Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Custom Code Emulator

Topic created on: December 10, 2012 02:26 CST by codeinject .

Hello All,

I am currently developing a code emulator more for fun than for anything else. Using libemu as the core for this emulator.
The only thing that I really want to active to load an entire PE into memory and let it rip.

So, my TODO list had the following:
- Read the headers
- Check if the PE is Valid (x86 Platform)
- Extract the required data to setup the memory segments
- Hook all the imported functions to my custom API.
- Build the stack segment (set esp and ebp)
- Set the Eflags
- Set the EIP to work correctly

Currently my app does the following.
0005371D >/$ 8BFF           mov     edi, edi    |<< Works
0005371F  |. 55             push    ebp         |<< Works
00053720  |. 8BEC           mov     ebp, esp    |<< Works
00053722  |. 83EC 10        sub     esp, 10     |<< It dies.

Conclusion, I have not build the stack segment correctly.

My question is, how does Windows load an exe to build it's stack in the right manner. I am looking for a technical implemenation or document.
Now I've hard-coded the registers:
    entry_point = pe->nt_header->AddressOfEntryPoint;
    emu_cpu_eip_set(cpu, entry_point);
    emu_cpu_reg32_set(cpu, eax, 0x00);
    emu_cpu_reg32_set(cpu, ecx, 0x00);
    emu_cpu_reg32_set(cpu, edx, entry_point);
    emu_cpu_reg32_set(cpu, ebx, 0x00);
    emu_cpu_reg32_set(cpu, esp, 0x0ff8c);
    emu_cpu_reg32_set(cpu, ebp, 0x00); <--Wrong as I don't know where to get this. (PyEmu told me (0x0095f000 - 0x1000 / 2) but that seems random).
    emu_cpu_reg32_set(cpu, esi, 0x00);
    emu_cpu_reg32_set(cpu, edi, 0x00);
    emu_cpu_eflags_set(cpu, 0x0000246);
    
Long story short: How to I get the correct values from the PE Header?
Thanks in advance


A day has passed.
I am still having issues these issues. And I've tested a number of binz.
I've noticed that every app dies at the same code.

83 65 f8 00
83 65 fc 00
53 57 bf 4e
e6 40 bb bb
00 00 ff ff
3b c7 74 0d
85 c3 74 09
f7 d0 a3 04


    emu_cpu_run(cpu);
    printf("Last Error: %s\n", emu_strerror(e));
    printf("Crash EIP: 0x%08x\n", emu_cpu_eip_get(cpu));
    printf("Bytes:\n");
    for(itr = 0 ; 32 > itr ; ++itr) {
        emu_memory_read_byte(mem, emu_cpu_eip_get(cpu)+itr, &byte);
        printf("%02x ", byte);
        if(((itr+1) % 4) == 0) {
            printf("\n");
        }
    }

  codeinject     December 13, 2012 07:59.05 CST
To increase the reach of my question I've cross-posted it on Sysinternals: http://forum.sysinternals.com/pe-emulator_topic28898.html?KW=
And another cross-post: http://stackoverflow.com/questions/13875908/loading-a-pe-in-memory-for-emulation

  SteveIRQL   December 19, 2012 04:19.38 CST
I am probably just misunderstanding the question, but shouldn't your stack allocation address not matter since you are emulating? Maybe you have a conflict between the address space of the process and the emulated environment?

  bodzcount     January 6, 2013 11:17.23 CST
I am thinking the same as Steve... Or are you trying to run a vm yourself?

  codeinject     January 7, 2013 16:16.44 CST
I am running the emulator myself.
I fixed it, I manage to run my entire PE within my application. It's slow but it works. I got a fully transparant emulator running (till hackers start poking in it, that is). And normal trace issues won't bother this emulator/debugger. As it doesnt use int3 or anything to set breakpoints. It's quite cool. But I am really tired so I might make a blog entry about this later for your guys to enjoy ;) (btw, its really not that hard with libEmu. Mostly its a lot of fun so it's not really that impresive)

Note: Registration is required to post to the forums.

There are 31,040 total registered users.


Recently Created Topics
Ultimate Hacking Cha...
Jun/21
CreateMutex
May/31
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Immunity Debugger Re...
Aug/03


Recent Forum Posts
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack


Recent Blog Entries
crystalwade
Jul/20
test

nieo
Mar/22
Android Application Reversing

halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit