├── .gitignore
├── License.md
├── MemoryLoader
├── MemZipLoader
│ ├── MemZipLoader.vcxproj
│ ├── MemZipLoader.vcxproj.filters
│ ├── dllmain.cpp
│ ├── pch.cpp
│ └── pch.h
├── MemoryLoader.sln
├── MemoryLoader
│ ├── MemoryLoader.cpp
│ ├── MemoryLoader.h
│ ├── MemoryLoader.vcxproj
│ ├── MemoryLoader.vcxproj.filters
│ ├── Misc.cpp
│ ├── Misc.h
│ ├── dllmain.cpp
│ ├── framework.h
│ ├── pch.cpp
│ └── pch.h
├── UrlLoader
│ ├── UrlLoader.cpp
│ ├── UrlLoader.h
│ ├── UrlLoader.vcxproj
│ ├── UrlLoader.vcxproj.filters
│ ├── dllmain.cpp
│ ├── pch.cpp
│ └── pch.h
└── include
│ ├── x32_bit7z
│ └── bit7z
│ │ ├── BUILD.txt
│ │ ├── LICENSE
│ │ ├── README.md
│ │ ├── include
│ │ ├── bit7z.hpp
│ │ ├── bit7zlibrary.hpp
│ │ ├── bitarchivecreator.hpp
│ │ ├── bitarchivehandler.hpp
│ │ ├── bitarchiveinfo.hpp
│ │ ├── bitarchiveitem.hpp
│ │ ├── bitarchiveopener.hpp
│ │ ├── bitcompressionlevel.hpp
│ │ ├── bitcompressionmethod.hpp
│ │ ├── bitcompressor.hpp
│ │ ├── bitexception.hpp
│ │ ├── bitextractor.hpp
│ │ ├── bitformat.hpp
│ │ ├── bitguids.hpp
│ │ ├── bitinputarchive.hpp
│ │ ├── bitmemcompressor.hpp
│ │ ├── bitmemextractor.hpp
│ │ ├── bitpropvariant.hpp
│ │ ├── bitstreamcompressor.hpp
│ │ ├── bitstreamextractor.hpp
│ │ └── bittypes.hpp
│ │ └── lib
│ │ ├── bit7z.lib
│ │ ├── bit7z_d.lib
│ │ └── bit7z_d.pdb
│ └── x64_bit7z
│ ├── BUILD.txt
│ ├── LICENSE
│ ├── README.md
│ ├── include
│ ├── bit7z.hpp
│ ├── bit7zlibrary.hpp
│ ├── bitarchivecreator.hpp
│ ├── bitarchivehandler.hpp
│ ├── bitarchiveinfo.hpp
│ ├── bitarchiveitem.hpp
│ ├── bitarchiveopener.hpp
│ ├── bitcompressionlevel.hpp
│ ├── bitcompressionmethod.hpp
│ ├── bitcompressor.hpp
│ ├── bitexception.hpp
│ ├── bitextractor.hpp
│ ├── bitformat.hpp
│ ├── bitguids.hpp
│ ├── bitinputarchive.hpp
│ ├── bitmemcompressor.hpp
│ ├── bitmemextractor.hpp
│ ├── bitpropvariant.hpp
│ ├── bitstreamcompressor.hpp
│ ├── bitstreamextractor.hpp
│ └── bittypes.hpp
│ └── lib
│ ├── bit7z64.lib
│ ├── bit7z64_d.lib
│ └── bit7z64_d.pdb
├── README.md
└── pics
├── base_ida.png
├── dropbox_example.png
├── loaders.png
├── memory_loader.png
└── url_loader.png
/.gitignore:
--------------------------------------------------------------------------------
1 | *.pyc
2 | */Debug/
3 | */Release/
4 | */x64/
5 | */x64_debug_ida_32/
6 | */.vs/
7 | */*/Debug/
8 | */*/Release/
9 | */*/x64/
10 | */*/x64_debug_ida_32/
11 | *.user
12 | *.vsspell
13 |
--------------------------------------------------------------------------------
/MemoryLoader/MemZipLoader/MemZipLoader.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Header Files
20 |
21 |
22 |
23 |
24 | Source Files
25 |
26 |
27 | Source Files
28 |
29 |
30 |
--------------------------------------------------------------------------------
/MemoryLoader/MemZipLoader/dllmain.cpp:
--------------------------------------------------------------------------------
1 | #include "pch.h"
2 | #include "MemoryLoader.h"
3 |
4 | ///
5 | /// accept_file* function in called by IDA API each time build_loaders_list is called,
6 | /// if the function return a 1 (LOAD_FILE/TRUE) the loader will be suggested as
7 | /// a loader option for this buffer.
8 | ///
9 | /// Boolean value if the loader is relevant
10 | int idaapi accept_file_zip_file(
11 | qstring* fileformatname,
12 | qstring*,
13 | linput_t*,
14 | const char* filename)
15 | {
16 | const std::wstring archive_name_w = ascii2unicode(filename);
17 | try {
18 | const bit7z::Bit7zLibrary lib{ ZipDllName };
19 | const bit7z::BitArchiveInfo arc{ lib, archive_name_w, bit7z::BitFormat::Zip };
20 | if (arc.items().empty()) {
21 | info(ZipFilesNumber, archive_name_w.c_str());
22 | return SKIP_NOT_RELEVANT;
23 | }
24 | }
25 | catch (const std::exception&) {
26 | return SKIP_NOT_RELEVANT;
27 | }
28 |
29 | // name of the loader that will be in IDA window
30 | *fileformatname = MEMORY_LOADER_FORMAT;
31 | return LOAD_FILE;
32 | };
33 |
34 | //-----------------------------------------------------------------------------
35 | // load a file from a ZIP file into IDA.
36 | void idaapi load_from_zip(linput_t* li, ushort /*neflag*/, const char* /*fileformatname*/)
37 | {
38 | UNREFERENCED_PARAMETER(li);
39 | try
40 | {
41 | // file name, will be filled after zip extracted
42 | std::string file_name_s{};
43 | // file buffer
44 | std::vector< bit7z::byte_t > file_buffer{};
45 |
46 | // represents the file name that will be displayed in IDA windows, at the top right corner
47 | qstring new_path{};
48 | // full path of IDB file
49 | qstring new_idb_path{};
50 | // full path of IDB file as wide string
51 | std::wstring new_path_idb_w{};
52 | // should override db flag, used to tell if db should be overrider and if the db should be saved immediately to new_idb_path
53 | int override_db = TRUE;
54 |
55 | // string representation for IDB file name (the architecture part).
56 | std::string desired_arc_str{};
57 | // tells if the architecture was already set
58 | bool set_arc = false;
59 |
60 | extract_zipped_file_to_buffer(file_name_s, file_buffer);
61 | retrieve_target_architecture(desired_arc_str);
62 | fix_naming_and_env(file_name_s, desired_arc_str, new_path, new_idb_path, new_path_idb_w);
63 | check_override_db_file(new_path_idb_w, new_idb_path, file_name_s, override_db);
64 |
65 | const unique_ptr_s1 li2{ create_linput(file_buffer) };
66 | const unique_ptr_s1 linfos{ create_linfos(li2.get()) };
67 |
68 | // check if build_loader_list returned a not a empty list
69 | // we don't support nested loading zips of zips
70 | if ((linfos.get() != nullptr) && (linfos.get()->ftype == f_ZIP)) {
71 | throw std::exception(NoNestedZipping);
72 | }
73 |
74 | handle_file_loading(linfos.get(), li2.get(), file_buffer, desired_arc_str, file_name_s, set_arc);
75 | validate_architecture_set(set_arc, desired_arc_str);
76 |
77 | // If the build_loaders_list could no find any suitable loader from IDA loaders list,
78 | // ask the user if the input should be as a binary (shellcode) buffer.
79 | if (linfos.get() == nullptr) {
80 | parse_as_shellcode(file_buffer);
81 | }
82 |
83 | /*
84 | Auto-analysis with
85 | apply type information
86 | apply signature to address
87 | load signature file (file name is kept separately)
88 | find functions chunks
89 | reanalyze
90 | */
91 | set_auto_state(AU_USED | AU_TYPE | AU_LIBF | AU_CHLB | AU_FCHUNK);
92 | auto_wait();
93 |
94 | // only save the db if we need to, if its new or if the user knows he is going to override it
95 | if (override_db == ASKBTN_YES) {
96 | const int success = save_database(new_idb_path.c_str(), 0);
97 | if (!success) {
98 | warning(BadDatabaseLocation, new_idb_path.c_str());
99 | }
100 | }
101 |
102 | msg(LoadedToAddress, new_path.c_str());
103 | }
104 | catch (const std::exception& ex)
105 | {
106 | loader_failure("Loader failure. Error: %s", ex.what());
107 | }
108 | }
109 |
110 | //-----------------------------------------------------------------------------
111 | // Loader description block
112 | loader_t LDSC =
113 | {
114 | IDP_INTERFACE_VERSION,
115 | 0,
116 | accept_file_zip_file,
117 | load_from_zip,
118 | nullptr,
119 | nullptr,
120 | };
121 |
--------------------------------------------------------------------------------
/MemoryLoader/MemZipLoader/pch.cpp:
--------------------------------------------------------------------------------
1 | // pch.cpp: source file corresponding to the pre-compiled header
2 |
3 | #include "pch.h"
4 |
5 | // When you are using pre-compiled headers, this source file is necessary for compilation to succeed.
6 |
--------------------------------------------------------------------------------
/MemoryLoader/MemZipLoader/pch.h:
--------------------------------------------------------------------------------
1 | // pch.h: This is a precompiled header file.
2 | // Files listed below are compiled only once, improving build performance for future builds.
3 | // This also affects IntelliSense performance, including code completion and many code browsing features.
4 | // However, files listed here are ALL re-compiled if any one of them is updated between builds.
5 | // Do not add files here that you will be updating frequently as this negates the performance advantage.
