-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathPEManager.py
More file actions
1322 lines (1163 loc) · 51.2 KB
/
PEManager.py
File metadata and controls
1322 lines (1163 loc) · 51.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/python
# -*- coding: utf-8 -*-
"""PEManager, Utility for parsing and modifying PE.
"""
import copy
import operator
from pefile import *
from Log import LoggerFactory
class PEManager(object):
"""
PEManager
"""
def __init__(self, filename):
"""
construct a new PEManager
Args:
filename (str) : file name with absolute file path.
"""
self.PEName = filename
pe_file = open(filename, 'r+b')
pe_data = mmap.mmap(pe_file.fileno(), 0, access=mmap.ACCESS_COPY)
self.PEOrigin = PE(None, data=pe_data, fast_load=False)
self.PE = PE(None, data=pe_data, fast_load=False)
self._IMAGE_BASE_ = self.PE.OPTIONAL_HEADER.ImageBase
self.instrument = None
self.log = None
self.section_prev_adjust = None
def set_instrument(self, instrumentor):
"""
set up instrument
Args:
instrumentor(:obj:`PEInstrument`) : instrument of this file
"""
self.instrument = instrumentor
def get_instrument(self):
"""
get instrument of current file
Returns:
:obj:`PEInstrument` : instrument of current file util
"""
return self.instrument
def append_section_to_file(self, section):
"""
append section to file structure.
Args:
section(:obj:`Section`) : section that append to file
"""
self.PE.sections.append(section)
self.PE.__structures__.append(section)
def get_file_data(self):
"""
get data of file
Returns:
:obj:`bytearray` : bytearray type data of file
"""
return self.PE.__data__
def get_aligned_offset(self, offset):
"""
Align offset with file alignment
Args:
offset(int) : offset of file
Returns:
int : aligned offset
"""
file_align = self.PE.OPTIONAL_HEADER.FileAlignment
v = offset % file_align
if v > 0:
return (offset - v) + file_align
return offset
def get_aligned_rva(self, va):
"""
get aligned virtual address from argument.
Args:
va(int): virtual address for align
Returns:
int : aligned virtual address
"""
aligned_va = self.get_section_alignment()
v = va % aligned_va
if v > 0:
return (va - v) + aligned_va
return va
def append_data_to_file(self, data):
"""
append data to file.
Args:
data(bytearray) : data for append that bytearray type.
Returns:
:obj:`tuple`: tuple containing:
aligned_orig_data_len(int) : file data length that aligned.\n
aligned_data_len(int) : argument data length that aligned.
"""
orig_data_len = len(self.get_file_data())
aligned_orig_data_len = self.get_aligned_offset(orig_data_len)
data_len = len(data)
aligned_data_len = self.get_aligned_offset(data_len)
# make null space for data.
space = bytearray((aligned_orig_data_len + aligned_data_len)
- orig_data_len)
self.PE.set_bytes_at_offset(orig_data_len - 1, bytes(space))
# Fill space with data
self.PE.set_bytes_at_offset(aligned_orig_data_len, bytes(data))
return aligned_orig_data_len, aligned_data_len
def create_new_executable_section(self, data):
"""
Create new executable section with given data.
Args:
data(bytearray) : Raw point of new section
"""
size_of_data = len(data)
(pointToRaw, sizeOfRaw) = self.append_data_to_file(data)
# TODO : Fixed the assumption that the first section is a text section.
section = self.PE.sections[0]
section.SizeOfRawData = sizeOfRaw
section.PointerToRawData = pointToRaw
section.Misc_VirtualSize = size_of_data
section.Misc_PhysicalAddress = size_of_data
section.Misc = size_of_data
# self.PE.OPTIONAL_HEADER.SizeOfCode = size_of_data
def create_new_data_section(self, data, name):
"""
Create a new data section and add it to the last section.
Args:
data(bytearray) : data for append to section.
name(str) : name of section.
