ret))
return ret
@@ -252,11 +272,12 @@ def hook_GetACP(ql, address):
# UINT CodePage,
# LPCPINFO lpCPInfo
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=2)
def hook_GetCPInfo(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"CodePage": UINT,
"lpCPInfo": POINTER
})
def hook_GetCPInfo(ql, address, params):
ret = 1
CodePage, lpCPInfo = ql.get_params(2)
ql.nprint('0x%0.2x: GetCPInfo(0x%x, 0x%x) = %d' % (address, CodePage, lpCPInfo, ret))
return ret
@@ -266,12 +287,14 @@ def hook_GetCPInfo(ql, address):
# int cchSrc,
# LPWORD lpCharType
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_GetStringTypeW(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"dwInfoType": DWORD,
"lpSrcStr": POINTER,
"cchSrc": INT,
"lpCharType": POINTER
})
def hook_GetStringTypeW(ql, address, params):
ret = 0
dwInfoType, lpSrcStr, cchSrc, lpCharType = ql.get_params(4)
ql.nprint('0x%0.2x: GetStringTypeW(0x%x, 0x%x, 0x%x, 0x%x) = %d' %
(address, dwInfoType, lpSrcStr, cchSrc, lpCharType, ret))
return ret
@@ -283,23 +306,25 @@ def hook_GetStringTypeW(ql, address):
# INT count,
# LPWORD chartype
# )
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=5)
def hook_GetStringTypeExA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"locale": POINTER,
"type": DWORD,
"src": STRING,
"count": INT,
"chartype": POINTER
})
def hook_GetStringTypeExA(ql, address, params):
ret = 0
locale, _type, src, count, chartype = ql.get_params(5)
ql.nprint('0x%0.2x: GetStringTypeExA(0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = %d' %
(address, locale, _type, src, count, chartype, ret))
return ret
# LPWCH GetEnvironmentStringsW(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetEnvironmentStringsW(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetEnvironmentStringsW(ql, address, params):
cmdline = b"\x00\x00"
addr = ql.heap.mem_alloc(len(cmdline))
ql.uc.mem_write(addr, cmdline)
ql.nprint('0x%0.2x: GetEnvironmentStringsW() = 0x%x' % (address, addr))
return addr
@@ -313,35 +338,42 @@ def hook_GetEnvironmentStringsW(ql, address):
# LPCCH lpDefaultChar,
# LPBOOL lpUsedDefaultChar
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=8)
def hook_WideCharToMultiByte(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"CodePage": UINT,
"dwFlags": DWORD,
"lpWideCharStr": WSTRING,
"cchWideChar": INT,
"lpMultiByteStr": POINTER,
"cbMultiByte": INT,
"lpDefaultChar": POINTER,
"lpUsedDefaultChar": POINTER
})
def hook_WideCharToMultiByte(ql, address, params):
ret = 0
CodePage, dwFlags, lpWideCharStr, cchWideChar, \
lpMultiByteStr, cbMultiByte, lpDefaultChar, \
lpUsedDefaultChar = ql.get_params(8)
cbMultiByte = params["cbMultiByte"]
s_lpWideCharStr = params["lpWideCharStr"]
lpMultiByteStr = params["lpMultiByteStr"]
if cbMultiByte == 0:
ret = len(read_wstring(ql, lpWideCharStr)) + 2
ret = len(s_lpWideCharStr) + 2
ret = align(ret // 2, 2)
else:
s = bytes(read_wstring(ql, lpWideCharStr), 'ascii').decode('utf-16le') + "\x00"
s = bytes(s_lpWideCharStr, 'ascii').decode('utf-16le') + "\x00"
ql.uc.mem_write(lpMultiByteStr, bytes(s, 'ascii'))
ret = len(s)
ql.nprint('0x%0.2x: WideCharToMultiByte(0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = %d'
% (address, CodePage, dwFlags, lpWideCharStr, cchWideChar,
lpMultiByteStr, cbMultiByte, lpDefaultChar, lpUsedDefaultChar, ret))
return ret
# BOOL FreeEnvironmentStringsW(
# LPWCH penv
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_FreeEnvironmentStringsW(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"penv": POINTER
})
def hook_FreeEnvironmentStringsW(ql, address, params):
ret = 1
penv = ql.get_params(1)
ql.nprint('0x%0.2x: FreeEnvironmentStringsW(0x%x) = %d' % (address, penv, ret))
return ret
@@ -353,12 +385,16 @@ def hook_FreeEnvironmentStringsW(ql, address):
# LPWSTR lpDestStr,
# int cchDest
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=6)
def hook_LCMapStringW(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"Locale": POINTER,
"dwMapFlags": DWORD,
"lpSrcStr": WSTRING,
"cchSrc": INT,
"lpDestStr": POINTER,
"cchDest": INT
})
def hook_LCMapStringW(ql, address, params):
ret = 0
Locale, dwMapFlags, lpSrcStr, cchSrc, lpDestStr, cchDest = ql.get_params(6)
ql.nprint('0x%0.2x: LCMapStringW(0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = %d'
% (address, Locale, dwMapFlags, lpSrcStr, cchSrc, lpDestStr, cchDest, ret))
return ret
@@ -370,12 +406,16 @@ def hook_LCMapStringW(ql, address):
# LPSTR lpDestStr,
# int cchDest
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=6)
def hook_LCMapStringA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"Locale": POINTER,
"dwMapFlags": DWORD,
"lpSrcStr": WSTRING,
"cchSrc": INT,
"lpDestStr": POINTER,
"cchDest": INT
})
def hook_LCMapStringA(ql, address, params):
ret = 0
Locale, dwMapFlags, lpSrcStr, cchSrc, lpDestStr, cchDest = ql.get_params(6)
ql.nprint('0x%0.2x: LCMapStringA(0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = %d'
% (address, Locale, dwMapFlags, lpSrcStr, cchSrc, lpDestStr, cchDest, ret))
return ret
@@ -384,10 +424,16 @@ def hook_LCMapStringA(ql, address):
# LPSTR lpFilename,
# DWORD nSize
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=3)
def hook_GetModuleFileNameA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hModule": HANDLE,
