Jump to content

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Find out more here. X
X


Photo

Run binary


  • Please log in to reply
179 replies to this topic

#1 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 03 August 2009 - 12:14 PM

It's about running exe from memory as it's often called.

So you have some binary data that you want to embed in your script and run afterward like some additional program. In this post I will try to explain how to do it.

First to deal with mentioned binary as that's, in spite of the plainness of retrieving it, often insuperable. To avoid questions about that this is one way of getting it:

AutoIt         
Global $sModule = "E:Program filesGUIDGenGUIDGEN.EXE" ; change to yours wanted Global $hModule = FileOpen($sModule, 16) If @error Then Exit Global $bBinary = FileRead($hModule) FileClose($hModule) Global Const $MAX_LINESIZE = 4095 Global $iNewLine, $j Global $iChinkSize = 32 Global $sBinary For $i = 1 To BinaryLen($bBinary) Step $iChinkSize     $j += 1     If 4*($j * $iChinkSize) > $MAX_LINESIZE - 129 Then         $iNewLine = 1     EndIf     If $iNewLine Then         $iNewLine = 0         $j = 0         $sBinary = StringTrimRight($sBinary, 5)         $sBinary &= @CRLF & '$bBinary &= "' & StringTrimLeft(BinaryMid($bBinary, $i, $iChinkSize), 2) & '" & _' & @CRLF         ContinueLoop     EndIf     If $i = 1 Then         $sBinary &= '$bBinary = "' & BinaryMid($bBinary, $i, $iChinkSize) & '" & _' & @CRLF     Else         $sBinary &= '       "' & StringTrimLeft(BinaryMid($bBinary, $i, $iChinkSize), 2) & '" & _' & @CRLF     EndIf Next $sBinary = StringTrimRight($sBinary, 5) ClipPut($sBinary) ConsoleWrite($sBinary)

Now for what's really important...
Executable file causes a computer to perform indicated tasks according to encoded instructions. Files that we talk about are in PE format.
When exe file is run special loader reads it and performs act of loading. That's how that particular exe gets in touch with a processor. Processor then executes different actions described by the opcodes.
Main requirement for any PE file required by the loader is for it to actually exist. To be written on the drive. It can't be in the air. That's not allowed and when you think of it it's only logical.

So how to run from memory?
I'm gonna fool the system. It will think that all works as it should and will have no idea that it plays my game.
There is more than way of doing that. Method described here has been used by different peoples before. When doing research for this post I have encountered many implementations. And I must say that I was very disappointed seeing that even the writers of the code often lack understanding of it. It's kind of pathetic when you see some code used and when asking author what's this or that you get answer "I don't know". And if you ask for the code to be explained by words (any fucking human language) coders fail terribly. How can you write code if you can't explain it?!?

Anyway, this is the procedure:

  • Start your script
  • Create new process using CreateProcess function with CREATE_SUSPENDED flag
  • Use GetThreadContext function to fill CONTEXT structure
  • Read and interpret passed binary
  • Allocate enough memory for the new module inside the victim process
  • Simulate loader. Construct the new module (load) in place of allocated space.
  • Make use of mentioned CONTEXT structure. Change entry point data and ImageBaseAddress data.
  • Resume execution

If all that went well windows should now be running not the original module but the new, saved in script as a variable.
The script:
Attached File  RunBinary.au3   27.3KB   30 downloads

Script is well commented so it shouldn't be too hard to get a grip.

New script is taking all possible advantages of PE format. That means if your module (embedded) has relocation directory it will run for sure.If not it could fail.