Returns:
:obj:`Section` : new section that created.
"""
if len(name) > 8:
print("[EXCEPTION] SECTION NAME MUST LESS THEN 8 CHARACTER")
exit()
size_of_data = len(data)
(pointToRaw, sizeOfRaw) = self.append_data_to_file(data)
section = self.get_cloned_section_header(self.get_data_section())
section.Name = name
section.SizeOfRawData = sizeOfRaw
section.PointerToRawData = pointToRaw
section.Misc_VirtualSize = size_of_data
section.Misc_PhysicalAddress = size_of_data
section.Misc = size_of_data
# section.Characteristics = (1 << 31) + (1 << 30) + (1 << 6)
characteristics = \
SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_WRITE'] \
| SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_READ'] \
| SECTION_CHARACTERISTICS['IMAGE_SCN_CNT_INITIALIZED_DATA']
section.Characteristics = characteristics
section.next_section_virtual_address = None
last_section = self.PE.sections[-1]
rva_end = last_section.VirtualAddress + last_section.Misc_VirtualSize
section.VirtualAddress = self.get_aligned_rva(rva_end)
last_section_last_offset = \
last_section.get_file_offset() + last_section.sizeof()
section.set_file_offset(last_section_last_offset)
self.PE.FILE_HEADER.NumberOfSections += 1
self.append_section_to_file(section)
return section
def get_section_raw_data(self, section):
"""
get raw data from section header
Args:
section(Section) : section header that
Returns:
:obj:`bytearray` : data that section contain.
"""
offset = section.PointerToRawData
size = section.SizeOfRawData
data = bytearray(self.get_file_data()[offset:offset + size])
return data
def get_entry_point_rva(self):
"""
get Entry point virtual address of file
Returns:
int : entry point virtual address
"""
return self.PE.OPTIONAL_HEADER.AddressOfEntryPoint
def get_text_section_virtual_address_range(self):
"""
get Virtual address range of text section
Returns:
:obj:`tuple` : tuple containing :
- int : the start address of section. \n
- int : the end address of section.
"""
executable_section = self.get_text_section()
va_size = executable_section.Misc_VirtualSize
va = executable_section.VirtualAddress
return va, va + va_size
def get_text_section(self):
"""
get text section.
Returns:
:obj:`section` : Text section.
"""
for currentSection in self.PE.sections:
if currentSection.Characteristics & 0x20000000:
return currentSection
def get_section_alignment(self):
"""
get section alignment.
Returns:
int : section alignment
"""
return self.PE.OPTIONAL_HEADER.SectionAlignment
def set_entry_point(self, entry_va):
"""
Set up entry point of file
Args:
entry_va (int): virtual address of entry point
"""
self.PE.OPTIONAL_HEADER.AddressOfEntryPoint = entry_va
def _adjust_file(self):
self._remove_certification()
self.adjust_file_layout()
self.PE.merge_modified_section_data()
self.PE.OPTIONAL_HEADER.SizeOfImage = self.get_image_size()
self.PE.OPTIONAL_HEADER.CheckSum = 0
self.PE.OPTIONAL_HEADER.CheckSum = self.PE.generate_checksum()
def writefile(self, file_path):
"""
write instrumented & modified file data to file.
Args:
file_path (str) : file path with absolute path.
"""
self.adjust_file_layout()
self.PE.write(file_path)
def writefile_without_adjust(self, file_path):
"""
write file data to file.
Args:
file_path(str) : file name with its absolute path.
"""
self.PE.write(file_path)
def get_image_size(self):
"""
last section's end represent that Image size.
Returns:
int : Image size.
"""
section = self.PE.sections[-1]
va = section.VirtualAddress
size = section.Misc_VirtualSize
return self.get_aligned_rva(va + size)
def get_relocation(self):
"""
get relocation elements.
Returns:
:obj:`dict` : Dict containing:
int : address of relocation block\n
:obj:`list` : relocation block info. list containing:
- int : relative address of relocation element.
