From b74d7a9e7e22f623d114d59f6c0282ef8844eb9c Mon Sep 17 00:00:00 2001
From: Clement Rouault <project@hakril.net>
Date: Thu, 7 Jul 2016 13:16:36 +0200
Subject: [PATCH] Add Jmp/Call Far 16:32 in simple_x86 + clean and simplify
 syswow-to-64 execution

---
 windows/native_exec/simple_x86.py | 34 ++++++++++-
 windows/syswow64.py               | 94 ++++++++++++-------------------
 2 files changed, 68 insertions(+), 60 deletions(-)

diff --git a/windows/native_exec/simple_x86.py b/windows/native_exec/simple_x86.py
index 1060c57..235f4a3 100644
--- a/windows/native_exec/simple_x86.py
+++ b/windows/native_exec/simple_x86.py
@@ -275,6 +275,12 @@ def accept_as_16immediat(x):
         raise ImmediatOverflow("16bits signed Immediat overflow")
 
 
+def accept_as_unsigned_16immediat(x):
+    try:
+        return struct.pack("<H", x)
+    except struct.error:
+        raise ImmediatOverflow("16bits unsigned Immediat overflow")
+
 def accept_as_32immediat(x):
     try:
         return struct.pack("<i", x)
@@ -311,6 +317,18 @@ class Imm16(object):
             return None, None
         return (1, BitArray.from_string(imm16))
 
+class UImm16(object):
+    def accept_arg(self, args, instr_state):
+        try:
+            x = int(args[0])
+        except (ValueError, TypeError):
+            return (None, None)
+        try:
+            imm16 = accept_as_unsigned_16immediat(x)
+        except ImmediatOverflow:
+            return None, None
+        return (1, BitArray.from_string(imm16))
+
 
 class Imm32(object):
     def accept_arg(self, args, instr_state):
@@ -324,6 +342,16 @@ class Imm32(object):
             return None, None
         return (1, BitArray.from_string(imm32))
 
+class SegmentSelectorAbsoluteAddr(object):
+    def accept_arg(self, args, instr_state):
+        sizess, datass = UImm16().accept_arg(args, instr_state)
+        if sizess is None:
+            return None, None
+        sizeabs, dataabs = Imm32().accept_arg(args[1:], instr_state)
+        if sizeabs is None:
+            return None, None
+        return (sizess + sizeabs, dataabs + datass)
+
 
 class ModRM(object):
     def __init__(self, sub_modrm, accept_reverse=True, has_direction_bit=True):
@@ -597,11 +625,13 @@ class JmpImm32(JmpImm):
 
 class Call(JmpType):
     encoding = [(RawBits.from_int(8, 0xe8), JmpImm32(5)),
-                (RawBits.from_int(8, 0xff), Slash(2))]
+                (RawBits.from_int(8, 0xff), Slash(2)),
+                (RawBits.from_int(8, 0x9a), SegmentSelectorAbsoluteAddr())]
 
 class Jmp(JmpType):
     encoding = [(RawBits.from_int(8, 0xeb), JmpImm8(2)),
-                (RawBits.from_int(8, 0xe9), JmpImm32(5))]
+                (RawBits.from_int(8, 0xe9), JmpImm32(5)),
+                (RawBits.from_int(8, 0xea), SegmentSelectorAbsoluteAddr())]
 
 
 class Jz(JmpType):
diff --git a/windows/syswow64.py b/windows/syswow64.py
index d9b668b..9aef214 100644
--- a/windows/syswow64.py
+++ b/windows/syswow64.py
@@ -5,6 +5,7 @@ import codecs
 import functools
 
 import windows
+import windows.native_exec.simple_x86 as x86
 import windows.native_exec.simple_x64 as x64
 from generated_def.winstructs import *
 from windows.winobject import process
@@ -15,47 +16,42 @@ from winproxy import NeededParameter, NtdllProxy, error_ntstatus
 CS_32bits = 0x23
 CS_64bits = 0x33
 
+#dummy_jump = "\xea" + struct.pack("<I", 0) + struct.pack("<H",  CS_64bits)
+#def genere_return_32bits_stub(ret_addr):
+#    ret_32b = x64.MultipleInstr()
+#    # Transform 64b return value to ULONG64 return value
+#    # EDX:EAX
+#    ret_32b += x64.Mov("RDX", "RAX")
+#    ret_32b += x64.Shr("RDX", 32)
+#    ret_32b += x64.Mov('RCX', (CS_32bits << 32) + ret_addr)
+#    ret_32b += x64.Push('RCX')
+#    ret_32b += x64.Retf32()  # 32 bits return addr
+#    return ret_32b.get_code()
 
