From 14b34d2e6a248f394cd474587b7afb205a47e63a Mon Sep 17 00:00:00 2001 From: Daniel Cohen Gindi Date: Wed, 1 Aug 2018 09:19:38 +0300 Subject: [PATCH 1/6] Fixed issues with WRONG wide char/ansi char arguments --- sigs/cert.rst | 2 +- sigs/file.rst | 12 ++++++------ sigs/job.rst | 2 +- sigs/network.rst | 30 +++++++++++++++--------------- sigs/ole.rst | 2 +- sigs/registry.rst | 36 ++++++++++++++++++------------------ sigs/services.rst | 22 +++++++++++----------- sigs/ui.rst | 14 +++++++------- src/diffing.c | 2 +- src/hooking.c | 6 +++--- 10 files changed, 64 insertions(+), 64 deletions(-) diff --git a/sigs/cert.rst b/sigs/cert.rst index 1d5ce7cb0..bef809530 100644 --- a/sigs/cert.rst +++ b/sigs/cert.rst @@ -42,7 +42,7 @@ Signature:: Parameters:: * HCRYPTPROV hProv - ** LPCTSTR szSubsystemProtocol store_name + ** LPCSTR szSubsystemProtocol store_name CertOpenSystemStoreW diff --git a/sigs/file.rst b/sigs/file.rst index caa566c45..6a6b3ff52 100644 --- a/sigs/file.rst +++ b/sigs/file.rst @@ -77,7 +77,7 @@ Signature:: Parameters:: - * LPCTSTR lpPathName + * LPCSTR lpPathName Pre:: @@ -189,7 +189,7 @@ Signature:: Parameters:: - * LPCTSTR lpFileName + * LPCSTR lpFileName * FINDEX_INFO_LEVELS fInfoLevelId * LPVOID lpFindFileData * FINDEX_SEARCH_OPS fSearchOp @@ -251,8 +251,8 @@ Signature:: Parameters:: - * LPCTSTR lpExistingFileName - * LPCTSTR lpNewFileName + * LPCSTR lpExistingFileName + * LPCSTR lpNewFileName ** BOOL bFailIfExists fail_if_exists Pre:: @@ -577,7 +577,7 @@ Signature:: Parameters:: - * LPTSTR lpBuffer + * LPSTR lpBuffer * UINT uSize Logging:: @@ -613,7 +613,7 @@ Signature:: Parameters:: - * LPTSTR lpBuffer + * LPSTR lpBuffer * UINT uSize Logging:: diff --git a/sigs/job.rst b/sigs/job.rst index 5f77c85b9..de2d8592d 100644 --- a/sigs/job.rst +++ b/sigs/job.rst @@ -15,7 +15,7 @@ Signature:: Parameters:: * LPSECURITY_ATTRIBUTES lpJobAttributes - ** LPCTSTR lpName + ** LPCWSTR lpName Logging:: diff --git a/sigs/network.rst b/sigs/network.rst index 392730bb2..60e71f480 100644 --- a/sigs/network.rst +++ b/sigs/network.rst @@ -110,10 +110,10 @@ Signature:: Parameters:: - ** LPCTSTR lpszAgent user_agent + ** LPCSTR lpszAgent user_agent ** DWORD dwAccessType access_type - ** LPCTSTR lpszProxyName proxy_name - ** LPCTSTR lpszProxyBypass proxy_bypass + ** LPCSTR lpszProxyName proxy_name + ** LPCSTR lpszProxyBypass proxy_bypass ** DWORD dwFlags flags Interesting:: @@ -161,10 +161,10 @@ Signature:: Parameters:: ** HINTERNET hInternet internet_handle - ** LPCTSTR lpszServerName hostname + ** LPCSTR lpszServerName hostname ** INTERNET_PORT nServerPort port - ** LPCTSTR lpszUsername username - ** LPCTSTR lpszPassword password + ** LPCSTR lpszUsername username + ** LPCSTR lpszPassword password ** DWORD dwService service ** DWORD dwFlags flags * DWORD_PTR dwContext @@ -219,8 +219,8 @@ Signature:: Parameters:: ** HINTERNET hInternet internet_handle - ** LPCTSTR lpszUrl url - * LPCTSTR lpszHeaders + ** LPCSTR lpszUrl url + * LPCSTR lpszHeaders * DWORD dwHeadersLength ** DWORD dwFlags flags * DWORD_PTR dwContext @@ -329,11 +329,11 @@ Signature:: Parameters:: ** HINTERNET hConnect connect_handle - ** LPCTSTR lpszVerb http_method - ** LPCTSTR lpszObjectName path - ** LPCTSTR lpszVersion http_version - ** LPCTSTR lpszReferer referer - * LPCTSTR *lplpszAcceptTypes + ** LPCSTR lpszVerb http_method + ** LPCSTR lpszObjectName path + ** LPCSTR lpszVersion http_version + ** LPCSTR lpszReferer referer + * LPCSTR *lplpszAcceptTypes ** DWORD dwFlags flags * DWORD_PTR dwContext @@ -385,7 +385,7 @@ Signature:: Parameters:: ** HINTERNET hRequest request_handle - * LPCTSTR lpszHeaders + * LPCSTR lpszHeaders * DWORD dwHeadersLength * LPVOID lpOptional * DWORD dwOptionalLength @@ -837,7 +837,7 @@ Signature:: Parameters:: * DWORD dwNetType - * LPTSTR lpProviderName + * LPWSTR lpProviderName * LPDWORD lpBufferSize Ensure:: diff --git a/sigs/ole.rst b/sigs/ole.rst index 986eee96d..ba1931ab0 100644 --- a/sigs/ole.rst +++ b/sigs/ole.rst @@ -88,7 +88,7 @@ Pre:: MULTI_QI *multi_qi = pResults; for (uint32_t idx = 0; idx < dwCount; idx++, multi_qi++) { our_snprintf(index, sizeof(index), "%d", idx++); - clsid_to_string(copy_ptr(&multi_qi->pIID), clsid); + clsid_to_string((IID *)copy_ptr(&multi_qi->pIID), clsid); log_string(&b, index, clsid, our_strlen(clsid)); } diff --git a/sigs/registry.rst b/sigs/registry.rst index 1c1001e5e..7646a87c2 100644 --- a/sigs/registry.rst +++ b/sigs/registry.rst @@ -13,7 +13,7 @@ RegOpenKeyExA Parameters:: ** HKEY hKey base_handle - ** LPCTSTR lpSubKey regkey_r + ** LPCSTR lpSubKey regkey_r ** DWORD ulOptions options ** REGSAM samDesired access ** PHKEY phkResult key_handle @@ -21,7 +21,7 @@ Parameters:: Pre:: wchar_t *regkey = get_unicode_buffer(); - reg_get_key_asciiz(hKey, lpSubKey, regkey); + reg_get_key_asciizA(hKey, lpSubKey, regkey); Interesting:: @@ -75,9 +75,9 @@ RegCreateKeyExA Parameters:: ** HKEY hKey base_handle - ** LPCTSTR lpSubKey regkey_r + ** LPCSTR lpSubKey regkey_r * DWORD Reserved - ** LPTSTR lpClass class + ** LPSTR lpClass class ** DWORD dwOptions options ** REGSAM samDesired access * LPSECURITY_ATTRIBUTES lpSecurityAttributes @@ -87,7 +87,7 @@ Parameters:: Pre:: wchar_t *regkey = get_unicode_buffer(); - reg_get_key_asciiz(hKey, lpSubKey, regkey); + reg_get_key_asciizA(hKey, lpSubKey, regkey); Interesting:: @@ -149,12 +149,12 @@ RegDeleteKeyA Parameters:: ** HKEY hKey key_handle - ** LPCTSTR lpSubKey regkey_r + ** LPCSTR lpSubKey regkey_r Pre:: wchar_t *regkey = get_unicode_buffer(); - reg_get_key_asciiz(hKey, lpSubKey, regkey); + reg_get_key_asciizA(hKey, lpSubKey, regkey); Interesting:: @@ -231,10 +231,10 @@ Parameters:: ** HKEY hKey key_handle ** DWORD dwIndex index - ** LPTSTR lpName key_name + ** LPSTR lpName key_name * LPDWORD lpcName * LPDWORD lpReserved - ** LPTSTR lpClass class + ** LPSTR lpClass class * LPDWORD lpcClass * PFILETIME lpftLastWriteTime @@ -297,7 +297,7 @@ Parameters:: ** HKEY hKey key_handle ** DWORD dwIndex index - ** LPTSTR lpValueName regkey_r + ** LPSTR lpValueName regkey_r * LPDWORD lpcchValueName * LPDWORD lpReserved ** LPDWORD lpType reg_type @@ -316,7 +316,7 @@ Ensure:: Pre:: wchar_t *regkey = get_unicode_buffer(); - reg_get_key_asciiz(hKey, lpValueName, regkey); + reg_get_key_asciizA(hKey, lpValueName, regkey); *lpType = REG_NONE; @@ -376,7 +376,7 @@ RegSetValueExA Parameters:: ** HKEY hKey key_handle - ** LPCTSTR lpValueName regkey_r + ** LPCSTR lpValueName regkey_r * DWORD Reserved ** DWORD dwType reg_type * const BYTE *lpData @@ -389,7 +389,7 @@ Flags:: Pre:: wchar_t *regkey = get_unicode_buffer(); - reg_get_key_asciiz(hKey, lpValueName, regkey); + reg_get_key_asciizA(hKey, lpValueName, regkey); Interesting:: @@ -450,7 +450,7 @@ RegQueryValueExA Parameters:: ** HKEY hKey key_handle - ** LPCTSTR lpValueName regkey_r + ** LPCSTR lpValueName regkey_r * LPDWORD lpReserved ** LPDWORD lpType reg_type * LPBYTE lpData @@ -468,7 +468,7 @@ Ensure:: Pre:: wchar_t *regkey = get_unicode_buffer(); - reg_get_key_asciiz(hKey, lpValueName, regkey); + reg_get_key_asciizA(hKey, lpValueName, regkey); *lpType = REG_NONE; @@ -534,12 +534,12 @@ RegDeleteValueA Parameters:: ** HKEY hKey key_handle - ** LPCTSTR lpValueName regkey_r + ** LPCSTR lpValueName regkey_r Pre:: wchar_t *regkey = get_unicode_buffer(); - reg_get_key_asciiz(hKey, lpValueName, regkey); + reg_get_key_asciizA(hKey, lpValueName, regkey); Interesting:: @@ -586,7 +586,7 @@ RegQueryInfoKeyA Parameters:: ** HKEY hKey key_handle - ** LPTSTR lpClass class + ** LPSTR lpClass class * LPDWORD lpcClass * LPDWORD lpReserved ** LPDWORD lpcSubKeys subkey_count diff --git a/sigs/services.rst b/sigs/services.rst index 26265bc45..7d9858a44 100644 --- a/sigs/services.rst +++ b/sigs/services.rst @@ -14,8 +14,8 @@ Signature:: Parameters:: - ** LPCTSTR lpMachineName machine_name - ** LPCTSTR lpDatabaseName database_name + ** LPCSTR lpMachineName machine_name + ** LPCSTR lpDatabaseName database_name ** DWORD dwDesiredAccess desired_access Interesting:: @@ -55,18 +55,18 @@ Signature:: Parameters:: ** SC_HANDLE hSCManager service_manager_handle - ** LPCTSTR lpServiceName service_name - ** LPCTSTR lpDisplayName display_name + ** LPCSTR lpServiceName service_name + ** LPCSTR lpDisplayName display_name ** DWORD dwDesiredAccess desired_access ** DWORD dwServiceType service_type ** DWORD dwStartType start_type ** DWORD dwErrorControl error_control - * LPCTSTR lpBinaryPathName - * LPCTSTR lpLoadOrderGroup + * LPCSTR lpBinaryPathName + * LPCSTR lpLoadOrderGroup * LPDWORD lpdwTagId - * LPCTSTR lpDependencies - ** LPCTSTR lpServiceStartName service_start_name - ** LPCTSTR lpPassword password + * LPCSTR lpDependencies + ** LPCSTR lpServiceStartName service_start_name + ** LPCSTR lpPassword password Pre:: @@ -157,7 +157,7 @@ Signature:: Parameters:: ** SC_HANDLE hSCManager service_manager_handle - ** LPCTSTR lpServiceName service_name + ** LPCSTR lpServiceName service_name ** DWORD dwDesiredAccess desired_access Interesting:: @@ -204,7 +204,7 @@ Parameters:: ** SC_HANDLE hService service_handle * DWORD dwNumServiceArgs - * LPCTSTR *lpServiceArgVectors + * LPCSTR *lpServiceArgVectors Logging:: diff --git a/sigs/ui.rst b/sigs/ui.rst index 6d38801ce..7a4d4c006 100644 --- a/sigs/ui.rst +++ b/sigs/ui.rst @@ -15,7 +15,7 @@ Signature:: Parameters:: * LPCSTR lpClassName - ** LPCTSTR lpWindowName window_name + ** LPCSTR lpWindowName window_name Pre:: @@ -72,8 +72,8 @@ Parameters:: ** HWND hwndParent parent_hwnd ** HWND hwndChildAfter child_after_hwnd - * LPCTSTR lpszClass - ** LPCTSTR lpszWindow window_name + * LPCSTR lpszClass + ** LPCSTR lpszWindow window_name Pre:: @@ -140,8 +140,8 @@ Signature:: Parameters:: ** HWND hWnd window_handle - ** LPCTSTR lpText text - ** LPCTSTR lpCaption caption + ** LPCSTR lpText text + ** LPCSTR lpCaption caption ** UINT uType flags ** WORD wLanguageId language_identifier * INT Unknown @@ -299,8 +299,8 @@ Signature:: Parameters:: ** DWORD dwExStyle extended_style - ** LPCTSTR lpClassName class_name - ** LPCTSTR lpWindowName window_name + ** LPCSTR lpClassName class_name + ** LPCSTR lpWindowName window_name ** DWORD dwStyle style ** int x ** int y diff --git a/src/diffing.c b/src/diffing.c index 11acddba0..0f95eacb9 100644 --- a/src/diffing.c +++ b/src/diffing.c @@ -202,7 +202,7 @@ void diffing_init(const char *path, int enable) } fclose(fp); - DeleteFile(path); + DeleteFileA(path); } g_diffing_enabled = enable; diff --git a/src/hooking.c b/src/hooking.c index 4e15d86cf..339ac22ce 100644 --- a/src/hooking.c +++ b/src/hooking.c @@ -111,7 +111,7 @@ int hook_init(HMODULE module_handle) g_monitor_end = g_monitor_start + module_image_size((const uint8_t *) module_handle); - g_ntdll_start = (uintptr_t) GetModuleHandle("ntdll"); + g_ntdll_start = (uintptr_t) GetModuleHandleA("ntdll"); g_ntdll_end = g_ntdll_start + module_image_size((const uint8_t *) g_ntdll_start); @@ -871,7 +871,7 @@ int hook(hook_t *h, void *module_handle) h->module_handle = module_handle; if(h->module_handle == NULL) { - h->module_handle = GetModuleHandle(h->library); + h->module_handle = GetModuleHandleA(h->library); // There is only one case in which a nullptr module handle is // allowed and that's when there is an address callback and the @@ -974,7 +974,7 @@ int hook(hook_t *h, void *module_handle) library, slab_size(&g_function_stubs)); h->library = library; - h->module_handle = GetModuleHandle(library); + h->module_handle = GetModuleHandleA(library); h->addr = NULL; // We're having a special case here. When we return 1, the monitor From 4b766981951304e2d4910dc45c31a70befdae0a1 Mon Sep 17 00:00:00 2001 From: Daniel Cohen Gindi Date: Wed, 1 Aug 2018 09:20:20 +0300 Subject: [PATCH 2/6] Added explicit casting with some types (required when compiling with cpp flags) --- sigs/crypto.rst | 4 ++-- sigs/process_native.rst | 2 +- sigs/system.rst | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/sigs/crypto.rst b/sigs/crypto.rst index 5cf203a13..c4b7e297d 100644 --- a/sigs/crypto.rst +++ b/sigs/crypto.rst @@ -313,7 +313,7 @@ Pre:: length += copy_uint32(&rgcbToBeHashed[idx]); } - uint8_t *buf = mem_alloc(length); + uint8_t *buf = (uint8_t *)mem_alloc(length); if(buf != NULL) { for (uint32_t idx = 0, offset = 0; idx < cToBeHashed; idx++) { copy_bytes( @@ -564,7 +564,7 @@ Pre:: if(pMessage != NULL && pMessage->pBuffers != NULL) { secbuf_get_buffer(pMessage->cBuffers, pMessage->pBuffers, &buf, &length); - buf = memdup(buf, length); + buf = (uint8_t *)memdup(buf, length); } Logging:: diff --git a/sigs/process_native.rst b/sigs/process_native.rst index 9078399e5..69c2679df 100644 --- a/sigs/process_native.rst +++ b/sigs/process_native.rst @@ -553,7 +553,7 @@ Middle:: // As it is non-trivial to extract the base address of the original // mapped section, we'll just go ahead and read the memory from the // remote process. - buffer = mem_alloc(buflen); + buffer = (uint8_t *)mem_alloc(buflen); if(buffer != NULL) { virtual_read_ex(ProcessHandle, *BaseAddress, buffer, &buflen); } diff --git a/sigs/system.rst b/sigs/system.rst index 6604e3d64..9fee73d85 100644 --- a/sigs/system.rst +++ b/sigs/system.rst @@ -142,7 +142,7 @@ Pre:: unhook_detect_disable(); char library[MAX_PATH+1]; - library_from_unicodez(get_module_file_name(ModuleHandle), + library_from_unicodez(get_module_file_name((HMODULE)ModuleHandle), library, sizeof(library)); Middle:: @@ -221,7 +221,7 @@ Pre:: char library[MAX_PATH+1]; - library_from_unicodez(get_module_file_name(ModuleHandle), + library_from_unicodez(get_module_file_name((HMODULE)ModuleHandle), library, sizeof(library)); Logging:: From f2ee7131bda4f819e2b969bbac3cdd7710320fd8 Mon Sep 17 00:00:00 2001 From: Daniel Cohen Gindi Date: Wed, 1 Aug 2018 09:20:32 +0300 Subject: [PATCH 3/6] Do not use reserved keyword `class` (required when compiling with cpp flags) --- sigs/registry_native.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sigs/registry_native.rst b/sigs/registry_native.rst index 7e91a67c7..e18ed22e4 100644 --- a/sigs/registry_native.rst +++ b/sigs/registry_native.rst @@ -25,7 +25,7 @@ Flags:: Pre:: - wchar_t *class = extract_unicode_string_unistr(Class); + wchar_t *classStr = extract_unicode_string_unistr(Class); wchar_t *regkey = get_unicode_buffer(); reg_get_key_objattr(ObjectAttributes, regkey); @@ -41,11 +41,11 @@ Interesting:: Logging:: u regkey regkey - u class class + u class classStr Post:: - free_unicode_buffer(class); + free_unicode_buffer(classStr); free_unicode_buffer(regkey); From 186223304bcf22b711badd2a15222a9941617f6d Mon Sep 17 00:00:00 2001 From: Daniel Cohen Gindi Date: Wed, 1 Aug 2018 09:21:13 +0300 Subject: [PATCH 4/6] Fixed "unary minus operator applied to unsigned type, result still unsigned" when compiling with c++ flags --- src/assembly.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assembly.c b/src/assembly.c index ed4f46e14..c39cb5513 100644 --- a/src/assembly.c +++ b/src/assembly.c @@ -233,9 +233,9 @@ int asm_lea_regregimm( int asm_sub_esp_imm(uint8_t *stub, uint32_t value) { #if __x86_64__ - return asm_lea_regregimm(stub, R_RSP, R_RSP, -value); + return asm_lea_regregimm(stub, R_RSP, R_RSP, -((int32_t)value)); #else - return asm_lea_regregimm(stub, R_ESP, R_ESP, -value); + return asm_lea_regregimm(stub, R_ESP, R_ESP, -((int32_t)value)); #endif } From bdcfdc63a825df510b709ec280c9ee5a0ab2a59e Mon Sep 17 00:00:00 2001 From: Daniel Cohen Gindi Date: Wed, 1 Aug 2018 09:21:34 +0300 Subject: [PATCH 5/6] Added MSVC equivalent of `__builtin_return_address(0)` --- src/hooking.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/hooking.c b/src/hooking.c index 339ac22ce..447e96d3f 100644 --- a/src/hooking.c +++ b/src/hooking.c @@ -154,8 +154,13 @@ static uintptr_t WINAPI _hook_retaddr4(void *a, void *b, void *c, void *d) { (void) a; (void) b; (void) c; (void) d; - // Probably gcc specific. - return (uintptr_t) __builtin_return_address(0); +#ifdef _MSC_VER + // msvc specific + return (uintptr_t)_ReturnAddress(); +#else + // gcc specific + return (uintptr_t)__builtin_return_address(0); +#endif } void hook_initcb_LdrLoadDll(hook_t *h) From b7b675dbd664c17f93305d676a180481eeb79600 Mon Sep 17 00:00:00 2001 From: Daniel Cohen Gindi Date: Tue, 7 Aug 2018 15:11:19 +0300 Subject: [PATCH 6/6] Added missing #pragma --- src/hooking.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/hooking.c b/src/hooking.c index 447e96d3f..2362fad86 100644 --- a/src/hooking.c +++ b/src/hooking.c @@ -150,6 +150,7 @@ int hook_init2() return 0; } +#pragma intrinsic(_ReturnAddress) static uintptr_t WINAPI _hook_retaddr4(void *a, void *b, void *c, void *d) { (void) a; (void) b; (void) c; (void) d;