"lpFilename": POINTER,
"nSize": DWORD
})
def hook_GetModuleFileNameA(ql, address, params):
ret = 0
hModule, lpFilename, nSize = ql.get_params(3)
hModule = params["hModule"]
lpFilename = params["lpFilename"]
nSize = params["nSize"]
if hModule == 0:
filename = ql.PE.filepath
filename_len = len(filename)
@@ -399,8 +445,6 @@ def hook_GetModuleFileNameA(ql, address):
ql.uc.mem_write(lpFilename, filename + b"\x00")
else:
raise QlErrorNotImplemented("not implemented")
ql.nprint('0x%0.2x: GetModuleFileNameA(0x%x, 0x%x, 0x%x) = %d'
% (address, hModule, lpFilename, nSize, ret))
return ret
@@ -411,11 +455,20 @@ def hook_GetModuleFileNameA(ql, address):
# LPDWORD lpNumberOfBytesRead,
# LPOVERLAPPED lpOverlapped
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=5)
def hook_ReadFile(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hFile": HANDLE,
"lpBuffer": POINTER,
"nNumberOfBytesToRead": DWORD,
"lpNumberOfBytesRead": POINTER,
"lpOverlapped": POINTER
})
def hook_ReadFile(ql, address, params):
ret = 1
hFile, lpBuffer, nNumberOfBytesToRead, \
lpNumberOfBytesRead, lpOverlapped = ql.get_params(5)
hFile = params["hFile"]
lpBuffer = params["lpBuffer"]
nNumberOfBytesToRead = params["nNumberOfBytesToRead"]
lpNumberOfBytesRead = params["lpNumberOfBytesRead"]
lpOverlapped = params["lpOverlapped"]
if hFile == STD_INPUT_HANDLE:
s = ql.stdin.read(nNumberOfBytesToRead)
slen = len(s)
@@ -430,8 +483,6 @@ def hook_ReadFile(ql, address):
data = f.read(nNumberOfBytesToRead)
ql.uc.mem_write(lpBuffer, data)
ql.uc.mem_write(lpNumberOfBytesRead, ql.pack32(lpNumberOfBytesRead))
ql.nprint('0x%0.2x: ReadFile(0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = %d'
% (address, hFile, lpBuffer, nNumberOfBytesToRead, lpNumberOfBytesRead, lpOverlapped, ret))
return ret
@@ -442,11 +493,20 @@ def hook_ReadFile(ql, address):
# LPDWORD lpNumberOfBytesWritten,
# LPOVERLAPPED lpOverlapped
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=5)
def hook_WriteFile(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hFile": HANDLE,
"lpBuffer": POINTER,
"nNumberOfBytesToWrite": DWORD,
"lpNumberOfBytesWritten": POINTER,
"lpOverlapped": POINTER
})
def hook_WriteFile(ql, address, params):
ret = 1
hFile, lpBuffer, nNumberOfBytesToWrite, \
lpNumberOfBytesWritten, lpOverlapped = ql.get_params(5)
hFile = params["hFile"]
lpBuffer = params["lpBuffer"]
nNumberOfBytesToWrite = params["nNumberOfBytesToWrite"]
lpNumberOfBytesWritten = params["lpNumberOfBytesWritten"]
lpOverlapped = params["lpOverlapped"]
if hFile == STD_OUTPUT_HANDLE:
s = ql.uc.mem_read(lpBuffer, nNumberOfBytesToWrite)
ql.stdout.write(s)
@@ -456,20 +516,19 @@ def hook_WriteFile(ql, address):
buffer = ql.uc.mem_read(lpBuffer, nNumberOfBytesToWrite)
f.write(bytes(buffer))
ql.uc.mem_write(lpNumberOfBytesWritten, ql.pack32(nNumberOfBytesToWrite))
ql.nprint('0x%0.2x: WriteFile(0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = 0x%x'
% (address, hFile, lpBuffer, nNumberOfBytesToWrite, lpNumberOfBytesWritten, lpOverlapped, ret))
return ret
def _CreateFile(ql, address, name):
def _CreateFile(ql, address, params, name):
ret = INVALID_HANDLE_VALUE
lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, \
dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile = ql.get_params(7)
if name == "CreateFileA":
s_lpFileName = read_cstring(ql, lpFileName)
else:
s_lpFileName = read_wstring(ql, lpFileName)
s_lpFileName = params["lpFileName"]
dwDesiredAccess = params["dwDesiredAccess"]
dwShareMode = params["dwShareMode"]
lpSecurityAttributes = params["lpSecurityAttributes"]
dwCreationDisposition = params["dwCreationDisposition"]
dwFlagsAndAttributes = params["dwFlagsAndAttributes"]
hTemplateFile = params["hTemplateFile"]
# access mask DesiredAccess
mode = ""
@@ -484,10 +543,6 @@ def _CreateFile(ql, address, name):
ql.handle_manager.append(new_handle)
ret = new_handle.id
ql.nprint('0x%0.2x: %s("%s", 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = 0x%x'
% (address, name, s_lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, \
dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, ret))
return ret
@@ -500,64 +555,79 @@ def _CreateFile(ql, address, name):
# DWORD dwFlagsAndAttributes,
# HANDLE hTemplateFile
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=7)
def hook_CreateFileA(ql, address):
ret = _CreateFile(ql, address, "CreateFileA")
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpFileName": STRING,
"dwDesiredAccess": DWORD,
"dwShareMode": DWORD,
"lpSecurityAttributes": POINTER,
"dwCreationDisposition": DWORD,
"dwFlagsAndAttributes": DWORD,
"hTemplateFile": HANDLE
})
def hook_CreateFileA(ql, address, params):
ret = _CreateFile(ql, address, params, "CreateFileA")
return ret
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=7)
def hook_CreateFileW(ql, address):
ret = _CreateFile(ql, address, "CreateFileW")
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpFileName": WSTRING,
"dwDesiredAccess": DWORD,
"dwShareMode": DWORD,
"lpSecurityAttributes": POINTER,
"dwCreationDisposition": DWORD,
"dwFlagsAndAttributes": DWORD,
"hTemplateFile": HANDLE
})
def hook_CreateFileW(ql, address, params):
ret = _CreateFile(ql, address, params, "CreateFileW")
return ret
