mirror of https://github.com/decompals/wibo.git
first commit
This commit is contained in:
Ash Wolf
commit
d1a4fd35a7
|
|
@ -0,0 +1,21 @@
|
||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2022 Ash Wolf
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# WiBo
|
||||||
|
|
||||||
|
An experiment to try and write a minimal, low-fuss wrapper that can run really simple command-line 32-bit Windows binaries on Linux - with less faff and less dependencies than WINE.
|
||||||
|
|
||||||
|
Don't run this on any untrusted executables, I implore you. (Or probably just don't run it at all... :p)
|
||||||
|
|
||||||
|
g++ -g -m32 -std=c++20 -lstdc++ main.cpp kernel32.cpp advapi32.cpp loader.cpp
|
||||||
|
|
||||||
|
If you need something like this project (but more mature), you might find [taviso/loadlibrary](https://github.com/taviso/loadlibrary) more interesting.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
Rough to-do list:
|
||||||
|
|
||||||
|
- Implement more APIs
|
||||||
|
- Do something intelligent with Windows `HANDLE`s
|
||||||
|
- Pass the command line properly
|
||||||
|
- Convert paths in environment variables (and the structure of `PATH` itself, maybe) to Windows format
|
||||||
|
- Implement PE relocations rather than just failing unceremoniously
|
||||||
|
- Make the PE loader work for DLLs as well in case we ever want to load some
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
#include "common.h"
|
||||||
|
|
||||||
|
namespace advapi32 {
|
||||||
|
unsigned int WIN_FUNC RegOpenKeyExA(void *hKey, const char *lpSubKey, unsigned int ulOptions, void *samDesired, void **phkResult) {
|
||||||
|
printf("RegOpenKeyExA(key=%p, subkey=%s, ...)\n", hKey, lpSubKey);
|
||||||
|
return 1; // screw them for now
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void *wibo::resolveAdvApi32(const char *name) {
|
||||||
|
if (strcmp(name, "RegOpenKeyExA") == 0) return (void *) advapi32::RegOpenKeyExA;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
#include <stdint.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
|
||||||
|
#define WIN_FUNC __attribute__((stdcall))
|
||||||
|
|
||||||
|
namespace wibo {
|
||||||
|
extern uint32_t lastError;
|
||||||
|
extern char *commandLine;
|
||||||
|
|
||||||
|
void *resolveKernel32(const char *name);
|
||||||
|
void *resolveAdvApi32(const char *name);
|
||||||
|
void *resolveStubByName(const char *dllName, const char *funcName);
|
||||||
|
void *resolveStubByOrdinal(const char *dllName, uint16_t ordinal);
|
||||||
|
|
||||||
|
struct Executable {
|
||||||
|
Executable();
|
||||||
|
~Executable();
|
||||||
|
bool loadPE(FILE *file);
|
||||||
|
|
||||||
|
void *imageBuffer;
|
||||||
|
size_t imageSize;
|
||||||
|
void *entryPoint;
|
||||||
|
|
||||||
|
template <typename T>
|
||||||
|
T *fromRVA(uint32_t rva) {
|
||||||
|
return (T *) (rva + (uint8_t *) imageBuffer);
|
||||||
|
}
|
||||||
|
|
||||||
|
template <typename T>
|
||||||
|
T *fromRVA(T *rva) {
|
||||||
|
return fromRVA<T>((uint32_t) rva);
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,322 @@
|
||||||
|
#include "common.h"
|
||||||
|
#include <algorithm>
|
||||||
|
#include <ctype.h>
|
||||||
|
#include <filesystem>
|
||||||
|
#include <string>
|
||||||
|
|
||||||
|
namespace kernel32 {
|
||||||
|
uint32_t WIN_FUNC GetLastError() {
|
||||||
|
return wibo::lastError;
|
||||||
|
}
|
||||||
|
|
||||||
|
void *WIN_FUNC GetCurrentProcess() {
|
||||||
|
return (void *) 0xFFFFFFFF;
|
||||||
|
}
|
||||||
|
|
||||||
|
void WIN_FUNC InitializeCriticalSection(void *param) {
|
||||||
|
// printf("InitializeCriticalSection(...)\n");
|
||||||
|
}
|
||||||
|
void WIN_FUNC DeleteCriticalSection(void *param) {
|
||||||
|
// printf("DeleteCriticalSection(...)\n");
|
||||||
|
}
|
||||||
|
void WIN_FUNC EnterCriticalSection(void *param) {
|
||||||
|
// printf("EnterCriticalSection(...)\n");
|
||||||
|
}
|
||||||
|
void WIN_FUNC LeaveCriticalSection(void *param) {
|
||||||
|
// printf("LeaveCriticalSection(...)\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* TLS (Thread-Local Storage)
|
||||||
|
*/
|
||||||
|
enum { MAX_TLS_VALUES = 100 };
|
||||||
|
static bool tlsValuesUsed[MAX_TLS_VALUES] = { false };
|
||||||
|
static void *tlsValues[MAX_TLS_VALUES];
|
||||||
|
unsigned int WIN_FUNC TlsAlloc() {
|
||||||
|
printf("TlsAlloc()\n");
|
||||||
|
for (int i = 0; i < MAX_TLS_VALUES; i++) {
|
||||||
|
if (tlsValuesUsed[i] == false) {
|
||||||
|
tlsValuesUsed[i] = true;
|
||||||
|
tlsValues[i] = 0;
|
||||||
|
printf("...returning %d\n", i);
|
||||||
|
return i;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
printf("...returning nothing\n");
|
||||||
|
return 0xFFFFFFFF;
|
||||||
|
}
|
||||||
|
unsigned int WIN_FUNC TlsFree(unsigned int dwTlsIndex) {
|
||||||
|
printf("TlsFree(%u)\n", dwTlsIndex);
|
||||||
|
if (dwTlsIndex >= 0 && dwTlsIndex < MAX_TLS_VALUES && tlsValuesUsed[dwTlsIndex]) {
|
||||||
|
tlsValuesUsed[dwTlsIndex] = false;
|
||||||
|
return 1;
|
||||||
|
} else {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
void *WIN_FUNC TlsGetValue(unsigned int dwTlsIndex) {
|
||||||
|
// printf("TlsGetValue(%u)\n", dwTlsIndex);
|
||||||
|
if (dwTlsIndex >= 0 && dwTlsIndex < MAX_TLS_VALUES && tlsValuesUsed[dwTlsIndex])
|
||||||
|
return tlsValues[dwTlsIndex];
|
||||||
|
else
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
unsigned int WIN_FUNC TlsSetValue(unsigned int dwTlsIndex, void *lpTlsValue) {
|
||||||
|
// printf("TlsSetValue(%u, %p)\n", dwTlsIndex, lpTlsValue);
|
||||||
|
if (dwTlsIndex >= 0 && dwTlsIndex < MAX_TLS_VALUES && tlsValuesUsed[dwTlsIndex]) {
|
||||||
|
tlsValues[dwTlsIndex] = lpTlsValue;
|
||||||
|
return 1;
|
||||||
|
} else {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Memory
|
||||||
|
*/
|
||||||
|
void *WIN_FUNC GlobalAlloc(uint32_t uFlags, size_t dwBytes) {
|
||||||
|
printf("GlobalAlloc(flags=%x, size=%x)\n", uFlags, dwBytes);
|
||||||
|
if (uFlags & 2) {
|
||||||
|
// GMEM_MOVEABLE - not implemented rn
|
||||||
|
return 0;
|
||||||
|
} else {
|
||||||
|
// GMEM_FIXED - this is simpler
|
||||||
|
void *buffer = malloc(dwBytes);
|
||||||
|
if (buffer && (uFlags & 0x40)) {
|
||||||
|
// GMEM_ZEROINT
|
||||||
|
memset(buffer, 0, dwBytes);
|
||||||
|
}
|
||||||
|
return buffer;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
void *WIN_FUNC GlobalFree(void *hMem) {
|
||||||
|
free(hMem);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Environment
|
||||||
|
*/
|
||||||
|
char *WIN_FUNC GetCommandLineA() {
|
||||||
|
return wibo::commandLine;
|
||||||
|
}
|
||||||
|
|
||||||
|
char *WIN_FUNC GetEnvironmentStrings() {
|
||||||
|
// Step 1, figure out the size of the buffer we need.
