ntt-zerolab-Bytecode_Jiu-Jitsu/Injector-BJJ

Injector-BJJ

Injector-BJJ is a sample injector malware that injects bytecode and symbol tables using Bytecode Jiu-Jitsu.

Build

1. Download and install Visual Studio

2. Open Injector-BJJ.sln

3. Build solution

Test

1. Open Command Prompt

2. Move to the test directory

3. Execute run.bat (Release build for x64 is required)

Tested Environment

Component	Version	Note
OS	Windows 11 version 23H2 x64	Built with en-us_windows_11_consumer_editions_version_23h2_updated_june_2024_x64_dvd_78b33b16.iso
Toolchain	Microsoft Visual C++ 2022
Target interpreters	VBScript 5.812.10240.16384

Preparation

Injector-BJJ has two options for when to determine its behavior: at runtime and at compile time. For the runtime determination of the behavior, Injector-BJJ requires three JSON-formatted files that will be input to commandline arguments: config.json, search.json, and payload.json. For the compile-time determinzation, Injector-BJJ requires three C header files: config_input.h, search_input.h, and payload_input.h.

Config files

config files (both JSON and C header) contain information regarding the internal structures of the target interpreter.

• Module name of the target interpreter
• Offset to the interpretation function from the image base
• Argument index in the interpreter function that contains the pointer to the management structure
• Reference offsets required to traverse from the management structure to bytecode, symbol tables, and the virtual program counter (VPC)

Example:

{
  "interp_module_name": "C:\\Windows\\System32\\vbscript.dll",
  "interp_func_offset": 33968,
  "management_structure_index": 1,
  "bytecode": {
    "reference_offsets": [
      0,
      480
    ]
  },
  "symbol_tables": [
    {
      "type": 2,
      "scope": 0,
      "reference_offsets": [
        0,
        496
      ],
      "forward_link_offset": 0
    }
  ],
  "vpc": {
    "reference_offsets": [
      0,
      472
    ]
  }
}

A config_input.h contains the information equivalent to above in the C-structure style. These files will be generated by STAGER-BJJ.

Search files

search files (both JSON and C header) contain information regarding a characteristic text searchable in memory. The target text is used to find the management structure under the ASLR-enabled environment.

• Bytes of the search pattern for the target text (in hexadecimal representation)
• Type of the target text (Multibyte string: 0, Wide character string: 1)
• Offset to the raw text in value objects

{
  "pattern": [
      72,
      101,
      108,
      108,
      111,
      44,
      32,
      66,
      108,
      97,
      99,
      107,
      32,
      72,
      97,
      116,
      32,
      102,
      111,
      108,
      107,
      115,
      33
  ],
  "type": 1,
  "value_object_offset": 72
}

A config_input.h contains the information equivalent to above in the C-structure style. These files will be generated by Extractor-BJJ.

Payload file

payload files (both JSON and C header) contain information regarding payloads (i.e., bytecode and symbol tables).

• Bytecode
  • Bytes
  • Length
• Symbol tables
  • Scope (Global: 0, Local: 1)
  • Value objects
    • Bytes
    • Length
    • Index in the symbol table

{
  "bytecode": {
    "bytes": [
      86,
      56,
      [snipped],
      2,
      1
    ],
    "len": 44
  },
  "symbol_tables": [
    {
      "scope": 0,
      "value_objects": [
        {
          "bytes": [
            208,
            0,
            [snipped],
            0,
            0
          ],
          "len": 224,
          "index": 0
        }
      ]
    }
  ]
}

A payload_input.h contains the information equivalent to above in the C-structure style. These files will be generated by Extractor-BJJ.

Usage

Runtime

Specify the three files of config.json, search.json, and payload.json at commandline arguments as follows.

> Injector-BJJ.exe -c config.json -p payload.json -s search.json

Compile time

Replace the three files of config_input.h, search_input.h, and payload_input.h in the solution directory and build the project. Then simply execute the generated executable file, which leads to carry out bytecode injection with the information embedded in each header file.

> Injector-BJJ.exe

Note: It is also possible to mix the behavior determination at compile time and those at runtime.

For example, you can only replace config_input.h at compile time and specify search.json and payload.json at runtime.

> Injector-BJJ.exe -s search.json -p payload.json