6 |
7 | #ifndef PCH_H
8 | #define PCH_H
9 |
10 | // add headers that you want to pre-compile here
11 | #include "framework.h"
12 |
13 | #endif //PCH_H
14 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 16
4 | VisualStudioVersion = 16.0.31005.135
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MemoryLoader", "MemoryLoader\MemoryLoader.vcxproj", "{9791A477-6890-435E-B444-A814A33DD8BC}"
7 | EndProject
8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MemZipLoader", "MemZipLoader\MemZipLoader.vcxproj", "{99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}"
9 | ProjectSection(ProjectDependencies) = postProject
10 | {9791A477-6890-435E-B444-A814A33DD8BC} = {9791A477-6890-435E-B444-A814A33DD8BC}
11 | EndProjectSection
12 | EndProject
13 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "UrlLoader", "UrlLoader\UrlLoader.vcxproj", "{5863B1A7-F926-4F70-A297-C35E3F1822D5}"
14 | ProjectSection(ProjectDependencies) = postProject
15 | {9791A477-6890-435E-B444-A814A33DD8BC} = {9791A477-6890-435E-B444-A814A33DD8BC}
16 | EndProjectSection
17 | EndProject
18 | Global
19 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
20 | Debug_32_address_ida|x64 = Debug_32_address_ida|x64
21 | Debug_32_address_ida|x86 = Debug_32_address_ida|x86
22 | Debug|x64 = Debug|x64
23 | Debug|x86 = Debug|x86
24 | Release|x64 = Release|x64
25 | Release|x86 = Release|x86
26 | EndGlobalSection
27 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
28 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug_32_address_ida|x64.ActiveCfg = Debug_32_address_ida|x64
29 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug_32_address_ida|x64.Build.0 = Debug_32_address_ida|x64
30 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug_32_address_ida|x86.ActiveCfg = Debug_32_address_ida|Win32
31 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug_32_address_ida|x86.Build.0 = Debug_32_address_ida|Win32
32 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug|x64.ActiveCfg = Debug|x64
33 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug|x64.Build.0 = Debug|x64
34 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug|x86.ActiveCfg = Debug|Win32
35 | {9791A477-6890-435E-B444-A814A33DD8BC}.Debug|x86.Build.0 = Debug|Win32
36 | {9791A477-6890-435E-B444-A814A33DD8BC}.Release|x64.ActiveCfg = Release|x64
37 | {9791A477-6890-435E-B444-A814A33DD8BC}.Release|x64.Build.0 = Release|x64
38 | {9791A477-6890-435E-B444-A814A33DD8BC}.Release|x86.ActiveCfg = Release|Win32
39 | {9791A477-6890-435E-B444-A814A33DD8BC}.Release|x86.Build.0 = Release|Win32
40 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug_32_address_ida|x64.ActiveCfg = Debug_32_address_ida|x64
41 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug_32_address_ida|x64.Build.0 = Debug_32_address_ida|x64
42 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug_32_address_ida|x86.ActiveCfg = Debug_32_address_ida|Win32
43 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug_32_address_ida|x86.Build.0 = Debug_32_address_ida|Win32
44 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug|x64.ActiveCfg = Debug|x64
45 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug|x64.Build.0 = Debug|x64
46 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug|x86.ActiveCfg = Debug|Win32
47 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Debug|x86.Build.0 = Debug|Win32
48 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Release|x64.ActiveCfg = Release|x64
49 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Release|x64.Build.0 = Release|x64
50 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Release|x86.ActiveCfg = Release|Win32
51 | {99BCE5FE-9286-40E4-8B18-E6DC2E79FF79}.Release|x86.Build.0 = Release|Win32
52 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug_32_address_ida|x64.ActiveCfg = Debug_32_address_ida|x64
53 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug_32_address_ida|x64.Build.0 = Debug_32_address_ida|x64
54 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug_32_address_ida|x86.ActiveCfg = Debug|Win32
55 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug_32_address_ida|x86.Build.0 = Debug|Win32
56 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug|x64.ActiveCfg = Debug|x64
57 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug|x64.Build.0 = Debug|x64
58 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug|x86.ActiveCfg = Debug|Win32
59 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Debug|x86.Build.0 = Debug|Win32
60 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Release|x64.ActiveCfg = Release|x64
61 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Release|x64.Build.0 = Release|x64
62 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Release|x86.ActiveCfg = Release|Win32
63 | {5863B1A7-F926-4F70-A297-C35E3F1822D5}.Release|x86.Build.0 = Release|Win32
64 | EndGlobalSection
65 | GlobalSection(SolutionProperties) = preSolution
66 | HideSolutionNode = FALSE
67 | EndGlobalSection
68 | GlobalSection(ExtensibilityGlobals) = postSolution
69 | SolutionGuid = {54BA595F-8CFC-49AD-BACD-1199F5658E4D}
70 | EndGlobalSection
71 | EndGlobal
72 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/MemoryLoader.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "pch.h"
3 |
4 | #ifdef _EXPORTING
5 | #define CLASS_DECLSPEC __declspec(dllexport)
6 | #else
7 | #define CLASS_DECLSPEC __declspec(dllimport)
8 | #endif
9 |
10 | ///
11 | /// * Setting up base address
12 | /// * Check if PE architecture matches IDA architecture
13 | /// * Loading all til files for windows to get as many symbols as possible with FLIRT.
14 | ///
15 | /// file buffer as byte array
16 | /// file name as string
17 | /// boolean parameter to represent if architecture was set
18 | CLASS_DECLSPEC
19 | void handle_loaded_pe(
20 | const std::vector< bit7z::byte_t >& file_buffer,
21 | const std::string& file_name_s,
22 | bool& set_arc
23 | );
24 |
25 | ///
26 | /// Check if the ELF architecture matches the IDA architecture.
27 | ///
28 | /// file buffer as byte array
29 | /// boolean parameter to represent if architecture was set
30 | CLASS_DECLSPEC
31 | void handle_loaded_elf(
32 | const std::vector< bit7z::byte_t >& file_buffer,
33 | bool& set_arc
34 | );
35 |
36 |
37 | ///
38 | /// Handles loading a file from a buffer, doing a best effort.
39 | /// *. Try to match with the best loader IDA has to offer.
40 | /// *. If no loader is found load the file as binary (user is asked).
41 | /// *. If a proper loader was found load the file with it into the db. Of course without creating an actual file.
42 | /// *. Fix compiler, id the compiler is not set to try to guess it.
43 | /// *. Extra logic for PE, and ELF.
44 | ///
45 | /// IDA loader information
46 | /// linput of IDA
47 | /// file buffer as byte array
48 | /// a string representation of the architecture
49 | /// file name as string
50 | /// boolean parameter to represent if architecture was set
51 | CLASS_DECLSPEC
52 | void handle_file_loading(
53 | load_info_t* linfos,
54 | linput_t* li2,
55 | const std::vector< bit7z::byte_t >& file_buffer,
56 | const std::string& desired_arc_str,
57 | const std::string& file_name_s,
58 | bool& set_arc
59 | );
60 |
61 | ///
62 | /// Check if the buffer is a shellcode and handle if it is. We thought
63 | /// that many times a researcher would need such functionality.
64 | /// for shellcode reversing.
65 | ///
66 | /// file buffer as byte array
67 | CLASS_DECLSPEC
68 | void parse_as_shellcode(const std::vector< bit7z::byte_t >& file_buffer);
69 |
70 | ///
71 | /// Tells if IDA architecture was set already, if its not set it.
72 | ///
73 | /// boolean parameter to represent if architecture was set
74 | /// a string representation of the architecture
75 | CLASS_DECLSPEC
76 | void validate_architecture_set(bool& set_arc, std::string& desired_arc_str);
77 |
78 | ///
79 | /// Sets IDA to 64 or 32 bit address space
80 | ///
81 | /// string representation of the architecture
82 | CLASS_DECLSPEC
83 | void retrieve_target_architecture(std::string& desired_arc_str);
84 |
85 | ///
86 | /// Check in the directory we started the IDA process if a db filename with the same name as the we extracted
87 | /// already exists. If it does, ask we should override it.
88 | ///
89 | /// wide string representation of the IDB path
90 | /// path to the new IDB path as qstring
91 | /// file name as string
92 | /// should override db flag
93 | CLASS_DECLSPEC
94 | void check_override_db_file(
95 | std::wstring& new_idb_path_w,
96 | qstring& new_idb_path,
97 | std::string& file_name_s,
98 | int& override_db);
99 |
100 | ///
101 | /// Handle all the changes to the IDA environment. This produces: IDB files and temporary files with
102 | /// corresponding names to the file you are reversing. Try to mimic the same behavior.
103 | ///
104 | /// file name as string
105 | /// string representation of the architecture
106 | /// New path for the file
107 | /// New IDB path of the reversed file
108 | /// wide string representation of the path of the file
109 | CLASS_DECLSPEC
110 | void fix_naming_and_env(std::string& file_name_s,
111 | std::string& desired_arc_str,
112 | qstring& new_path,
113 | qstring& new_idb_path,
114 | std::wstring& new_path_idb_w);
115 |
116 | ///
117 | /// Extracts file from Zip into a buffer. Will display a drop-box with files in zips.
118 | ///
119 | /// file name as string
120 | /// file buffer to fill
121 | CLASS_DECLSPEC
122 | void extract_zipped_file_to_buffer(std::string& file_name_s,
123 | std::vector< bit7z::byte_t >& file_buffer);
124 |
125 | ///
126 | /// Using unique pointers syntax in order to make sure we free the resource used in allocating
127 | /// input object for IDA db and its possible loaders list.
128 | /// https://en.cppreference.com/w/cpp/memory/unique_ptr
129 | ///
130 | template
131 | using deleter_from_fn = std::integral_constant;
132 | template
133 | using unique_ptr_s1 = std::unique_ptr>;
134 |
135 | ///
136 | /// Wrapper for freeing li memory.
137 | ///
138 | /// loader input source
139 | CLASS_DECLSPEC
140 | void destroy_linput(linput_t* li);
141 |
142 | ///
143 | /// Wrapper for creating a linput object that represents loader input source.
144 | ///
145 | /// vector of bytes
146 | /// loader input source pointer
147 | CLASS_DECLSPEC
148 | linput_t* create_linput(std::vector< bit7z::byte_t >& file_buffer);
149 |
150 | ///
151 | /// Free the list of loaders.
152 | ///
153 | ///
154 | CLASS_DECLSPEC
155 | void destroy_linfos(load_info_t* linfos);
156 |
157 | ///
158 | /// Generate a list a list of loaders for loader input source.