# void GetSystemTimeAsFileTime(
# LPFILETIME lpSystemTimeAsFileTime
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_GetSystemTimeAsFileTime(ql, address):
lpSystemTimeAsFileTime = ql.get_params(1)
ql.nprint('0x%0.2x: GetSystemTimeAsFileTime(0x%x)' % (address, lpSystemTimeAsFileTime))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpSystemTimeAsFileTime": POINTER
})
def hook_GetSystemTimeAsFileTime(ql, address, params):
pass
# DWORD GetCurrentThreadId(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetCurrentThreadId(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetCurrentThreadId(ql, address, params):
ret = ql.thread_manager.current_thread.id
ql.nprint('0x%0.2x: GetCurrentThreadId() = %d' % (address, ret))
return ret
# DWORD GetCurrentProcessId(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetCurrentProcessId(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetCurrentProcessId(ql, address, params):
ret = 1000
ql.nprint('0x%0.2x: GetCurrentProcessId() = %d' % (address, ret))
return ret
# BOOL QueryPerformanceCounter(
# LARGE_INTEGER *lpPerformanceCount
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_QueryPerformanceCounter(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpPerformanceCount": POINTER
})
def hook_QueryPerformanceCounter(ql, address, params):
ret = 0
lpPerformanceCount = ql.get_params(1)
ql.nprint('0x%0.2x: QueryPerformanceCounter(0x%x) = 0x%x' % (address, lpPerformanceCount, ret))
return ret
# BOOL IsProcessorFeaturePresent(
# DWORD ProcessorFeature
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_IsProcessorFeaturePresent(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"ProcessorFeature": DWORD
})
def hook_IsProcessorFeaturePresent(ql, address, params):
ret = 0
ProcessorFeature = ql.get_params(1)
ql.nprint('0x%0.2x: IsProcessorFeaturePresent(0x%x) = 0x%x' % (address, ProcessorFeature, ret))
return ret
@@ -569,14 +639,25 @@ def hook_IsProcessorFeaturePresent(ql, address):
# DWORD dwCreationFlags,
# LPDWORD lpThreadId
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=6)
def hook_CreateThread(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpThreadAttributes": POINTER,
"dwStackSize": SIZE_T,
"lpStartAddress": POINTER,
"lpParameter": POINTER,
"dwCreationFlags": DWORD,
"lpThreadId": POINTER
})
def hook_CreateThread(ql, address, params):
CREATE_RUN = 0
CREATE_SUSPENDED = 0x00000004
ret = 0
lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, \
dwCreationFlags, lpThreadId = ql.get_params(6)
lpThreadAttributes = params["lpThreadAttributes"]
dwStackSize = params["dwStackSize"]
lpStartAddress = params["lpStartAddress"]
lpParameter = params["lpParameter"]
dwCreationFlags = params["dwCreationFlags"]
lpThreadId = params["lpThreadId"]
# new thread obj
new_thread = Thread(ql)
@@ -605,9 +686,6 @@ def hook_CreateThread(ql, address):
if lpThreadId != 0:
ql.mem_write(lpThreadId, ql.pack(thread_id))
ql.nprint('0x%0.2x: CreateThread(0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = 0x%x' \
% (address, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId, ret))
# set thread handle
return ret
@@ -616,14 +694,16 @@ def hook_CreateThread(ql, address):
# HANDLE hHandle,
# DWORD dwMilliseconds
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=2)
def hook_WaitForSingleObject(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hHandle": HANDLE,
"dwMilliseconds": DWORD
})
def hook_WaitForSingleObject(ql, address, params):
ret = 0
hHandle, dwMilliseconds = ql.get_params(2)
hHandle = params["hHandle"]
dwMilliseconds = params["dwMilliseconds"]
target_thread = ql.handle_manager.get(hHandle).thread
ql.thread_manager.current_thread.waitfor(target_thread)
ql.nprint('0x%0.2x: WaitForSingleObject(0x%x, 0x%x) = %d' % \
(address, hHandle, dwMilliseconds, ret))
return ret
@@ -633,10 +713,18 @@ def hook_WaitForSingleObject(ql, address):
# BOOL bWaitAll,
# DWORD dwMilliseconds
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=4)
def hook_WaitForMultipleObjects(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"nCount": DWORD,
"lpHandles": POINTER,
"bWaitAll": BOOL,
"dwMilliseconds": DWORD
})
def hook_WaitForMultipleObjects(ql, address, params):
ret = 0
nCount, lpHandles, bWaitAll, dwMilliseconds = ql.get_params(4)
nCount = params["nCount"]
lpHandles = params["lpHandles"]
bWaitAll = params["bWaitAll"]
dwMilliseconds = params["dwMilliseconds"]
for i in range(nCount):
handle_value = ql.unpack(ql.mem_read(lpHandles + i * ql.pointersize, ql.pointersize))
@@ -644,29 +732,25 @@ def hook_WaitForMultipleObjects(ql, address):
thread = ql.handle_manager.get(handle_value).thread
ql.thread_manager.current_thread.waitfor(thread)
ql.nprint('0x%0.2x: WaitForMultipleObjects(0x%x, 0x%x, 0x%x, 0x%x) = %d' % \
(address, nCount, lpHandles, bWaitAll, dwMilliseconds, ret))
return ret
# BOOL CloseHandle(
# HANDLE hObject
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_CloseHandle(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hObject": HANDLE
})
def hook_CloseHandle(ql, address, params):
ret = 0
hObject = ql.get_params(1)
ql.nprint('0x%0.2x: CloseHandle(0x%x) = %d' % \
(address, hObject, ret))
return ret
# DWORD GetTickCount(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetTickCount(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetTickCount(ql, address, params):
ret = 200000
