2. Softice detection
Once you have cleaned out most of the garbage code of PELock, you can then comfortably proceed on to study PELock but first we need PELock to run in the presence of Softice. Under win2k, PELock has too effective softice detection which is int1 detection and UnhandledExceptionFilter byte check.
When softice is loaded, softice replaces the first byte of kernel32!UnhandledExceptionFilter API with a "CC" instead of the usual "55". PELock checks this byte for "CC" as follow
004010D4 80 38 CC cmp byte ptr [eax], 0CCh ; '¦'
004010D7 75 0F jnz short OK
004010D9 74 01 jz short near ptr bad
Thus, to bypass this check, we place a memory READ breakpoint on UnhandledExceptionFilter and change the Zero flag.
bpm UnhandledExceptionFilter r do "r fl z"
When Windows 2000 is running without softice, INT01 descriptor entry in IDT has DPL=0. So if a ring-3 task attempts to call INT01 with DPL=0, a GP=INT0D fault will occur and Windows INT0D handler will report C0000005 (EXCEPTION_ACCESS_VIOLATION) as the exception code and Eip as address where exception occur. When ntice is loaded, it sets DPL=3 for INT01 descriptor entry in IDT and now INT01 can be accessed by normal ring-3 task. Now if an INT01 is encountered, the next instruction address is stored on stack instead and Windows will check for any breakpoints placed, if not found then Windows will report a 80000004 (EXCEPTION_SINGLE_STEP) exception. In short, if softice is loaded, then the exception code is 80000004 and exception address is EIP+2 when int1 is encountered while if softice is not loaded, the exception code would be C0000005 and exception address would be EIP. (For detail reference, please refer to Intel Manual Volume 3). Thanks [Yates] for the explanation!
PELock uses the fact that exception addresses differ to check if softice is loaded. An normal SEH handler is set up!
004044A3 CD 01 int 1 ; exception address here if softice is not loader
004044A5 C3 retn ; exception address here if softice loaded
004044A6 ; -----------------------------------------------------------
004044A6 EB 36 jmp short near sice_not_present
004044A6 ; -----------------------------------------------------------
004044A8 90 90 90 90 90 90+ Softice_detected db 35h dup(90h)
004044DD ; -----------------------------------------------------------
004044DD C3 retn
004044DD ; -----------------------------------------------------------
004044DE 90 90 90 90 90 90+sice_not_present db 40h dup(90h)
<--- Inside SEH handler --->
004040E4 83 A8 B8 00 00 00+ sub [eax+CONTEXT.Eip], 0FFFFFFFDh ; add Eip by 3 bytes
004040E4 FD ; if sice is present, int1 exception
004040E4 ; will move Eip ahead by 2 bytes already
Hence, if softice is detected, the execution flow will change and soon PELock will exit silently. To overcome this detection, we need to patch IDT entry for INT01 descriptor so that DPL=0 again. In win2k do
idt ; to obtain address of Interrupt Descriptors Table
d <address of IDT>
Change the 0Dh byte from IDT on the table from EE to 8E Thanks SiNTaX and Nikolatesla for the tip
For more detailed explanation, you can refer to Art Of Assembly about IDT format.
3. Import Rebuilding
Once you are done with IDT patching, UnhandedExceptionFilter will break twice but PELock will happily run with softice loaded. Our next task is then to obtain valid import data. Run PELock, at the first UnhandledExceptionFilter breakpoint, you will be inside the "home-made" GetProcAddress described above, do "bpm Eip x" to place a breakpoint in this routine, when softice breaks at this breakpoint, press F12 once and you will be in the middle of IAT loading and redirecting process.
00405350 EB 2A jmp short near ptr ImportLoadingStart
00405350 ; ------------------------------------------------------
00405352 90 90 90 90 90 90+next_dll_entry db 27h dup(90h) ; CODE XREF: seg000:004059C3j
00405379 ; ------------------------------------------------------
00405379 8D 7E 01 lea edi, [esi+1]
00405379 ; ------------------------------------------------------
0040537C 90 90 90 90 90 90+ImportLoadingStart db 24h dup(90h) ; CODE XREF: seg000:00405350j
004053A0 ; ------------------------------------------------------
004053A0 57 push edi ; edi -> DLL name
004053A1 FF 55 00 call [ebp+API.LoadLibrary]
004053A1 ; ------------------------------------------------------
004053A4 90 90 90 90 90 90+ db 2Ch dup(90h)
004053D0 ; ------------------------------------------------------
004053D0 85 C0 test eax, eax
004053D2 0F 84 13 1A 00 00 jz Library_loading_fail
004053D2 ; ------------------------------------------------------
004053D8 90 90 90 90 90 90+ db 26h dup(90h)
004053FE ; ------------------------------------------------------
004053FE 8B D0 mov edx, eax ; edx = DLL handle
004053FE ; ------------------------------------------------------
00405400 90 90 90 90 90 90+ db 2Dh dup(90h)
0040542D ; ------------------------------------------------------
0040542D 8B F7 mov esi, edi ; import data block pointer
0040542D ; ------------------------------------------------------
0040542F 90 90 90 90 90 90+ db 2Dh dup(90h)
0040545C ; ------------------------------------------------------
0040545C string_scan_loop: ; CODE XREF: seg000:00405461j
0040545C 8A 06 mov al, [esi] ; simple loop scan along Import Data block
0040545E 46 inc esi ; to mov pointer to the end of DLL name
0040545F 84 C0 test al, al ; by checking for null byte
00405461 75 F9 jnz short string_scan_loop
00405461 ; ------------------------------------------------------
00405463 90 90 90 90 90 90+not_end_of_thunk db 4Eh dup(90h) ; CODE XREF: seg000:00405925j
004054B1 ; ------------------------------------------------------
004054B1 8B 46 01 mov eax, [esi+1] ; get API name hash from Import Data Block
004054B1 ; ------------------------------------------------------
004054B4 90 90 90 90 90 90+ db 2Ah dup(90h)
004054DE ; ------------------------------------------------------
004054DE B9 B2 06 00 00 mov ecx, 6B2h ; initialize counter for CRC loop below
004054DE ; ------------------------------------------------------
004054E3 90 90 90 90 90 90+ db 23h dup(90h)
00405506 ; ------------------------------------------------------
00405506 CRC_import_decrypt_loop: ; CODE XREF: seg000:00405510j
00405506 2B 84 8D 0A 3D 00+ sub eax, [ebp+ecx*4+3D0Ah] ; loop decrypting API name hash
0040550D D3 C0 rol eax, cl ; using CRC of the code area around here
0040550F 49 dec ecx ; to prevent patching
00405510 75 F4 jnz short CRC_import_decrypt_loop
00405510 ; ------------------------------------------------------
00405512 90 90 90 90 90 90+ db 28h dup(90h)
0040553A ; ------------------------------------------------------
0040553A 8A 0E mov cl, [esi] ; get the first char of API name
0040553C 83 C6 05 add esi, 5
0040553C ; ------------------------------------------------------
0040553F 90 90 90 90 90 90+ db 23h dup(90h)
00405562 ; ------------------------------------------------------
00405562 51 push ecx ; push first_char
00405562 ; ------------------------------------------------------
00405563 90 90 90 90 90 90+ db 23h dup(90h)
00405586 ; ------------------------------------------------------
00405586 50 push eax ; push API_name_hash
00405586 ; ------------------------------------------------------
00405587 90 90 90 90 90 90+ db 32h dup(90h)
004055B9 ; ------------------------------------------------------
004055B9 52 push edx ; push DLL handle
004055B9 ; ------------------------------------------------------
004055BA 90 90 90 90 90 90+ db 29h dup(90h)
004055E3 ; ------------------------------------------------------
004055E3 FF 75 00 push dword ptr [ebp+0]
004055E3 ; ------------------------------------------------------
004055E6 90 90 90 90 90 90+ db 33h dup(90h)
00405619 ; ------------------------------------------------------
00405619 E8 E7 B9 FF FF call GetAPIAddress ; The home-made GetProcAddress
00405619 ; ------------------------------------------------------
0040561E 90 90 90 90 90 90+ db 30h dup(90h) <=== YOU SHOULD LAND HERE
but these garbage code are removed by my idc script
0040564E ; ------------------------------------------------------
0040564E 85 C0 test eax, eax ; check API address found
0040564E ; ------------------------------------------------------
00405650 90 90 90 90 90 90+ db 1Dh dup(90h)
0040566D ; ------------------------------------------------------
0040566D 0F 84 92 17 00 00 jz API_add_not_found
0040566D ; ------------------------------------------------------
00405673 90 90 90 90 90 90+ db 5Bh dup(90h)
004056CE ; ------------------------------------------------------
004056CE F6 C1 80 test cl, 80h ; check redirection flag
004056CE ; if cl=80 then API is to be redirected
004056CE ; ------------------------------------------------------
004056D1 90 90 90 90 90 90+ db 2Bh dup(90h)
004056FC ; ------------------------------------------------------