- int : address of relocation element.
- int : type that represented by int.
"""
relocation = {}
if hasattr(self.PE, 'DIRECTORY_ENTRY_BASERELOC'):
for entry in self.PE.DIRECTORY_ENTRY_BASERELOC:
for el in entry.entries:
if el.struct.Data == 0:
continue
address = el.rva
relocation[address] = [el.rva, address, el.type]
return relocation
def get_relocation_from_structures(self):
"""
get relocation elements from file structures that not parsed yet.
Returns:
:obj:`dict`: Dict containing:
int : relative address of relocation block. \n
:obj:`list` : list of relocation entry. :obj:`list` containing:
- :obj:`Structure` : IMAGE_BASE_RELOCATION_ENTRY
Examples:
{ Relocation block address : [Relocation Entry]}
"""
structures_relocation_block = {}
structures_relocation_entries = {}
block_va = -1
for entry in self.PE.__structures__:
if entry.name.find('IMAGE_BASE_RELOCATION_ENTRY') != -1:
if block_va > 0:
structures_relocation_entries[block_va].append(entry)
elif entry.name.find('IMAGE_BASE_RELOCATION') != -1:
block_va = entry.VirtualAddress
structures_relocation_block[block_va] = entry
structures_relocation_entries[block_va] = []
elif entry.name.find('DIRECTORY_ENTRY_BASERELOC') != -1:
"DIRECTORY"
return structures_relocation_entries
def get_import_structures(self):
"""
get import lists of pe file.
Returns:
:obj:`list` : containing structures of import :
:obj:`Structure`: IMAGE_IMPORT_DESCRIPTOR or IMAGE_THUNK_DATA
"""
imports_start_index = 0
imports_end_index = 0
for index, structure in enumerate(self.PE.__structures__):
if ((structure.name == 'IMAGE_IMPORT_DESCRIPTOR')
== (structure.name == 'IMAGE_THUNK_DATA')):
if imports_start_index > 0:
imports_end_index = index
break
else:
if imports_start_index == 0:
imports_start_index = index
return self.PE.__structures__[imports_start_index:imports_end_index]
def get_imports_range_in_structures(self):
"""
start and end index of import at structures.
Returns:
:obj:`tuple` : tuple containing:
- int : start index of import at structures.
- int : last index of import at structures.
"""
imports_start_index = 0
imports_end_index = 0
for index, structure in enumerate(self.PE.__structures__):
if ((structure.name == 'IMAGE_IMPORT_DESCRIPTOR')
== (structure.name == 'IMAGE_THUNK_DATA')):
if imports_start_index > 0:
imports_end_index = index
break
else:
if imports_start_index == 0:
imports_start_index = index
return imports_start_index, imports_end_index
def is_possible_relocation(self):
"""
Verify that the file can be relocated.
Returns:
bool : True if relocation possible, False otherwise.
"""
if hasattr(self.PE, 'DIRECTORY_ENTRY_BASERELOC'):
return True
return False
def adjust_file_layout(self):
"""
adjust broken file layout while instrumentation.
"""
# adjust that before section adjusting
self._adjust_entry_point()
self._adjust_executable_section()
# self.adjustRelocationDirectories()
# section adjusting
self._adjust_section()
# adjust that after section adjusting
self._adjust_optional_header()
self._adjust_data_directories()
def _adjust_section(self):
"""
instrumentation or modification can increase size of section.
as a result, section's area can overlapped.
that is why we need to relocate section without overlapped area.
"""
self.section_prev_adjust = copy.deepcopy(self.PE.sections)
for index in range(len(self.PE.sections) - 1):
src_section = self.PE.sections[index]
virtual_size = src_section.Misc_VirtualSize
src_va = src_section.VirtualAddress
src_va_end = src_va + virtual_size
dst_section = self.PE.sections[index + 1]
if dst_section.VirtualAddress < src_va_end:
print("adjust virtual address")
section_va = dst_section.VirtualAddress
adjusted_section_va = section_va + (src_va_end - section_va)
adjusted_section_va = self.get_aligned_rva(adjusted_section_va)
dst_section.VirtualAddress = adjusted_section_va
src_section.next_section_virtual_address = adjusted_section_va
def _adjust_optional_header(self):
"""
while instrumentation, it can change position of pointer recoreded in
Optional header. for that reason that we need adjust this.
"""
# adjust base of data
if hasattr(self.PEOrigin.OPTIONAL_HEADER, 'BaseOfData'):
base_of_data = self.PEOrigin.OPTIONAL_HEADER.BaseOfData
for index in range(len(self.PEOrigin.sections)):
section = self.PEOrigin.sections[index]
if (section.VirtualAddress
<= base_of_data
< (section.VirtualAddress + section.Misc_VirtualSize)):
base_of_data_section_rva = base_of_data \
- section.VirtualAddress
adjusted_section = self.PE.sections[index]
self.PE.OPTIONAL_HEADER.BaseOfData = \
adjusted_section.VirtualAddress \
+ base_of_data_section_rva
"""
Recalculates the SizeOfImage, SizeOfCode, SizeOfInitializedData and
SizeOfUninitializedData of the optional header.
"""
optional_hdr = self.PE.OPTIONAL_HEADER
optional_hdr.SizeOfImage = (
self.PE.sections[-1].VirtualAddress +
self.PE.sections[-1].Misc_VirtualSize
)
optional_hdr.SizeOfCode = 0
optional_hdr.SizeOfInitializedData = 0
optional_hdr.SizeOfUninitializedData = 0
# Recalculating the sizes by iterating over every section and checking
# if the appropriate characteristics are set.
for section in self.PE.sections:
if section.Characteristics & 0x00000020:
# Section contains code.
optional_hdr.SizeOfCode += section.SizeOfRawData
if section.Characteristics & 0x00000040:
# Section contains initialized data.
optional_hdr.SizeOfInitializedData += section.SizeOfRawData
if section.Characteristics & 0x00000080:
# Section contains uninitialized data.
optional_hdr.SizeOfUninitializedData += section.SizeOfRawData
def _adjust_data_directories(self):
"""
adjust element of data directories.
"""
sections = self.PE.sections
origin_sections = self.section_prev_adjust
data_directories = self.PE.OPTIONAL_HEADER.DATA_DIRECTORY
for index in range(len(origin_sections)):
section = sections[index]
origin_section = origin_sections[index]
origin_section_start = origin_section.VirtualAddress
if index + 1 < len(origin_sections):
origin_section_end = origin_sections[index + 1].VirtualAddress
else:
origin_section_end = origin_section.VirtualAddress + \
origin_section.Misc_VirtualSize
data_directories = \
self.adjust_directories(data_directories,
origin_section_start,
section.VirtualAddress,
origin_section_end,
section.Misc_VirtualSize)
def adjust_directories(self, data_directories, origin_section_start,
adjust_section_start, origin_section_end,
adjust_section_end):
"""
adjust directories Virtual address.
Args:
data_directories(:obj:`list`): data directories in PE file.
origin_section_start(Int) : start virtual address of section.
adjust_section_start(int) : start virtual address of adjust section.
origin_section_end(int) : last virtual address of section.
adjust_section_end(int) : last virtual address of adjust section.
"""
directory_adjust = {
'IMAGE_DIRECTORY_ENTRY_IMPORT': self.adjust_import,
# 'IMAGE_DIRECTORY_ENTRY_DEBUG': self.adjustDebug,
'IMAGE_DIRECTORY_ENTRY_TLS': self.adjust_TLS,
'IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG': self.adjust_load_config,
'IMAGE_DIRECTORY_ENTRY_EXPORT': self.adjust_export,
'IMAGE_DIRECTORY_ENTRY_RESOURCE': self.adjust_resource,
'IMAGE_DIRECTORY_ENTRY_BASERELOC': self.adjust_relocation,
'IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT': self.adjust_delay_import,
'IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT': self.adjust_bound_imports,
'IMAGE_DIRECTORY_ENTRY_IAT': self.adjust_iat,
}
remove_list = []
increased_size = adjust_section_start - origin_section_start
for directory in data_directories:
if (origin_section_start
<= directory.VirtualAddress
< origin_section_end):
print("{} <= {} < {}, {}"
.format(origin_section_start,
directory.VirtualAddress,
origin_section_end,
directory.name))
index = self.PE.OPTIONAL_HEADER.DATA_DIRECTORY.index(directory)
self.PE.OPTIONAL_HEADER.DATA_DIRECTORY[index].VirtualAddress \
= directory.VirtualAddress + increased_size
try:
if directory.name in directory_adjust:
entry = directory_adjust[directory.name]
entry(directory, directory.VirtualAddress,
directory.Size, increased_size)
except IndexError as e:
print("===== [INDEX ERROR] =====")
print(e)
exit()
remove_list.append(directory)
for el in remove_list:
data_directories.remove(el)
return data_directories
def _remove_certification(self):
"""
set zero to certification data directory of pe file.
"""
for index in range(len(self.PE.OPTIONAL_HEADER.DATA_DIRECTORY)):
directory = self.PE.OPTIONAL_HEADER.DATA_DIRECTORY[index]
if directory.name == 'IMAGE_DIRECTORY_ENTRY_SECURITY':
directory.VirtualAddress = 0
directory.Size = 0
def adjust_relocation(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_BASERELOC
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
self.adjust_relocation_directories(increase_size)
self.log = LoggerFactory().get_new_logger("AdjustRelocation2nd.log")
relocation_dict = self.get_relocation_from_structures()
# TODO : fix assume that first section is text.
origin_sections = self.PEOrigin.sections
target_sections = self.PE.sections
execute_section_start = origin_sections[0].VirtualAddress
execute_section_end = (execute_section_start
+ origin_sections[0].Misc_VirtualSize)
other_section_start = origin_sections[1].VirtualAddress
other_section_end = (target_sections[-1:][0].VirtualAddress
+ target_sections[-1:][0].Misc_VirtualSize)
sorted_relocation_dict = sorted(relocation_dict.items(),
key=operator.itemgetter(0))
for block_va, entries in sorted_relocation_dict:
for entry in entries:
if entry.Data == 0x0:
continue
reloc_rva = (entry.Data & 0xfff) + block_va
value = self.PE.get_dword_at_rva(reloc_rva)
if ((execute_section_start + self._IMAGE_BASE_)
<= value
< (execute_section_end + self._IMAGE_BASE_)):
instrumented_size = \
self.get_instrument() \
.get_instrumented_vector_size(value
- self._IMAGE_BASE_
- 0x1000)
structure = self.get_structure_from_rva(reloc_rva)
if structure is not None:
structure.AddressOfData = value + instrumented_size
# actually effect
structure.ForwarderString = value + instrumented_size
structure.Function = value + instrumented_size
structure.Ordinal = value + instrumented_size
"""
origin = structure.__pack__()
temp = structure.AddressOfData
structure.AddressOfData = value + instrumented_size
if origin == structure.__pack__():
print("1")
structure.AddressOfData = temp
temp = structure.ForwarderString
structure.ForwarderString = value + instrumented_size
if origin == structure.__pack__():
print("2")
structure.ForwarderString = temp
temp = structure.Function
structure.Function = value + instrumented_size
if origin == structure.__pack__():
print("3")
structure.Function = temp
temp = structure.Ordinal
structure.Ordinal = value + instrumented_size
if origin == structure.__pack__():
print("4")
structure.Ordinal = temp
"""
self.set_dword_at_rva(reloc_rva, value + instrumented_size)
self.log.log("[1] [0x{:x}]\t0x{:x}\t0x{:x}\t0x{:x}\n"
.format(reloc_rva, value,
self.PE.get_dword_at_rva(reloc_rva),
instrumented_size))
elif ((other_section_start + self._IMAGE_BASE_)
<= value
< (other_section_end + self._IMAGE_BASE_)):
self.set_dword_at_rva(reloc_rva, value + increase_size)
self.log.log(
"[2] [0x{:x}]\t0x{:x}\t0x{:x}\t0x{:x}\n"
.format(reloc_rva, value,
self.PE.get_dword_at_rva(reloc_rva),
increase_size)
)
else:
try:
self.log.log(
"[3] [0x{:x}]\t0x{:x}\t0x{:x}\t0x{:x}\n"
.format(reloc_rva, value,
self.PE.get_dword_at_rva(reloc_rva),
increase_size)
)
except ValueError as e:
print("=================[ERROR]===================")
print(e)
print(
"\t[ELSE] [0x{:x}]\t0x{:x}\t0x{:x}\t0x{:x}\n"
.format(reloc_rva, value,
self.PE.get_dword_at_rva(reloc_rva),
increase_size)
)
exit()
def adjust_load_config(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
size = self.PE.get_dword_at_rva(rva)
time = self.PE.get_dword_at_rva(rva + 0x4)
version = self.PE.get_dword_at_rva(rva + 0x8)
global_flags_clear = self.PE.get_dword_at_rva(rva + 0xC)
global_flags_set = self.PE.get_dword_at_rva(rva + 0x10)
critical_section_default_timeout = self.PE.get_dword_at_rva(rva + 0x14)
decommit_free_block_threshold = self.PE.get_dword_at_rva(rva + 0x18)
decommit_total_free_threshold = self.PE.get_dword_at_rva(rva + 0x1C)
Lock_Prefix_Table_VA = self.PE.get_dword_at_rva(rva + 0x20)
Maximum_Allocation_Size = self.PE.get_dword_at_rva(rva + 0x24)
VIrtual_Memory_Threshold = self.PE.get_dword_at_rva(rva + 0x28)
Process_Heap_Flags = self.PE.get_dword_at_rva(rva + 0x2C)
Process_Affinity_Mask = self.PE.get_dword_at_rva(rva + 0x30)
CSD_Version = self.PE.get_dword_at_rva(rva + 0x34)
Edit_List_VA = self.PE.get_dword_at_rva(rva + 0x38)
directory_load_config = self.PE.DIRECTORY_ENTRY_LOAD_CONFIG
if directory_load_config.struct.SecurityCookie > 0x0:
directory_load_config.struct.SecurityCookie += increase_size
if directory_load_config.struct.SEHandlerTable > 0x0:
directory_load_config.struct.SEHandlerTable += increase_size
if directory_load_config.struct.GuardCFCheckFunctionPointer > 0x0:
directory_load_config.struct.GuardCFCheckFunctionPointer \
+= increase_size
# Security_Cookie_VA = self.PE.get_dword_at_rva(rva + 0x3C)
# self.setDwordAtRVA(rva + 0x3C, Security_Cookie_VA + increase_size)
# SE_Handler_Table_VA = self.PE.get_dword_at_rva(rva + 0x40)
# self.setDwordAtRVA(rva + 0x40, SE_Handler_Table_VA + increase_size)
SE_Handler_Count = self.PE.get_dword_at_rva(rva + 0x44)
return 0
def adjust_debug(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_DEBUG
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
return 0
def adjust_TLS(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_TLS
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
directory_tls = self.PE.DIRECTORY_ENTRY_TLS
if directory_tls.struct.AddressOfCallBacks > 0:
directory_tls.struct.AddressOfCallBacks \
+= increase_size
if directory_tls.struct.AddressOfIndex > 0:
directory_tls.struct.AddressOfIndex \
+= increase_size
if directory_tls.struct.EndAddressOfRawData > 0:
directory_tls.struct.EndAddressOfRawData \
+= increase_size
if directory_tls.struct.StartAddressOfRawData > 0:
directory_tls.struct.StartAddressOfRawData += increase_size
return 0
def adjust_iat(self, directory, rva, size, increase_size):
pass
def adjust_bound_imports(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
return 0
def adjust_delay_import(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
first_import_entry = self.PE.DIRECTORY_ENTRY_DELAY_IMPORT[0]
first_import_entry.struct.pINT = \
first_import_entry.struct.pINT + increase_size
first_import_entry.struct.pIAT = \
first_import_entry.struct.pIAT + increase_size
first_import_entry.struct.pBoundIAT += increase_size
first_import_entry.struct.phmod += increase_size
first_import_entry.struct.szName += increase_size
for import_data in first_import_entry.imports:
iat = import_data.struct_iat
ilt = import_data.struct_table
address = iat.AddressOfData
instrumented_size = \
self.get_instrument() \
.get_instrumented_vector_size(address
- self._IMAGE_BASE_
- increase_size)
iat.AddressOfData += instrumented_size
iat.ForwarderString += instrumented_size
iat.Function += instrumented_size
iat.Ordinal += instrumented_size
ilt.AddressOfData += increase_size
ilt.ForwarderString += increase_size
ilt.Function += increase_size
ilt.Ordinal += increase_size
def adjust_import(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_IMPORT
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
import_structures = self.get_import_structures()
for entry in import_structures:
if entry.name == 'IMAGE_IMPORT_DESCRIPTOR':
if entry.OriginalFirstThunk > 0:
entry.OriginalFirstThunk += increase_size
if entry.Characteristics > 0:
entry.Characteristics += increase_size
if entry.FirstThunk > 0:
entry.FirstThunk += increase_size
if entry.Name > 0:
entry.Name += increase_size
elif entry.name == 'IMAGE_THUNK_DATA':
if entry.Ordinal & 0x80000000:
# This is Ordinal import
pass
else:
if entry.AddressOfData > 0:
entry.AddressOfData += increase_size
if entry.ForwarderString > 0:
entry.ForwarderString += increase_size
if entry.Function > 0:
entry.Function += increase_size
def adjust_export(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_EXPORT
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
self.log = LoggerFactory().get_new_logger("AdjustExport.log")
export_entry = self.PE.DIRECTORY_ENTRY_EXPORT
export_entry_struct = export_entry.struct
export_entry_struct.AddressOfFunctions += increase_size
export_entry_struct.AddressOfNameOrdinals += increase_size
export_entry_struct.AddressOfNames += increase_size
export_entry_struct.Name += increase_size
instrument_size = 0
for index in range(len(export_entry.symbols)):
entry_name_rva = export_entry_struct.AddressOfNames + (index * 4)
name_rva = self.PE.get_dword_at_rva(entry_name_rva)
name_rva += increase_size
self.set_dword_at_rva(entry_name_rva, name_rva)
entry_fn_rva = export_entry_struct.AddressOfFunctions + (index * 4)
fn_rva = self.PE.get_dword_at_rva(entry_fn_rva)
# when export RVA belong other section.
if self.PEOrigin.sections[1].VirtualAddress <= fn_rva:
self.log.log("[OTHER]\t")
instrument_size = self.PE.sections[1].VirtualAddress \
- self.PEOrigin.sections[1].VirtualAddress
# when export RVA belong code section.
if self.PEOrigin.sections[0].VirtualAddress \
<= fn_rva \
< self.PEOrigin.sections[1].VirtualAddress:
self.log.log("[CODE]\t")
instrument_size = self.get_instrument() \
.get_instrumented_vector_size(fn_rva - 0x1000)
self.set_dword_at_rva(entry_fn_rva, fn_rva + instrument_size)
self.log.log("{:x}\t{:x}\n".format(fn_rva, instrument_size))
def adjust_resource(self, directory, rva, size, increase_size):
"""
adjust relocation directory's elements.
Args:
directory(:obj:`Structure`): IMAGE_DIRECTORY_ENTRY_RESOURCE
rva(int): current directory's relative virtual address.
size(int): current directory's size.
increase_size(int): increased size of section that directory included.
"""
for rsrc_entries in self.PE.DIRECTORY_ENTRY_RESOURCE.entries:
for rsrc_directory_entry in rsrc_entries.directory.entries:
for rsrc_directory_el in rsrc_directory_entry.directory.entries:
rsrc_directory_el.data.struct.OffsetToData += increase_size
def set_dword_at_rva(self, rva, dword):
"""
set dword at rva.
Args:
rva(int) : relative address.
dword(bytes) : 4-bytes type value.
"""
return self.PE.set_dword_at_rva(rva, dword)
def get_data_section(self):
"""
get data section of PE.
Returns:
:obj:`Section` : data section of PE.
"""
data_section = \
self.get_section_belong_rva(self.PE.OPTIONAL_HEADER.BaseOfData)
return data_section
def _adjust_entry_point(self):
"""
adjust entry point of file
"""
entry_va = self.get_entry_point_rva()
instrument_size = \
self.get_instrument() \
.get_instrumented_vector_size(entry_va - 0x1000)
self.set_entry_point(entry_va + instrument_size)
def _adjust_executable_section(self):
"""
create new section and append modified code data.
"""
code_data = self.get_instrument().get_code()
self.create_new_executable_section(code_data)
def get_relocation_directories(self):
"""
get relocation directories with its include elements.
Returns:
:obj:`tuple`: tuple containing:
:obj:`dict` : relocation blocks
- block address(int) : address of block
- block entry(:obj:`Structure`) : IMAGE_BASE_RELOCATION
:obj:`dict` : relocation entry
- block address(int) : The block address to which the entry belongs
- relocation entry(:obj:`Structure`) : IMAGE_BASE_RELOCATION_ENTRY
"""
relocation_blocks = {}
relocation_entries = {}
block_va = -1
for entry in self.PE.__structures__:
if entry.name.find('IMAGE_BASE_RELOCATION_ENTRY') != -1:
if block_va > 0:
relocation_entries[block_va].append(entry)
elif entry.name.find('IMAGE_BASE_RELOCATION') != -1:
block_va = entry.VirtualAddress
relocation_blocks[block_va] = entry
relocation_entries[block_va] = []
elif entry.name.find('DIRECTORY_ENTRY_BASERELOC') != -1:
"DIRECTORY"
return relocation_blocks, relocation_entries
def adjust_relocation_offset(self):
"""
structures has owned offset.
so, if modify position or order of structures element
then must fix offset of structures element.
"""
file_offset = 0
for entry in self.PE.__structures__:
if entry.name.find('IMAGE_BASE_RELOCATION_ENTRY') != -1:
entry.set_file_offset(file_offset)
file_offset += 2
elif entry.name.find('IMAGE_BASE_RELOCATION') != -1:
if file_offset == 0:
file_offset = entry.get_file_offset()
entry.set_file_offset(file_offset)
file_offset += 8
elif entry.name.find('DIRECTORY_ENTRY_BASERELOC') != -1:
'DIRECTORY_ENTRY_BASERELOC'
def get_abs_va_from_offset(self, offset):
"""
calculate absolute virtual address from offset.
Args:
offset(int) : offset of file.
Returns:
int : absolute address to match offset.
"""
rva = self.PE.get_rva_from_offset(offset)
return self.get_abs_va_from_rva(rva)
def get_abs_va_from_rva(self, rva):
"""
get absolute virtual address from rva that argument.
Args:
rva(int) : relative address to be calculate.
Returns:
int : absolute address from rva.
"""