ql.nprint('0x%0.2x: GetTickCount() = %d' % (address, ret))
return ret
@@ -675,11 +759,15 @@ def hook_GetTickCount(ql, address):
# DWORD TypeMask,
# BYTE Condition
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=4)
def hook_VerSetConditionMask(ql, address):
l_ConditionMask, h_ConditionMask, TypeMask, Condition = ql.get_params(4)
tmp_ConditionMask = h_ConditionMask << 8 + l_ConditionMask
ConditionMask = tmp_ConditionMask
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"ConditionMask": ULONGLONG,
"TypeMask": DWORD,
"Condition": BYTE
})
def hook_VerSetConditionMask(ql, address, params):
ConditionMask = params["ConditionMask"]
TypeMask = params["TypeMask"]
Condition = params["Condition"]
if (TypeMask == 0):
ret = ConditionMask
else:
@@ -705,29 +793,25 @@ def hook_VerSetConditionMask(ql, address):
elif (TypeMask & VER_MINORVERSION):
ConditionMask |= ullCondMask << (0 * VER_NUM_BITS_PER_CONDITION_MASK)
ret = ConditionMask
ql.nprint('0x%0.2x: VerSetConditionMask(0x%x,0x%x, 0x%x) = 0x%x' %
(address, tmp_ConditionMask, TypeMask, Condition, ret))
return ret
# HANDLE GetProcessHeap(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetProcessHeap(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetProcessHeap(ql, address, params):
ret = ql.heap.start_address
ql.nprint('0x%0.2x: GetProcessHeap() = 0x%x' % (address, ret))
return ret
# LONG UnhandledExceptionFilter(
# _EXCEPTION_POINTERS *ExceptionInfo
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_UnhandledExceptionFilter(ql, address):
ExceptionInfo = ql.get_params(1)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"ExceptionInfo": POINTER
})
def hook_UnhandledExceptionFilter(ql, address, params):
ret = 1
ql.nprint('0x%0.2x: UnhandledExceptionFilter(0x%x) = 0x%x' % (address, ExceptionInfo, ret))
return ret
@@ -735,20 +819,20 @@ def hook_UnhandledExceptionFilter(ql, address):
# HANDLE hProcess,
# UINT uExitCode
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=2)
def hook_TerminateProcess(ql, address):
hProcess, uExitCode = ql.get_params(2)
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hProcess": HANDLE,
"uExitCode": UINT
})
def hook_TerminateProcess(ql, address, params):
ret = 1
ql.nprint('0x%0.2x: TerminateProcess(0x%x, 0x%x) = 0x%x' % (address, hProcess, uExitCode, ret))
return ret
ql.uc.emu_stop()
ql.RUN = False
return ret
# HANDLE GetCurrentProcess(
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=0)
def hook_GetCurrentProcess(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={})
def hook_GetCurrentProcess(ql, address, params):
ret = 1
ql.nprint('0x%0.2x: GetCurrentProcess() = 0x%x' % (address, ret))
return ret
qiling/os/windows/dlls/msvcrt.py
+116 -100
View File
@@ -18,10 +18,11 @@ from qiling.os.windows.utils import *
# void __set_app_type (
# int at
# )
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook___set_app_type(ql, address):
at = ql.get_params(1)
ql.nprint('0x%0.2x: __set_app_type(0x%x)' % (address, at))
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"at": INT
})
def hook___set_app_type(ql, address, params):
pass
# int __getmainargs(
@@ -30,25 +31,27 @@ def hook___set_app_type(ql, address):
# char *** _Env,
# int _DoWildCard,
# _startupinfo * _StartInfo);
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=5)
def hook___getmainargs(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"_Argc": POINTER,
"_Argv": POINTER,
"_Env": POINTER,
"_DoWildCard": INT,
"_StartInfo": POINTER
})
def hook___getmainargs(ql, address, params):
ret = 0
_Argc, _Argv, _Env, _DoWildCard, _StartInfo = ql.get_params(5)
ql.nprint('0x%0.2x: __getmainargs(0x%x, 0x%x, 0x%x, 0x%x, 0x%x) = %d' % (address, _Argc, _Argv, _Env, _DoWildCard, _StartInfo, ret))
return ret
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook___p__fmode(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook___p__fmode(ql, address, params):
addr = ql.heap.mem_alloc(ql.pointersize)
ql.nprint('0x%0.2x: __p__fmode() = 0x%x' % (address, addr))
return addr
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook___p__commode(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook___p__commode(ql, address, params):
addr = ql.heap.mem_alloc(ql.pointersize)
ql.nprint('0x%0.2x: __p__commode() = 0x%x' % (address, addr))
return addr
@@ -56,26 +59,28 @@ def hook___p__commode(ql, address):
# unsigned int new,
# unsigned int mask
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=2)
def hook__controlfp(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"new": UINT,
"mask": UINT
})
def hook__controlfp(ql, address, params):
ret = 0x8001f
new , mask = ql.get_params(2)
ql.nprint('0x%0.2x: _controlfp(0x%x, 0x%x) = 0x%x' % (address, new, mask, ret))
return ret
# int atexit(
# void (__cdecl *func)(void)
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook_atexit(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"func": POINTER
})
def hook_atexit(ql, address, params):
ret = 0
func = ql.get_params(1)
ql.nprint('0x%0.2x: atexit(0x%x) = %d' % (address, func, ret))
return ret
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook___p__environ(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook___p__environ(ql, address, params):
ret = ql.heap.mem_alloc(ql.pointersize * len(ql.env))
