mirror of https://github.com/avast/ioc
Add files via upload
This commit is contained in:
avast-ti
GitHub
parent
9011adc20e
commit
57928008a7
|
|
@ -0,0 +1 @@
|
|||
Sets complex global variables from C.
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
|
||||
#include <windows.h>
|
||||
#include <stdio.h>
|
||||
#include <conio.h>
|
||||
|
||||
#include "vb.h" //structures
|
||||
#include "pcode.h"
|
||||
|
||||
int lpProcCallEngine = 0;
|
||||
|
||||
//the easiest way to control the mem layout of several different types to replicate our expected global mem
|
||||
//pragma pack 1 mandatory
|
||||
#pragma pack(1)
|
||||
struct globals{
|
||||
int i; //FMemLdRf [arg_8+0x0] size: 4 Dim g As Long
|
||||
VARIANT v; //FMemLdRf [arg_8+0x4] size: 0x10 Dim v As Variant
|
||||
SAFEARRAY* b; //FMemLdR4 [arg_8+0x14] size: 0x4 Dim b() As Byte
|
||||
short boolean; //FMemLdRf [arg_8+0x18] size: 0x2 Dim bool As Boolean
|
||||
short s; //FMemLdRf [arg_8+0x1A] size: 0x2 Dim s As Integer
|
||||
};
|
||||
|
||||
unsigned char sub_main[] = {
|
||||
0x3A, 0x4C, 0xFF, 0x00, 0x00, 0x07, 0x08, 0x00, 0x00, 0x00, 0x4D, 0x6C, 0xFF, 0x03, 0x40, 0x04,
|
||||
0x5C, 0xFF, 0x0A, 0x01, 0x00, 0x08, 0x00, 0x04, 0x5C, 0xFF, 0xFB, 0xEF, 0x3C, 0xFF, 0xFD, 0xFE,
|
||||
0x38, 0xFF, 0x04, 0x34, 0xFF, 0x34, 0x6C, 0x34, 0xFF, 0x0A, 0x02, 0x00, 0x04, 0x00, 0x3C, 0x32,
|
||||
0x04, 0x00, 0x38, 0xFF, 0x34, 0xFF, 0x36, 0x04, 0x00, 0x5C, 0xFF, 0x3C, 0xFF, 0x1B, 0x03, 0x00,
|
||||
0x94, 0x08, 0x00, 0x14, 0x00, 0xF4, 0x01, 0xFC, 0xCB, 0xFB, 0xFE, 0x23, 0x38, 0xFF, 0x2A, 0x23,
|
||||
0x34, 0xFF, 0x04, 0x30, 0xFF, 0x34, 0x6C, 0x30, 0xFF, 0x0A, 0x02, 0x00, 0x04, 0x00, 0x3C, 0x32,
|
||||
0x06, 0x00, 0x38, 0xFF, 0x34, 0xFF, 0x30, 0xFF, 0x3A, 0x4C, 0xFF, 0x04, 0x00, 0x07, 0x08, 0x00,
|
||||
0x18, 0x00, 0x4D, 0x6C, 0xFF, 0x0B, 0x40, 0x04, 0x5C, 0xFF, 0x0A, 0x01, 0x00, 0x08, 0x00, 0x04,
|
||||
0x5C, 0xFF, 0xFB, 0xEF, 0x3C, 0xFF, 0xFD, 0xFE, 0x38, 0xFF, 0x04, 0x34, 0xFF, 0x34, 0x6C, 0x34,
|
||||
0xFF, 0x0A, 0x02, 0x00, 0x04, 0x00, 0x3C, 0x32, 0x04, 0x00, 0x38, 0xFF, 0x34, 0xFF, 0x36, 0x04,
|
||||
0x00, 0x5C, 0xFF, 0x3C, 0xFF, 0x3A, 0x4C, 0xFF, 0x05, 0x00, 0x07, 0x08, 0x00, 0x1A, 0x00, 0x4D,
|
||||
0x6C, 0xFF, 0x02, 0x40, 0x04, 0x5C, 0xFF, 0x0A, 0x01, 0x00, 0x08, 0x00, 0x04, 0x5C, 0xFF, 0xFB,
|
||||
0xEF, 0x3C, 0xFF, 0xFD, 0xFE, 0x38, 0xFF, 0x04, 0x34, 0xFF, 0x34, 0x6C, 0x34, 0xFF, 0x0A, 0x02,
|
||||
0x00, 0x04, 0x00, 0x3C, 0x32, 0x04, 0x00, 0x38, 0xFF, 0x34, 0xFF, 0x36, 0x04, 0x00, 0x5C, 0xFF,
|
||||
0x3C, 0xFF, 0x1B, 0x06, 0x00, 0x07, 0x08, 0x00, 0x04, 0x00, 0x0B, 0x07, 0x00, 0x04, 0x00, 0x23,
|
||||
0x38, 0xFF, 0x2A, 0x23, 0x34, 0xFF, 0x04, 0x30, 0xFF, 0x34, 0x6C, 0x30, 0xFF, 0x0A, 0x02, 0x00,
|
||||
0x04, 0x00, 0x3C, 0x32, 0x06, 0x00, 0x38, 0xFF, 0x34, 0xFF, 0x30, 0xFF, 0x14, 0x00, 0x00, 0x00,
|
||||
0x9C, 0x10, 0x40, 0x00, 0x04, 0x00, 0x4C, 0x00, 0x10, 0x01, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00,
|
||||
0x38, 0xFF, 0x01, 0x00, 0x34, 0xFF, 0x01, 0x00, 0x30, 0xFF, 0x01, 0x00, 0x5C, 0xFF, 0x02, 0x00,
|
||||
0x3C, 0xFF, 0x02, 0x00, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC,
|
||||
0xE9, 0xE9, 0xE9, 0xE9, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC
|
||||
};
|
||||
|
||||
|
||||
void __stdcall strCallback(char* arg){
|
||||
printf("%s\n",arg);
|
||||
}
|
||||
|
||||
void main(void){
|
||||
|
||||
int rv = 0;
|
||||
int abort = 0;
|
||||
int constPool[20] = {0};
|
||||
int lpProjObj[10] = {0};
|
||||
|
||||
objInfo.aObject = (int)&codeObj;
|
||||
objInfo.lpConstantPool = (int)&constPool;
|
||||
objInfo.aObjectTable = (int)&objtable;
|
||||
objtable.lpProjectObject = (int)&lpProjObj;
|
||||
|
||||
HMODULE hRuntime = (HMODULE)LoadLibrary("msvbvm60.dll");
|
||||
lpProcCallEngine = (int)GetProcAddress(hRuntime,"ProcCallEngine");
|
||||
CreateIExprSrvObj IExprSrvObj = (CreateIExprSrvObj)GetProcAddress(hRuntime,"CreateIExprSrvObj");
|
||||
|
||||
IExprSrvObj(0,4,0); //initilize runtime enough for most things to work (COM, native pcode handlers etc)
|
||||
|
||||
// sub_main - 368 bytes
|
||||
int offset_sub_main = (int)&sub_main + 0x110;
|
||||
(*(int*)offset_sub_main) = (int)&objInfo;
|
||||
|
||||
globals g;
|
||||
codeObj.aModulePublic = (int*)&g;
|
||||
g.i = 0x11223344;
|
||||
g.v.vt = VT_BSTR;
|
||||
g.v.bstrVal = SysAllocString(L"test string");
|
||||
g.b = SafeArrayCreateVector(VT_UI1, 0, 5);
|
||||
g.boolean = -1; //vbtrue
|
||||
g.s = 0x33;
|
||||
|
||||
constPool[0x0] = (int)SysAllocString(L"g = ");
|
||||
constPool[0x1] = (int)GetProcAddress(hRuntime,"rtcHexVarFromVar");
|
||||
constPool[0x2] = (int)&strCallback;
|
||||
constPool[0x3] = (int)SysAllocString(L"ubound(b) = ");
|
||||
constPool[0x4] = (int)SysAllocString(L"bool = ");
|
||||
constPool[0x5] = (int)SysAllocString(L"s = ");
|
||||
constPool[0x6] = (int)SysAllocString(L"typename(v) = ");
|
||||
constPool[0x7] = (int)GetProcAddress(hRuntime,"rtcTypeName");
|
||||
|
||||
_asm{
|
||||
//int 3
|
||||
mov edx, offset_sub_main
|
||||
mov ecx, lpProcCallEngine
|
||||
call ecx
|
||||
mov rv, eax
|
||||
}
|
||||
|
||||
printf("\nPress any key to exit...");
|
||||
getch();
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -0,0 +1 @@
|
|||
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
|
||||
Microsoft Visual Studio Solution File, Format Version 10.00
|
||||
# Visual Studio 2008
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "psc", "psc.vcproj", "{F7BF03C0-A926-4A71-B419-529BE5651E0C}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Win32 = Debug|Win32
|
||||
Release|Win32 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{F7BF03C0-A926-4A71-B419-529BE5651E0C}.Debug|Win32.ActiveCfg = Debug|Win32
|
||||
{F7BF03C0-A926-4A71-B419-529BE5651E0C}.Debug|Win32.Build.0 = Debug|Win32
|
||||
{F7BF03C0-A926-4A71-B419-529BE5651E0C}.Release|Win32.ActiveCfg = Release|Win32
|
||||
{F7BF03C0-A926-4A71-B419-529BE5651E0C}.Release|Win32.Build.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
|
@ -0,0 +1,184 @@
|
|||
<?xml version="1.0" encoding="Windows-1252"?>
|
||||
<VisualStudioProject
|
||||
ProjectType="Visual C++"
|
||||
Version="9.00"
|
||||
Name="psc"
|
||||
ProjectGUID="{F7BF03C0-A926-4A71-B419-529BE5651E0C}"
|
||||
RootNamespace="psc"
|
||||
Keyword="Win32Proj"
|
||||
TargetFrameworkVersion="196613"
|
||||
>
|
||||
<Platforms>
|
||||
<Platform
|
||||
Name="Win32"