-def genere_return_32bits_stub(ret_addr):
-    ret_32b = x64.MultipleInstr()
-    # Transform 64b return value to ULONG64 return value
-    # EDX:EAX
-    ret_32b += x64.Mov("RDX", "RAX")
-    ret_32b += x64.Shr("RDX", 32)
-    ret_32b += x64.Mov('RCX', (CS_32bits << 32) + ret_addr)
-    ret_32b += x64.Push('RCX')
-    ret_32b += x64.Retf32()  # 32 bits return addr
-    return ret_32b.get_code()
-
-# The format of a jump to 64bits mode
-dummy_jump = "\xea" + struct.pack("<I", 0) + struct.pack("<H",  CS_64bits)
-
-
-def execute_64bits_code_from_syswow(shellcode):
+def generate_64bits_execution_stub_from_syswow(x64shellcode):
     """shellcode must NOT end by a ret"""
     current_process = windows.current_process
     if not current_process.is_wow_64:
-        raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process")
-    # 1 -> ret | 8 -> ljump
-    size_to_alloc = len(shellcode) + len(genere_return_32bits_stub(0xffffffff)) + 1 + 8
-    addr = windows.current_process.allocator.reserve_size(size_to_alloc)
-    # post-exec 32bits stub (xor eax, eax; ret)
-    ret = "\xC3"
-    ret_addr = addr
-    shell_code_addr = ret_addr + len(ret) + len(dummy_jump)
-    # ljmp
-    jump = "\xea" + struct.pack("<I", shell_code_addr) + struct.pack("<H",  CS_64bits)
-    jump_addr = ret_addr + len(ret)
-    # Return to 32bits stub
-    shellcode += genere_return_32bits_stub(ret_addr)
-    # WRITE ALL THE STUBS
-    current_process.write_memory(ret_addr, ret)
-    current_process.write_memory(jump_addr, jump)
-    current_process.write_memory(shell_code_addr, shellcode)
-    # Execute
-    exec_stub = ctypes.CFUNCTYPE(ULONG64)(jump_addr)
-    return exec_stub()
+        raise ValueError("Calling generate_64bits_execution_stub_from_syswow from non-syswow process")
 
+    transition64 = x64.MultipleInstr()
+    transition64 += x64.Call(":TOEXEC")
+    transition64 += x64.Mov("RDX", "RAX")
+    transition64 += x64.Shr("RDX", 32)
+    transition64 += x64.Retf32()  # 32 bits return addr
+    transition64 += x64.Label(":TOEXEC")
+    x64shellcodeaddr = windows.current_process.allocator.write_code(transition64.get_code() + x64shellcode)
+
+    transition =     x86.MultipleInstr()
+    transition +=    x86.Call(CS_64bits, x64shellcodeaddr)
+    transition +=    x86.Ret()
+
+    stubaddr = windows.current_process.allocator.write_code(transition.get_code())
+    exec_stub = ctypes.CFUNCTYPE(ULONG64)(stubaddr)
+    return exec_stub
+
+def execute_64bits_code_from_syswow(x64shellcode):
+    return generate_64bits_execution_stub_from_syswow(x64shellcode)()
 
 def generate_syswow64_call(target):
     nb_args = len(target.prototype._argtypes_)
@@ -121,6 +117,7 @@ def generate_syswow64_call(target):
     code_64b += x64.Pop('RDX')
     code_64b += x64.Pop('RCX')
     code_64b += x64.Pop('RBX')
+    code_64b += x64.Ret()
     return try_generate_stub_target(code_64b.get_code(), argument_buffer, target)
 
 
@@ -128,27 +125,10 @@ def try_generate_stub_target(shellcode, argument_buffer, target):
     """shellcode must NOT end by a ret"""
     if not windows.current_process.is_wow_64:
         raise ValueError("Calling execute_64bits_code_from_syswow from non-syswow process")
-    size_to_alloc = len(shellcode) + len(genere_return_32bits_stub(0xffffffff)) + 1 + 8
-    addr = windows.current_process.allocator.reserve_size(size_to_alloc)
-    # post-exec 32bits stub (ret)
-    ret = "\xC3"
-    ret_addr = addr
-    shell_code_addr = ret_addr + len(ret) + len(dummy_jump)
-    # ljmp
-    jump = "\xea" + struct.pack("<I", shell_code_addr) + chr(CS_64bits) + "\x00\x00"
-    jump_addr = ret_addr + len(ret)
-    # Return to 32bits stub
-    shellcode += genere_return_32bits_stub(ret_addr)
-    # WRITE ALL THE STUBS
-    windows.current_process.write_memory(ret_addr, ret)
-    windows.current_process.write_memory(jump_addr, jump)
-    windows.current_process.write_memory(shell_code_addr, shellcode)
-    # Execute
-    native_caller = ctypes.CFUNCTYPE(c_ulong)(jump_addr)
+    native_caller = generate_64bits_execution_stub_from_syswow(shellcode)
     native_caller.errcheck = target.errcheck
     # Generate the wrapper function that fill the argument_buffer
     expected_arguments_number = len(target.prototype._argtypes_)
-
     def wrapper(*args):
         if len(args) != expected_arguments_number:
             raise ValueError("{0} syswow accept {1} args ({2} given)".format(target.__name__, expected_arguments_number, len(args)))
@@ -161,11 +141,9 @@ def try_generate_stub_target(shellcode, argument_buffer, target):
                 except ctypes.ArgumentError as e:
                     raise ctypes.ArgumentError("Argument {0}: wrong type <{1}>".format(i, type(value).__name__))
             writable_args.append(value)
-
         # Build buffer
         buffer = struct.pack("<" + "Q" * len(writable_args), *writable_args)
         ctypes.memmove(argument_buffer, buffer, len(buffer))
-        # TODO : get 64bits returned value ?
         return native_caller()
     wrapper.__name__ = "{0}<syswow64>".format(target.__name__,)
     wrapper.__doc__ = "This is a wrapper to {0} in 64b mode, it accept <{1}> args".format(target.__name__, expected_arguments_number)
@@ -173,8 +151,8 @@ def try_generate_stub_target(shellcode, argument_buffer, target):
 
 
 def get_current_process_syswow_peb_addr():
-    get_peb_64_code = x64.Mov('RAX', x64.mem('gs:[0x60]'))
-    return execute_64bits_code_from_syswow(get_peb_64_code.get_code())
+    get_peb_64_code = x64.assemble("mov rax, gs:[0x60]; ret")
+    return execute_64bits_code_from_syswow(get_peb_64_code)
 
 def get_current_process_syswow_peb():
     current_process = windows.current_process