Changeset 4111 for zzuf/trunk/srcTweet

Timestamp:

Dec 9, 2009, 1:28:28 AM (11 years ago)

Author:

Sam Hocevar

Message:

Try to work around the Vista ASLR feature by retrieving the executable's
base address once it is loaded in memory.

File:

• zzuf/trunk/src/zzuf.c (modified) (6 diffs)

zzuf/trunk/src/zzuf.c

@@ -45 +45 @@
 #if defined HAVE_WINDOWS_H
 #   include <windows.h>
+#   include <imagehlp.h>
+#   include <tlhelp32.h>
 #endif
 #if defined HAVE_IO_H
@@ -122 +124 @@
 #if defined HAVE_WINDOWS_H
 static int dll_inject(void *, void *);
-static void *get_entry(char const *);
+static intptr_t get_base_address(DWORD);
+static intptr_t get_entry_point_offset(char const *);
 #endif
 static void finfo(FILE *, struct opts *, uint32_t);
@@ -1089 +1092 @@
     pid = GetCurrentProcess();
 
-    /* Get entry point */
-    epaddr = get_entry(opts->newargv[0]);
-    if(!epaddr)
-        return -1;
-
     memset(&sinfo, 0, sizeof(sinfo));
     sinfo.cb = sizeof(sinfo);
@@ -1106 +1104 @@
                         CREATE_SUSPENDED, NULL, NULL, &sinfo, &pinfo);
     if(!ret)
+        return -1;
+
+    /* Get the child process's entry point address */
+    epaddr = (void *)(get_base_address(pinfo.dwProcessId)
+                       + get_entry_point_offset(opts->newargv[0]));
+    if(!epaddr)
         return -1;
 
@@ -1198 +1202 @@
 }
 
-static void *get_entry(char const *name)
+/* Find the process's base address once it is loaded in memory (the header
+ * information is unreliable because of Vista's ASLR). */
+static intptr_t get_base_address(DWORD pid)
+{
+    MODULEENTRY32 entry;
+    intptr_t ret = 0;
+    void *list;
+    int k;
+
+    list = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid);
+    entry.dwSize = sizeof(entry);
+    for(k = Module32First(list, &entry); k; k = Module32Next(list, &entry))
+    {
+        /* FIXME: how do we select the correct module? */
+        ret = (intptr_t)entry.modBaseAddr;
+    }
+    CloseHandle(list);
+
+    return ret;
+}
+
+/* Find the process's entry point address offset. The information is in
+ * the file's PE header. */
+static intptr_t get_entry_point_offset(char const *name)
 {
     PIMAGE_DOS_HEADER dos;
     PIMAGE_NT_HEADERS nt;
-    void *file, *map, *base, *ret = NULL;
+    intptr_t ret = 0;
+    void *file, *map, *base;
 
     file = CreateFile(name, GENERIC_READ, FILE_SHARE_READ,
@@ -1232 +1260 @@
       && nt->OptionalHeader.Magic == 0x10b /* IMAGE_NT_OPTIONAL_HDR32_MAGIC */)
     {
-        ret = (void *)(uintptr_t)(nt->OptionalHeader.ImageBase +
-                                  nt->OptionalHeader.AddressOfEntryPoint);
+        ret = (intptr_t)nt->OptionalHeader.AddressOfEntryPoint;
     }