|
||||
/>
|
||||
</Platforms>
|
||||
<ToolFiles>
|
||||
</ToolFiles>
|
||||
<Configurations>
|
||||
<Configuration
|
||||
Name="Debug|Win32"
|
||||
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
|
||||
IntermediateDirectory="$(ConfigurationName)"
|
||||
ConfigurationType="1"
|
||||
CharacterSet="2"
|
||||
>
|
||||
<Tool
|
||||
Name="VCPreBuildEventTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCCustomBuildTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCXMLDataGeneratorTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCWebServiceProxyGeneratorTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCMIDLTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCCLCompilerTool"
|
||||
Optimization="0"
|
||||
PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE"
|
||||
MinimalRebuild="true"
|
||||
BasicRuntimeChecks="3"
|
||||
RuntimeLibrary="3"
|
||||
UsePrecompiledHeader="0"
|
||||
WarningLevel="3"
|
||||
DebugInformationFormat="4"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCManagedResourceCompilerTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCResourceCompilerTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCPreLinkEventTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCLinkerTool"
|
||||
OutputFile="test.exe"
|
||||
LinkIncremental="2"
|
||||
GenerateDebugInformation="true"
|
||||
SubSystem="1"
|
||||
TargetMachine="1"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCALinkTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCManifestTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCXDCMakeTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCBscMakeTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCFxCopTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCAppVerifierTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCPostBuildEventTool"
|
||||
/>
|
||||
</Configuration>
|
||||
<Configuration
|
||||
Name="Release|Win32"
|
||||
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
|
||||
IntermediateDirectory="$(ConfigurationName)"
|
||||
ConfigurationType="1"
|
||||
CharacterSet="1"
|
||||
WholeProgramOptimization="1"
|
||||
>
|
||||
<Tool
|
||||
Name="VCPreBuildEventTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCCustomBuildTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCXMLDataGeneratorTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCWebServiceProxyGeneratorTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCMIDLTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCCLCompilerTool"
|
||||
Optimization="2"
|
||||
EnableIntrinsicFunctions="true"
|
||||
PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE"
|
||||
RuntimeLibrary="2"
|
||||
EnableFunctionLevelLinking="true"
|
||||
UsePrecompiledHeader="0"
|
||||
WarningLevel="3"
|
||||
DebugInformationFormat="3"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCManagedResourceCompilerTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCResourceCompilerTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCPreLinkEventTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCLinkerTool"
|
||||
LinkIncremental="1"
|
||||
GenerateDebugInformation="true"
|
||||
SubSystem="1"
|
||||
OptimizeReferences="2"
|
||||
EnableCOMDATFolding="2"
|
||||
TargetMachine="1"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCALinkTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCManifestTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCXDCMakeTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCBscMakeTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCFxCopTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCAppVerifierTool"
|
||||
/>
|
||||
<Tool
|
||||
Name="VCPostBuildEventTool"
|
||||
/>
|
||||
</Configuration>
|
||||
</Configurations>
|
||||
<References>
|
||||
</References>
|
||||
<Files>
|
||||
<File
|
||||
RelativePath=".\main.cpp"
|
||||
>
|
||||
</File>
|
||||
<File
|
||||
RelativePath=".\pcode.h"
|
||||
>
|
||||
</File>
|
||||
<File
|
||||
RelativePath=".\vb.h"
|
||||
>
|
||||
</File>
|
||||
</Files>
|
||||
<Globals>
|
||||
</Globals>
|
||||
</VisualStudioProject>
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
Attribute VB_Name = "Module1"
|
||||
Option Explicit
|
||||
|
||||
Dim g As Long
|
||||
Dim v As Variant
|
||||
Dim b() As Byte
|
||||
Dim bool As Boolean
|
||||
Dim s As Integer
|
||||
|
||||
Private Declare Sub strCallback Lib "dummy.dll" (ByVal s As String)
|
||||
|
||||
Sub Main()
|
||||
strCallback "g = " & Hex(g)
|
||||
strCallback "ubound(b) = " & UBound(b)
|
||||
strCallback "bool = " & Hex(bool)
|
||||
strCallback "s = " & Hex(s)
|
||||
strCallback "typename(v) = " & TypeName(v)
|
||||
End Sub
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
Type=Exe
|
||||
Reference=*\G{00020430-0000-0000-C000-000000000046}#2.0#0#..\..\..\..\..\..\..\Windows\SysWOW64\stdole2.tlb#OLE Automation
|
||||
Module=Module1; Module1.bas
|
||||
Startup="Sub Main"
|
||||
HelpFile=""
|
||||
ExeName32="Project1.exe"
|
||||
Command32=""
|
||||
Name="Project1"
|
||||
HelpContextID="0"
|
||||
CompatibleMode="0"
|
||||
MajorVer=1
|
||||
MinorVer=0
|
||||
RevisionVer=0
|
||||
AutoIncrementVer=0
|
||||
ServerSupportFiles=0
|
||||
CompilationType=-1
|
||||
OptimizationType=0
|
||||
FavorPentiumPro(tm)=0
|
||||
CodeViewDebugInfo=0
|
||||
NoAliasing=0
|
||||
BoundsCheck=0
|
||||
OverflowCheck=0
|
||||
FlPointCheck=0
|
||||
FDIVCheck=0
|
||||
UnroundedFP=0
|
||||
StartMode=0
|
||||
Unattended=0
|
||||
Retained=0
|
||||
ThreadPerObject=0
|
||||
MaxNumberOfThreads=1
|
||||
|
||||
[fastBuild]
|
||||
fullPath=%ap%\Project1.exe
|
||||
|
|
@ -0,0 +1 @@
|
|||
Module1 = 52, 52, 1192, 701,
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
|
||||
|
||||
struct ObjectTable{
|
||||
int lNull1; // As Long ' 0x00 (00d)
|
||||
int aExecProj; // As Long ' 0x04 (04d) Pointer to a memory structure
|
||||
int aProjectInfo2; // As Long ' 0x08 (08d) Pointer to Project Info 2
|
||||
int Const1; // As Long ' 0x0C
|
||||
int Null2; // As Long ' 0x10
|
||||
int lpProjectObject; // As Long ' 0x14
|
||||
char uuidObj[15]; // As Byte 'converted from 4 flags dzzie (from vb.idc)
|
||||
short fCompileType; // As Integer ' 0x28 (40d) Internal flag used during compilation
|
||||
short ObjectCount1; // As Integer ' 0x2A
|
||||
short iCompiledObjects; // As Integer ' 0x2C (44d) Number of objects compiled.
|
||||
short iObjectsInUse; // As Integer ' 0x2E (46d) Updated in the IDE to correspond the total number ' but will go up or down when initializing/unloading modules.
|
||||
int lpObjectArray; // As Long ' 0x30
|
||||
int fIdeFlag; // As Long ' 0x34
|
||||
int lpIdeData; // As Long ' 0x38
|
||||
int lpIdeData2; // As Long ' 0x3C
|
||||
int aProjectName; // As Long ' 0x40 NTS
|
||||
int LangID1; // As Long ' 0x44
|
||||
int LangID2; // As Long ' 0x48
|
||||
int lpIdeData3; // As Long ' 0x4C
|
||||
int dwIdentifier; // As Long ' 0x50
|
||||
};
|
||||
|
||||
struct CodeObject{
|
||||
int aObjectInfo; // As Long ' 0x00 Pointer to the Object Info for this Object.
|
||||
int Const1; // As Long ' 0x04 Always set to -1 after compiling.
|
||||
int aPublicBytes; // As Long ' 0x08 Pointer to Public Variable Size integers
|
||||
int aStaticBytes; // As Long ' 0x0C Pointer to Static Variables Struct
|
||||
int* aModulePublic; // As Long ' 0x10 Pointer to Public Variables in DATA section
|
||||
int aModuleStatic; // As Long ' 0x14 Pointer to Static Variables in DATA section
|
||||
int aObjectName; // As Long ' 0x18 Name of the Object.
|
||||
int ProcCount; // As Long ' 0x1C Number of Methods in Object
|
||||
int aProcNamesArray;// As Long ' 0x20 If present, pointer to Method names array.
|
||||
int oStaticVars; // As Long ' 0x24 Offset to Static Vars from aModuleStatic
|
||||
int ObjectType; // As Long ' 0x28 Flags defining the Object Type.
|
||||
int Null3; // As Long ' 0x2C Not valid after compilation.
|
||||
};
|
||||
|
||||
struct ObjectInfo{
|
||||
short wRefCount; // 0 As Integer ' Always 1 after compilation.
|
||||
short ObjectIndex; // 2 As Integer '
|
||||
int aObjectTable; // 4 As Long ' Pointer to the Object Table
|
||||
int lpIdeData; // 8 Long ' Zero after compilation. Used in IDE only.
|
||||
int lpPrivateObject; // 0xC As Long ' Pointer to Private Object Descriptor.
|
||||
int dwReserved; // 0x10 As Long
|
||||
int Null2; // 0x14 As Long
|
||||
int aObject; // 0x18 As Long ' points to the parent tObject
|
||||
int lpProjectData; // 0x1c As Long ' 0x1C [can someone verify this?]
|
||||
short NumberOfProcs; // 0x20 As Integer
|
||||
short wMethodCount2; // 0x22 As Integer ' Zeroed out after compilation. IDE only.
|
||||
int lpMethods; // 0x24 As Long ' Pointer to Array of Methods.
|
||||
short iConstantsCount; // 0x28 As Integer ' Number of Constants
|
||||
short iMaxConstants; // 0x2A As Integer ' Maximum Constants to allocate.
|
||||
int lpIdeData2; // 0x2C As Long
|
||||
int lpIdeData3; // 0x30 As Long
|
||||
int lpConstantPool; // 0x34 As Long 'can be immediatly followed by OptionalObjectInfo
|
||||
};
|
||||
|
||||
ObjectTable objtable = {0};
|
||||
CodeObject codeObj = {0};
|
||||
ObjectInfo objInfo = {0};
|
||||
|
||||
typedef void (__stdcall *CreateIExprSrvObj)(int,int,int);
|
||||
Loading…
Reference in New Issue