From 4828517d5b619ddbbfbb05d1d698c50f02869b53 Mon Sep 17 00:00:00 2001 From: midipix Date: Sat, 28 Jan 2017 19:08:59 +0000 Subject: ldso: added pe_load_framework_loader(). --- src/internal/pe_os.h | 7 + src/ldso/pe_load_framework_loader.c | 246 ++++++++++++++++++++++++++++++++++++ 2 files changed, 253 insertions(+) create mode 100644 src/ldso/pe_load_framework_loader.c (limited to 'src') diff --git a/src/internal/pe_os.h b/src/internal/pe_os.h index a2f83b0..ba7da0e 100644 --- a/src/internal/pe_os.h +++ b/src/internal/pe_os.h @@ -11,6 +11,7 @@ #define OS_STATUS_INVALID_ADDRESS (int32_t)0xC0000141 #define OS_STATUS_CONTEXT_MISMATCH (int32_t)0xC0000719 #define OS_STATUS_COULD_NOT_INTERPRET (int32_t)0xC00000B9 +#define OS_STATUS_NOT_SUPPORTED (int32_t)0xC00000BB #define OS_STATUS_NAME_TOO_LONG (int32_t)0xC0000106 #define OS_STATUS_INTERNAL_ERROR (int32_t)0xC00000E5 #define OS_STATUS_BAD_FILE_TYPE (int32_t)0xC0000903 @@ -157,4 +158,10 @@ typedef int32_t __stdcall os_zw_open_file( __in uint32_t share_access, __in uint32_t open_options); +typedef int32_t __stdcall os_ldr_load_dll( + __in wchar16_t * image_path __optional, + __in uint32_t * image_flags __optional, + __in struct pe_unicode_str * image_name, + __out void ** image_base); + #endif diff --git a/src/ldso/pe_load_framework_loader.c b/src/ldso/pe_load_framework_loader.c new file mode 100644 index 0000000..3e3e903 --- /dev/null +++ b/src/ldso/pe_load_framework_loader.c @@ -0,0 +1,246 @@ +/*****************************************************************************/ +/* pemagination: a (virtual) tour into portable bits and executable bytes */ +/* Copyright (C) 2013--2017 Z. Gilboa */ +/* Released under GPLv2 and GPLv3; see COPYING.PEMAGINE. */ +/*****************************************************************************/ + +#include +#include +#include "pe_os.h" + +static int32_t pe_get_device_dos_drive_letter( + void * hntdll, + os_zw_query_object * zw_query_object, + uintptr_t * dbuffer, + uint32_t dbufsize, + wchar16_t * devname, + size_t devnamelen, + wchar16_t * letter) +{ + int32_t status; + void * hdevice; + int sigh; + size_t idx; + size_t cap; + uint32_t len; + struct os_oa oa; + struct os_iosb iosb; + wchar16_t * src; + wchar16_t * dst; + struct pe_unicode_str path; + struct pe_unicode_str * dpath; + os_zw_open_file * zw_open_file; + os_zw_close * zw_close; + + wchar16_t namebuf[8] = { + '\\','?','?','\\', + 'X',':','\\',0}; + + unsigned char letters[26] = { + 'C','Z','Y','X','W','V', + 'E','H','F','G','D','I', + 'P','Q','R','S','T','U', + 'J','K','L','M','N','O', + 'A','B'}; + + /* init */ + if (!(zw_open_file = (os_zw_open_file *)pe_get_procedure_address( + hntdll,"ZwOpenFile"))) + return OS_STATUS_INTERNAL_ERROR; + + if (!(zw_close = (os_zw_close *)pe_get_procedure_address( + hntdll,"ZwClose"))) + return OS_STATUS_INTERNAL_ERROR; + + /* path */ + path.buffer = namebuf; + path.strlen = 7 * sizeof(wchar16_t); + path.maxlen = 0; + + /* oa */ + oa.len = sizeof(struct os_oa); + oa.root_dir = 0; + oa.obj_name = &path; + oa.obj_attr = 0; + oa.sec_desc = 0; + oa.sec_qos = 0; + + /* just a few rounds of submissiveness */ + for (sigh=0; sigh<26; sigh++) { + namebuf[4] = letters[sigh]; + + status = zw_open_file( + &hdevice, + OS_SEC_SYNCHRONIZE + | OS_FILE_READ_ATTRIBUTES + | OS_FILE_READ_ACCESS, + &oa,&iosb, + OS_FILE_SHARE_READ + | OS_FILE_SHARE_WRITE + | OS_FILE_SHARE_DELETE, + OS_FILE_DIRECTORY_FILE); + + if (status == OS_STATUS_SUCCESS) { + status = zw_query_object( + hdevice, + OS_OBJECT_NAME_INFORMATION, + dbuffer,dbufsize,&len); + + if (status == OS_STATUS_SUCCESS) { + dpath = (struct pe_unicode_str *)dbuffer; + + src = devname; + dst = dpath->buffer; + + idx = 0; + cap = devnamelen / sizeof(wchar16_t); + + for (; idxhloader, + OS_OBJECT_NAME_INFORMATION, + buffer,bufsize,&len))) + return status; + + /* integrity */ + if (len == sizeof(struct pe_unicode_str)) + return OS_STATUS_BAD_FILE_TYPE; + + /* first sigh */ + npath = (struct pe_unicode_str *)buffer; + + wch = npath->buffer; + cap = npath->buffer + (npath->strlen / sizeof(wchar16_t)); + + if ((cap < &wch[8]) + || (wch[0] != '\\') + || (wch[1] != 'D') + || (wch[2] != 'e') + || (wch[3] != 'v') + || (wch[4] != 'i') + || (wch[5] != 'c') + || (wch[6] != 'e') + || (wch[7] != '\\')) + return OS_STATUS_NOT_SUPPORTED; + + mup = (cap > &wch[11]) + && (wch[8]=='M') + && (wch[9]=='u') + && (wch[10]=='p') + && (wch[11]=='\\'); + + slash = mup ? &wch[12] : &wch[8]; + + for (; (*slash != '\\') && (slash < cap); ) + slash++; + + if (slash == cap) + return OS_STATUS_INTERNAL_ERROR; + + if (mup) + for (++slash; (*slash != '\\') && (slash < cap); ) + slash++; + + if (slash == cap) + return OS_STATUS_INTERNAL_ERROR; + + /* second sigh */ + addr = (uintptr_t)cap; + addr += sizeof(uintptr_t) - 1; + addr /= sizeof(uintptr_t); + addr *= sizeof(uintptr_t); + + dbuffer = (uintptr_t *)addr; + dbufsize = bufsize; + dbufsize -= (dbuffer - buffer) * sizeof(uintptr_t); + + if ((status = pe_get_device_dos_drive_letter( + hntdll, + zw_query_object, + dbuffer,dbufsize, + npath->buffer, + (slash - npath->buffer) * sizeof(wchar16_t), + &letter))) + return status; + + slash = &slash[-2]; + slash[0] = letter; + slash[1] = ':'; + + path.buffer = slash; + path.strlen = (cap - slash) * sizeof(wchar16_t); + + /* third sigh */ + for (slash=cap; (slash > path.buffer) && (*slash != '\\'); ) + slash--; + + if (slash == path.buffer) + return OS_STATUS_INTERNAL_ERROR; + + ldrdir = path.buffer; + *slash = 0; + + path.strlen -= (++slash - ldrdir) * sizeof(wchar16_t); + path.maxlen = path.strlen; + path.buffer = slash; + + /* hoppla */ + return ldr_load_dll( + ldrdir,flags, + &path,baseaddr); +} -- cgit v1.2.3