count = 0
for key in ql.env:
@@ -86,44 +91,45 @@ def hook___p__environ(ql, address):
ql.mem_write(pointer, ql.pack(env_addr))
ql.mem_write(ret + count * ql.pointersize, ql.pack(pointer))
count += 1
ql.nprint('0x%0.2x: __p__environ() = 0x%x' % (address, ret))
return ret
# int puts(
# const char *str
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook_puts(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"str": STRING
})
def hook_puts(ql, address, params):
ret = 0
string_addr = ql.get_params(1)
string = read_cstring(ql, string_addr)
string = params["str"]
ret = len(string)
ql.nprint('0x%0.2x: puts(0x%x=\"%s\") = %d' % (address, string_addr, string, ret))
return ret
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook__cexit(ql, address):
ql.nprint('0x%0.2x: cexit()' % (address))
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook__cexit(ql, address, params):
pass
# void __cdecl _initterm(
# PVFV *,
# PVFV *
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=2)
def hook__initterm(ql, address):
pfbegin, pfend = ql.get_params(2)
ql.nprint('0x%0.2x: _initterm(0x%x, 0x%x)' % (address, pfbegin, pfend))
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"pfbegin": POINTER,
"pfend": POINTER
})
def hook__initterm(ql, address, params):
pass
# void exit(
# int const status
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook_exit(ql, address):
status = ql.get_params(1)
ql.nprint('0x%0.2x: exit(0x%x)' % (address, status))
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"status": INT
})
def hook_exit(ql, address, params):
ql.uc.emu_stop()
ql.RUN = False
@@ -132,16 +138,17 @@ def hook_exit(ql, address):
# PVFV *,
# PVFV *
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=2)
def hook__initterm_e(ql, address):
pfbegin, pfend = ql.get_params(2)
ql.nprint('0x%0.2x: _initterm_e(0x%x, 0x%x) = 0x%x' % (address, pfbegin, pfend, 0))
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"pfbegin": POINTER,
"pfend": POINTER
})
def hook__initterm_e(ql, address, params):
return 0
# char*** __cdecl __p___argv (void);
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook___p___argv(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook___p___argv(ql, address, params):
ret = ql.heap.mem_alloc(ql.pointersize * len(ql.argv))
count = 0
for each in ql.argv:
@@ -151,21 +158,19 @@ def hook___p___argv(ql, address):
ql.mem_write(arg_pointer, ql.pack(arg))
ql.mem_write(ret + count * ql.pointersize, ql.pack(arg_pointer))
count += 1
ql.nprint('0x%0.2x: __p___argv() = 0x%x' % (address, ret))
return ret
# int* __p___argc(void)
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook___p___argc(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook___p___argc(ql, address, params):
ret = ql.heap.mem_alloc(ql.pointersize)
ql.mem_write(ret, ql.pack(len(ql.argv)))
ql.nprint('0x%0.2x: __p___argc() = 0x%x' % (address, ret))
return ret
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook__get_initial_narrow_environment(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook__get_initial_narrow_environment(ql, address, params):
ret = 0
count = 0
for key in ql.env:
@@ -175,7 +180,6 @@ def hook__get_initial_narrow_environment(ql, address):
ret = env
ql.mem_write(env, bytes(value, 'ascii') + b'\x00')
count += 1
ql.nprint('0x%0.2x: _get_initial_narrow_environment() = 0x%x' % (address, ret))
return ret
@@ -218,7 +222,7 @@ def printf(ql, address, fmt, params_addr, name):
# int printf(const char *format, ...)
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook_printf(ql, address):
def hook_printf(ql, address, _):
ret = 0
format_string = ql.get_params(1)
@@ -245,16 +249,16 @@ def hook_printf(ql, address):
return None
# MSVCRT_FILE * CDECL MSVCRT___acrt_iob_func(unsigned idx)
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook___acrt_iob_func(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"idx": UINT
})
def hook___acrt_iob_func(ql, address, params):
ret = 0
idx = ql.get_params(1)
ql.nprint('0x%0.2x: __acrt_iob_func(0x%x) = 0x%x' % (address, idx, ret))
return ret
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=2)
def hook___stdio_common_vfprintf(ql, address):
def hook___stdio_common_vfprintf(ql, address, _):
ret = 0
_, _, _, p_format, _, p_args = ql.get_params(6)
fmt = read_cstring(ql, p_format)
@@ -265,36 +269,34 @@ def hook___stdio_common_vfprintf(ql, address):
# int lstrlenW(
# LPCWSTR lpString
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook_lstrlenW(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
'lpString': WSTRING
})
def hook_lstrlenW(ql, address, params):
ret = 0
lpString = ql.get_params(1)
if lpString == 0:
string = params["lpString"]
if string == 0:
ret = 0
ql.nprint('0x%0.2x: lstrlenW(0x0) = 0x%x' % (address, ret))
else:
string = read_wstring(ql, lpString)
ret = len(string)
ql.nprint('0x%0.2x: lstrlenW(%s) = 0x%x' % (address, repr(string), ret))
return ret
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=0)
def hook___lconv_init(ql, address):
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={})
def hook___lconv_init(ql, address, params):
ret = 0
ql.nprint('0x%0.2x: __lconv_init() = %d' % (address, ret))
return ret
# size_t strlen(
# const char *str
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook_strlen(ql, address):
