|
8 | 8 |
|
9 | 9 | from qiling import Qiling |
10 | 10 | from qiling.extensions import pipe |
| 11 | +from qiling.const import QL_INTERCEPT, QL_VERBOSE |
| 12 | +from qiling.os.windows.api import HWND, UINT, LONG |
| 13 | + |
| 14 | +def hook_DialogBoxParamA_onexit(ql: Qiling, address: int, params, retval: int): |
| 15 | + # extract lpDialogFunc value |
| 16 | + # [see arguments list at 'qiling/os/windows/dlls/user32.py' -> 'hook_DialogBoxParamA'] |
| 17 | + lpDialogFunc = params['lpDialogFunc'] |
| 18 | + |
| 19 | + def call_DialogFunc(ql: Qiling): |
| 20 | + # we would like to resume from the exact same address that used to invoke |
| 21 | + # this hook. in order to prevent an endless loop of hook invocations, we |
| 22 | + # remove the hook through its handle. |
| 23 | + hh.remove() |
| 24 | + |
| 25 | + WM_COMMAND = 0x111 |
| 26 | + IDS_APPNAME = 1001 |
| 27 | + |
| 28 | + # [steps #3 and #4] |
| 29 | + # set up the arguments and call the address passed through the lpDialogFunc |
| 30 | + # param. make sure it resumes back to where we were. |
| 31 | + ql.os.fcall.call_native(lpDialogFunc, ( |
| 32 | + (HWND, 0), |
| 33 | + (UINT, WM_COMMAND), |
| 34 | + (UINT, IDS_APPNAME), |
| 35 | + (LONG, 0), |
| 36 | + ), ql.arch.regs.arch_pc) |
| 37 | + |
| 38 | + # get DialogBoxParamA return address; should be the first item on the stack |
| 39 | + retaddr = ql.arch.stack_read(0) |
| 40 | + |
| 41 | + # we would like to call DialogFunc as soon as DialogBoxParamA returns, so we |
| 42 | + # hook its return address. once it returns, 'call_DialogFunc' will be invoked. |
| 43 | + hh = ql.hook_address(call_DialogFunc, retaddr) |
| 44 | + |
| 45 | +def our_sandbox(path: str, rootfs: str): |
| 46 | + ql = Qiling([path], rootfs, verbose=QL_VERBOSE.DEFAULT) |
| 47 | + |
| 48 | + # this crackme's logic lies within the function passed to DialogBoxParamA through |
| 49 | + # the lpDialogFunc parameter. normally DialogBoxParamA would call the function |
| 50 | + # passed through that parameter, but Qiling's implementation for it doesn't do |
| 51 | + # that. |
| 52 | + # |
| 53 | + # to solve this crackme and force the "success" dialog to show, we will: |
| 54 | + # 1. set up a mock stdin and feed it with the correct flag |
| 55 | + # 1. hook DialogBoxParamA to see where its lpDialogFunc param points to |
| 56 | + # 2. set up a valid set of arguments DialogFunc expects to see |
| 57 | + # 3. call it and see it greets us with a "success" message |
| 58 | + |
| 59 | + # [step #1] |
| 60 | + # set up a mock stdin and feed it with mocked keystrokes |
| 61 | + ql.os.stdin = pipe.SimpleInStream(sys.stdin.fileno()) |
| 62 | + ql.os.stdin.write(b'Ea5yR3versing\n') |
| 63 | + |
| 64 | + # [step #2] |
| 65 | + # intercept DialogBoxParamA on exit |
| 66 | + ql.os.set_api('DialogBoxParamA', hook_DialogBoxParamA_onexit, QL_INTERCEPT.EXIT) |
11 | 67 |
|
12 | | -def force_call_dialog_func(ql: Qiling): |
13 | | - # get DialogFunc address |
14 | | - lpDialogFunc = ql.unpack32(ql.mem.read(ql.reg.esp - 0x8, 4)) |
15 | | - # setup stack for DialogFunc |
16 | | - ql.stack_push(0) |
17 | | - ql.stack_push(1001) |
18 | | - ql.stack_push(273) |
19 | | - ql.stack_push(0) |
20 | | - ql.stack_push(0x0401018) |
21 | | - # force EIP to DialogFunc |
22 | | - ql.reg.eip = lpDialogFunc |
23 | | - |
24 | | -def our_sandbox(path, rootfs): |
25 | | - ql = Qiling(path, rootfs, stdin=pipe.SimpleInStream(sys.stdin.fileno())) |
26 | | - |
27 | | - ql.os.stdin.write(b"Ea5yR3versing\n") |
28 | | - ql.hook_address(force_call_dialog_func, 0x00401016) |
29 | 68 | ql.run() |
30 | 69 |
|
31 | 70 | if __name__ == "__main__": |
32 | | - # Flag is : Ea5yR3versing |
33 | | - our_sandbox(["rootfs/x86_windows/bin/Easy_CrackMe.exe"], "rootfs/x86_windows") |
| 71 | + our_sandbox(r"rootfs/x86_windows/bin/Easy_CrackMe.exe", r"rootfs/x86_windows") |
0 commit comments