|
||||||
|
size_t bufSize = 0;
|
||||||
|
char **work = environ;
|
||||||
|
|
||||||
|
while (*work) {
|
||||||
|
bufSize += strlen(*work) + 1;
|
||||||
|
work++;
|
||||||
|
}
|
||||||
|
bufSize++;
|
||||||
|
|
||||||
|
// Step 2, actually build that buffer
|
||||||
|
char *buffer = (char *) malloc(bufSize);
|
||||||
|
char *ptr = buffer;
|
||||||
|
work = environ;
|
||||||
|
|
||||||
|
while (*work) {
|
||||||
|
size_t strSize = strlen(*work);
|
||||||
|
memcpy(ptr, *work, strSize);
|
||||||
|
ptr[strSize] = 0;
|
||||||
|
ptr += strSize + 1;
|
||||||
|
work++;
|
||||||
|
}
|
||||||
|
*ptr = 0; // an extra null at the end
|
||||||
|
|
||||||
|
return buffer;
|
||||||
|
}
|
||||||
|
|
||||||
|
void WIN_FUNC FreeEnvironmentStringsA(char *buffer) {
|
||||||
|
free(buffer);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* I/O
|
||||||
|
*/
|
||||||
|
void *WIN_FUNC GetStdHandle(uint32_t nStdHandle) {
|
||||||
|
switch (nStdHandle) {
|
||||||
|
case ((uint32_t) -10): // STD_INPUT_HANDLE
|
||||||
|
return stdin;
|
||||||
|
case ((uint32_t) -11): // STD_OUTPUT_HANDLE
|
||||||
|
return stdout;
|
||||||
|
case ((uint32_t) -12): // STD_ERROR_HANDLE
|
||||||
|
return stderr;
|
||||||
|
default:
|
||||||
|
return (void *) 0xFFFFFFFF;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned int WIN_FUNC DuplicateHandle(void *hSourceProcessHandle, void *hSourceHandle, void *hTargetProcessHandle, void **lpTargetHandle, unsigned int dwDesiredAccess, unsigned int bInheritHandle, unsigned int dwOptions) {
|
||||||
|
// This is kinda silly...
|
||||||
|
if (hSourceHandle == stdin || hSourceHandle == stdout || hSourceHandle == stderr) {
|
||||||
|
// Just pretend we duplicated it, why not
|
||||||
|
*lpTargetHandle = hSourceHandle;
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
// This probably won't come up
|
||||||
|
printf("Unhandled DuplicateHandle(source=%p)\n", hSourceHandle);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
std::filesystem::path pathFromWindows(const char *inStr) {
|
||||||
|
// Convert to forward slashes
|
||||||
|
std::string str = inStr;
|
||||||
|
std::replace(str.begin(), str.end(), '\\', '/');
|
||||||
|
|
||||||
|
// Remove the drive letter
|
||||||
|
if (str.starts_with("c:/") || str.starts_with("C:/")) {
|
||||||
|
str.erase(0, 2);
|
||||||
|
}
|
||||||
|
|
||||||
|
return std::filesystem::path(str);
|
||||||
|
}
|
||||||
|
|
||||||
|
std::string pathToWindows(const std::filesystem::path &path) {
|
||||||
|
std::string str = path;
|
||||||
|
|
||||||
|
if (path.is_absolute()) {
|
||||||
|
str.insert(0, "C:");
|
||||||
|
}
|
||||||
|
|
||||||
|
std::replace(str.begin(), str.end(), '/', '\\');
|
||||||
|
return str;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned int WIN_FUNC GetFullPathNameA(const char *lpFileName, unsigned int nBufferLength, char *lpBuffer, char **lpFilePart) {
|
||||||
|
printf("GetFullPathNameA(%s)...\n", lpFileName);
|
||||||
|
std::filesystem::path absPath = std::filesystem::absolute(pathFromWindows(lpFileName));
|
||||||
|
std::string absStr = pathToWindows(absPath);
|
||||||
|
printf("AbsPath: %s - %s\n", absPath.c_str(), absStr.c_str());
|
||||||
|
|
||||||
|
// Enough space?
|
||||||
|
if ((absStr.size() + 1) <= nBufferLength) {
|
||||||
|
strcpy(lpBuffer, absStr.c_str());
|
||||||
|
|
||||||
|
// Do we need to fill in FilePart?
