渗透测试实战回忆录

// demo.cpp : This file contains the 'main' function. Program execution begins and ends there.
//

#include <iostream>
#include <Windows.h>

int main()
{
    std::cout << "SysWOW64 is 32 bit PE!\n";
    LoadLibraryA("C:\\Windows\\SysWOW64\\ntdll.dll");
    std::cout << "the lasterror is " << GetLastError() << std::endl;
    std::cout << "It is ok the countine execute code\n";
}

void * os::dll_load(const char *name, char *ebuf, int ebuflen) {
  log_info(os)("attempting shared library load of %s", name);
  Events::log_dll_message(nullptr, "Attempting to load shared library %s", name);

  void* result;
  JFR_ONLY(NativeLibraryLoadEvent load_event(name, &result);)
  result = LoadLibrary(name);
  if (result != nullptr) {
    Events::log_dll_message(nullptr, "Loaded shared library %s", name);
    // Recalculate pdb search path if a DLL was loaded successfully.
    SymbolEngine::recalc_search_path();
    log_info(os)("shared library load of %s was successful", name);
    return result;
  }

  if (ebuf == nullptr || ebuflen < 1) {
    // no error reporting requested
    return nullptr;
  }

  DWORD errcode = GetLastError();
  // Read system error message into ebuf
  // It may or may not be overwritten below (in the for loop and just above)
  lasterror(ebuf, (size_t) ebuflen);
  ebuf[ebuflen - 1] = '\0';
  Events::log_dll_message(nullptr, "Loading shared library %s failed, error code %lu", name, errcode);
  log_info(os)("shared library load of %s failed, error code %lu", name, errcode);

  if (errcode == ERROR_MOD_NOT_FOUND) {
    strncpy(ebuf, "Can't find dependent libraries", ebuflen - 1);
    ebuf[ebuflen - 1] = '\0';
    JFR_ONLY(load_event.set_error_msg(ebuf);)
    return nullptr;
  }

  // Parsing dll below
  // If we can read dll-info and find that dll was built
  // for an architecture other than Hotspot is running in
  // - then print to buffer "DLL was built for a different architecture"
  // else call os::lasterror to obtain system error message
  int fd = ::open(name, O_RDONLY | O_BINARY, 0);
  if (fd < 0) {
    JFR_ONLY(load_event.set_error_msg("open on dll file did not work");)
    return nullptr;
  }

  uint32_t signature_offset;
  uint16_t lib_arch = 0;
  bool failed_to_get_lib_arch =
    ( // Go to position 3c in the dll
     (os::seek_to_file_offset(fd, IMAGE_FILE_PTR_TO_SIGNATURE) < 0)
     ||
     // Read location of signature
     (sizeof(signature_offset) !=
     (::read(fd, (void*)&signature_offset, sizeof(signature_offset))))
     ||
     // Go to COFF File Header in dll
     // that is located after "signature" (4 bytes long)
     (os::seek_to_file_offset(fd,
     signature_offset + IMAGE_FILE_SIGNATURE_LENGTH) < 0)
     ||
     // Read field that contains code of architecture
     // that dll was built for
     (sizeof(lib_arch) != (::read(fd, (void*)&lib_arch, sizeof(lib_arch))))
    );

  ::close(fd);
  if (failed_to_get_lib_arch) {
    // file i/o error - report os::lasterror(...) msg
    JFR_ONLY(load_event.set_error_msg("failed to get lib architecture");)
    return nullptr;
  }

  typedef struct {
    uint16_t arch_code;
    char* arch_name;
  } arch_t;

  static const arch_t arch_array[] = {
    {IMAGE_FILE_MACHINE_AMD64,     (char*)"AMD 64"},
    {IMAGE_FILE_MACHINE_ARM64,     (char*)"ARM 64"}
  };
#if (defined _M_ARM64)
  static const uint16_t running_arch = IMAGE_FILE_MACHINE_ARM64;
#elif (defined _M_AMD64)
  static const uint16_t running_arch = IMAGE_FILE_MACHINE_AMD64;
#else
  #error Method os::dll_load requires that one of following \
         is defined :_M_AMD64 or _M_ARM64
#endif


  // Obtain a string for printf operation
  // lib_arch_str shall contain string what platform this .dll was built for
  // running_arch_str shall string contain what platform Hotspot was built for
  char *running_arch_str = nullptr, *lib_arch_str = nullptr;
  for (unsigned int i = 0; i < ARRAY_SIZE(arch_array); i++) {
    if (lib_arch == arch_array[i].arch_code) {
      lib_arch_str = arch_array[i].arch_name;
    }
    if (running_arch == arch_array[i].arch_code) {
      running_arch_str = arch_array[i].arch_name;
    }
  }

  assert(running_arch_str,
         "Didn't find running architecture code in arch_array");

  // If the architecture is right
  // but some other error took place - report os::lasterror(...) msg
  if (lib_arch == running_arch) {
    JFR_ONLY(load_event.set_error_msg("lib architecture matches, but other error occured");)
    return nullptr;
  }

  if (lib_arch_str != nullptr) {
    os::snprintf_checked(ebuf, ebuflen,
                         "Can't load %s-bit .dll on a %s-bit platform",
                         lib_arch_str, running_arch_str);
  } else {
    // don't know what architecture this dll was build for
    os::snprintf_checked(ebuf, ebuflen,
                         "Can't load this .dll (machine code=0x%x) on a %s-bit platform",
                         lib_arch, running_arch_str);
  }
  JFR_ONLY(load_event.set_error_msg(ebuf);)
  return nullptr;
}

package com.endlessparadox;  
  
public class NativeApi {  
  
    public native int demo(int a, int b);  
  
    public int demoSafe(int a, int b) {  
        return demo(a, b);  
    }  
}

#include "pch.h"
#include "com_endlessparadox_NativeApi.h"

JNIEXPORT jint JNICALL Java_com_endlessparadox_NativeApi_demo(JNIEnv* env, jobject obj, jint a, jint b) {
    
    printf("testing load");
    return a + b;  // 示例实现
}

#include "pch.h"
#include "com_endlessparadox_NativeApi.h"

__declspec(dllexport) long __stdcall Java_com_endlessparadox_NativeApi_demo(JNIEnv* env, jobject obj, long a, long b) {
    
    printf("testing load");
    return a + b;  // 示例实现
}

package com.endlessparadox;  
  
public final class NativeLoader {  
  
    private static volatile boolean loaded = false;  
    private static volatile Throwable loadError = null;  
    private NativeLoader() {}  
    /**  
     * 尝试加载 native 库（只会执行一次）  
     */  
    public static boolean load() {  
        if (loaded) {  
            return true;  
        }  
        synchronized (NativeLoader.class) {  
            if (loaded) {  
                return true;  
            }  
            try {  
                // x64  
                //System.load("C:\\Users\\hacker\\source\\repos\\NativeApi\\x64\\Release\\NativeApi.dll");                // x32                System.load("C:\\Users\\hacker\\source\\repos\\NativeApi\\Release\\NativeApi.dll");  
                loaded = true;  
                return true;  
            } catch (Throwable t) {  
                loadError = t;  
                return false;  
            }  
        }  
    }  
  
    public static boolean isLoaded() {  
        return loaded;  
    }  
    public static Throwable getLoadError() {  
        return loadError;  
    }  
}

package com.endlessparadox;  
  
public class Main {  
  
    public static void main(String[] args) {  
  
        if (!NativeLoader.load()) {  
            System.err.println("JNI load failed");  
            NativeLoader.getLoadError().printStackTrace();  
            // 可选择 return / fallback        }else {  
            NativeApi api = new NativeApi();  
            int r = api.demoSafe(2, 3);  
            System.out.println("result = " + r);  
        }  
  