004056FC 8B 0E mov ecx, [esi]
004056FC ; ------------------------------------------------------
004056FE 90 90 90 90 90 90+ db 47h dup(90h)
00405745 ; ------------------------------------------------------
00405745 0F 84 87 00 00 00 jz near ptr redirect_import+2Bh ; our CRUCIAL JUMP
00405745 ; ------------------------------------------------------
0040574B 90 90 90 90 90 90+ db 55h dup(90h)
004057A0 ; ------------------------------------------------------
004057A0 89 01 mov [ecx], eax ; update First Thunk of Import Directory
004057A2 E9 1F 01 00 00 jmp next_entry_in_thunk ; with original API address
004057A2 ; ------------------------------------------------------
004057A7 90 90 90 90 90 90+redirect_import db 8Bh dup(90h) ; CODE XREF: seg000:00405745j
00405832 ; ------------------------------------------------------
00405832 89 19 mov [ecx], ebx ; update First Thunk with redirected API address
00405832 ; ------------------------------------------------------
00405834 90 90 90 90 90 90+ db 5Dh dup(90h)
00405891 ; ------------------------------------------------------
00405891 E8 51 01 00 00 call near ptr redirect_API+1Fh
00405891 ; ------------------------------------------------------
00405896 90 90 90 90 90 90+ db 30h dup(90h)
004058C6 ; ------------------------------------------------------
004058C6 next_entry_in_thunk: ; CODE XREF: seg000:004057A2j
004058C6 83 C6 04 add esi, 4
004058C6 ; ------------------------------------------------------
004058C9 90 90 90 90 90 90+ db 30h dup(90h)
004058F9 ; ------------------------------------------------------
004058F9 B1 FE mov cl, 0FEh ; '¦' ; check for stopping byte
004058F9 ; ------------------------------------------------------
004058FB 90 90 90 90 90 90+ db 28h dup(90h)
00405923 ; ------------------------------------------------------
00405923 38 0E cmp [esi], cl ; if found then it is the end of thunk
00405925 0F 85 60 FB FF FF jnz near ptr not_end_of_thunk+28h
00405925 ; ------------------------------------------------------
0040592B 90 90 90 90 90 90+ db 32h dup(90h)
0040595D ; ------------------------------------------------------
0040595D 38 4E 01 cmp [esi+1], cl ; check for stopping byte again
0040595D ; ------------------------------------------------------
00405960 90 90 90 90 90 90+ db 28h dup(90h)
00405988 ; ------------------------------------------------------
00405988 0F 84 FC 17 00 00 jz import_done ; if 2 stopping byte together
00405988 ; it is the end of Import Data
00405988 ; ------------------------------------------------------
0040598E 90 90 90 90 90 90+ db 35h dup(90h)
004059C3 ; ------------------------------------------------------
004059C3 E9 8A F9 FF FF jmp near ptr next_dll_entry
I hope the comments are sufficient. Basically, Import Data is stored in a big block with "FE" used as a stopping byte or marker. Each DLL import entry is started with DLL name in plain ASCII, followed by import entries table and ended with "FE". Each import entry in the table comprises of 5 bytes, the first byte is first ASCII char of API name, the next dword is the API name hash. Here is an example of Import Data block :
00407E21 6B 65 72 6E 65 6C+aKernel32_dll_0 db 'kernel32.dll',0
00407E2E 56 db 56h ; V
00407E2F B5 F2 31 F6 dd 0F631F2B5h
00407E33 56 db 56h ; V
00407E34 22 0A AC 32 dd 32AC0A22h
<-------------SNIP------------->
00407E60 47 db 47h ; G
00407E61 E4 0D 06 DE dd 0DE060DE4h
00407E65 FF db 0FEh ; stopping byte
00407E66 75 73 65 72 33 32+aUser32_dll db 'user32.dll',0
00407E71 4D db 4Dh ; M
00407E72 71 A2 D2 A8 dd 0A8D2A271h
00407E76 FF db 0FEh ; stopping byte
00407E77 FF db 0FEh ;
Each import entry above is then passed as parameters for the "home-made" GetProcAddress which (assumes that system DLL export directories are alphabetically sorted) will then parse the export directory until it finds a match on the first char. It will then start performing hash on each API name of the Export Directory until a match for the required hash is found, this API address found will then be check for bpx then return to eax by the routine. As you can see, the compare at 4056CE and the conditional jump at 405745 are key decider on whether an API should be redirected or not. We would like PELock not to redirect any API at all but patching the jump wont do simply because the code CRC is used to calculate our import hash values. There are two solution to this, patching the "home-made" GetProcAddress to change value of ecx to 0 so that the jz at 405745 will always not jump or switching the zero flag at 405745 if zero flag is set. I opted for the second method by using this simple command below in softice.
bpm 405745 x if ZFL==1 do "r fl z; x"
Softice screen will flicker a lot as the breakpoint is hit pretty often (wonder why :) and there are quite a lot of imports so if you stand up, do a bit of stretching away from the monitor for a minute or so, when you come back PELock will already be running as if nothing had changed. BUT run Imprec now, enter OEP as 1000 and it will automatically find IAT for you at 28000. Click Get Import and Import will be able to resolve all import normally except 1. It is left as an exercise for readers to find out which API it is and why it is still redirected.
