Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LDR error while loading windows shellcode #1415

Open
SBBTD opened this issue Dec 7, 2023 · 0 comments
Open

LDR error while loading windows shellcode #1415

SBBTD opened this issue Dec 7, 2023 · 0 comments

Comments

@SBBTD
Copy link

SBBTD commented Dec 7, 2023

Describe the bug
The LDR table is wrong when loading windows shellcode.
The first record is not process image.
I find it's same as #1043 that was closed:

LDR sequence error
InLoadOrderLinks= ntdll, kernel32, ...
InMemoryOrderLinks= ntdll,kernel32, ...
InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)

The correct order should be
InLoadOrderLinks= process, ntdll, kernel32, ...
InMemoryOrderLinks= process, ntdll, kernel32, ...
InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)

Sample Code
get kernel32 base by from PEB and InLoadOrderModuleList

from qiling import Qiling
from qiling.const import *

'''
40000 64A130000000  mov eax, dword ptr fs:[30]   ; PEB
40006 8B400C        mov eax, dword ptr [eax+0c]  ; PEB_LDR_DATA
40009 8B400C        mov eax, dword ptr [eax+0c]  ; InLoadOrderModuleList, record of process image
4000C 8B00          mov eax, dword ptr [eax]     ; next module, record of ntdll
4000E 8B00          mov eax, dword ptr [eax]     ; next module, record of kernel32
40010 8B4018        mov eax, dword ptr [eax+18]  ; base of kernel32
40013 C3            ret                          ; at last $EAX = base of kernel32
'''
shellcode = bytes.fromhex('64a1300000008b400c8b400c8b008b008b4018c3')

ql= Qiling(code=shellcode, archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS,
           rootfs='examples/rootfs/x86_windows', verbose=QL_VERBOSE.DEBUG)

# ret, $eax should = base addr of kernel32.dll 
ql.debugger = "qdb:0x40013"
ql.run()

Expected behavior
The first entry of LDR should be process image while loading windows shellcode.

Additional context
I checked the source code and found that when normal PE files are loaded, PE image is added to ldr first, while shellcode is not.
https://github.com/qilingframework/qiling/blob/master/qiling/loader/pe.py#L772

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant