replace IAT-placeholders in shellcode with call's to the IAT
(self)
| 243 | |
| 244 | |
| 245 | def injectable_write_iat_references(self): |
| 246 | """replace IAT-placeholders in shellcode with call's to the IAT""" |
| 247 | code = self.superpe.get_code_section_data() |
| 248 | for iatRequest in self.injectable.get_all_iat_requests(): |
| 249 | for placeholder in iatRequest.references: |
| 250 | if not placeholder in code: |
| 251 | raise Exception("IatResolve ID {} not found, abort".format(placeholder)) |
| 252 | offset_from_code = code.index(placeholder) |
| 253 | |
| 254 | # Note that the SuperPe may already have been patched for new IAT imports |
| 255 | destination_virtual_address = self.superpe.get_vaddr_of_iatentry(iatRequest.name) |
| 256 | if destination_virtual_address == None: |
| 257 | raise Exception("IatResolve: Function {} not found".format(iatRequest.name)) |
| 258 | |
| 259 | image_base = self.injectable.superpe.get_image_base() |
| 260 | va = self.superpe.get_code_section().VirtualAddress |
| 261 | instruction_virtual_address = offset_from_code + image_base + va |
| 262 | #instruction_virtual_address = offset_from_code + self.injectable.superpe.get_image_base() + self.superpe.get_code_section().VirtualAddress |
| 263 | logger.debug(" Replace {} at VA 0x{:X} with: call to IAT at VA 0x{:X} ({})".format( |
| 264 | placeholder.hex(), |
| 265 | instruction_virtual_address, |
| 266 | destination_virtual_address, |
| 267 | iatRequest.name |
| 268 | )) |
| 269 | jmp = assemble_relative_call(instruction_virtual_address, destination_virtual_address) |
| 270 | if len(jmp) != len(placeholder): |
| 271 | raise Exception("IatResolve: Call to IAT has different length than placeholder: {} != {} abort".format( |
| 272 | len(jmp), len(placeholder) |
| 273 | )) |
| 274 | idx = code.index(placeholder) |
| 275 | code = code.replace(placeholder, jmp) |
| 276 | asm_disasm(code[idx:idx+7]) |
| 277 | |
| 278 | self.superpe.write_code_section_data(code) |
| 279 | |
| 280 | |
| 281 | def inject_and_reference_data(self): |
no test coverage detected