159 | ///
160 | /// loader input source pointer
161 | /// List of loaders
162 | CLASS_DECLSPEC
163 | load_info_t* create_linfos(linput_t* li);
164 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/MemoryLoader.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Header Files
20 |
21 |
22 | Header Files
23 |
24 |
25 | Header Files
26 |
27 |
28 | Header Files
29 |
30 |
31 |
32 |
33 | Source Files
34 |
35 |
36 | Source Files
37 |
38 |
39 | Source Files
40 |
41 |
42 | Source Files
43 |
44 |
45 |
46 |
47 |
48 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/Misc.cpp:
--------------------------------------------------------------------------------
1 | #include "pch.h"
2 | #include "Misc.h"
3 |
4 | // IDA bitness detection.
5 | const WORD MAGIC_PE_32 = 0x10b;
6 | const WORD MAGIC_PE_64 = 0x20b;
7 | const BYTE MAGIC_ELF_32 = 0x1;
8 | const BYTE MAGIC_ELF_64 = 0x2;
9 | const char x32bit[] = "32";
10 | const char x64bit[] = "64";
11 |
12 |
13 | const char LoaderFail[] = "Loader failure";
14 | const std::vector < std::string> SigList32 = { "vc32mfc", "vc32mfce", "vc32rtf", "vc32ucrt", "vc32_14" };
15 | const std::vector < std::string> SigList64 = { "vc64atl", "vc64extra", "vc64mfc", "vc64rtf", "vc64seh",
16 | "vc64ucrt", "vc64_14" };
17 |
18 | // Loader helpers
19 | const char ShouldLoadAsBin[] = "Could not tell the type of file going to load it as binary. OK ?";
20 | const char DefaultProcessor[] = "MetaPc";
21 | const char CPPCompDefaultName[] = "generic abi";
22 |
23 | // Forms
24 | const char ChooseFileFromZip[] = " Chose file from the zip.\n\
25 | \n\n\n";
26 |
27 | // Msg strings
28 | const char LoadedToAddress[] = "Finished loading into memory the file %s from zip.\n";
29 | const char FailedToOpenZipFile[] = "Could not open %s as a zip file.\n";
30 | const char ZipFilesNumber[] = "File %s doesn't contain any files.\n";
31 | const char NoImageBase[] = "Could not find the file's image base address for %s file.\n";
32 | const char YesImageBase[] = "Successfully fixed the image base address for %s file to %p.\n";
33 | const char NoLoadersFound[] = "No loaders were found for %s file.";
34 | const char BadDatabaseLocation[] = "Could not save the database to location %s, please consider changing the database location. (File->Save as...)";
35 |
36 | // Questions strings
37 | const char NoBitsLoader[] = "The loader could not tell if the PE is either 32 or 64. Please choose.";
38 | const char bit64[] = "64bit";
39 | const char bit32[] = "32bit";
40 | const char Cancel[] = "Cancel";
41 |
42 | // Zip strings
43 | const char EnterZipPass[] = "Please enter zip password:";
44 | const char ZipDefaultPass[] = "infected";
45 | const WCHAR ZipDllName[] = L"7z.dll";
46 |
47 | // Exceptions strings
48 | const char ReloadIDADirect[] = "Please reload by selecting the IDB file ";
49 | const char UserCanceled[] = "User canceled.";
50 | const char LoaderFailedBadFileBuffer[] = "IDA could not create a non-binary file from memory.";
51 | const char NoNestedZipping[] = "Nested zipping not supported at this time!";
52 | const char NotSupportedFileFormat[] = "Unrecognized file format.";
53 | const char BadBits[] = "File is not in the right bitness. Please use IDA ";
54 | const char DidNotChooseFile[] = "User did not choose file.";
55 | const char CouldNotTellArch[] = "Could not tell if the file is 64 / 32 bit, but going to load anyway.";
56 | const char NoEmptyUrl[] = "The URL can't be empty.";
57 | const char FileSizeWarning[] = "The file you are downloading is larger than 50 MB. Continue ?";
58 | const char CouldNotTellIfIDA64[] = "Could not tell if IDA process's bitness is 64 or 32 bit.";
59 | const char Unicode2asciiFailed[] = "Converting unicode string to ASCII string has failed.";
60 | const char Ascii2unicodeFailed[] = "Converting ASCII string to unicode string has failed.";
61 |
62 | // shell codes segments help
63 | const char SentiSeg[] = "SentiSeg000";
64 | const char CODE_SEG_STR[] = "CODE";
65 |
66 |
67 | qstring path_append(const qstring& p1, const qstring& p2) {
68 |
69 | char sep = '/';
70 | qstring tmp = p1;
71 |
72 | #ifdef _WIN32
73 | sep = '\\';
74 | #endif
75 |
76 | if (p1[p1.length()] != sep) { // Need to add a
77 | tmp += sep; // path separator
78 | return(tmp + p2);
79 | }
80 | else
81 | return(p1 + p2);
82 | }
83 |
84 | bool check_pe_architecture(const bit7z::byte_t* file_data, const WORD magic, bool& set_arc)
85 | {
86 | __try
87 | {
88 | const PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)file_data;
89 | const PIMAGE_NT_HEADERS image_nt_headers = (PIMAGE_NT_HEADERS)(file_data + dos_header->e_lfanew);
90 | set_arc = true;
91 | return image_nt_headers->OptionalHeader.Magic == magic;
92 | }
93 | __except (EXCEPTION_EXECUTE_HANDLER) {
94 | warning(CouldNotTellArch);
95 | set_arc = false;
96 | return true;
97 | }
98 | }
99 |
100 | bool check_elf_architecture(const bit7z::byte_t* file_data, const BYTE magic, bool & set_arc)
101 | {
102 | __try {
103 | const size_t elf_bits_offset = 0x04;
104 | unsigned char* where_to_read = (unsigned char*)file_data + elf_bits_offset;
105 | // according to elf format: 2 - 64 bit, 1 - 32 bit
106 | const int elf_bitness = *where_to_read;
107 | set_arc = true;
108 | return elf_bitness == magic;
109 | }
110 | __except (EXCEPTION_EXECUTE_HANDLER) {
111 | warning(CouldNotTellArch);
112 | set_arc = false;
113 | return true;
114 | }
115 | }
116 |
117 | bool is_dll(const bit7z::byte_t* file_data)
118 | {
119 | __try {
120 | const PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)file_data;
121 | const PIMAGE_NT_HEADERS image_nt_headers = (PIMAGE_NT_HEADERS)(file_data + dos_header->e_lfanew);
122 | if ((image_nt_headers->FileHeader.Characteristics & IMAGE_FILE_DLL))
123 | return true;
124 | return false;
125 | }
126 | __except (EXCEPTION_EXECUTE_HANDLER) {
127 | msg("Could not tell if the file is DLL or not (an exception was thrown while parsing PE). Setting IsDll to False by default.\n");
128 | return false;
129 | }
130 |
131 | }
132 |
133 | ULONGLONG get_baseaddress_pe(const bit7z::byte_t* file_data)
134 | {
135 | __try {
136 | const PIMAGE_DOS_HEADER dos_header = (PIMAGE_DOS_HEADER)file_data;
137 | const PIMAGE_NT_HEADERS image_nt_headers = (PIMAGE_NT_HEADERS)(file_data + dos_header->e_lfanew);
138 | return image_nt_headers->OptionalHeader.ImageBase;
139 | }
140 | __except (EXCEPTION_EXECUTE_HANDLER) {
141 | msg("Could not calculate base address for PE.\n");
142 | return 0;
143 | }
144 | }
145 |
146 | bool is_ida_64() {
147 | char ida_name[MAX_PATH]{};
148 | if (GetModuleBaseNameA(GetCurrentProcess(), NULL, ida_name, MAX_PATH) == 0) {
149 | throw std::exception(CouldNotTellIfIDA64);
150 | }
151 | const std::string ida_name_str = { ida_name };
152 | if (ida_name_str.find("ida64.exe") != std::string::npos) {
153 | return true;
154 | }
155 | return false;
156 | }
157 |
158 | char* unicode2ascii(const wchar_t* wsz_string)
159 | {
160 | const int outlen = ::WideCharToMultiByte(CP_UTF8, NULL, wsz_string, (int)wcslen(wsz_string), NULL, 0, NULL, NULL);
161 | char* utf8 = new char[(size_t)outlen + 1];
162 | ::WideCharToMultiByte(CP_UTF8, NULL, wsz_string, (int)wcslen(wsz_string), utf8, outlen, NULL, NULL);
163 | utf8[outlen] = '\0';
164 | return utf8;
165 | }
166 |
167 | wchar_t* ascii2unicode(const char* ansi)
168 | {
169 | const int inlen = ::MultiByteToWideChar(CP_ACP, NULL, ansi, (int)strlen(ansi), NULL, 0);
170 | wchar_t* wsz_string = new wchar_t[(size_t)inlen + 1];
171 | ::MultiByteToWideChar(CP_ACP, NULL, ansi, (int)strlen(ansi), wsz_string, inlen);
172 | wsz_string[inlen] = '\0';
173 | return wsz_string;
174 | }
175 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/Misc.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "pch.h"
3 |
4 | #include
5 |
6 | #ifdef _EXPORTING
7 | #define CLASS_DECLSPEC __declspec(dllexport)
8 | #else
9 | #define CLASS_DECLSPEC __declspec(dllimport)
10 | #endif
11 |
12 | ///
13 | /// Join paths.
14 | ///
15 | /// first path
16 | /// second path
17 | /// New joined path
18 | CLASS_DECLSPEC
19 | qstring path_append(const qstring& p1,
20 | const qstring& p2);
21 |
22 | ///
23 | /// Check if PE in the right architecture for IDA.
24 | ///
25 | /// pointer to file data
26 | /// PE magic to look for
27 | /// If the function could tell the architecture of the PE
28 | /// If the PE has the right magic.
29 | CLASS_DECLSPEC
30 | bool check_pe_architecture(const bit7z::byte_t* file_data,
31 | const WORD magic,
32 | bool& set_arc);
33 |
34 | ///
35 | /// Check if ELF in the right architecture for IDA.
36 | ///
37 | /// pointer to file data
38 | /// ELF magic to look for
39 | /// If the function could tell the architecture of the elf
40 | /// If the ELF has the right magic.