When it will fail?
Modules with no reloc directory (IMAGE_DIRECTORY_ENTRY_BASERELOC) ought to be loaded at precise address (stored within module; IMAGE_OPTIONAL_HEADER ImageBase). If for some reason not enough space can be allocated at that address within victim's memory space, function will fail. Thing is system makes rules, if we are not allowed to some memory space of a process there is nothing to do then to try again. So, try again if it fails. Maybe change the 'victim'.




edit:
64bit support added. That means you can embed either x64 or x86 modules.
If your AutoIt is x64 you embed x64 modules. If AutoIt is x86 embed x86.
x64 AutoIt could also use embedded x86 modules but I don't like that because needed structures would have to be changed to something that's not meeting aesthetics standards pinch.gif.


Edited by trancexx, 24 September 2014 - 06:55 PM.

  • snify, NapMyday and codewar509 like this

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE








#2 Manko

Manko

    Polymath

  • Active Members
  • PipPipPipPip
  • 229 posts

Posted 03 August 2009 - 12:55 PM

Really interesting post trancexx!

But beeing able to reach ring 0, by manipulating context structure, sounds too fantastic... Isn't such things protected, atleast on w2k and up?

Thanks for making the CONTEXT struct available on autoit, It makes me remember my days playing around with "debugging" AsProtect...

Thanks also for making this interesting method available!

BUT, I was wondering... This scheme doesn't work if the app we want to run, statically uses other dlls than the dummy of our choice.. right?
We would have to load those dlls and manually fill in IAT...? Would that be enough? Also if dlls conflict they would be rebased...
Maybe we would have to do all IAT for safetys sake...

Realized it is paused before loader does all dll loading mapping for us. >_<

I'm glad I'm on vacation, otherwise I might dive headfirst into this... :(

PS. Speaking of vacation... I was in split last summer. Some hot week! 36-40 degrees in the shade, almost all the time. Also, the nights were wonderful! DS.

/Manko [EDIT: Just to mention, Ive been to split... And I was too hasty about problems with scheme...]

Edited by Manko, 03 August 2009 - 01:10 PM.

Yes i rush things! (I sorta do small bursts inbetween doing nothing.) Things I have rushed and reRushed:* ProDLLer - Process manager - Unload viri modules (dll) and moore...* _WinAPI_ProcessListOWNER_WTS() - Get Processes owner list...* _WinAPI_GetCommandLineFromPID() - Get commandline of target process...* _WinAPI_ThreadsnProcesses() Much info if expanded - optional Indented "Parent/Child"-style Processlist. Moore to come... eventually...

#3 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 03 August 2009 - 01:20 PM

I'm glad I'm on vacation, otherwise I might dive headfirst into this... :(

PS. Speaking of vacation... I was in split last summer. Some hot week! 36-40 degrees in the shade, almost all the time. Also, the nights were wonderful! DS.


Yeah, it's pretty much the same now. My advice is to find some nice beach, get undressed an enjoy.
Nights are made for sin >_< - don't you wonderful to me now :(

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE


#4 Ascend4nt

Ascend4nt

    Universalist

  • Active Members
  • PipPipPipPipPipPip
  • 1,369 posts

Posted 03 August 2009 - 02:49 PM

Wow, great work trancexx! Where there's a will there's a way >_<

#5 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 04 August 2009 - 06:29 AM

I will show the ultimate (Vista working) solution if you help me take this topic to page 2 >_<
Why then and not now?
This method gives the whole new possibilities to jerks that do malware ( :( ). But fortunately some 1337 haxor is usually just a kid. And kids are known for their impatience. That said I'm expecting that mentioned haxor is not going to read page 2 of this topic because by reading post 1 and scrolling page up and down few times he/she will likely be off of this due to the accumulated boredness.
Anyway, I left more than one clue already on how to do it, so if you figured out wait for page 2 to see if we are on the same wave length.

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE


#6 Ascend4nt

Ascend4nt

    Universalist

  • Active Members
  • PipPipPipPipPipPip
  • 1,369 posts

Posted 04 August 2009 - 11:00 AM

Anyway, I left more than one clue already on how to do it, so if you figured out wait for page 2 to see if we are on the same wave length.


lol, I don't think you and I ever will be on the same wave length. But as for the 'impatient hax0r' haha, you don't think they'd perhaps see the mention of a 2nd page? (hmm... guess there's the option to edit posts..).