_str = ql.get_params(1)
string1 = read_cstring(ql, _str)
strlen = len(string1)
ql.nprint('0x%0.2x: strlen(0x%x=\"%s\") = %d' % (address, _str, string1, strlen))
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"str": STRING
})
def hook_strlen(ql, address, params):
_str = params["str"]
strlen = len(_str)
return strlen
@@ -303,11 +305,17 @@ def hook_strlen(ql, address):
# const char *string2,
# size_t count
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=3)
def hook_strncmp(ql, address):
s1, s2, count = ql.get_params(3)
string1 = ql.uc.mem_read(s1, count).decode()
string2 = ql.uc.mem_read(s2, count).decode()
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"string1": STRING,
"string2": STRING,
"count": SIZE_T
})
def hook_strncmp(ql, address, params):
s1 = params["string1"]
s2 = params["string2"]
count = params["count"]
string1 = s1[:count]
string2 = s2[:count]
if string1 == string2:
result = 0
@@ -315,28 +323,28 @@ def hook_strncmp(ql, address):
result = 1
else:
result = -1
ql.nprint('0x%0.2x: strncmp(0x%x=\"%s\", 0x%x=\"%s\", 0x%x) = %d' % (address, s1, string1, s2, string2, count, result))
return result
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook_malloc(ql, address):
size = ql.get_params(1)
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"size": UINT
})
def hook_malloc(ql, address, params):
size = params['size']
addr = ql.heap.mem_alloc(size)
ql.nprint('0x%0.2x: malloc(0x%x) = 0x%x' % (address, size, addr))
return addr
# _onexit_t _onexit(
# _onexit_t function
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=1)
def hook__onexit(ql, address):
function = ql.get_params(1)
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"function": POINTER
})
def hook__onexit(ql, address, params):
function = params['function']
addr = ql.heap.mem_alloc(ql.pointersize)
ql.uc.mem_write(addr, ql.pack(function))
ql.nprint('0x%0.2x: _onexit(0x%x) = 0x%x' % (address, function, addr))
return addr
@@ -345,11 +353,16 @@ def hook__onexit(ql, address):
# int c,
# size_t count
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=3)
def hook_memset(ql, address):
dest, c, count = ql.get_params(3)
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"dest": POINTER,
"c": INT,
"count": SIZE_T
})
def hook_memset(ql, address, params):
dest = params["dest"]
c = params["c"]
count = params["count"]
ql.uc.mem_write(dest, bytes(c) * count)
ql.nprint('0x%0.2x: memset(0x%x, 0x%x, 0x%x) = 0x%x' % (address, dest, c, count, dest))
return dest
@@ -357,9 +370,12 @@ def hook_memset(ql, address):
# size_t num,
# size_t size
# );
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, param_num=2)
def hook_calloc(ql, address):
num, size = ql.get_params(2)
@winapi(x86=X86_CDECL, x8664=X8664_FASTCALL, params={
"num": SIZE_T,
"size": SIZE_T
})
def hook_calloc(ql, address, params):
num = params['num']
size = params['size']
ret = ql.heap.mem_alloc(num * size)
ql.nprint('0x%0.2x: calloc(0x%x, 0x%x) = 0x%x' % (address, num, size, ret))
return ret
qiling/os/windows/dlls/user32.py
+34 -23
View File
@@ -22,12 +22,15 @@ from qiling.os.windows.utils import *
# DLGPROC lpDialogFunc,
# LPARAM dwInitParam
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=5)
def hook_DialogBoxParamA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hInstance": HANDLE,
"lpTemplateName": POINTER,
"hWndParent": HANDLE,
"lpDialogFunc": POINTER,
"dwInitParam": POINTER
})
def hook_DialogBoxParamA(ql, address, params):
ret = 0
hInstance, lpTemplateName, hWndParent, lpDialogFunc, dwInitParam = ql.get_params(5)
ql.nprint('0x%0.2x: DialogBoxParamA(0x%0.2x, 0x%0.2x, 0x%0.2x, 0x%0.2x, 0x%0.2x) = %d' %
(address, hInstance, lpTemplateName, hWndParent, lpDialogFunc, dwInitParam, ret))
return ret
@@ -37,16 +40,24 @@ def hook_DialogBoxParamA(ql, address):
# LPSTR lpString,
# int cchMax
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=4)
def hook_GetDlgItemTextA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hDlg": HANDLE,
"nIDDlgItem": INT,
"lpString": POINTER,
"cchMax": INT
})
def hook_GetDlgItemTextA(ql, address, params):
ret = 0
hDlg, nIDDlgItem, lpString, cchMax = ql.get_params(4)
hDlg = params["hDlg"]
nIDDlgItem = params["nIDDlgItem"]
lpString = params["lpString"]
cchMax = params["cchMax"]
ql.stdout.write(b"Input DlgItemText :\n")
string = ql.stdin.readline().strip()[:cchMax]
ret = len(string)
ql.uc.mem_write(lpString, string)
ql.nprint('0x%0.2x: GetDlgItemTextA(0x%0.2x, 0x%0.2x, 0x%0.2x, 0x%0.2x) = %d' %
(address, hDlg, nIDDlgItem, lpString, cchMax, ret))
return ret
@@ -56,14 +67,14 @@ def hook_GetDlgItemTextA(ql, address):
# LPCSTR lpCaption,
# UINT uType
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=4)
def hook_MessageBoxA(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hWnd": HANDLE,
"lpText": STRING,
"lpCaption": STRING,
"uType": UINT
})
def hook_MessageBoxA(ql, address, params):
ret = 2
hWnd, lpText, lpCaption, uType = ql.get_params(4)
s_lpText = read_cstring(ql, lpText)
s_lpCaption = read_cstring(ql, lpCaption)
ql.nprint('0x%0.2x: MessageBoxA(0x%0.2x, "%s", "%s", 0x%0.2x) = %d' %
(address, hWnd, s_lpText, s_lpCaption, uType, ret))
return ret
@@ -71,10 +82,10 @@ def hook_MessageBoxA(ql, address):
# HWND hDlg,
# INT_PTR nResult
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=2)
def hook_EndDialog(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hDlg": HANDLE,
"nResult": POINTER
})
def hook_EndDialog(ql, address, params):
ret = 1
hDlg, nResult = ql.get_params(2)
ql.nprint('0x%0.2x: EndDialog(0x%0.2x, 0x%0.2x) = %d' %
(address, hDlg, nResult, ret))
return ret
return ret
qiling/os/windows/dlls/wininet.py
+30 -17
View File
@@ -15,11 +15,22 @@ from qiling.os.windows.fncc import *
from qiling.os.windows.utils import *
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=5)
def hook_InternetOpenA(ql, address):
lpszAgent, dwAccessType, lpszProxy, lpszProxyBypass, dwFlags = ql.get_params(5)
ql.nprint('0x%0.2x: InternetOpenA(0x%x, 0x%x, 0x%x, 0x%x, 0x%x)' %
(address, lpszAgent, dwAccessType, lpszProxy, lpszProxyBypass, dwFlags))
# void InternetOpenA(
# LPCSTR lpszAgent,
# DWORD dwAccessType,
# LPCSTR lpszProxy,
# LPCSTR lpszProxyBypass,
# DWORD dwFlags
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"lpszAgent": STRING,
"dwAccessType": DWORD,
"lpszProxy": STRING,
"lpszProxyBypass": STRING,
"dwFlags": DWORD
})
def hook_InternetOpenA(ql, address, params):
pass
# void InternetOpenUrlA(
@@ -30,22 +41,24 @@ def hook_InternetOpenA(ql, address):
# DWORD dwFlags,
# DWORD_PTR dwContext
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=6)
def hook_InternetOpenUrlA(ql, address):
hInternet, lpszUrl, lpszHeaders, dwHeadersLength, \
dwFlags, dwContext = ql.get_params(6)
s_lpszUrl = read_cstring(ql, lpszUrl) if lpszUrl != 0 else ""
s_lpszHeaders = read_cstring(ql, lpszHeaders) if lpszHeaders != 0 else ""
ql.nprint('0x%0.2x: InternetOpenUrlA(0x%x, "%s", "%s", 0x%x, 0x%x, 0x%x)' %
(address, hInternet, s_lpszUrl, s_lpszHeaders, dwHeadersLength, dwFlags, dwContext))
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hInternet": POINTER,
"lpszUrl": STRING,
"lpszHeaders": STRING,
"dwHeadersLength": DWORD,
"dwFlags": DWORD,
"dwContext": POINTER
})
def hook_InternetOpenUrlA(ql, address, params):
pass
# BOOLAPI InternetCloseHandle(
# HINTERNET hInternet
# );
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, param_num=1)
def hook_InternetCloseHandle(ql, address):
@winapi(x86=X86_STDCALL, x8664=X8664_FASTCALL, params={
"hInternet": POINTER
})
def hook_InternetCloseHandle(ql, address, params):
ret = 1
hInternet = ql.get_params(1)
ql.nprint('0x%0.2x: InternetCloseHandle(0x%x) = %d' % (address, hInternet, ret))
return ret
qiling/os/windows/fncc.py
+91 -14
View File
@@ -21,27 +21,99 @@ X86_STDCALL = 1
X86_CDECL = 2
X8664_FASTCALL = 3
DWORD = 1
UINT = 1
INT = 1
BOOL = 1
SIZE_T = 1
BYTE = 1
ULONGLONG = 2
HANDLE = 3
POINTER = 3
STRING = 4
WSTRING = 5
def x86_stdcall(ql, param_num, func, args, kwargs):
def set_params(ql, in_params, out_params):
index = 0
for each in in_params:
if in_params[each] == DWORD or in_params[each] == POINTER:
out_params[each] = get_params_by_index(ql, index)
elif in_params[each] == ULONGLONG:
if ql.arch == QL_X86:
low = get_params_by_index(ql, index)
index += 1
high = get_params_by_index(ql, index)
out_params[each] = high << 8 + low
else:
out_params[each] = get_params_by_index(ql, index)
elif in_params[each] == STRING:
ptr = get_params_by_index(ql, index)
if ptr == 0:
out_params[each] = 0
else:
out_params[each] = read_cstring(ql, ptr)
elif in_params[each] == WSTRING:
ptr = get_params_by_index(ql, index)
if ptr == 0:
out_params[each] = 0
else:
out_params[each] = read_wstring(ql, ptr)
index += 1
return index
def print_function(ql, address, function_name, params, ret):
function_name = function_name.replace('hook_', '')
if function_name == "__stdio_common_vfprintf" or function_name == "printf":
return
log = '0x%0.2x: %s(' % (address, function_name)
for each in params:
value = params[each]
if type(value) == str or type(value) == bytearray:
log += '%s = "%s", ' % (each, value)
else:
log += '%s = 0x%x, ' % (each, value)
log = log.strip(", ")
log += ')'
if ret is not None:
log += ' = 0x%x' % ret
ql.nprint(log)
def x86_stdcall(ql, param_num, params, func, args, kwargs):
# get ret addr
ret_addr = ql.stack_read(0)
# read params
if params is not None:
param_num = set_params(ql, params, args[2])
# call function
result = func(*args, **kwargs)
# set return value
if result is not None:
set_return_value(ql, result)
# print
print_function(ql, args[1], func.__name__, args[2], result)
# add esp
esp = ql.uc.reg_read(UC_X86_REG_ESP)
ql.uc.reg_write(UC_X86_REG_ESP, esp + (param_num + 1) * 4)
# set ret
if result is not None:
ql.set_return_value(result)
# ret => pop eip
if ql.RUN:
ql.uc.reg_write(UC_X86_REG_EIP, ret_addr)
return result
def x86_cdecl(ql, param_num, func, args, kwargs):
def x86_cdecl(ql, param_num, params, func, args, kwargs):
# read params
if params is not None:
param_num = set_params(ql, params, args[2])
# call function
result = func(*args, **kwargs)
# set return value
if result is not None:
ql.set_return_value(result)
set_return_value(ql, result)
# print
print_function(ql, args[1], func.__name__, args[2], result)
# ret => pop eip
if ql.RUN:
ret_addr = ql.stack_pop()
@@ -49,12 +121,19 @@ def x86_cdecl(ql, param_num, func, args, kwargs):
return result
def x8664_fastcall(ql, param_num, func, args, kwargs):
def x8664_fastcall(ql, param_num, params, func, args, kwargs):