41 | CLASS_DECLSPEC
42 | bool check_elf_architecture(const bit7z::byte_t* file_data,
43 | const BYTE magic,
44 | bool & set_arc);
45 |
46 | ///
47 | /// Used to check IDAs bitness.
48 | ///
49 | /// If ida64.exe or ida.exe is running.
50 | CLASS_DECLSPEC
51 | bool is_ida_64();
52 |
53 | ///
54 | /// Check if PE is DLL, used by loader to set IS_DLL property.
55 | ///
56 | /// pointer to file data
57 | ///
58 | CLASS_DECLSPEC
59 | bool is_dll(const bit7z::byte_t* file_data);
60 |
61 | ///
62 | /// Tries to calculate PEs base address.
63 | ///
64 | /// pointer to file data
65 | /// Base Address of PE. Or null if there was an exception.
66 | CLASS_DECLSPEC
67 | ULONGLONG get_baseaddress_pe(const bit7z::byte_t* file_data);
68 |
69 | ///
70 | /// Credit, https://gist.github.com/tfzxyinhao/2818b31a7ce94154a133#file-charsetconvert
71 | ///
72 | /// wide char pointer to string
73 | ///
74 | CLASS_DECLSPEC
75 | char* unicode2ascii(const wchar_t* wsz_string);
76 |
77 | ///
78 | /// Credit, https://gist.github.com/tfzxyinhao/2818b31a7ce94154a133#file-charsetconvert
79 | ///
80 | /// char pointer to string
81 | ///
82 | CLASS_DECLSPEC
83 | wchar_t* ascii2unicode(const char* ansi);
84 |
85 | #define MEMORY_LOADER_FORMAT "MemZipLoader"
86 | #define LOAD_FILE 1
87 | #define SKIP_NOT_RELEVANT 0
88 |
89 | // IDA bitness detection.
90 | CLASS_DECLSPEC extern const WORD MAGIC_PE_32;
91 | CLASS_DECLSPEC extern const WORD MAGIC_PE_64;
92 | CLASS_DECLSPEC extern const BYTE MAGIC_ELF_32;
93 | CLASS_DECLSPEC extern const BYTE MAGIC_ELF_64;
94 | CLASS_DECLSPEC extern const char x32bit[];
95 | CLASS_DECLSPEC extern const char x64bit[];
96 |
97 | CLASS_DECLSPEC extern const char LoaderFail[];
98 | CLASS_DECLSPEC extern const std::vector < std::string> SigList32;
99 | CLASS_DECLSPEC extern const std::vector < std::string> SigList64;
100 |
101 | // Loader helpers
102 | CLASS_DECLSPEC extern const char ShouldLoadAsBin[];
103 | CLASS_DECLSPEC extern const char DefaultProcessor[];
104 | CLASS_DECLSPEC extern const char CPPCompDefaultName[];
105 |
106 | // Forms
107 | CLASS_DECLSPEC extern const char ChooseFileFromZip[];
108 |
109 | // Msg strings
110 | CLASS_DECLSPEC extern const char LoadedToAddress[];
111 | CLASS_DECLSPEC extern const char FailedToOpenZipFile[];
112 | CLASS_DECLSPEC extern const char ZipFilesNumber[];
113 | CLASS_DECLSPEC extern const char NoImageBase[];
114 | CLASS_DECLSPEC extern const char YesImageBase[];
115 | CLASS_DECLSPEC extern const char NoLoadersFound[];
116 | CLASS_DECLSPEC extern const char BadDatabaseLocation[];
117 |
118 | // Questions strings
119 | CLASS_DECLSPEC extern const char NoBitsLoader[];
120 | CLASS_DECLSPEC extern const char bit64[];
121 | CLASS_DECLSPEC extern const char bit32[];
122 | CLASS_DECLSPEC extern const char Cancel[];
123 |
124 | // Zip strings
125 | CLASS_DECLSPEC extern const char EnterZipPass[];
126 | CLASS_DECLSPEC extern const char ZipDefaultPass[];
127 | CLASS_DECLSPEC extern const WCHAR ZipDllName[];
128 |
129 | // Exceptions strings
130 | CLASS_DECLSPEC extern const char ReloadIDADirect[];
131 | CLASS_DECLSPEC extern const char UserCanceled[];
132 | CLASS_DECLSPEC extern const char LoaderFailedBadFileBuffer[];
133 | CLASS_DECLSPEC extern const char NoNestedZipping[];
134 | CLASS_DECLSPEC extern const char NotSupportedFileFormat[];
135 | CLASS_DECLSPEC extern const char BadBits[];
136 | CLASS_DECLSPEC extern const char DidNotChooseFile[];
137 | CLASS_DECLSPEC extern const char CouldNotTellArch[];
138 | CLASS_DECLSPEC extern const char NoEmptyUrl[];
139 | CLASS_DECLSPEC extern const char FileSizeWarning[];
140 | CLASS_DECLSPEC extern const char CouldNotTellIfIDA64[];
141 | CLASS_DECLSPEC extern const char Unicode2asciiFailed[];
142 | CLASS_DECLSPEC extern const char Ascii2unicodeFailed[];
143 |
144 | // shell codes segments help
145 | CLASS_DECLSPEC extern const char SentiSeg[];
146 | CLASS_DECLSPEC extern const char CODE_SEG_STR[];
147 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/dllmain.cpp:
--------------------------------------------------------------------------------
1 | #include "pch.h"
2 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/framework.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 |
3 | #define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
4 | // Windows Header Files
5 | #include
6 | #include
7 | #include
8 | #include
9 |
10 | // c++ imports
11 | #include
12 | #include
13 | #include
14 | #include
15 | #include
16 |
17 | // IDA imports
18 | // 4267, 4244 and 4201 are convection related warning produced in IDA SDK
19 | // we assume its OK, so we suppress them to get a clean compilation.
20 | #pragma warning(push)
21 | #pragma warning (disable: 4267)
22 | #pragma warning (disable: 4244)
23 | #pragma warning (disable: 4201)
24 | #include "pro.h"
25 | #include "kernwin.hpp"
26 | #include "loader.hpp"
27 | #include "nalt.hpp"
28 | #include "typeinf.hpp"
29 | #include "auto.hpp"
30 | #include "funcs.hpp"
31 | #include "ua.hpp"
32 | #include "idaldr.h"
33 | #pragma warning (pop)
34 |
35 | // own includes
36 | #include "Misc.h"
37 |
38 | // 7zip lib imports
39 | #include
40 | #include
41 | #include
42 | #include
43 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/pch.cpp:
--------------------------------------------------------------------------------
1 | // pch.cpp: source file corresponding to the pre-compiled header
2 |
3 | #include "pch.h"
4 |
5 | // When you are using pre-compiled headers, this source file is necessary for compilation to succeed.
6 |
--------------------------------------------------------------------------------
/MemoryLoader/MemoryLoader/pch.h:
--------------------------------------------------------------------------------
1 | // pch.h: This is a precompiled header file.
2 | // Files listed below are compiled only once, improving build performance for future builds.
3 | // This also affects IntelliSense performance, including code completion and many code browsing features.
4 | // However, files listed here are ALL re-compiled if any one of them is updated between builds.
5 | // Do not add files here that you will be updating frequently as this negates the performance advantage.
6 |
7 | #ifndef PCH_H
8 | #define PCH_H
9 |
10 | // add headers that you want to pre-compile here
11 | #include "framework.h"
12 |
13 | #endif //PCH_H
14 |
--------------------------------------------------------------------------------
/MemoryLoader/UrlLoader/UrlLoader.cpp:
--------------------------------------------------------------------------------
1 | #include "pch.h"
2 | #include "UrlLoader.h"
3 |
4 | const char EnterUrl[] = "Enter URL: ";
5 | const char CouldNotCalcHash[] = "Could not calculate sha1 for file downloaded.";
6 | const char CouldNotOpenUrl[] = "Could not open URL ";
7 | const char MemAllocationForUrl[] = "Could not allocate memory for file to be downloaded to.";
8 | // Latest Chrome on Windows User Agent, for 8.3.2021
9 | const WCHAR UserAgent[] = L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36";
10 | const int WARNING_FILE_SIZE = 50 * 1000000;
11 |
12 | void calc_sha1_for_buffer(std::vector< bit7z::byte_t > file_buffer, std::string& file_sha1)
13 | {
14 | HCRYPTPROV h_prov = 0;
15 | HCRYPTHASH h_hash = 0;
16 | BYTE rgb_hash[SHA1LEN];
17 | DWORD cb_hash = SHA1LEN;
18 | CHAR rgb_digits[] = "0123456789abcdef";
19 |
20 | // Get handle to the crypt provider
21 | if (!CryptAcquireContext(&h_prov,
22 | NULL,
23 | NULL,
24 | PROV_RSA_FULL,
25 | CRYPT_VERIFYCONTEXT))
26 | {
27 | throw std::exception("CryptAcquireContext failed: %d\n", GetLastError());
28 | }
29 |
30 | if (!CryptCreateHash(h_prov, CALG_SHA1, 0, 0, &h_hash))
31 | {
32 | CryptReleaseContext(h_prov, 0);
33 | throw std::exception("CryptAcquireContext failed: %d\n", GetLastError());
34 | }
35 |
36 | if (!CryptHashData(h_hash, file_buffer.data(), (DWORD)file_buffer.size(), 0))
37 | {
38 | CryptReleaseContext(h_prov, 0);
39 | CryptDestroyHash(h_hash);
40 | throw std::exception("CryptHashData failed: %d\n", GetLastError());
41 | }
42 |
43 | if (CryptGetHashParam(h_hash, HP_HASHVAL, rgb_hash, &cb_hash, 0))
44 | {
45 | // https://www.vbforums.com/showthread.php?371715-Need-Help-Getting-SHA1-value-of-File
46 | for (DWORD i = 0; i < cb_hash; i++)
47 | {
48 | file_sha1 += rgb_digits[rgb_hash[i] >> 4];
49 | file_sha1 += rgb_digits[rgb_hash[i] & 0xf];
50 | }
51 | }
52 |
53 | CryptDestroyHash(h_hash);
54 | CryptReleaseContext(h_prov, 0);
55 | msg("SHA1 for file downloaded: %s", file_sha1.c_str());
56 | }
57 |
58 | std::vector< bit7z::byte_t > load_file_from_url(const std::wstring & dest_url_w)
59 | {
60 | unsigned char* file_contents_from_url = nullptr;
61 | const size_t buf_size = 1024;
62 | unsigned char tmp_buf[buf_size]{};
63 | try
64 | {
65 | const HINTERNET h_internet_session = InternetOpen(
66 | UserAgent, // agent
67 | INTERNET_OPEN_TYPE_PRECONFIG, // access
68 | NULL, NULL, 0); // defaults
69 |
70 | // Make connection to desired page.
71 | HINTERNET h_url = InternetOpenUrl(
72 | h_internet_session, // session handle
73 | (LPWSTR)dest_url_w.c_str(), // URL to access
74 | NULL, 0, 0, 0); // defaults
75 | if (!h_url) {
76 | const std::string dest_url_s = unicode2ascii(dest_url_w.c_str());
77 | throw std::exception((CouldNotOpenUrl + dest_url_s).c_str());
78 | }
79 |
80 | // First calculate how much to read.
81 | DWORD total_read = 0;
82 | DWORD total_bytes_read = 0;
83 | bool asked = false;
84 | while (
85 | (InternetReadFile(
86 | h_url, // handle to URL
87 | tmp_buf, // pointer to buffer
88 | buf_size, // size of buffer
89 | &total_bytes_read )
90 | ) && (total_bytes_read != 0))
91 | {
92 | if ((total_read >= WARNING_FILE_SIZE) && !asked) {
93 | const int should_continue = ask_yn(ASKBTN_NO, FileSizeWarning);
94 | if ((should_continue == ASKBTN_NO) || (should_continue == ASKBTN_CANCEL)) {
95 | throw std::exception(UserCanceled);
96 | }
97 | asked = true;
98 | }
99 | total_read += total_bytes_read ;
100 | }
101 |
102 | msg("Download complete from URL - file size read %d.\n", total_read);
103 |
104 | file_contents_from_url = (unsigned char*)malloc(sizeof(unsigned char) * total_read);
105 | if (file_contents_from_url == NULL) {
106 | throw std::exception(MemAllocationForUrl);
107 | }
108 |
109 | // Make connection to desired page.
110 | h_url = InternetOpenUrl(
111 | h_internet_session, // session handle
112 | (LPWSTR)dest_url_w.c_str(), // URL to access
113 | NULL, 0, 0, 0); // defaults
114 | if (!h_url) {
115 | const std::string dest_url_s = unicode2ascii(dest_url_w.c_str());
116 | throw std::exception((CouldNotOpenUrl + dest_url_s).c_str());
117 | }
118 |
119 | total_bytes_read = 0;
120 | while (
121 | (InternetReadFile(
122 | h_url, // handle to URL
123 | file_contents_from_url, // pointer to buffer
124 | total_read, // size of buffer
125 | &total_bytes_read )
126 | ) && (total_bytes_read != 0))
127 | {
128 | if (total_read == total_bytes_read ) {
129 | break;
130 | }
131 | }
132 |
133 | InternetCloseHandle(h_internet_session);
134 |
135 | std::vector< bit7z::byte_t > file_buffer(file_contents_from_url, file_contents_from_url + total_read);
136 |
137 | msg("Actual size read %d.\n", file_buffer.size());
138 |
139 | free(file_contents_from_url);
140 | return file_buffer;
141 | }
142 | catch (const std::exception&)
143 | {
144 | if (file_contents_from_url) {
145 | free(file_contents_from_url);
146 | }
147 | throw;
148 | }
149 |
150 | }
151 |
--------------------------------------------------------------------------------
/MemoryLoader/UrlLoader/UrlLoader.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "pch.h"
3 |
4 | ///
5 | /// Download file from url.
6 | ///
7 | /// destination url
8 | ///
9 | /// We actually download the file twice, I have seen code for downloading files that heavily rely on Content-Length
10 | /// filed in the HTTP headers we decided ageist it, we just download the file twice anyway we think that people reverse small files.
11 | ///
12 | /// A vector with file download as byte array
13 | std::vector< bit7z::byte_t > load_file_from_url(const std::wstring & dest_url_w);
14 |
15 | ///
16 | /// Generates sha1 for the file downloaded
17 | ///
18 | /// vector of bytes representing the file
19 | /// out parameter for file sha1
20 | void calc_sha1_for_buffer(std::vector< bit7z::byte_t > file_buffer, std::string& file_sha1);
21 |
22 | #define URL_LOADER "UrlLoader"
23 | #define SHA1LEN 20
24 | extern const int WARNING_FILE_SIZE; // 50 MB
25 | extern const char EnterUrl[];
26 | extern const char CouldNotCalcHash[];
27 | extern const char CouldNotOpenUrl[];
28 | extern const char MemAllocationForUrl[];
29 | extern const WCHAR UserAgent[];
30 |
--------------------------------------------------------------------------------
/MemoryLoader/UrlLoader/UrlLoader.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Header Files
20 |
21 |
22 | Header Files
23 |
24 |
25 |
26 |
27 | Source Files
28 |
29 |
30 | Source Files
31 |
32 |
33 | Source Files
34 |
35 |
36 |
--------------------------------------------------------------------------------
/MemoryLoader/UrlLoader/dllmain.cpp:
--------------------------------------------------------------------------------
1 | #include "pch.h"
2 | #include "MemoryLoader.h"
3 | #include "UrlLoader.h"
4 |
5 | ///
6 | /// accept_file* function in called by IDA API each time build_loaders_list is called,
7 | /// if the function return a 1 (LOAD_FILE/TRUE) the loader will be suggested as
8 | /// a loader option for this buffer.
9 | ///
10 | /// Boolean value if the loader is relevant
11 | int idaapi accept_file_url(
12 | qstring* fileformatname,
13 | qstring*,
14 | linput_t*,
15 | const char* filename)
16 | {
17 | // If the load_loaders_list is called with no filename (pragmatically) we don't suggest this loader,
18 | // if the load_loaders_list called with a filename (by loading a file from disk).
19 | if (strlen(filename) == 0) {
20 | return SKIP_NOT_RELEVANT;
21 | }
22 |
23 | *fileformatname = URL_LOADER;
24 | return LOAD_FILE;
25 |
26 | }
27 |
28 | //-----------------------------------------------------------------------------
29 | // load a file from a specified URL into IDA.
30 | void idaapi load_from_url(linput_t* li, ushort /*neflag*/, const char* /*fileformatname*/)
31 | {
32 | UNREFERENCED_PARAMETER(li);
33 | try
34 | {
35 | // file sha1
36 | std::string file_sha1{};
37 |
38 | // future file name, we will be filled after the file is downloaded and the sha1,
39 | // of the downloaded file calculated
40 | std::string file_name_s{};
41 |
42 | // represents the file name that will be displayed in IDA windows, at the top right corner
43 | qstring new_path{};
44 | // full path of IDB file
45 | qstring new_idb_path{};
46 | // full path of IDB file as wide string
47 | std::wstring new_path_idb_w{};
48 | // should override db flag, used to tell if db should be overrider and if the db should be saved immediately to new_idb_path
49 | int override_db = TRUE;
50 |
51 | // string representation for IDB file name (the architecture part).
52 | std::string desired_arc_str{};
53 | // tells if the architecture was already set
54 | bool set_arc = false;
55 |
56 | qstring url = {};
57 | const int entered_url = ask_str(&url, 1, EnterUrl);
58 |
59 | if (url.empty()) {
60 | throw std::exception(NoEmptyUrl);
61 | }
62 |
63 | if (entered_url == ASKBTN_CANCEL) {
64 | throw std::exception(UserCanceled);
65 | }
66 |
67 | const std::wstring url_w = ascii2unicode(url.c_str());
68 |
69 | // file buffer
70 | std::vector file_buffer = load_file_from_url(url_w);
71 |
72 | calc_sha1_for_buffer(file_buffer, file_sha1);
73 | retrieve_target_architecture(desired_arc_str);
74 | fix_naming_and_env(file_sha1, desired_arc_str, new_path, new_idb_path, new_path_idb_w);
75 | check_override_db_file(new_path_idb_w, new_idb_path, file_name_s, override_db);
76 |
77 | const unique_ptr_s1 li2{ create_linput(file_buffer) };
78 | const unique_ptr_s1 linfos{ create_linfos(li2.get()) };
79 |
80 | handle_file_loading(linfos.get(), li2.get(), file_buffer, desired_arc_str, file_name_s, set_arc);
81 | validate_architecture_set(set_arc, desired_arc_str);
82 |
83 | // If the build_loaders_list could no find any suitable loader from IDA loaders list,
84 | // ask the user if the input should be as a binary (shellcode) buffer.
85 | if (linfos.get() == nullptr) {
86 | parse_as_shellcode(file_buffer);
87 | }
88 |
89 | /*
90 | Auto-analysis with
91 | apply type information
92 | apply signature to address
93 | load signature file (file name is kept separately)
94 | find functions chunks
95 | reanalyze
96 | */
97 | set_auto_state(AU_USED | AU_TYPE | AU_LIBF | AU_CHLB | AU_FCHUNK);
98 | auto_wait();
99 |
100 | // only save the db if we need to, if its new or if the user knows he is going to override it
101 | if (override_db == ASKBTN_YES) {
102 | const int success = save_database(new_idb_path.c_str(), 0);
103 | if (!success) {
104 | warning(BadDatabaseLocation, new_idb_path.c_str());
105 | }
106 | }
107 |
108 | msg(LoadedToAddress, file_name_s.c_str());
109 | }
110 | catch (const std::exception& ex)
111 | {
112 | loader_failure("Loader failure. Error: %s", ex.what());
113 | }
114 | }
115 |
116 | //-----------------------------------------------------------------------------
117 | // Loader description block
118 | loader_t LDSC =
119 | {
120 | IDP_INTERFACE_VERSION,
121 | 0,
122 | accept_file_url,
123 | load_from_url,
124 | NULL,
125 | NULL,
126 | };
127 |
128 |
--------------------------------------------------------------------------------
/MemoryLoader/UrlLoader/pch.cpp:
--------------------------------------------------------------------------------
1 | // pch.cpp: source file corresponding to the pre-compiled header
2 |
3 | #include "pch.h"
4 |
5 | // When you are using pre-compiled headers, this source file is necessary for compilation to succeed.
