gavz

Perfect Loader Implementations

Thank you to SpecterOps for supporting this research and to Lee and Sarah for proofreading and editing! Crossposted on the SpecterOps Blog.

TLDR: You may use fuse-loader or perfect-loader as examples for extending an OS's native loader to support in-memory libraries.

Some software applications require the ability to load dynamic libraries from the memory of the application's own process. The majority of desktop OSes do not support this use case, so a number of developers have reimplemented the process of loading a library to overcome this limitation.

Features

Make sure you build the binary with debug symbols. For example: RUSTFLAGS=-g cargo build --release
Use rust-gdb to start the binary and load the script: rust-gdb rust_binary -x memlayout-rust.py
Break anywhere you like, and use the command mem-layout VARIABLE_NAME to print the layout of that variable:

Custom structures are also supported:

Target

Start Chrome with the following flags:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

--remote-debugging-port=9222

--remote-debugging-address=0.0.0.0


	#include <android/log.h>
	#include <jni.h>
	#include <binder/Binder.h>
	#include <binder/Parcel.h>
	#include <binder/IServiceManager.h>
	#include <dlfcn.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <unistd.h>

	package main

	// ▄─▄ ▄ ▄ ▄ ──▄ ▄─▄ ▄─▄
	// ▓─ ▓ ▓ ▓ ▓ ▓ ▀─▄ ▀─▄
	// ▀ ▀─▀─▀ ──▀ ▀─▀ ▀─▀
	// f w d --> 5 5
	//
	// simple rfc1928 proxy server
	//
	//

	#!/usr/bin/python3
	from __future__ import division
	from __future__ import print_function
	import re
	import codecs
	import logging
	import time
	import argparse
	import sys
	from impacket import version

	#!/usr/bin/env python
	# coding: utf-8

	"""
	Modified for JtR by Dhiru Kholia in July, 2016

	Copyright (c) 2015 Will Bond <will@wbond.net>

	Permission is hereby granted, free of charge, to any person obtaining a copy of
	this software and associated documentation files (the "Software"), to deal in

	using System;
	using System.IO;
	using System.Text;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using static GetSxsPath.NativeMethods;

	namespace GetSxsPath
	{
	internal class NativeMethods

	X-Forwarded-Host
	X-Forwarded-Port
	X-Forwarded-Scheme
	Origin: null
	Origin: [siteDomain].attacker.com
	X-Frame-Options: Allow
	X-Forwarded-For: 127.0.0.1
	X-Client-IP: 127.0.0.1
	Client-IP: 127.0.0.1
	---For injecting BXSS(blind XSS) \|\| SQLI payloads---

	"""
	this script is based on vds12 of the hexrays sdk.
	author: de
	"""

	import ida_pro
	import ida_hexrays
	import ida_kernwin
	import ida_funcs
	import ida_bytes