exploitimpl.cpp

#include "stdafx.h"
#include "hookimpl.h"
#include "HookImplementObject.h"
#include "utils.h"
#include "exploitmpl.h"
#include "UniversalObject.h"

using namespace cchips;

processing_status WINAPI CHookImplementObject::detour_virtualAlloc(detour_node* node, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_virtualAllocEx(CHookImplementObject::detour_node* node, HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
{
    EXPLOIT_POST_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
        if (flAllocationType != MEM_COMMIT)
            break;
        // we only check it when target process is current process
        // this might fix mantis: 0492346
        if (hProcess != GetCurrentProcess())
            break;
        if (flProtect != PAGE_EXECUTE_READ && flProtect != PAGE_EXECUTE_READWRITE)
            break;
        std::vector<PVOID> frame_chains;
        WalkFrameCurrentChain(frame_chains);
        if (!frame_chains.size()) return processing_continue;

        for (const auto& chain : frame_chains) {
            if (CheckExploitFuncs::AddressInModule(reinterpret_cast<ULONG_PTR>(chain), node->hook_implement_object->GetSpecialModuleInfo().m_self_info)) {
                continue;
            }
            if (CheckExploitFuncs::AddressInModule(reinterpret_cast<ULONG_PTR>(chain), node->hook_implement_object->GetSpecialModuleInfo().m_vbe_info)) {
                if (CheckExploitFuncs::CheckStackInstruction(reinterpret_cast<ULONG_PTR>(chain))) {
                    exploit_log("\"API\": \"{}\", \"reason\": {}", node->function->GetName(), CheckExploitFuncs::e_reason_vbe_suspicious);
                }
            }
            else {
                std::shared_ptr<CObObject> return_ptr = node->function->GetIdentifier(SI_RETURN);
                if (!return_ptr) return processing_continue;
                std::any anyvalue = return_ptr->GetValue(static_cast<char*>(node->return_va));
                if (!anyvalue.has_value() || anyvalue.type() != typeid(PVOID))
                    return processing_continue;
                if (PVOID virtual_addr = std::any_cast<PVOID>(anyvalue); virtual_addr != nullptr) {
                    if (CheckExploitFuncs::ValidStackPointer(reinterpret_cast<ULONG_PTR>(virtual_addr))) {
                        exploit_log("\"API\": \"{}\", \"reason\": {}", node->function->GetName(), CheckExploitFuncs::e_reason_allocate_exec_stack);
                    }
                }
            }
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_virtualProtectEx(detour_node* node, HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, LPDWORD lpflOldProtect)
{
    EXPLOIT_POST_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
            // we only check it when target process is current process
            // this might fix mantis: 0492346
            if (hProcess != GetCurrentProcess())
                break;
        if (flNewProtect != PAGE_EXECUTE_READ && flNewProtect != PAGE_EXECUTE_READWRITE)
            break;
        std::vector<PVOID> frame_chains;
        WalkFrameCurrentChain(frame_chains);
        if (!frame_chains.size()) return processing_continue;