6 |
--------------------------------------------------------------------------------
/MemoryLoader/UrlLoader/pch.h:
--------------------------------------------------------------------------------
1 | // pch.h: This is a precompiled header file.
2 | // Files listed below are compiled only once, improving build performance for future builds.
3 | // This also affects IntelliSense performance, including code completion and many code browsing features.
4 | // However, files listed here are ALL re-compiled if any one of them is updated between builds.
5 | // Do not add files here that you will be updating frequently as this negates the performance advantage.
6 |
7 | #ifndef PCH_H
8 | #define PCH_H
9 |
10 | // add headers that you want to pre-compile here
11 | #include "framework.h"
12 |
13 | #endif //PCH_H
14 |
--------------------------------------------------------------------------------
/MemoryLoader/include/x32_bit7z/bit7z/BUILD.txt:
--------------------------------------------------------------------------------
1 | 3.1.2 msvc2019_mt_x86
2 |
--------------------------------------------------------------------------------
/MemoryLoader/include/x32_bit7z/bit7z/include/bit7z.hpp:
--------------------------------------------------------------------------------
1 | /*
2 | * bit7z - A C++ static library to interface with the 7-zip DLLs.
3 | * Copyright (c) 2014-2019 Riccardo Ostani - All Rights Reserved.
4 | *
5 | * This program is free software; you can redistribute it and/or
6 | * modify it under the terms of the GNU General Public License
7 | * as published by the Free Software Foundation; either version 2
8 | * of the License, or (at your option) any later version.
9 | *
10 | * Bit7z is distributed in the hope that it will be useful,
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 | * GNU General Public License for more details.
14 | *
15 | * You should have received a copy of the GNU General Public License
16 | * along with bit7z; if not, see https://www.gnu.org/licenses/.
17 | */
18 |
19 | #ifndef BIT7Z_HPP
20 | #define BIT7Z_HPP
21 |
22 | #include "bitarchiveinfo.hpp"
23 | #include "bitcompressor.hpp"
24 | #include "bitmemcompressor.hpp"
25 | #include "bitstreamcompressor.hpp"
26 | #include "bitextractor.hpp"
27 | #include "bitmemextractor.hpp"
28 | #include "bitstreamextractor.hpp"
29 | #include "bitexception.hpp"
30 |
31 | #endif // BIT7Z_HPP
32 |
33 |
--------------------------------------------------------------------------------
/MemoryLoader/include/x32_bit7z/bit7z/include/bit7zlibrary.hpp:
--------------------------------------------------------------------------------
1 | /*
2 | * bit7z - A C++ static library to interface with the 7-zip DLLs.
3 | * Copyright (c) 2014-2019 Riccardo Ostani - All Rights Reserved.
4 | *
5 | * This program is free software; you can redistribute it and/or
6 | * modify it under the terms of the GNU General Public License
7 | * as published by the Free Software Foundation; either version 2
8 | * of the License, or (at your option) any later version.
9 | *
10 | * Bit7z is distributed in the hope that it will be useful,
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 | * GNU General Public License for more details.
14 | *
15 | * You should have received a copy of the GNU General Public License
16 | * along with bit7z; if not, see https://www.gnu.org/licenses/.
17 | */
18 |
19 | #ifndef BIT7ZLIBRARY_HPP
20 | #define BIT7ZLIBRARY_HPP
21 |
22 | #include
23 |
24 | #include
25 |
26 | #define DEFAULT_DLL L"7z.dll"
27 |
28 | struct IInArchive;
29 | struct IOutArchive;
30 |
31 | //! \cond IGNORE_BLOCK_IN_DOXYGEN
32 | template< typename T >
33 | class CMyComPtr;
34 | //! \endcond
35 |
36 | namespace bit7z {
37 | /**
38 | * @brief The Bit7zLibrary class allows the access to the basic functionalities provided by the 7z DLLs.
39 | */
40 | class Bit7zLibrary {
41 | public:
42 | /**
43 | * @brief Constructs a Bit7zLibrary object using the path of the wanted 7zip DLL.
44 | *
45 | * By default, it searches a 7z.dll in the same path of the application.
46 | *
47 | * @param dll_path the path to the dll wanted
48 | */
49 | explicit Bit7zLibrary( const std::wstring& dll_path = DEFAULT_DLL );
50 |
51 | /**
52 | * @brief Destructs the Bit7zLibrary object, freeing the loaded dynamic-link library (DLL) module.
53 | */
54 | virtual ~Bit7zLibrary();
55 |
56 | /**
57 | * @brief Initiates the object needed to create a new archive or use an old one.
58 | *
59 | * @note Usually this method should not be called directly by users of the bit7z library.
60 | *
61 | * @param format_ID GUID of the archive format (see BitInFormat's guid() method)
62 | * @param interface_ID ID of the archive interface to be requested (IID_IInArchive or IID_IOutArchive)
63 | * @param out_object Pointer to a CMyComPtr of an object wich implements the interface requested
64 | */
65 | void createArchiveObject( const GUID* format_ID, const GUID* interface_ID, void** out_object ) const;
66 |
67 | /**
68 | * @brief Set the 7-zip dll to use large memory pages.
69 | */
70 | void setLargePageMode();
71 |
72 | private:
73 | typedef UINT32 ( WINAPI* CreateObjectFunc )( const GUID* clsID, const GUID* interfaceID, void** out );
74 | typedef HRESULT ( WINAPI* SetLargePageMode )();
75 |
76 | HMODULE mLibrary;
77 | CreateObjectFunc mCreateObjectFunc;
78 |
79 | Bit7zLibrary( const Bit7zLibrary& ); // not copyable!
80 | Bit7zLibrary& operator=( const Bit7zLibrary& ); // not assignable!
81 | };
82 | }
83 |
84 | #endif // BIT7ZLIBRARY_HPP
85 |
--------------------------------------------------------------------------------
/MemoryLoader/include/x32_bit7z/bit7z/include/bitarchivecreator.hpp:
--------------------------------------------------------------------------------
1 | /*
2 | * bit7z - A C++ static library to interface with the 7-zip DLLs.
3 | * Copyright (c) 2014-2019 Riccardo Ostani - All Rights Reserved.
4 | *
5 | * This program is free software; you can redistribute it and/or
6 | * modify it under the terms of the GNU General Public License
7 | * as published by the Free Software Foundation; either version 2
8 | * of the License, or (at your option) any later version.
9 | *
10 | * Bit7z is distributed in the hope that it will be useful,
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 | * GNU General Public License for more details.
14 | *
15 | * You should have received a copy of the GNU General Public License
16 | * along with bit7z; if not, see https://www.gnu.org/licenses/.
17 | */
18 |
19 | #ifndef BITARCHIVECREATOR_HPP
20 | #define BITARCHIVECREATOR_HPP
21 |
22 | #include "../include/bitarchivehandler.hpp"
23 | #include "../include/bitinputarchive.hpp"
24 | #include "../include/bitformat.hpp"
25 | #include "../include/bitcompressionlevel.hpp"
26 | #include "../include/bitcompressionmethod.hpp"
27 |
28 | #include
29 |
30 | struct IOutStream;
31 | struct ISequentialOutStream;
32 |
33 | namespace bit7z {
34 | using std::wstring;
35 | using std::unique_ptr;
36 | using std::ostream;
37 |
38 | class UpdateCallback;
39 |
40 | /**
41 | * @brief Abstract class representing a generic archive creator.
42 | */
43 | class BitArchiveCreator : public BitArchiveHandler {
44 | public:
45 | /**
46 | * @return the format used by the archive creator.
47 | */
48 | const BitInFormat& format() const override;
49 |
50 | /**
51 | * @return the format used by the archive creator.
52 | */
53 | const BitInOutFormat& compressionFormat() const;
54 |
55 | /**
56 | * @return whether the creator crypts also the headers of archives or not
57 | */
58 | bool cryptHeaders() const;
59 |
60 | /**
61 | * @return the compression level used by the archive creator.
62 | */
63 | BitCompressionLevel compressionLevel() const;
64 |
65 | /**
66 | * @return the compression method used by the archive creator.
67 | */
68 | BitCompressionMethod compressionMethod() const;
69 |
70 | /**
71 | * @return the dictionary size used by the archive creator.
72 | */
73 | uint32_t dictionarySize() const;
74 |
75 | /**
76 | * @return whether the archive creator uses solid compression or not.
77 | */
78 | bool solidMode() const;
79 |
80 | /**
81 | * @return whether the archive creator is allowed to update existing archives or not.
82 | */
83 | bool updateMode() const;
84 |
85 | /**
86 | * @return the size (in bytes) of the archive volume used by the creator
87 | * (a 0 value means that all files are going in a single archive).
88 | */
89 | uint64_t volumeSize() const;
90 |
91 | /**
92 | * @brief Sets up a password for the output archive.
93 | *
94 | * When setting a password, the produced archive will be encrypted using the default
95 | * cryptographic method of the output format. The option "crypt headers" remains unchanged,
96 | * in contrast with what happens when calling the setPassword(wstring, bool) method.
97 | *
98 | * @note Calling setPassword when the output format doesn't support archive encryption
99 | * (e.g. GZip, BZip2, etc...) does not have any effects (in other words, it doesn't
100 | * throw exceptions and it has no effects on compression operations).
101 | *
102 | * @note After a password has been set, it will be used for every subsequent operation.
103 | * To disable the use of the password, you need to call the clearPassword method
104 | * (inherited from BitArchiveHandler), which is equivalent to setPassword(L"").
105 | *
106 | * @param password
107 | */
108 | void setPassword( const wstring& password ) override;
109 |
110 | /**
111 | * @brief Sets up a password for the output archive.
112 | *
113 | * When setting a password, the produced archive will be encrypted using the default
114 | * cryptographic method of the output format. If the format is 7z and the option
115 | * "crypt_headers" is set to true, also the headers of the archive will be encrypted,
116 | * resulting in a password request everytime the output file will be opened.
117 | *
118 | * @note Calling setPassword when the output format doesn't support archive encryption
119 | * (e.g. GZip, BZip2, etc...) does not have any effects (in other words, it doesn't
120 | * throw exceptions and it has no effects on compression operations).
