+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] understanding thread context in Runpe method (/showthread.php?tid=6027146)
understanding thread context in Runpe method - invisible_hack2 - Nov 22, 2019
hi guys, i've some questions
why is ebx+8? it's eax register in context structure but why? is imagebase in eax register of context struct ? i don't get any documentation about it in internet
here is the code
Code
ReadProcessMemory(PI.hProcess, LPCVOID(CTX->Ebx + 8), LPVOID(&dwImageBase), 4, NULL);CONTEXT (winnt.h) - Win32 apps | Microsoft Docs
full source
PE-Crypter/runPE.h at master jozemberi/PE-Crypter GitHub
RE: understanding thread context in Runpe method - gigajew - Nov 22, 2019
Don’t focus on what’s where in the stack, what you need to look at is how the windows loader works when a process is created to get an answer to your question
RE: understanding thread context in Runpe method - invisible_hack2 - Nov 22, 2019
Don’t focus on what’s where in the stack, what you need to look at is how the windows loader works when a process is created to get an answer to your question
where could i get that info?
RE: understanding thread context in Runpe method - Rossiya - Nov 23, 2019
Process hollowing is nothing more than replacing another process's image with a different one - it's often used to bypass detection where applicable and mask rogue operations by having them be performed by what would appear to be a legitimate process that's actually been hijacked.
Simple & quick basics:
1. Create the process-to-be-hollowed in a suspended state.
2. Unmap the image of the process for the process-to-be-hollowed.
3. Map the new image to the process-to-be-hollowed.
4. Cleanup.
5. Resume execution for the main thread of the hollowed process.
Cleanup stage includes anything from address relocation to hijacking code execution to the new start address via registers with the thread context.
Furthermore, I'd recommend using system calls for NtCreateUserProcess, NtGetContextThread, NtSetContextThread, NtUnmapViewOfSection, NtReadVirtualMemory, NtWriteVirtualMemory, NtResumeThread, NtClose, etc.
If you decide to use NtCreateUserProcess then reverse-engineer CreateProcessInternalW to get a proper implementation working as NtCreateUserProcess alone is only for native PEs (Windows NT native to clarify).
I recommend you study Windows NT APIs (how they work and what their intended use is, as well as how to use them) as well as the Windows PE File Format before you continue.
RE: understanding thread context in Runpe method - LynxAxe - Nov 23, 2019
(Nov 23, 2019 11:38 AM)Rossiya Wrote: 2. Unmap the image of the process for the process-to-be-hollowed.
It's better for you to use NtUnmapViewOfSectionEx instead of NtUnmapViewOfSection because these NTDLL Ex* APIs keep getting ignored or forgotten about by Anti-Virus products that are using user-mode hooking.
I've been told that NtUnmapViewOfSection/Ex is destined for doom on some Windows PCs so I would suggest you rock your own emulation of it!
RE: understanding thread context in Runpe method - HFDone - Nov 24, 2019
at the end the compiler translate your code to assembly
to understand it you should look into asm runpe
the importent part is the end when you can see why you need the context struct and how its done via thread
...
invoke GetThreadContext,[_PI.hProcess],CTX
invoke WriteProcessMemory,[_PI.hProcess],dword[CTX.Ebx+8],imagebase,0x4,0
pop eax
add eax,dword[eax+0x3C]
mov eax,dword[eax+0x28]
mov [CTX.Eax],eax ; EntryPoint
invoke SetThreadContext,[_PI.hProcess],CTX
invoke ResumeThread,[_PI.hThread]
RE: understanding thread context in Runpe method - invisible_hack2 - Nov 24, 2019
(Nov 23, 2019 11:38 AM)Rossiya Wrote: Process hollowing is nothing more than replacing another process's image with a different one - it's often used to bypass detection where applicable and mask rogue operations by having them be performed by what would appear to be a legitimate process that's actually been hijacked.Thank you,it's exactly the kind of answer i was looking for
Simple & quick basics:
1. Create the process-to-be-hollowed in a suspended state.
2. Unmap the image of the process for the process-to-be-hollowed.
3. Map the new image to the process-to-be-hollowed.
4. Cleanup.
5. Resume execution for the main thread of the hollowed process.
Cleanup stage includes anything from address relocation to hijacking code execution to the new start address via registers with the thread context.
Furthermore, I'd recommend using system calls for NtCreateUserProcess, NtGetContextThread, NtSetContextThread, NtUnmapViewOfSection, NtReadVirtualMemory, NtWriteVirtualMemory, NtResumeThread, NtClose, etc.
If you decide to use NtCreateUserProcess then reverse-engineer CreateProcessInternalW to get a proper implementation working as NtCreateUserProcess alone is only for native PEs (Windows NT native to clarify).
I recommend you study Windows NT APIs (how they work and what their intended use is, as well as how to use them) as well as the Windows PE File Format before you continue.
(Nov 24, 2019 03:43 AM)HFDone Wrote: at the end the compiler translate your code to assembly
to understand it you should look into asm runpe
the importent part is the end when you can see why you need the context struct and how its done via thread
...
invoke GetThreadContext,[_PI.hProcess],CTX
invoke WriteProcessMemory,[_PI.hProcess],dword[CTX.Ebx+8],imagebase,0x4,0
pop eax
add eax,dword[eax+0x3C]
mov eax,dword[eax+0x28]
mov [CTX.Eax],eax ; EntryPoint
invoke SetThreadContext,[_PI.hProcess],CTX
invoke ResumeThread,[_PI.hThread]
so basically eax register is where entry point start ?
RE: understanding thread context in Runpe method - HFDone - Nov 24, 2019
WriteProcessMemory function (memoryapi.h) - Win32 apps | Microsoft Docs
lpBaseAddress
A pointer to the base address in the specified process to which data is written. Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for write access, and if it is not accessible, the function fails.
lpBuffer
A pointer to the buffer that contains data to be written in the address space of the specified process.
Ebx+8 ; ImageBase
eax ; EntryPoint
RE: understanding thread context in Runpe method - LynxAxe - Nov 24, 2019
(Nov 23, 2019 06:51 PM)LynxAxe Wrote: It's better for you to use NtUnmapViewOfSectionEx instead of NtUnmapViewOfSection because these NTDLL Ex* APIs keep getting ignored or forgotten about by Anti-Virus products that are using user-mode hooking.
I've been told that NtUnmapViewOfSection/Ex is destined for doom on some Windows PCs so I would suggest you rock your own emulation of it!
Bear in mind, NtUnmapViewOfSectionEx was only introduced for Windows 8, so make sure you check the version of Windows that is installed on the PC before trying to use it.
Code
NTSYSAPI NTSTATUS NtUnmapViewOfSection(
HANDLE ProcessHandle,
PVOID BaseAddress
);To ensure compatibility, you should use dynamic address resolving (roll your own better emulation of GetProcAddress with EAT scanning) so you can target one or the other depending on whether NtUnmapViewOfSectionEx is present on the version of Windows that's running.
Another member also suggested using system calls manually and I vouch for this suggestion and would recommend it instead of finding the address of those APIs from NTDLL and using them as-is, I cannot express the importance of this !
RE: understanding thread context in Runpe method - Zephyros - Nov 24, 2019
At the process entry, before code is executed, the ebx register contains the PEB (process environment block)
It contains various important info, but in this case it is used to read and late write the processes image base. (8 is the offset from the start of PEB)
Updating it to the correct value is important if the injected Exe contains resources, else the Windows APIs can't find them.
For more info: x86 - Windows initial execution context - Stack Overflow
RE: understanding thread context in Runpe method - invisible_hack2 - Nov 25, 2019
(Nov 24, 2019 08:35 AM)HFDone Wrote: WriteProcessMemory function (memoryapi.h) - Win32 apps | Microsoft Docs
lpBaseAddress
A pointer to the base address in the specified process to which data is written. Before data transfer occurs, the system verifies that all data in the base address and memory of the specified size is accessible for write access, and if it is not accessible, the function fails.
lpBuffer
A pointer to the buffer that contains data to be written in the address space of the specified process.
Ebx+8 ; ImageBase
eax ; EntryPoint
Good explanation ,now everything is much clearer
(Nov 24, 2019 02:15 PM)Zephyros Wrote: At the process entry, before code is executed, the ebx register contains the PEB (process environment block)
It contains various important info, but in this case it is used to read and late write the processes image base. (8 is the offset from the start of PEB)
Updating it to the correct value is important if the injected Exe contains resources, else the Windows APIs can't find them.
For more info: x86 - Windows initial execution context - Stack Overflow
Thank you too 🤗 🤗