#7 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 04 August 2009 - 03:50 PM

That's the plan (blueprint, design, device, draft, drawing, idea, intent, layout, map, plot, program, projection, road map, scheme... >_< )

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE


#8 Ascend4nt

Ascend4nt

    Universalist

  • Active Members
  • PipPipPipPipPipPip
  • 1,369 posts

Posted 05 August 2009 - 12:26 AM

someone's been using a thesaurus..

#9 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 05 August 2009 - 06:35 PM

someone's been using a thesaurus..

Are you saying that I'm smoking pot (marijuana, grass, weed)?!?

...see how I used etymology to conclude that >_<

Anyways, enough small talk, it's not productive.

edit: missing word :(

Edited by trancexx, 05 August 2009 - 08:48 PM.

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE


#10 monoceres

monoceres

    idiot, slow down

  • MVPs
  • 4,047 posts

Posted 05 August 2009 - 07:35 PM

Educational, brilliant and absolutely fantastic as usual trancexx.

What happens when the exe that is being run from memory has completely different dependency and stuff? Say for example that the exe has some function from lets say advapi32 in it's IAT and the startup exe doesn't, wouldn't that screw up execution? What about resources.

Oh and btw which forum setting are you using, hopefully you are using the standard setting so we don't have to wait too long for the complete solution >_<

Broken link? PM me and I'll send you the file!


#11 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 05 August 2009 - 08:46 PM

Educational, brilliant and absolutely fantastic as usual trancexx.

What happens when the exe that is being run from memory has completely different dependency and stuff? Say for example that the exe has some function from lets say advapi32 in it's IAT and the startup exe doesn't, wouldn't that screw up execution? What about resources.

Oh and btw which forum setting are you using, hopefully you are using the standard setting so we don't have to wait too long for the complete solution >_<

Hey, nice to see you. Hope your batteries are charged.

I see you are on Vista. There is no problem about running anything. All should work. Except, of course, if some particular OS is targeted when compiling (function not existing before maybe) and run on system without that function. But that's more general problem.
All sections are written - the clone is made. That includes resources section as well.
That also means that even compressed modules (any method or tool) plays.

20 posts per page, that's my setting lol

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE


#12 JRSmile

JRSmile

    MCSE 2012R2

  • Active Members
  • PipPipPipPipPipPip
  • 461 posts

Posted 05 August 2009 - 09:58 PM

im just trying to enhance the post count by one, just to see what is on page "10" >_<
$a=StringSplit("547275737420796F757220546563686E6F6C75737421","")For $b=1 To UBound($a)+(-1*-1*-1)step(2^4/8);&$b+=1*2/40*ยต&Asc(4)Assign("c",Eval("c")&Chr(Dec($a[$b]&$a[$b+1])))''Chr("a")&"HI"Next;time_U&r34d,ths,U-may=get$the&c.l.u.e;b3st-regards,JRSmile;MsgBox(0x000000,"",Eval("c"));PiEs:d0nt+*b3.s4d.4ft3r.1st-try:-)

#13 Ascend4nt

Ascend4nt

    Universalist

  • Active Members
  • PipPipPipPipPipPip
  • 1,369 posts

Posted 05 August 2009 - 10:59 PM

rofl. This is all very ridiculous. And what is everyone gonna replace their comments with when it finally does 'rolllover' to the 2nd page? Perhaps we can discuss the state of the economy.

#14 monoceres

monoceres

    idiot, slow down

  • MVPs
  • 4,047 posts

Posted 05 August 2009 - 11:17 PM

Hey, nice to see you. Hope your batteries are charged.


Heh, you noticed :( And yes, ready to do wonders and such!


20 posts per page, that's my setting lol


Puh. I have it on 40.



Anyways, solving it for Vista is simple. So for anyone very curious read this and remember that address randomization is a link-time option (Hope this won't violate your "loosing kiddies idea" >_< )

Edit: Fixed terminology

Edited by monoceres, 05 August 2009 - 11:34 PM.

Broken link? PM me and I'll send you the file!


#15 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 06 August 2009 - 07:32 AM

Anyways, solving it for Vista is simple. So for anyone very curious read this and remember that address randomization is a link-time option (Hope this won't violate your "loosing kiddies idea" >_< )

Edit: Fixed terminology

Must-read for everyone.

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE


#16 Andreik

Andreik

    Bishop

  • Active Members
  • PipPipPipPipPipPip
  • 2,592 posts

Posted 06 August 2009 - 10:59 AM

I replace the path with @SystemDir & "\calc.exe" and then to run from memory and I get error number 3.
Global $sModule = "E:\Program files\GUIDGen\GUIDGEN.EXE"

When the words fail... music speaks

#17 Manko

Manko

    Polymath

  • Active Members
  • PipPipPipPip
  • 229 posts

Posted 06 August 2009 - 12:30 PM

I replace the path with @SystemDir & "\calc.exe" and then to run from memory and I get error number 3.

Global $sModule = "E:\Program files\GUIDGen\GUIDGEN.EXE"

Unfortunately many windows apps run at base 0x10000000 instead of 0x40000000. In this case, therefore, there is an obvious incompatibility. It can be worked around, I'm sure, but I'm too lazy... Vacation and all...

/Manko
Yes i rush things! (I sorta do small bursts inbetween doing nothing.) Things I have rushed and reRushed:* ProDLLer - Process manager - Unload viri modules (dll) and moore...* _WinAPI_ProcessListOWNER_WTS() - Get Processes owner list...* _WinAPI_GetCommandLineFromPID() - Get commandline of target process...* _WinAPI_ThreadsnProcesses() Much info if expanded - optional Indented "Parent/Child"-style Processlist. Moore to come... eventually...

#18 trancexx

trancexx

    Queen F. Elizabeth MCXI

  • Active Members
  • PipPipPipPipPipPip
  • 6,216 posts

Posted 06 August 2009 - 06:44 PM

Error 3 is pre-execution error. It's indicating that MS-DOS header is missing or is messed up.
@Andreik, deal with it. It's a banal thing.

          ......       ......
        .:oOOOOo:.   .:oOOOOo:.
      .:oOO:'':Oo:. .:oO:'':OOo:.
     .:oO:      'Oo:oO'      :Oo:.
     :oO:         'o'   
      :Oo:
     :oO:                     :Oo:
     ':oO:     OT9AO0IEDrk   :Oo:'
      ':oO:                 :Oo:'
        ':oO.             .Oo:'
          ':oO
.         .Oo:'
            ':oO.     .Oo:'
              ':oO. .Oo:'
                'oO:Oo'
                  'o' :kiss:



 

.
eMyvnE


#19 Suirad

Suirad

    Seeker

  • Active Members
  • 39 posts

Posted 07 August 2009 - 08:03 AM

General failure will be if the size of the new exe is bigger than AutoIt's size. That would require allocating more memory to work (I'm not doing that

That being the size of the executable that is running the other? In that case, wouldn't be easy to just add an Install() of a few sizable files to eliminate the problem?

#20 Andreik

Andreik

    Bishop

  • Active Members
  • PipPipPipPipPipPip
  • 2,592 posts

Posted 07 August 2009 - 09:27 AM

Error 3 is pre-execution error. It's indicating that MS-DOS header is missing or is messed up.
@Andreik, deal with it. It's a banal thing.


I don't understand yet all things from your UDF. From all the executables that I tried to run from memory just one of them was succesfully, for others I got errors like 3,6,7.

Anyway I like your UDF and examples, all work fine. >_<
When the words fail... music speaks




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users