121 | *
122 | * @note Calling setPassword with "crypt_headers" set to true does not have effects on
123 | * formats different from 7z.
124 | *
125 | * @note After a password has been set, it will be used for every subsequent operation.
126 | * To disable the use of the password, you need to call the clearPassword method
127 | * (inherited from BitArchiveHandler), which is equivalent to setPassword(L"").
128 | *
129 | * @param password the password desired.
130 | * @param crypt_headers if true, the headers of the output archive will be encrypted
131 | * (valid only with 7z format).
132 | */
133 | void setPassword( const wstring& password, bool crypt_headers );
134 |
135 | /**
136 | * @brief Sets the compression level to be used when creating an archive.
137 | *
138 | * @param compression_level the compression level desired.
139 | */
140 | void setCompressionLevel( BitCompressionLevel compression_level );
141 |
142 | /**
143 | * @brief Sets the compression method to be used when creating an archive.
144 | *
145 | * @param compression_method the compression method desired.
146 | */
147 | void setCompressionMethod( BitCompressionMethod compression_method );
148 |
149 | /**
150 | * @brief Sets the dictionary size to be used when creating an archive.
151 | *
152 | * @param dictionary_size the dictionary size desired.
153 | */
154 | void setDictionarySize( uint32_t dictionary_size );
155 |
156 | /**
157 | * @brief Sets whether to use solid compression or not.
158 | *
159 | * @note Setting the solid compression mode to true has effect only when using the 7z format with multiple
160 | * input files.
161 | *
162 | * @param solid_mode if true, it will be used the "solid compression" method.
163 | */
164 | void setSolidMode( bool solid_mode );
165 |
166 | /**
167 | * @brief Sets whether the creator can update existing archives or not.
168 | *
169 | * @note If false, an exception will be thrown in case a compression operation targets an existing archive.
170 | *
171 | * @param update_mode if true, compressing operations will update existing archives.
172 | */
173 | void setUpdateMode( bool update_mode );
174 |
175 | /**
176 | * @brief Sets the size (in bytes) of the archive volumes.
177 | *
178 | * @note This setting has effects only when the destination archive is on filesystem.
179 | *
180 | * @param size The dimension of a volume.
181 | */
182 | void setVolumeSize( uint64_t size );
183 |
184 | protected:
185 | const BitInOutFormat& mFormat;
186 |
187 | BitArchiveCreator( const Bit7zLibrary& lib, const BitInOutFormat& format );
188 |
189 | virtual ~BitArchiveCreator() override = 0;
190 |
191 | CMyComPtr< IOutArchive > initOutArchive() const;
192 |
193 | CMyComPtr< IOutStream > initOutFileStream( const wstring& out_archive,
194 | CMyComPtr< IOutArchive >& new_arc,
195 | unique_ptr< BitInputArchive >& old_arc ) const;
196 |
197 | void setArchiveProperties( IOutArchive* out_archive ) const;
198 | void compressToFile( const wstring& out_file, UpdateCallback* update_callback ) const;
199 | void compressToBuffer( vector< byte_t >& out_buffer, UpdateCallback* update_callback ) const;
200 | void compressToStream( ostream& out_stream, UpdateCallback* update_callback ) const;
201 |
202 | private:
203 | BitCompressionLevel mCompressionLevel;
204 | BitCompressionMethod mCompressionMethod;
205 | uint32_t mDictionarySize;
206 | bool mCryptHeaders;
207 | bool mSolidMode;
208 | bool mUpdateMode;
209 | uint64_t mVolumeSize;
210 | };
211 | }
212 |
213 | #endif // BITARCHIVECREATOR_HPP
214 |
--------------------------------------------------------------------------------
/MemoryLoader/include/x32_bit7z/bit7z/include/bitarchivehandler.hpp:
--------------------------------------------------------------------------------
1 | /*
2 | * bit7z - A C++ static library to interface with the 7-zip DLLs.
3 | * Copyright (c) 2014-2019 Riccardo Ostani - All Rights Reserved.
4 | *
5 | * This program is free software; you can redistribute it and/or
6 | * modify it under the terms of the GNU General Public License
7 | * as published by the Free Software Foundation; either version 2
8 | * of the License, or (at your option) any later version.
9 | *
10 | * Bit7z is distributed in the hope that it will be useful,
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 | * GNU General Public License for more details.
14 | *
15 | * You should have received a copy of the GNU General Public License
16 | * along with bit7z; if not, see https://www.gnu.org/licenses/.
17 | */
18 |
19 | #ifndef BITARCHIVEHANDLER_HPP
20 | #define BITARCHIVEHANDLER_HPP
21 |
22 | #include
23 | #include
24 |
25 | #include "../include/bit7zlibrary.hpp"
26 |
27 | namespace bit7z {
28 | using std::wstring;
29 | using std::function;
30 |
31 | class BitInFormat;
32 |
33 | /**
34 | * @brief A std::function whose argument is the total size of the ongoing operation.
35 | */
36 | typedef function< void( uint64_t total_size ) > TotalCallback;
37 |
38 | /**
39 | * @brief A std::function whose argument is the current processed size of the ongoing operation.
40 | */
41 | typedef function< void( uint64_t progress_size ) > ProgressCallback;
42 |
43 | /**
44 | * @brief A std::function whose arguments are the current processed input size and the current output size of the
45 | * ongoing operation.
46 | */
47 | typedef function< void( uint64_t input_size, uint64_t output_size ) > RatioCallback;
48 |
49 | /**
50 | * @brief A std::function whose argument is the name of the file currently being processed by the ongoing operation.
51 | */
52 | typedef function< void( wstring filename ) > FileCallback;
53 |
54 | /**
55 | * @brief A std::function which returns the password to be used in order to handle an archive.
56 | */
57 | typedef function< wstring() > PasswordCallback;
58 |
59 | /**
60 | * @brief Abstract class representing a generic archive handler.
61 | */
62 | class BitArchiveHandler {
63 | public:
64 | /**
65 | * @return the Bit7zLibrary object used by the handler.
66 | */
67 | const Bit7zLibrary& library() const;
68 |
69 | /**
70 | * @return the format used by the handler for extracting or compressing.
71 | */
72 | virtual const BitInFormat& format() const = 0;
73 |
74 | /**
75 | * @return the password used to open, extract or encrypt the archive.
76 | */
77 | const wstring password() const;
78 |
79 | /**
80 | * @return true if a password is defined, false otherwise.
81 | */
82 | bool isPasswordDefined() const;
83 |
84 | /**
85 | * @return the current total callback.
86 | */
87 | TotalCallback totalCallback() const;
88 |
89 | /**
90 | * @return the current progress callback.
91 | */
92 | ProgressCallback progressCallback() const;
93 |
94 | /**
95 | * @return the current ratio callback.
96 | */
97 | RatioCallback ratioCallback() const;
98 |
99 | /**
100 | * @return the current file callback.
101 | */
102 | FileCallback fileCallback() const;
103 |
104 | /**
105 | * @return the current password callback.
106 | */
107 | PasswordCallback passwordCallback() const;
108 |
109 | /**
110 | * @brief Sets up a password to be used by the archive handler.
111 | *
112 | * The password will be used to encrypt/decrypt archives by using the default
113 | * cryptographic method of the archive format.
114 | *
115 | * @note Calling setPassword when the input archive is not encrypted does not have effect on
116 | * the extraction process.
117 | *
118 | * @note Calling setPassword when the output format doesn't support archive encryption
119 | * (e.g. GZip, BZip2, etc...) does not have any effects (in other words, it doesn't
120 | * throw exceptions and it has no effects on compression operations).
121 | *
122 | * @note After a password has been set, it will be used for every subsequent operation.
123 | * To disable the use of the password, you need to call the clearPassword method, which is equivalent
124 | * to call setPassword(L"").
125 | *
126 | * @param password the password to be used.
127 | */
128 | virtual void setPassword( const wstring& password );
129 |
130 | /**
131 | * @brief Clear the current password used by the handler.
132 | *
133 | * Calling clearPassword() will disable the encryption/decryption of archives.
134 | *
135 | * @note This is equivalent to calling setPassword(L"").
136 | */
137 | void clearPassword();
138 |
139 | /**
140 | * @brief Sets the callback to be called when the total size of an operation is available.
141 | *
142 | * @param callback the total callback to be used.
143 | */
144 | void setTotalCallback( const TotalCallback& callback );
145 |
146 | /**
147 | * @brief Sets the callback to be called when the processed size of the ongoing operation is updated.
148 | *
149 | * @note The percentage of completition of the current operation can be obtained by calculating
150 | * static_cast( ( 100.0 * processed_size ) / total_size ).
151 | *
152 | * @param callback the progress callback to be used.
153 | */
154 | void setProgressCallback( const ProgressCallback& callback );
155 |
156 | /**
157 | * @brief Sets the callback to be called when the input processed size and current output size of the
158 | * ongoing operation are known.
159 | *
160 | * @note The ratio percentage of a compression operation can be obtained by calculating
161 | * static_cast( ( 100.0 * output_size ) / input_size ).
162 | *
163 | * @param callback the ratio callback to be used.
164 | */
165 | void setRatioCallback( const RatioCallback& callback );
166 |
167 | /**
168 | * @brief Sets the callback to be called when the currently file being processed changes.
169 | *
170 | * @param callback the file callback to be used.
171 | */
172 | void setFileCallback( const FileCallback& callback );
173 |
174 | /**
175 | * @brief Sets the callback to be called when a password is needed to complete the ongoing operation.
176 | *
177 | * @param callback the password callback to be used.
178 | */
179 | void setPasswordCallback( const PasswordCallback& callback );
180 |
181 | protected:
182 | const Bit7zLibrary& mLibrary;
183 | wstring mPassword;
184 |
185 | explicit BitArchiveHandler( const Bit7zLibrary& lib, const wstring& password = L"" );
186 |
187 | virtual ~BitArchiveHandler() = 0;
188 |
189 | private:
190 | //CALLBACKS
191 | TotalCallback mTotalCallback;
192 | ProgressCallback mProgressCallback;
193 | RatioCallback mRatioCallback;
194 | FileCallback mFileCallback;
195 | PasswordCallback mPasswordCallback;
196 | };
197 | }
198 |
199 | #endif // BITARCHIVEHANDLER_HPP
200 |
--------------------------------------------------------------------------------
/MemoryLoader/include/x32_bit7z/bit7z/include/bitarchiveinfo.hpp:
--------------------------------------------------------------------------------
1 | /*
2 | * bit7z - A C++ static library to interface with the 7-zip DLLs.
3 | * Copyright (c) 2014-2019 Riccardo Ostani - All Rights Reserved.
4 | *
5 | * This program is free software; you can redistribute it and/or
6 | * modify it under the terms of the GNU General Public License
7 | * as published by the Free Software Foundation; either version 2
8 | * of the License, or (at your option) any later version.
9 | *
10 | * Bit7z is distributed in the hope that it will be useful,
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 | * GNU General Public License for more details.
14 | *
15 | * You should have received a copy of the GNU General Public License
16 | * along with bit7z; if not, see https://www.gnu.org/licenses/.
17 | */
18 |
19 | #ifndef BITARCHIVEINFO_HPP
20 | #define BITARCHIVEINFO_HPP
21 |
22 | #include "../include/bitarchiveopener.hpp"
23 | #include "../include/bitinputarchive.hpp"
24 | #include "../include/bitarchiveitem.hpp"
25 | #include "../include/bittypes.hpp"
26 |
27 | struct IInArchive;
28 | struct IOutArchive;
29 | struct IArchiveExtractCallback;
30 |
31 | namespace bit7z {
32 | /**
33 | * @brief The BitArchiveInfo class allows to retrieve metadata information of archives and their content.
34 | */
35 | class BitArchiveInfo : public BitArchiveOpener, public BitInputArchive {
36 | public:
37 | /**
38 | * @brief Constructs a BitArchiveInfo object, opening the input file archive.
39 | *
40 | * @note When bit7z is compiled using the BIT7Z_AUTO_FORMAT macro define, the format
41 | * argument has default value BitFormat::Auto (automatic format detection of the input archive).
42 | * On the other hand, when BIT7Z_AUTO_FORMAT is not defined (i.e. no auto format detection available)
43 | * the format argument must be specified.
44 | *
45 | * @param lib the 7z library used.
46 | * @param in_file the input archive file path.
47 | * @param format the input archive format.
48 | * @param password the password needed to open the input archive.
49 | */
50 | BitArchiveInfo( const Bit7zLibrary& lib,
51 | const wstring& in_file,
52 | const BitInFormat& format DEFAULT_FORMAT,
53 | const wstring& password = L"" );
54 |
55 | /**
56 | * @brief Constructs a BitArchiveInfo object, opening the archive in the input buffer.
57 | *
58 | * @note When bit7z is compiled using the BIT7Z_AUTO_FORMAT macro define, the format
59 | * argument has default value BitFormat::Auto (automatic format detection of the input archive).
60 | * On the other hand, when BIT7Z_AUTO_FORMAT is not defined (i.e. no auto format detection available)
61 | * the format argument must be specified.
62 | *
63 | * @param lib the 7z library used.
64 | * @param in_buffer the input buffer containing the archive.
65 | * @param format the input archive format.
66 | * @param password the password needed to open the input archive.
67 | */
68 | BitArchiveInfo( const Bit7zLibrary& lib,
69 | const vector< byte_t >& in_buffer,
70 | const BitInFormat& format DEFAULT_FORMAT,
71 | const wstring& password = L"" );
72 |
73 | /**
74 | * @brief Constructs a BitArchiveInfo object, opening the archive from the standard input stream.
75 | *
76 | * @note When bit7z is compiled using the BIT7Z_AUTO_FORMAT macro define, the format
77 | * argument has default value BitFormat::Auto (automatic format detection of the input archive).
78 | * On the other hand, when BIT7Z_AUTO_FORMAT is not defined (i.e. no auto format detection available)
79 | * the format argument must be specified.
80 | *
81 | * @param lib the 7z library used.
82 | * @param in_stream the standard input stream of the archive.
83 | * @param format the input archive format.
84 | * @param password the password needed to open the input archive.
85 | */
86 | BitArchiveInfo( const Bit7zLibrary& lib,
87 | std::istream& in_stream,
88 | const BitInFormat& format DEFAULT_FORMAT,
89 | const wstring& password = L"" );
90 |
91 | /**
92 | * @brief BitArchiveInfo destructor.
93 | *
94 | * @note It releases the input archive file.
95 | */
96 | virtual ~BitArchiveInfo() override;
97 |
98 | /**
99 | * @return a map of all the available (i.e. non empty) archive properties and their respective values.
100 | */
101 | map< BitProperty, BitPropVariant > archiveProperties() const;
102 |
103 | /**
104 | * @return a vector of all the archive items as BitArchiveItem objects.
105 | */
106 | vector< BitArchiveItem > items() const;
107 |
108 | /**
109 | * @return the number of folders contained in the archive.
110 | */
111 | uint32_t foldersCount() const;
112 |
113 | /**
114 | * @return the number of files contained in the archive.
115 | */
116 | uint32_t filesCount() const;
117 |
118 | /**
119 | * @return the total uncompressed size of the archive content.
120 | */
121 | uint64_t size() const;
122 |
123 | /**
124 | * @return the total compressed size of the archive content.
125 | */
126 | uint64_t packSize() const;
127 |
128 | /**
129 | * @return true if and only if the archive has at least one encrypted item.
130 | */
131 | bool hasEncryptedItems() const;
132 |
133 | /**
134 | * @return the number of volumes composing the archive.
135 | */
136 | uint32_t volumesCount() const;
137 |
138 | /**
139 | * @return true if and only if the archive is composed by multiple volumes.
140 | */
141 | bool isMultiVolume() const;
142 |
143 | /**
144 | * @return true if and only if the archive was created using solid compression.
145 | */
146 | bool isSolid() const;
147 | };
148 | }
149 |
150 | #endif // BITARCHIVEINFO_HPP
151 |
--------------------------------------------------------------------------------
/MemoryLoader/include/x32_bit7z/bit7z/include/bitarchiveitem.hpp:
--------------------------------------------------------------------------------
1 | /*
2 | * bit7z - A C++ static library to interface with the 7-zip DLLs.
3 | * Copyright (c) 2014-2019 Riccardo Ostani - All Rights Reserved.
4 | *
5 | * This program is free software; you can redistribute it and/or
6 | * modify it under the terms of the GNU General Public License
7 | * as published by the Free Software Foundation; either version 2
8 | * of the License, or (at your option) any later version.
9 | *
10 | * Bit7z is distributed in the hope that it will be useful,
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 | * GNU General Public License for more details.
14 | *
15 | * You should have received a copy of the GNU General Public License
16 | * along with bit7z; if not, see https://www.gnu.org/licenses/.
17 | */
18 |
19 | #ifndef BITARCHIVEITEMREADER_HPP
20 | #define BITARCHIVEITEMREADER_HPP
21 |
22 | #include
49 |
50 |
51 | ## Installation
52 | lace the Memory Loader DLL files in IDA's directory
53 | The nameing convertion is:
54 |
55 |
56 | x86 |
57 | MemoryLoader.dll |
58 |
59 |
60 | x64 |
61 | MemoryLoader64.dll |
62 |
63 |
64 |
65 | Place the loaders files in IDA's loaders directory
66 | The nameing convertion is:
67 |
68 |
69 | x86 |
70 | MemZipLoader.dll |
71 | UrlLoader.dll |
72 |
73 |
74 | x64 |
75 | MemZipLoader64.dll |
76 | UrlLoader64.dll |
77 |
78 |
79 |
80 | ## Usage
81 |
82 |
83 | MemZipLoader |
84 |
85 | The loader accepts ZIP files, opens a dropbox, indexing and displaying all files inside. (recursive directory search)
86 | The file will be extracted to a buffer without any files being written to the disk.
87 | |
88 |
89 |
90 | UrlLoader |
91 |
92 | The loader is suggested no matter what file you open from the disk. Selecting URL loader disables loading the
93 | file you selected and asks for a URL and loads it as a file. The name of the file will be its sha1. The IDB will
94 | be placed in the same directory as the original file you opened. The file gets extracted to a buffer
95 | without being written to the disk.
96 | |
97 |
98 |
99 |
100 | ## MemLoader & MemZipLoader & UrlLoader Tested On:
101 |
102 |
103 | IDA version 7.5+ |
104 |
105 |
106 | x64 |
107 | pe |
108 | elf |
109 | arm |
110 | macho |
111 | shellcode(Binary) |
112 |
113 |
114 | x86 |
115 | pe |
116 | elf |
117 | arm |
118 | macho |
119 | shellcode(Binary) |
120 |
121 |
122 |
123 | ## Known Issues
124 | * Loaders are working and tesed only for Windows OS.
125 | * X86 PEs in some cases the calling convention settings are not accurate.
126 | * PEs don't get their symbols loaded. Only flirt and types signatures applied.
127 | * MemZipLoader does not support opening zip inside a zip.
128 |
129 | ## Credits
130 | * This open-source project is backed by [SentinelOne](https://www.sentinelone.com/blog/)
131 | * ZIP Lib [Zip](https://rikyoz.dev/bit7z/)
132 | * IDA SDK [IDA](https://www.hex-rays.com/products/ida/support/sdkdoc/index.html)
133 |
134 |
--------------------------------------------------------------------------------
/pics/base_ida.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SentineLabs/Memloader/b51384c71c976f62b60fd0a91b2d3209b73989ae/pics/base_ida.png
--------------------------------------------------------------------------------
/pics/dropbox_example.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SentineLabs/Memloader/b51384c71c976f62b60fd0a91b2d3209b73989ae/pics/dropbox_example.png
--------------------------------------------------------------------------------
/pics/loaders.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SentineLabs/Memloader/b51384c71c976f62b60fd0a91b2d3209b73989ae/pics/loaders.png
--------------------------------------------------------------------------------
/pics/memory_loader.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SentineLabs/Memloader/b51384c71c976f62b60fd0a91b2d3209b73989ae/pics/memory_loader.png
--------------------------------------------------------------------------------
/pics/url_loader.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SentineLabs/Memloader/b51384c71c976f62b60fd0a91b2d3209b73989ae/pics/url_loader.png
--------------------------------------------------------------------------------