From e31d0234963748c5adf76b97eb8980a602c8d5f1 Mon Sep 17 00:00:00 2001 From: Tal Liberman Date: Sun, 17 Jun 2018 18:28:13 +0300 Subject: [PATCH] Call GetProcAddress to obtain pointers to EnumSystemFirmwareTables and GetSystemFirmwareTable since they aren't available on XP. --- al-khaser/Anti VM/Qemu.cpp | 3 ++- al-khaser/Anti VM/VMWare.cpp | 3 ++- al-khaser/Anti VM/VirtualBox.cpp | 3 ++- al-khaser/Shared/Utils.cpp | 31 +++++++++++++++++++++++++++++-- al-khaser/Shared/Utils.h | 1 + 5 files changed, 36 insertions(+), 5 deletions(-) diff --git a/al-khaser/Anti VM/Qemu.cpp b/al-khaser/Anti VM/Qemu.cpp index 0a3691d..0222ea3 100644 --- a/al-khaser/Anti VM/Qemu.cpp +++ b/al-khaser/Anti VM/Qemu.cpp @@ -87,7 +87,7 @@ BOOL qemu_firmware_ACPI() PDWORD tableNames = static_cast(malloc(4096)); SecureZeroMemory(tableNames, 4096); - DWORD tableSize = EnumSystemFirmwareTables(static_cast('ACPI'), tableNames, 4096); + DWORD tableSize = enum_system_firmware_tables(static_cast('ACPI'), tableNames, 4096); DWORD tableCount = tableSize / 4; if (tableSize < 4 || tableCount == 0) result = TRUE; @@ -112,6 +112,7 @@ BOOL qemu_firmware_ACPI() } } +lblCleanup: free(tableNames); return result; } diff --git a/al-khaser/Anti VM/VMWare.cpp b/al-khaser/Anti VM/VMWare.cpp index 064ead4..c368cf3 100644 --- a/al-khaser/Anti VM/VMWare.cpp +++ b/al-khaser/Anti VM/VMWare.cpp @@ -237,7 +237,7 @@ BOOL vmware_firmware_ACPI() PDWORD tableNames = static_cast(malloc(4096)); SecureZeroMemory(tableNames, 4096); - DWORD tableSize = EnumSystemFirmwareTables(static_cast('ACPI'), tableNames, 4096); + DWORD tableSize = enum_system_firmware_tables(static_cast('ACPI'), tableNames, 4096); DWORD tableCount = tableSize / 4; if (tableSize < 4 || tableCount == 0) result = TRUE; @@ -259,6 +259,7 @@ BOOL vmware_firmware_ACPI() } } +lblCleanup: free(tableNames); return result; } diff --git a/al-khaser/Anti VM/VirtualBox.cpp b/al-khaser/Anti VM/VirtualBox.cpp index ed221a8..f608af8 100644 --- a/al-khaser/Anti VM/VirtualBox.cpp +++ b/al-khaser/Anti VM/VirtualBox.cpp @@ -451,7 +451,7 @@ BOOL vbox_firmware_ACPI() PDWORD tableNames = static_cast(malloc(4096)); SecureZeroMemory(tableNames, 4096); - DWORD tableSize = EnumSystemFirmwareTables(static_cast('ACPI'), tableNames, 4096); + DWORD tableSize = enum_system_firmware_tables(static_cast('ACPI'), tableNames, 4096); DWORD tableCount = tableSize / 4; if (tableSize < 4 || tableCount == 0) result = TRUE; @@ -480,6 +480,7 @@ BOOL vbox_firmware_ACPI() } } +lblCleanup: free(tableNames); return result; } diff --git a/al-khaser/Shared/Utils.cpp b/al-khaser/Shared/Utils.cpp index 324df95..25895a7 100644 --- a/al-khaser/Shared/Utils.cpp +++ b/al-khaser/Shared/Utils.cpp @@ -792,12 +792,39 @@ BOOL find_str_in_data(PBYTE needle, size_t needleLen, PBYTE haystack, size_t hay } +UINT enum_system_firmware_tables(DWORD FirmwareTableProviderSignature, PVOID pFirmwareTableBuffer, DWORD BufferSize) +{ + typedef UINT(WINAPI* tEnumSystemFirmwareTables)(DWORD, PVOID, DWORD); + tEnumSystemFirmwareTables f_EnumSystemFirmwareTables = (tEnumSystemFirmwareTables)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "EnumSystemFirmwareTables"); + + if (NULL == f_EnumSystemFirmwareTables) + { + printf("Couldn't find EnumSystemFirmwareTables :(\n"); + // If the function fails for any other reason, the return value is zero. + // https://msdn.microsoft.com/en-us/library/windows/desktop/ms724259(v=vs.85).aspx + return 0; + } + + return f_EnumSystemFirmwareTables(FirmwareTableProviderSignature, pFirmwareTableBuffer, BufferSize); + +} + PBYTE get_system_firmware(_In_ DWORD signature, _In_ DWORD table, _Out_ PDWORD pBufferSize) { DWORD bufferSize = 4096; PBYTE firmwareTable = static_cast(malloc(bufferSize)); SecureZeroMemory(firmwareTable, bufferSize); - DWORD resultBufferSize = GetSystemFirmwareTable(signature, table, firmwareTable, bufferSize); + typedef UINT(WINAPI* tGetSystemFirmwareTable)(DWORD, DWORD, PVOID, DWORD); + + tGetSystemFirmwareTable f_GetSystemFirmwareTable = (tGetSystemFirmwareTable)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetSystemFirmwareTable"); + if (NULL == f_GetSystemFirmwareTable) + { + printf("Couldn't find GetSystemFirmwareTable :(\n"); + free(firmwareTable); + return NULL; + } + + DWORD resultBufferSize = f_GetSystemFirmwareTable(signature, table, firmwareTable, bufferSize); if (resultBufferSize == 0) { printf("First call failed :(\n"); @@ -810,7 +837,7 @@ PBYTE get_system_firmware(_In_ DWORD signature, _In_ DWORD table, _Out_ PDWORD p { firmwareTable = static_cast(realloc(firmwareTable, resultBufferSize)); SecureZeroMemory(firmwareTable, resultBufferSize); - if (GetSystemFirmwareTable(signature, table, firmwareTable, resultBufferSize) == 0) + if (f_GetSystemFirmwareTable(signature, table, firmwareTable, resultBufferSize) == 0) { printf("Second call failed :(\n"); free(firmwareTable); diff --git a/al-khaser/Shared/Utils.h b/al-khaser/Shared/Utils.h index ef4c374..184884f 100644 --- a/al-khaser/Shared/Utils.h +++ b/al-khaser/Shared/Utils.h @@ -37,6 +37,7 @@ ULONG get_gdt_base(); UCHAR* get_str_base(); BOOL IsElevated(); BOOL find_str_in_data(PBYTE needle, size_t needleLen, PBYTE haystack, size_t haystackLen); +UINT enum_system_firmware_tables(_In_ DWORD FirmwareTableProviderSignature, _Out_ PVOID pFirmwareTableBuffer, _In_ DWORD BufferSize); PBYTE get_system_firmware(_In_ DWORD signature, _In_ DWORD table, _Out_ PDWORD pBufferSize); #define MALLOC(x) HeapAlloc(GetProcessHeap(), 0, x)