        System.out.println("this is end");  
    }  
}

MiniDumpWriteDump = (BOOL (__stdcall *)(HANDLE, DWORD, HANDLE, MINIDUMP_TYPE, PMINIDUMP_EXCEPTION_INFORMATION, PMINIDUMP_USER_STREAM_INFORMATION, PMINIDUMP_CALLBACK_INFORMATION))GetProcAddress(v9, "MiniDumpWriteDump");

BOOL MiniDumpWriteDump(
  [in] HANDLE                            hProcess,
  [in] DWORD                             ProcessId,
  [in] HANDLE                            hFile,
  [in] MINIDUMP_TYPE                     DumpType,
  [in] PMINIDUMP_EXCEPTION_INFORMATION   ExceptionParam,
  [in] PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam,
  [in] PMINIDUMP_CALLBACK_INFORMATION    CallbackParam
);

(struct MiniDumpAllocationProvider **)(*(__int64 (__fastcall **)(struct MiniDumpAllocationProvider *, __int64))(*(_QWORD *)v15 + 8LL))

void __fastcall TelemetryLogFunctionCallWithResult(
        struct _GUID *p_Uuid,
        const unsigned __int16 *MiniDumpCreateLiveAllocationProvider,
        int dwErrCode)
{
  __int64 v6; // rax
  int n2; // eax
  int dwErrCode_1; // [rsp+38h] [rbp-39h] BYREF
  __int64 n0x2000000; // [rsp+40h] [rbp-31h] BYREF
  struct _EVENT_DATA_DESCRIPTOR UserData[2]; // [rsp+48h] [rbp-29h] BYREF
  __int64 *p_n0x2000000; // [rsp+68h] [rbp-9h]
  __int64 n8; // [rsp+70h] [rbp-1h]
  struct _GUID *p_Uuid_1; // [rsp+78h] [rbp+7h]
  __int64 n16; // [rsp+80h] [rbp+Fh]
  const wchar_t *FunctionResult; // [rsp+88h] [rbp+17h]
  __int64 n30; // [rsp+90h] [rbp+1Fh]
  const unsigned __int16 *MiniDumpCreateLiveAllocationProvider_1; // [rsp+98h] [rbp+27h]
  int n2_1; // [rsp+A0h] [rbp+2Fh]
  int v19; // [rsp+A4h] [rbp+33h]
  int *p_dwErrCode; // [rsp+A8h] [rbp+37h]
  __int64 n4; // [rsp+B0h] [rbp+3Fh]

  AcquireSRWLockShared(&g_telemetry_lock);
  if ( g_telemetryEnabled
    && (unsigned int)n5 > 5
    && (qword_180033010 & 0x400000000000LL) != 0
    && (qword_180033018 & 0x400000000000LL) == qword_180033018 )
  {
    dwErrCode_1 = dwErrCode;
    p_dwErrCode = &dwErrCode_1;
    n0x2000000 = 0x2000000;
    n4 = 4;
    if ( MiniDumpCreateLiveAllocationProvider )
    {
      v6 = -1;
      do
        ++v6;
      while ( MiniDumpCreateLiveAllocationProvider[v6] );
      n2 = 2 * v6 + 2;
    }
    else
    {
      MiniDumpCreateLiveAllocationProvider = (const unsigned __int16 *)&unk_18002B964;
      n2 = 2;
    }
    n2_1 = n2;
    v19 = 0;
    FunctionResult = L"FunctionResult";
    MiniDumpCreateLiveAllocationProvider_1 = MiniDumpCreateLiveAllocationProvider;
    p_n0x2000000 = &n0x2000000;
    n30 = 30;
    p_Uuid_1 = p_Uuid;
    n16 = 16;
    n8 = 8;
    tlgWriteTransfer_EventWriteTransfer(&n5, byte_18002FD56, 0, 0, 7u, UserData);
  }
  ReleaseSRWLockShared(&g_telemetry_lock);
}