        for (const auto& chain : frame_chains) {
            if (CheckExploitFuncs::AddressInModule(reinterpret_cast<ULONG_PTR>(chain), node->hook_implement_object->GetSpecialModuleInfo().m_self_info)) {
                continue;
            }
            if (CheckExploitFuncs::AddressInModule(reinterpret_cast<ULONG_PTR>(chain), node->hook_implement_object->GetSpecialModuleInfo().m_vbe_info)) {
                if (CheckExploitFuncs::CheckStackInstruction(reinterpret_cast<ULONG_PTR>(chain))) {
                    exploit_log("\"API\": \"{}\", \"reason\": {}", node->function->GetName(), CheckExploitFuncs::e_reason_vbe_suspicious);
                }
                continue;
            }
            if (CheckExploitFuncs::ValidStackPointer(reinterpret_cast<ULONG_PTR>(lpAddress))) {
                exploit_log("\"API\": \"{}\", \"reason\": {}", node->function->GetName(), CheckExploitFuncs::e_reason_allocate_exec_stack);
            }
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_createProcessA(detour_node* node, LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
            std::shared_ptr<CHookImplementObject> impl_ptr = node->hook_implement_object;
        if (lpApplicationName) {
            std::string str_name = lpApplicationName;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(str_name)) {
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, str_name);
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
        else if (lpCommandLine) {
            std::string str_name = lpCommandLine;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(str_name)) {
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, str_name);
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_createProcessW(detour_node* node, LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
            std::shared_ptr<CHookImplementObject> impl_ptr = node->hook_implement_object;
        if (lpApplicationName) {
            std::wstring wstr_name = lpApplicationName;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(W2AString(wstr_name))) {
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, W2AString(wstr_name));
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
        else if (lpCommandLine) {
            std::wstring wstr_name = lpCommandLine;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(W2AString(wstr_name))) {
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, W2AString(wstr_name));
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_createProcessInternalW(detour_node* node, HANDLE hToken, LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation, PHANDLE hNewToken)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
        std::shared_ptr<CHookImplementObject> impl_ptr = node->hook_implement_object;
        if (lpApplicationName) {
            std::wstring wstr_name = lpApplicationName;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(W2AString(wstr_name))) {
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, W2AString(wstr_name));
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
        else if (lpCommandLine) {
            std::wstring wstr_name = lpCommandLine;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(W2AString(wstr_name))) {
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, W2AString(wstr_name));
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_dialogBoxParamA(detour_node* node, HINSTANCE hInstance, LPCSTR lpTemplateName, HWND hWndParent, DLGPROC lpDialogFunc, LPARAM dwInitParam)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        if ((DWORD)lpTemplateName == 4070)
        {
            // try unlock password of VBA behaviors found, report e_reason_unlock_vba
            exploit_log("\"API\": \"{}\", \"reason\": {}", node->function->GetName(), CheckExploitFuncs::e_reason_unlock_vba);
            std::shared_ptr<CObObject> return_ptr = node->function->GetIdentifier(SI_RETURN);
            if (!return_ptr) return processing_continue;
            std::any anyvalue = return_ptr->GetValue(static_cast<char*>(node->return_va));
            if (!anyvalue.has_value() || anyvalue.type() != typeid(LPVOID))
                return processing_continue;
            anyvalue = reinterpret_cast<LPVOID>(1);
            return_ptr->SetValue(static_cast<char*>(node->return_va), anyvalue);
            return processing_exit;
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_dialogBoxParamW(detour_node* node, HINSTANCE hInstance, LPCWSTR lpTemplateName, HWND hWndParent, DLGPROC lpDialogFunc, LPARAM dwInitParam)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
        do {
            if ((DWORD)lpTemplateName == 4070)
            {
                // try unlock password of VBA behaviors found, report e_reason_unlock_vba
                exploit_log("\"API\": \"{}\", \"reason\": {}", node->function->GetName(), CheckExploitFuncs::e_reason_unlock_vba);
                std::shared_ptr<CObObject> return_ptr = node->function->GetIdentifier(SI_RETURN);
                if (!return_ptr) return processing_continue;
                std::any anyvalue = return_ptr->GetValue(static_cast<char*>(node->return_va));
                if (!anyvalue.has_value() || anyvalue.type() != typeid(LPVOID))
                    return processing_continue;
                anyvalue = reinterpret_cast<LPVOID>(1);
                return_ptr->SetValue(static_cast<char*>(node->return_va), anyvalue);
                return processing_exit;
            }
        } while (0);
#endif
        return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_createFileA(detour_node* node, LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_createFileW(detour_node* node, LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_copyFileA(detour_node* node, LPCSTR lpExistingFileName, LPCSTR lpNewFileName, BOOL bFailIfExists)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_copyFileW(detour_node* node, LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName, BOOL bFailIfExists)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_shellExecuteA(detour_node* node, HWND hwnd, LPCSTR lpOperation, LPCSTR lpFile, LPCSTR lpParameters, LPCSTR lpDirectory, INT nShowCmd)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
        std::shared_ptr<CHookImplementObject> impl_ptr = node->hook_implement_object;
        if (lpFile) {
            std::string str_name = lpFile;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(str_name)) {
                // start danger process behaviors found, report e_reason_danger_process
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, str_name);
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_shellExecuteW(detour_node* node, HWND hwnd, LPCWSTR lpOperation, LPCWSTR lpFile, LPCWSTR lpParameters, LPCWSTR lpDirectory, INT nShowCmd)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
            std::shared_ptr<CHookImplementObject> impl_ptr = node->hook_implement_object;
        if (lpFile) {
            std::wstring wstr_name = lpFile;
            if (impl_ptr->GetCategoryPtr()->IsDangerousCommand(W2AString(wstr_name))) {
                // start danger process behaviors found, report e_reason_danger_process
                exploit_log("\"API\": \"{}\", \"reason\": {}, \"command\": \"{}\"", node->function->GetName(), CheckExploitFuncs::e_reason_danger_process, W2AString(wstr_name));
            }
            else {
                //if (CheckTaintList((LPWSTR)lpApplicationName)) {
                //    FOUND_EXPLOIT(EXPLOIT_REASON_SUSPICIOUS_PROCESS, NULL);
                //}
            }
        }
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_URLDownloadToFileA(detour_node* node, LPUNKNOWN pCaller, LPCSTR szURL, LPCSTR szFileName, DWORD dwReserved, LPBINDSTATUSCALLBACK lpfnCB)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_URLDownloadToFileW(detour_node* node, LPUNKNOWN pCaller, LPCWSTR szURL, LPCWSTR szFileName, DWORD dwReserved, LPBINDSTATUSCALLBACK lpfnCB)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_URLDownloadToCacheFileA(detour_node* node, LPUNKNOWN lpUnkcaller, LPCSTR szURL, LPCSTR szFileName, DWORD cchFileName, DWORD dwReserved, IBindStatusCallback *pBSC)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_URLDownloadToCacheFileW(detour_node* node, LPUNKNOWN lpUnkcaller, LPCSTR szURL, LPCWSTR szFileName, DWORD cchFileName, DWORD dwReserved, IBindStatusCallback *pBSC)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_winExec(detour_node* node, LPCSTR lpCmdLine, UINT uCmdShow)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_loadLibraryA(detour_node* node, LPCSTR lpLibFileName)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
        do {
            CHECK_COMMON_EXPLOIT()
        } while (0);
#endif
            return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_loadLibraryW(detour_node* node, LPCWSTR lpLibFileName)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_loadLibraryExA(detour_node* node, LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_loadLibraryExW(detour_node* node, LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_ntMapViewOfSection(detour_node* node, HANDLE SectionHandle, HANDLE ProcessHandle, PVOID *BaseAddress, ULONG ZeroBits, ULONG CommitSize, PLARGE_INTEGER SectionOffset, PULONG ViewSize, UINT InheritDisposition, ULONG AllocationType, ULONG Protect)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

PVOID WINAPI CHookImplementObject::detour_rtlAllocateHeap(PVOID HeapHandle, ULONG Flags, SIZE_T Size)
{
    if (m_heap_allocation_define.rtlallocateheap_func)
    {
        PVOID ret_base = m_heap_allocation_define.rtlallocateheap_func(HeapHandle, Flags, Size);
        static LONG add_lock = 0;
        LONG lock_int = InterlockedCompareExchange(&add_lock, 1, 0);
        if (lock_int == 0) {
#ifdef _X86_
            do {
                if (CheckExploitFuncs::CheckHeapSpray(HeapHandle, ret_base, Size)) {
                    // heap spray behaviors found, report e_reason_heap_spray
                    exploit_log("\"API\": \"{}\", \"reason\": {}", "RtlAllocateHeap", CheckExploitFuncs::e_reason_heap_spray);
                }
                else {
                    InterlockedExchange(&add_lock, 0);
                }
            } while (0);
#endif
        }
        return ret_base;
    }
    return nullptr;
}

BOOLEAN WINAPI CHookImplementObject::detour_rtlFreeHeap(PVOID HeapHandle, ULONG Flags, PVOID BaseAddress)
{
    if (m_heap_allocation_define.rtlfreeheap_func)
    {
#ifdef _X86_
        do {
            CheckExploitFuncs::FreeHeapSpray(HeapHandle, BaseAddress);
        } while (0);
#endif
        return m_heap_allocation_define.rtlfreeheap_func(HeapHandle, Flags, BaseAddress);
    }
    return FALSE;
}

PVOID WINAPI CHookImplementObject::detour_rtlDestroyHeap(PVOID HeapHandle)
{
    if (m_heap_allocation_define.rtldestroyheap_func)
    {
#ifdef _X86_
        do {
            CheckExploitFuncs::DestroyHeapSpray(HeapHandle);
        } while (0);
#endif
        return m_heap_allocation_define.rtldestroyheap_func(HeapHandle);
    }
    return nullptr;
}

processing_status WINAPI CHookImplementObject::detour_WSAStartup(detour_node* node, WORD wVersionRequired, LPWSADATA lpWSAData)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_socket(detour_node* node, int af, int type, int protocol)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}

processing_status WINAPI CHookImplementObject::detour_connect(detour_node* node, SOCKET s, const sockaddr *name, int namelen)
{
    EXPLOIT_PRE_BEGIN(node)
#ifdef _X86_
    do {
        CHECK_COMMON_EXPLOIT()
    } while (0);
#endif
    return processing_continue;
}