Changeset 1661

Timestamp:

07/21/08 00:47:21 (3 months ago)

Author:

common

Message:

libemu

• sctest
  
  • implement hooks for fopen fwrite fclose CreateFile? WriteFile? CloseHandle?
    implement a nanny to make sure we do not use invalid filehandles
    add the nanny to the Makefile
    now sctest can emulate shellcodes which download files themselves, it will store the file in /tmp/<filename>-XXXXXX
    

Files:

• libemu/trunk/tools/sctest/Makefile.am (modified) (1 diff)
• libemu/trunk/tools/sctest/nanny.c (added)
• libemu/trunk/tools/sctest/nanny.h (added)
• libemu/trunk/tools/sctest/sctestmain.c (modified) (5 diffs)
• libemu/trunk/tools/sctest/userhooks.c (modified) (5 diffs)
• libemu/trunk/tools/sctest/userhooks.h (modified) (1 diff)

libemu/trunk/tools/sctest/Makefile.am

@@ -18 +18 @@
-sctest_SOURCES += userhooks.c
-sctest_SOURCES += userhooks.h
-#
-#
+
+
-

libemu/trunk/tools/sctest/sctestmain.c

@@ -96 +96 @@
-#include "dot.h"
-#include "tests.h"
+#include "nanny.h"
+
-
-struct run_time_options opts;
@@ -131 +133 @@
-        struct emu_env *env = emu_env_new(e);
-
+        struct nanny *na = nanny_new();
-//      lenv->profile = wenv->profile;
-
@@ -151 +154 @@
-        if ( opts.interactive == true )
-        {
+
+                emu_env_w32_load_dll(env->env.win,"msvcrt.dll");
+                emu_env_w32_export_hook(env, "fclose", user_hook_fclose, na);
+                emu_env_w32_export_hook(env, "fopen", user_hook_fopen, na);
+                emu_env_w32_export_hook(env, "fwrite", user_hook_fwrite, na);
+
-                emu_env_w32_export_hook(env, "CreateProcessA", user_hook_CreateProcess, NULL);
-                emu_env_w32_export_hook(env, "WaitForSingleObject", user_hook_WaitForSingleObject, NULL);
+                emu_env_w32_export_hook(env, "CreateFileA", user_hook_CreateFile, na);
+                emu_env_w32_export_hook(env, "WriteFile", user_hook_WriteFile, na);
+                emu_env_w32_export_hook(env, "CloseHandle", user_hook_CloseHandle, na);
+
-
-                emu_env_w32_load_dll(env->env.win,"ws2_32.dll");
@@ -159 +172 @@
-                emu_env_w32_export_hook(env, "closesocket", user_hook_closesocket, NULL);
-                emu_env_w32_export_hook(env, "connect", user_hook_connect, NULL);
-                emu_env_w32_export_hook(env, "fclose", user_hook_fclose, NULL);
-                emu_env_w32_export_hook(env, "fopen", user_hook_fopen, NULL);
-                emu_env_w32_export_hook(env, "fwrite", user_hook_fwrite, NULL);
-
-                emu_env_w32_export_hook(env, "listen", user_hook_listen, NULL);
@@ -402 +412 @@
-
-        emu_profile_debug(env->profile);
-
+
+
+
-
-        if (eh != NULL)

libemu/trunk/tools/sctest/userhooks.c

@@ -86 +86 @@
-#include "userhooks.h"
-#include "options.h"
+#include "nanny.h"
-
-#include <stdint.h>
@@ -340 +341 @@
-        printf("Hook me Captain Cook!\n");
-        printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -348 +366 @@
-        printf("Hook me Captain Cook!\n");
-        printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -355 +392 @@
-        printf("Hook me Captain Cook!\n");
-        printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -450 +505 @@
-}
-
+
+uint32_t user_hook_CreateFile(struct emu_env *env, struct emu_env_hook *hook, ...)
+{
+        printf("Hook me Captain Cook!\n");
+        printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
+/*
+HANDLE CreateFile(
+  LPCTSTR lpFileName,
+  DWORD dwDesiredAccess,
+  DWORD dwShareMode,
+  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
+  DWORD dwCreationDisposition,
+  DWORD dwFlagsAndAttributes,
+  HANDLE hTemplateFile
+);
+*/
+
+        va_list vl;
+        va_start(vl, hook);
+        char *lpFileName                        = va_arg(vl, char *);
+        /*int dwDesiredAccess           =*/(void)va_arg(vl, int);
+        /*int dwShareMode                       =*/(void)va_arg(vl, int);
+        /*int lpSecurityAttributes      =*/(void)va_arg(vl, int);
+        /*int dwCreationDisposition     =*/(void)va_arg(vl, int);
+        /*int dwFlagsAndAttributes      =*/(void)va_arg(vl, int);
+        /*int hTemplateFile                     =*/(void)va_arg(vl, int);
+        va_end(vl);
+
+        char *localfile;
+        asprintf(&localfile, "/tmp/%s-XXXXXX",lpFileName);
+        int fd = mkstemp(localfile);
+        close(fd);
+
+        FILE *f = fopen(localfile,"w");
+
+        uint32_t handle;
+        nanny_add_file(hook->hook.win->userdata, localfile, &handle, f);
+
+        return (uint32_t)handle;
+}
+
+uint32_t user_hook_WriteFile(struct emu_env *env, struct emu_env_hook *hook, ...)
+{
+        printf("Hook me Captain Cook!\n");
+        printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
+/*
+BOOL WriteFile(
+  HANDLE hFile,
+  LPCVOID lpBuffer,
+  DWORD nNumberOfBytesToWrite,
+  LPDWORD lpNumberOfBytesWritten,
+  LPOVERLAPPED lpOverlapped
+);
+*/
+
+        va_list vl;
+        va_start(vl, hook);
+        FILE *hFile                                     = va_arg(vl, FILE *);
+        void *lpBuffer                                  = va_arg(vl, void *);
+        int   nNumberOfBytesToWrite     = va_arg(vl, int);
+        /* int *lpNumberOfBytesWritten  =*/(void)va_arg(vl, int*);
+        /* int *lpOverlapped                =*/(void)va_arg(vl, int*);
+        va_end(vl);
+
+        struct nanny_file *nf = nanny_get_file(hook->hook.win->userdata, (uint32_t)hFile);
+
+        if (nf != NULL)
+                fwrite(lpBuffer, nNumberOfBytesToWrite, 1, nf->real_file);
+        else
+                printf("shellcode tried to write data to not existing handle\n");
+
+        return 1;
+
+}
+
+
+uint32_t user_hook_CloseHandle(struct emu_env *env, struct emu_env_hook *hook, ...)
+{
+        printf("Hook me Captain Cook!\n");
+        printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__);
+/*
+BOOL CloseHandle(
+  HANDLE hObject
+);
+*/
+
+        va_list vl;
+        va_start(vl, hook);
+        FILE *hObject = va_arg(vl, FILE *);
+        va_end(vl);
+
+        struct nanny_file *nf = nanny_get_file(hook->hook.win->userdata, (uint32_t)hObject);
+
+        if (nf != NULL)
+        {
+                FILE *f = nf->real_file;
+                nanny_del_file(hook->hook.win->userdata, (uint32_t)hObject);
+                fclose(f);
+        }
+        else 
+        {
+                printf("shellcode tried to close not existing handle (maybe closed it already?)\n");
+        }
+
+
+        return 0;
+
+}
+

libemu/trunk/tools/sctest/userhooks.h

@@ -18 +18 @@
-uint32_t user_hook_WSASocket(struct emu_env *env, struct emu_env_hook *hook, ...);
-
+uint32_t user_hook_CreateFile(struct emu_env *env, struct emu_env_hook *hook, ...);
+uint32_t user_hook_WriteFile(struct emu_env *env, struct emu_env_hook *hook, ...);
+uint32_t user_hook_CloseHandle(struct emu_env *env, struct emu_env_hook *hook, ...);