# get ret addr
ret_addr = ql.stack_read(0)
# read params
if params is not None:
param_num = set_params(ql, params, args[2])
# call function
result = func(*args, **kwargs)
# set return value
if result is not None:
ql.set_return_value(result)
set_return_value(ql, result)
# print
print_function(ql, args[1], func.__name__, args[2], result)
# add rsp
rsp = ql.uc.reg_read(UC_X86_REG_RSP)
if param_num > 4:
@@ -68,23 +147,21 @@ def x8664_fastcall(ql, param_num, func, args, kwargs):
# x86/x8664 PE should share Windows APIs
def winapi(x86, x8664, param_num, raw=False):
def winapi(x86, x8664, param_num=None, params=None):
"""
@param_num: the number of function params
"""
def decorator(func):
def wrapper(*args, **kwargs):
if raw:
return func(*args, **kwargs)
ql = args[0]
if ql.arch == QL_X86:
if x86 == X86_STDCALL:
return x86_stdcall(ql, param_num, func, args, kwargs)
return x86_stdcall(ql, param_num, params, func, args, kwargs)
elif x86 == X86_CDECL:
return x86_cdecl(ql, param_num, func, args, kwargs)
return x86_cdecl(ql, param_num, params, func, args, kwargs)
elif ql.arch == QL_X8664:
if x8664 == X8664_FASTCALL:
return x8664_fastcall(ql, param_num, func, args, kwargs)
return x8664_fastcall(ql, param_num, params, func, args, kwargs)
else:
raise QlErrorArch("unknown ql.arch")
return wrapper
qiling/os/windows/handle.py
+2 -1
View File
@@ -14,7 +14,7 @@
class Handle:
ID = 0xa0000000
def __init__(self, id=None, file=None, regkey=None, thread=None):
def __init__(self, id=None, file=None, regkey=None, thread=None, service=None):
if id is None:
self.id = Handle.ID
Handle.ID += 1
@@ -24,6 +24,7 @@ class Handle:
# self.fileobj = fileobj
self.regkey = regkey
self.thread = thread
self.service = service
# rewrite "="
def __eq__(self, other):
qiling/os/windows/registry.py
+22 -18
View File
@@ -50,18 +50,24 @@ class RegistryManager:
ql.reg_diff = "config.json"
self.config = os.path.join(rootfs, ql.reg_dir, ql.reg_diff)
if not os.path.exists(self.config):
f = open(self.config, 'w')
f.write("{}")
f.close()
# read config
# use registry config first
self.f_config = open(self.config, "r+")
try:
self.registry_config = json.loads(self.f_config.read())
except json.decoder.JSONDecodeError:
raise QlErrorJsonDecode("Windows Registry JSON decode error")
if not os.path.exists(self.config):
self.registry_config = {}
else:
# read config
# use registry config first
self.f_config = open(self.config, "rb")
data = self.f_config.read()
if data == b"":
self.registry_config = {}
self.f_config.close()
else:
try:
self.registry_config = json.loads(data)
except json.decoder.JSONDecodeError:
raise QlErrorJsonDecode("Windows Registry JSON decode error")
finally:
self.f_config.close()
# hkey local system
self.hklm = {}
@@ -164,17 +170,15 @@ class RegistryManager:
length = len(data)
elif reg_type == Registry.RegQWord:
data = self.ql.pack64(reg_value)
self.ql.mem_write(address, data)
self.ql.mem_write(address, data)
length = len(data)
else:
raise QlErrorNotImplemented("Windows Registry Type write to memory %s not implemented" % (REG_TYPES[reg_type]))
return length
def __del__(self):
def save(self):
# write registry config to config file
if self.registry_config and self.registry_config != "":
self.f_config.seek(0)
self.f_config.truncate()
self.f_config.write(json.dumps(self.registry_config))
self.f_config.close()
if self.registry_config and len(self.registry_config) != 0:
with open(self.config, "wb") as f:
f.write(bytes(json.dumps(self.registry_config), "utf-8"))
qiling/os/windows/utils.py
+23
View File
@@ -85,6 +85,29 @@ def string_unpack(string):
return string.decode().split("\x00")[0]
def x86_get_params_by_index(ql, index):
# index starts from 0
# skip ret_addr
return ql.stack_read((index + 1) * 4)
def x8664_get_params_by_index(ql, index):
reg_list = [UC_X86_REG_RCX, UC_X86_REG_RDX, UC_X86_REG_R8, UC_X86_REG_R9]
if index < 4:
return ql.uc.reg_read(reg_list[index])
index -= 4
# skip ret_addr
return ql.stack_read((index + 1) * 8)
def get_params_by_index(ql, index):
if ql.arch == QL_X86:
return x86_get_params_by_index(ql, index)
elif ql.arch == QL_X8664:
return x8664_get_params_by_index(ql, index)
def _x86_get_args(ql, number):
arg_list = []
for i in range(number):
qiling/os/windows/x86.py
+2 -2
View File
@@ -46,7 +46,7 @@ def hook_winapi(uc, address, size, ql):
# call win32 api
if address in ql.PE.import_symbols:
try:
globals()['hook_' + ql.PE.import_symbols[address].decode()](ql, address)
globals()['hook_' + ql.PE.import_symbols[address].decode()](ql, address, {})
except KeyError as e:
print("[!]", e, "\t is not implemented")
@@ -166,4 +166,4 @@ def runner(ql):
ql_hook_code_disasm(ql.uc, ql.pc, 64, ql)
ql.errmsg = 1
ql.nprint("%s" % e)
ql.registry_manager.save()
qiling/os/windows/x8664.py
+2 -1
View File
@@ -37,7 +37,7 @@ def set_pe64_gdt(ql):
def hook_winapi(uc, address, size, ql):
if address in ql.PE.import_symbols:
try:
globals()['hook_' + ql.PE.import_symbols[address].decode()](ql, address)
globals()['hook_' + ql.PE.import_symbols[address].decode()](ql, address, {})
except KeyError as e:
print("[!]", e, "\t is not implemented")
@@ -145,3 +145,4 @@ def runner(ql):
ql_hook_code_disasm(ql.uc, ql.pc, 64, ql)
ql.errmsg = 1
ql.nprint("%s" % e)
ql.registry_manager.save()