|
||||||
|
if (lpFilePart) {
|
||||||
|
*lpFilePart = 0;
|
||||||
|
if (!std::filesystem::is_directory(absPath)) {
|
||||||
|
*lpFilePart = strrchr(lpBuffer, '\\');
|
||||||
|
if (*lpFilePart)
|
||||||
|
*lpFilePart += 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return absStr.size();
|
||||||
|
} else {
|
||||||
|
return absStr.size() + 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned int WIN_FUNC GetFileAttributesA(const char *lpFileName) {
|
||||||
|
auto path = pathFromWindows(lpFileName);
|
||||||
|
printf("GetFileAttributesA(%s)... (%s)\n", lpFileName, path.c_str());
|
||||||
|
auto status = std::filesystem::status(path);
|
||||||
|
|
||||||
|
wibo::lastError = 0;
|
||||||
|
|
||||||
|
switch (status.type()) {
|
||||||
|
case std::filesystem::file_type::regular:
|
||||||
|
printf("File exists\n");
|
||||||
|
return 0x80; // FILE_ATTRIBUTE_NORMAL
|
||||||
|
case std::filesystem::file_type::directory:
|
||||||
|
return 0x10; // FILE_ATTRIBUTE_DIRECTORY
|
||||||
|
case std::filesystem::file_type::not_found:
|
||||||
|
default:
|
||||||
|
printf("File does not exist\n");
|
||||||
|
wibo::lastError = 2; // ERROR_FILE_NOT_FOUND
|
||||||
|
return 0xFFFFFFFF; // INVALID_FILE_ATTRIBUTES
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned int WIN_FUNC WriteFile(void *hFile, const void *lpBuffer, unsigned int nNumberOfBytesToWrite, unsigned int *lpNumberOfBytesWritten, void *lpOverlapped) {
|
||||||
|
// for now, we VERY naively assume that the handle is a FILE*
|
||||||
|
// haha this is gonna come back and bite me, isn't it
|
||||||
|
wibo::lastError = 0;
|
||||||
|
|
||||||
|
size_t written = fwrite(lpBuffer, 1, nNumberOfBytesToWrite, (FILE *) hFile);
|
||||||
|
if (lpNumberOfBytesWritten)
|
||||||
|
*lpNumberOfBytesWritten = written;
|
||||||
|
|
||||||
|
if (written == 0)
|
||||||
|
wibo::lastError = 29; // ERROR_WRITE_FAULT
|
||||||
|
|
||||||
|
return (written == nNumberOfBytesToWrite);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Console Nonsense
|
||||||
|
*/
|
||||||
|
unsigned int WIN_FUNC SetConsoleCtrlHandler(void *HandlerRoutine, unsigned int Add) {
|
||||||
|
// This is a function that gets called when doing ^C
|
||||||
|
// We might want to call this later (being mindful that it'll be stdcall I think)
|
||||||
|
|
||||||
|
// For now, just pretend we did the thing
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
struct CONSOLE_SCREEN_BUFFER_INFO {
|
||||||
|
int16_t dwSize_x;
|
||||||
|
int16_t dwSize_y;
|
||||||
|
int16_t dwCursorPosition_x;
|
||||||
|
int16_t dwCursorPosition_y;
|
||||||
|
uint16_t wAttributes;
|
||||||
|
int16_t srWindow_left;
|
||||||
|
int16_t srWindow_top;
|
||||||
|
int16_t srWindow_right;
|
||||||
|
int16_t srWindow_bottom;
|
||||||
|
int16_t dwMaximumWindowSize_x;
|
||||||
|
int16_t dwMaximumWindowSize_y;
|
||||||
|
};
|
||||||
|
|
||||||
|
unsigned int WIN_FUNC GetConsoleScreenBufferInfo(void *hConsoleOutput, CONSOLE_SCREEN_BUFFER_INFO *lpConsoleScreenBufferInfo) {
|
||||||
|
// Tell a lie
|
||||||
|
// mwcc doesn't care about anything else
|
||||||
|
lpConsoleScreenBufferInfo->dwSize_x = 80;
|
||||||
|
lpConsoleScreenBufferInfo->dwSize_y = 25;
|
||||||
|
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned int WIN_FUNC GetSystemDirectoryA(char *lpBuffer, unsigned int uSize) {
|
||||||
|
strcpy(lpBuffer, "C:\\Windows\\System32");
|
||||||
|
return strlen(lpBuffer);
|
||||||
|
}
|
||||||
|
|
||||||
|
unsigned int WIN_FUNC GetWindowsDirectoryA(char *lpBuffer, unsigned int uSize) {
|
||||||
|
strcpy(lpBuffer, "C:\\Windows");
|
||||||
|
return strlen(lpBuffer);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void *wibo::resolveKernel32(const char *name) {
|
||||||
|
if (strcmp(name, "GetLastError") == 0) return (void *) kernel32::GetLastError;
|
||||||
|
if (strcmp(name, "GetCurrentProcess") == 0) return (void *) kernel32::GetCurrentProcess;
|
||||||
|
if (strcmp(name, "InitializeCriticalSection") == 0) return (void *) kernel32::InitializeCriticalSection;
|
||||||
|
if (strcmp(name, "DeleteCriticalSection") == 0) return (void *) kernel32::DeleteCriticalSection;
|
||||||
|
if (strcmp(name, "EnterCriticalSection") == 0) return (void *) kernel32::EnterCriticalSection;
|
||||||
|
if (strcmp(name, "LeaveCriticalSection") == 0) return (void *) kernel32::LeaveCriticalSection;
|
||||||
|
if (strcmp(name, "GlobalAlloc") == 0) return (void *) kernel32::GlobalAlloc;
|
||||||
|
if (strcmp(name, "GlobalFree") == 0) return (void *) kernel32::GlobalFree;
|
||||||
|
if (strcmp(name, "TlsAlloc") == 0) return (void *) kernel32::TlsAlloc;
|
||||||
|
if (strcmp(name, "TlsFree") == 0) return (void *) kernel32::TlsFree;
|
||||||
|
if (strcmp(name, "TlsGetValue") == 0) return (void *) kernel32::TlsGetValue;
|
||||||
|
if (strcmp(name, "TlsSetValue") == 0) return (void *) kernel32::TlsSetValue;
|
||||||
|
if (strcmp(name, "GetCommandLineA") == 0) return (void *) kernel32::GetCommandLineA;
|
||||||
|
if (strcmp(name, "GetEnvironmentStrings") == 0) return (void *) kernel32::GetEnvironmentStrings;
|
||||||
|
if (strcmp(name, "FreeEnvironmentStringsA") == 0) return (void *) kernel32::FreeEnvironmentStringsA;
|
||||||
|
if (strcmp(name, "GetStdHandle") == 0) return (void *) kernel32::GetStdHandle;
|
||||||
|
if (strcmp(name, "DuplicateHandle") == 0) return (void *) kernel32::DuplicateHandle;
|
||||||
|
if (strcmp(name, "GetFullPathNameA") == 0) return (void *) kernel32::GetFullPathNameA;
|
||||||
|
if (strcmp(name, "GetFileAttributesA") == 0) return (void *) kernel32::GetFileAttributesA;
|
||||||
|
if (strcmp(name, "WriteFile") == 0) return (void *) kernel32::WriteFile;
|
||||||
|
if (strcmp(name, "SetConsoleCtrlHandler") == 0) return (void *) kernel32::SetConsoleCtrlHandler;
|
||||||
|
if (strcmp(name, "GetConsoleScreenBufferInfo") == 0) return (void *) kernel32::GetConsoleScreenBufferInfo;
|
||||||
|
if (strcmp(name, "GetSystemDirectoryA") == 0) return (void *) kernel32::GetSystemDirectoryA;
|
||||||
|
if (strcmp(name, "GetWindowsDirectoryA") == 0) return (void *) kernel32::GetWindowsDirectoryA;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,207 @@
|
||||||
|
#include "common.h"
|
||||||
|
#include <errno.h>
|
||||||
|
#include <memory>
|
||||||
|
#include <sys/mman.h>
|
||||||
|
#include <sys/syscall.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
|
||||||
|
struct PEHeader {
|
||||||
|
uint8_t magic[4]; // "PE\0\0"
|
||||||
|
uint16_t machine;
|
||||||
|
uint16_t numberOfSections;
|
||||||
|
uint32_t timeDateStamp;
|
||||||
|
uint32_t pointerToSymbolTable;
|
||||||
|
uint32_t numberOfSymbols;
|
||||||
|
uint16_t sizeOfOptionalHeader;
|
||||||
|
uint16_t characteristics;
|
||||||
|
};
|
||||||
|
struct PEImageDataDirectory {
|
||||||
|
uint32_t virtualAddress;
|
||||||
|
uint32_t size;
|
||||||
|
};
|
||||||
|
struct PE32Header {
|
||||||
|
uint16_t magic; // 0x10B for PE32
|
||||||
|
uint8_t majorLinkerVersion;
|
||||||
|
uint8_t minorLinkerVersion;
|
||||||
|
uint32_t sizeOfCode;
|
||||||
|
uint32_t sizeOfInitializedData;
|
||||||
|
uint32_t sizeOfUninitializedData;
|
||||||
|
uint32_t addressOfEntryPoint;
|
||||||
|
uint32_t baseOfCode;
|
||||||
|
uint32_t baseOfData;
|
||||||
|
uint32_t imageBase;
|
||||||
|
uint32_t sectionAlignment;
|
||||||
|
uint32_t fileAlignment;
|
||||||
|
uint16_t majorOperatingSystemVersion;
|
||||||
|
uint16_t minorOperatingSystemVersion;
|
||||||
|
uint16_t majorImageVersion;
|
||||||
|
uint16_t minorImageVersion;
|
||||||
|
uint16_t majorSubsystemVersion;
|
||||||
|
uint16_t minorSubsystemVersion;
|
||||||
|
uint32_t win32VersionValue;
|
||||||
|
uint32_t sizeOfImage;
|
||||||
|
uint32_t sizeOfHeaders;
|
||||||
|
uint32_t checkSum;
|
||||||
|
uint16_t subsystem;
|
||||||
|
uint16_t dllCharacteristics;
|
||||||
|
uint32_t sizeOfStackReserve;
|
||||||
|
uint32_t sizeOfStackCommit;
|
||||||
|
uint32_t sizeOfHeapReserve;
|
||||||
|
uint32_t sizeOfHeapCommit;
|
||||||
|
uint32_t loaderFlags;
|
||||||
|
uint32_t numberOfRvaAndSizes;
|
||||||
|
PEImageDataDirectory exportTable;
|
||||||
|
PEImageDataDirectory importTable; // *
|
||||||
|
PEImageDataDirectory resourceTable; // *
|
||||||
|
PEImageDataDirectory exceptionTable;
|
||||||
|
PEImageDataDirectory certificateTable;
|
||||||
|
PEImageDataDirectory baseRelocationTable; // *
|
||||||
|
PEImageDataDirectory debug; // *
|
||||||
|
PEImageDataDirectory architecture;
|
||||||
|
PEImageDataDirectory globalPtr;
|
||||||
|
PEImageDataDirectory tlsTable;
|
||||||
|
PEImageDataDirectory loadConfigTable;
|
||||||
|
PEImageDataDirectory boundImport;
|
||||||
|
PEImageDataDirectory iat;
|
||||||
|
PEImageDataDirectory delayImportDescriptor;
|
||||||
|
PEImageDataDirectory clrRuntimeHeader;
|
||||||
|
PEImageDataDirectory reserved;
|
||||||
|
};
|
||||||
|
struct PESectionHeader {
|
||||||
|
char name[8];
|
||||||
|
uint32_t virtualSize;
|
||||||
|
uint32_t virtualAddress;
|
||||||
|
uint32_t sizeOfRawData;
|
||||||
|
uint32_t pointerToRawData;
|
||||||
|
uint32_t pointerToRelocations;
|
||||||
|
uint32_t pointerToLinenumbers;
|
||||||
|
uint16_t numberOfRelocations;
|
||||||
|
uint16_t numberOfLinenumbers;
|
||||||
|
uint32_t characteristics;
|
||||||
|
};
|
||||||
|
struct PEImportDirectoryEntry {
|
||||||
|
uint32_t *importLookupTable;
|
||||||
|
uint32_t timeDateStamp;
|
||||||
|
uint32_t forwarderChain;
|
||||||
|
char *name;
|
||||||
|
uint32_t *importAddressTable;
|
||||||
|
};
|
||||||
|
struct PEHintNameTableEntry {
|
||||||
|
uint16_t hint;
|
||||||
|
char name[1]; // variable length
|
||||||
|
};
|
||||||
|
|
||||||
|
uint16_t read16(FILE *file) {
|
||||||
|
uint16_t v = 0;
|
||||||
|
fread(&v, 2, 1, file);
|
||||||
|
return v;
|
||||||
|
}
|
||||||
|
uint32_t read32(FILE *file) {
|
||||||
|
uint32_t v = 0;
|
||||||
|
fread(&v, 4, 1, file);
|
||||||
|
return v;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
wibo::Executable::Executable() {
|
||||||
|
imageBuffer = nullptr;
|
||||||
|
imageSize = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
wibo::Executable::~Executable() {
|
||||||
|
if (imageBuffer) {
|
||||||
|
munmap(imageBuffer, imageSize);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
bool wibo::Executable::loadPE(FILE *file) {
|
||||||
|
// Skip to PE header
|
||||||
|
fseek(file, 0x3C, SEEK_SET);
|
||||||
|
uint32_t offsetToPE = read32(file);
|
||||||
|
fseek(file, offsetToPE, SEEK_SET);
|
||||||
|
|
||||||
|
// Read headers
|
||||||
|
PEHeader header;
|
||||||
|
fread(&header, sizeof header, 1, file);
|
||||||
|
if (memcmp(header.magic, "PE\0\0", 4) != 0)
|
||||||
|
return false;
|
||||||
|
if (header.machine != 0x14C) // i386
|
||||||
|
return false;
|
||||||
|
|
||||||
|
printf("Sections: %d / Size of optional header: %x\n", header.numberOfSections, header.sizeOfOptionalHeader);
|
||||||
|
|
||||||
|
PE32Header header32;
|
||||||
|
memset(&header32, 0, sizeof header32);
|
||||||
|
fread(&header32, std::min(sizeof(header32), (size_t) header.sizeOfOptionalHeader), 1, file);
|
||||||
|
if (header32.magic != 0x10B)
|
||||||
|
return false;
|
||||||
|
|
||||||
|
printf("Image Base: %x / Size: %x\n", header32.imageBase, header32.sizeOfImage);
|
||||||
|
|
||||||
|
long pageSize = sysconf(_SC_PAGE_SIZE);
|
||||||
|
printf("Page size: %x\n", pageSize);
|
||||||
|
|
||||||
|
// Build buffer
|
||||||
|
imageSize = header32.sizeOfImage;
|
||||||
|
imageBuffer = mmap((void *) header32.imageBase, header32.sizeOfImage, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANONYMOUS|MAP_FIXED|MAP_PRIVATE, -1, 0);
|
||||||
|
if (imageBuffer == MAP_FAILED) {
|
||||||
|
perror("Image mapping failed!");
|
||||||
|
imageBuffer = 0;
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Read the sections
|
||||||
|
fseek(file, offsetToPE + sizeof header + header.sizeOfOptionalHeader, SEEK_SET);
|
||||||
|
|
||||||
|
for (int i = 0; i < header.numberOfSections; i++) {
|
||||||
|
PESectionHeader section;
|
||||||
|
fread(§ion, sizeof section, 1, file);
|
||||||
|
|
||||||
|
char name[9];
|
||||||
|
memcpy(name, section.name, 8);
|
||||||
|
name[8] = 0;
|
||||||
|
printf("Section %d: name=%s addr=%x size=%x (raw=%x) ptr=%x\n", i, name, section.virtualAddress, section.virtualSize, section.sizeOfRawData, section.pointerToRawData);
|
||||||
|
|
||||||
|
if (section.sizeOfRawData > 0) {
|
||||||
|
// Grab this data
|
||||||
|
long savePos = ftell(file);
|
||||||
|
fseek(file, section.pointerToRawData, SEEK_SET);
|
||||||
|
void *sectionBase = (void *) (header32.imageBase + section.virtualAddress);
|
||||||
|
fread(sectionBase, section.virtualSize, 1, file);
|
||||||
|
fseek(file, savePos, SEEK_SET);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Handle imports
|
||||||
|
PEImportDirectoryEntry *dir = fromRVA<PEImportDirectoryEntry>(header32.importTable.virtualAddress);
|
||||||
|
|
||||||
|
while (dir->name) {
|
||||||
|
char *name = fromRVA(dir->name);
|
||||||
|
printf("DLL Name: %s\n", name);
|
||||||
|
uint32_t *lookupTable = fromRVA(dir->importLookupTable);
|
||||||
|
uint32_t *addressTable = fromRVA(dir->importAddressTable);
|
||||||
|
|
||||||
|
while (*lookupTable) {
|
||||||
|
uint32_t lookup = *lookupTable;
|
||||||
|
if (lookup & 0x80000000) {
|
||||||
|
// Import by ordinal
|
||||||
|
uint16_t ordinal = lookup & 0xFFFF;
|
||||||
|
printf(" Ordinal: %d\n", ordinal);
|
||||||
|
*addressTable = (uint32_t) resolveStubByOrdinal(name, ordinal);
|
||||||
|
} else {
|
||||||
|
// Import by name
|
||||||
|
PEHintNameTableEntry *hintName = fromRVA<PEHintNameTableEntry>(lookup);
|
||||||
|
printf(" Name: %s\n", hintName->name);
|
||||||
|
*addressTable = (uint32_t) resolveStubByName(name, hintName->name);
|
||||||
|
}
|
||||||
|
++lookupTable;
|
||||||
|
++addressTable;
|
||||||
|
}
|
||||||
|
|
||||||
|
++dir;
|
||||||
|
}
|
||||||
|
|
||||||
|
entryPoint = fromRVA<void>(header32.addressOfEntryPoint);
|
||||||
|
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,97 @@
|
||||||
|
#include "common.h"
|
||||||
|
#include <asm/ldt.h>
|
||||||
|
#include <errno.h>
|
||||||
|
#include <memory>
|
||||||
|
#include <sys/mman.h>
|
||||||
|
#include <sys/syscall.h>
|
||||||
|
|
||||||
|
uint32_t wibo::lastError = 0;
|
||||||
|
char *wibo::commandLine;
|
||||||
|
|
||||||
|
void stub() {
|
||||||
|
// should go through all the functions imported by mwcceppc.exe
|
||||||
|
// and create template stubs for them, at least...
|
||||||
|
printf("Unhandled function\n");
|
||||||
|
exit(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
uint32_t __attribute__((stdcall)) CoInitialize(void *pvReserved) {
|
||||||
|
printf("CoInitialize(...)\n");
|
||||||
|
return 0; // S_OK I think?
|
||||||
|
}
|
||||||
|
|
||||||
|
void *wibo::resolveStubByName(const char *dllName, const char *funcName) {
|
||||||
|
if (strcmp(dllName, "KERNEL32.dll") == 0) {
|
||||||
|
void *func = wibo::resolveKernel32(funcName);
|
||||||
|
if (func)
|
||||||
|
return func;
|
||||||
|
}
|
||||||
|
if (strcmp(dllName, "ADVAPI32.dll") == 0) {
|
||||||
|
void *func = wibo::resolveAdvApi32(funcName);
|
||||||
|
if (func)
|
||||||
|
return func;
|
||||||
|
}
|
||||||
|
if (strcmp(dllName, "ole32.dll") == 0) {
|
||||||
|
if (strcmp(funcName, "CoInitialize") == 0) return (void *) CoInitialize;
|
||||||
|
}
|
||||||
|
|
||||||
|
printf("Missing function: %s (%s)\n", dllName, funcName);
|
||||||
|
return (void *) stub;
|
||||||
|
}
|
||||||
|
|
||||||
|
void *wibo::resolveStubByOrdinal(const char *dllName, uint16_t ordinal) {
|
||||||
|
return (void *) stub;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Windows Thread Information Block
|
||||||
|
struct TIB {
|
||||||
|
void *sehFrame;
|
||||||
|
void *stackBase;
|
||||||
|
void *stackLimit;
|
||||||
|
void *subSystemTib;
|
||||||
|
void *fiberData;
|
||||||
|
void *arbitraryDataSlot;
|
||||||
|
TIB *tib;
|
||||||
|
};
|
||||||
|
|
||||||
|
int main(int argc, char **argv) {
|
||||||
|
// Create TIB
|
||||||
|
TIB tib;
|
||||||
|
tib.tib = &tib;
|
||||||
|
|
||||||
|
struct user_desc tibDesc;
|
||||||
|
tibDesc.entry_number = 0;
|
||||||
|
tibDesc.base_addr = (unsigned int) &tib;
|
||||||
|
tibDesc.limit = 0x1000;
|
||||||
|
tibDesc.seg_32bit = 1;
|
||||||
|
tibDesc.contents = 0; // hopefully this is ok
|
||||||
|
tibDesc.read_exec_only = 0;
|
||||||
|
tibDesc.limit_in_pages = 0;
|
||||||
|
tibDesc.seg_not_present = 0;
|
||||||
|
tibDesc.useable = 1;
|
||||||
|
if (syscall(SYS_modify_ldt, 1, &tibDesc, sizeof tibDesc) != 0) {
|
||||||
|
perror("Failed to modify LDT\n");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Build a command line (todo, fill this with argv etc)
|
||||||
|
wibo::commandLine = new char[1024];
|
||||||
|
strcpy(wibo::commandLine, "mwcceppc.exe");
|
||||||
|
|
||||||
|
wibo::Executable exec;
|
||||||
|
|
||||||
|
FILE *f = fopen("mwcceppc.exe", "rb");
|
||||||
|
exec.loadPE(f);
|
||||||
|
fclose(f);
|
||||||
|
|
||||||
|
uint16_t tibSegment = (tibDesc.entry_number << 3) | 7;
|
||||||
|
// Invoke the damn thing
|
||||||
|
asm(
|
||||||
|
"movw %0, %%fs; call *%1"
|
||||||
|
:
|
||||||
|
: "r"(tibSegment), "r"(exec.entryPoint)
|
||||||
|
);
|
||||||
|
printf("We came back\n");
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue