fix up

2025-03-07 19:27:05 +08:00
parent 8504a9c8f9
commit c5a9c95575
6 changed files with 249 additions and 12 deletions
--- a/ai_anti_malware/.vscode/settings.json
+++ b/ai_anti_malware/.vscode/settings.json
@@ -52,6 +52,10 @@
        "xtr1common": "cpp",
        "xtree": "cpp",
        "xutility": "cpp",
-        "functional": "cpp"
+        "functional": "cpp",
+        "fstream": "cpp",
+        "iomanip": "cpp",
+        "xlocmon": "cpp",
+        "xloctime": "cpp"
    }
 }
--- a/ai_anti_malware/ai_anti_malware.cpp
+++ b/ai_anti_malware/ai_anti_malware.cpp
@@ -32,7 +32,9 @@ auto getPeInfo(std::string inputFilePath) -> std::shared_ptr<BasicPeInfo> {
    return sampleInfo;
 }
 int main() {
-    auto sampleInfo = getPeInfo("E:\\对战平台\\CrowAntiCheat\\CrowAntiCheat\\client\\Console_Test\\x64\\Release\\Console_Test.exe");
+    // auto sampleInfo =
+    // getPeInfo("E:\\对战平台\\CrowAntiCheat\\CrowAntiCheat\\client\\Console_Test\\x64\\Release\\Console_Test.exe");
+    auto sampleInfo = getPeInfo("C:\\ConsoleApplication1.exe");
    printf("input new file %s \n", sampleInfo->inputFilePath);
    printf("is x64: %d\n", sampleInfo->isX64);
    printf("is relocated: %d\n", sampleInfo->isRelocated);
--- a/ai_anti_malware/sandbox.cpp
+++ b/ai_anti_malware/sandbox.cpp
@@ -396,11 +396,14 @@ auto Sandbox::SetupVirtualMachine() -> void {
    uc_mem_write(m_ucEngine, m_KSharedUserDataBase,
                 (void*)m_KSharedUserDataBase, m_KSharedUserDataSize);

-    m_tebBase = TEB_BASE;  // 进程TEB地址
-    m_pebBase = PEB_BASE;  // 进程PEB地址
+    m_tebBase = TEB_BASE;             // 进程TEB地址
+    m_pebBase = PEB_BASE;             // 进程PEB地址
+    m_envBlockBase = ENV_BLOCK_BASE;  // 环境变量块地址
    // stack
-    m_stackBase = AlignSize(this->m_peInfo->isX64 ? STACK_BASE_64 : STACK_BASE_32, 16);
-    m_stackSize = AlignSize(this->m_peInfo->isX64 ? STACK_SIZE_64 : STACK_SIZE_32, 16);
+    m_stackBase =
+        AlignSize(this->m_peInfo->isX64 ? STACK_BASE_64 : STACK_BASE_32, 16);
+    m_stackSize =
+        AlignSize(this->m_peInfo->isX64 ? STACK_SIZE_64 : STACK_SIZE_32, 16);
    m_stackEnd = m_stackBase + m_stackSize;

    // heap
@@ -487,6 +490,22 @@ auto Sandbox::SetupVirtualMachine() -> void {
        msr.value = m_tebBase;
        uc_reg_write(m_ucEngine, UC_X86_REG_MSR, &msr);
    }
+    // 映射新的内存区域
+    size_t envSize = AlignSize(this->GetEnvStringsSize(), PAGE_SIZE);
+    printf("env block size: %llx\n", envSize);  // 添加调试输出
+    uc_err envErr = uc_mem_map(m_ucEngine, m_envBlockBase, envSize,
+                               UC_PROT_READ | UC_PROT_WRITE);
+    if (envErr != UC_ERR_OK) {
+        throw std::runtime_error("Failed to map environment block");
+    }
+
+    auto envData = this->GetEnvString();
+    envErr = uc_mem_write(m_ucEngine, m_envBlockBase, envData.data(),
+                          envData.size() * sizeof(wchar_t));
+    if (envErr != UC_ERR_OK) {
+        throw std::runtime_error("Failed to write environment block");
+    }
+
    for (DWORD i = 0; i < 64; i++) {
        GetTeb64()->TlsSlots[i] = (void*)0x1337ffffff;
    }
@@ -640,3 +659,46 @@ auto Sandbox::Run() -> void {
        }
    }
 }
+
+auto Sandbox::GetEnvString() -> std::vector<wchar_t> {
+    std::vector<wchar_t> envBlock;
+    // 添加一些基本的环境变量
+    const std::wstring vars[] = {
+        L"ALLUSERSPROFILE=C:\\ProgramData",
+        L"APPDATA=C:\\Users\\User\\AppData\\Roaming",
+        L"CommonProgramFiles=C:\\Program Files\\Common Files",
+        L"COMPUTERNAME=DESKTOP",
+        L"ComSpec=C:\\Windows\\system32\\cmd.exe",
+        L"HOMEDRIVE=C:",
+        L"HOMEPATH=\\Users\\User",
+        L"LOCALAPPDATA=C:\\Users\\User\\AppData\\Local",
+        L"NUMBER_OF_PROCESSORS=8",
+        L"OS=Windows_NT",
+        L"Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem",
+        L"PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
+        L"PROCESSOR_ARCHITECTURE=AMD64",
+        L"ProgramData=C:\\ProgramData",
+        L"ProgramFiles=C:\\Program Files",
+        L"PROMPT=$P$G",
+        L"SystemDrive=C:",
+        L"SystemRoot=C:\\Windows",
+        L"TEMP=C:\\Users\\User\\AppData\\Local\\Temp",
+        L"TMP=C:\\Users\\User\\AppData\\Local\\Temp",
+        L"USERDOMAIN=DESKTOP",
+        L"USERNAME=User",
+        L"USERPROFILE=C:\\Users\\User",
+        L"windir=C:\\Windows"};
+
+    // 将环境变量添加到块中
+    for (const auto& var : vars) {
+        envBlock.insert(envBlock.end(), var.begin(), var.end());
+        envBlock.push_back(L'\0');  // 每个变量以null结尾
+    }
+    envBlock.push_back(L'\0');  // 环境块以额外的null结尾
+
+    return envBlock;
+}
+
+auto Sandbox::GetEnvStringsSize() -> size_t {
+    return GetEnvString().size() * sizeof(wchar_t);
+}
--- a/ai_anti_malware/sandbox.h
+++ b/ai_anti_malware/sandbox.h
@@ -10,6 +10,7 @@
 #define SF_MASK (1 << 7)
 #define OF_MASK (1 << 11)
 #define ALL_MASK (OF_MASK | SF_MASK | ZF_MASK | PF_MASK | CF_MASK)
+// 随便瞎JB写的
 #define STACK_BASE_64 0x14A0000
 #define STACK_BASE_32 0x14A0000
 #define STACK_SIZE_64 0x40000
@@ -18,6 +19,7 @@
 #define HEAP_SIZE_64 0x5000000
 #define HEAP_ADDRESS_32 0x5000000
 #define HEAP_SIZE_32 0x5000000
+#define ENV_BLOCK_BASE 0x50000

 #define PEB_BASE 0x90000
 #define TEB_BASE 0x90000
@@ -93,6 +95,11 @@ class Sandbox {
    auto GetCommandLine() const -> const char* { return m_commandLine.c_str(); }
    auto GetCommandLineAddress() const -> uint64_t { return CMDLINE_ADDRESS; }
    auto GetCommandLineWAddress() const -> uint64_t { return CMDLINEW_ADDRESS; }
+    auto GetEnvStrings() const -> std::vector<std::wstring> {
+        return envStrings;
+    }
+    auto GetEnvString() -> std::vector<wchar_t>;
+    auto GetEnvStringsSize() -> size_t;
    auto InitCommandLine() -> void;

    // 堆管理相关的公共方法
@@ -102,6 +109,7 @@ class Sandbox {
    auto FindHeapSegment(uint64_t address) -> HeapSegment*;
    auto MergeBlocks(HeapBlock* block) -> void;
    auto SplitBlock(HeapBlock* block, size_t size) -> void;
+    auto GetEnvBlockBase() const -> uint64_t { return m_envBlockBase; }
    std::map<uint64_t, HeapSegment*> m_heapSegments;  // 堆段映射表

   private:
@@ -119,6 +127,7 @@ class Sandbox {
    uint64_t m_heapSize;
    uint64_t m_heapEnd;
    uint64_t m_fakeBase;
+    uint64_t m_envBlockBase;
    struct_gs_base m_gsBaseStruct = {0};
    X64TEB m_teb64 = {0};
    X64PEB m_peb64 = {0};
@@ -131,7 +140,32 @@ class Sandbox {
    std::vector<std::shared_ptr<struct_moudle>> m_moduleList;
    std::map<std::string, std::shared_ptr<_fakeApi>> api_map;
    std::string m_commandLine;  // 存储命令行字符串
-
+    // 创建一些基本的环境变量
+    std::vector<std::wstring> envStrings = {
+        L"ALLUSERSPROFILE=C:\\ProgramData",
+        L"APPDATA=C:\\Users\\User\\AppData\\Roaming",
+        L"CommonProgramFiles=C:\\Program Files\\Common Files",
+        L"COMPUTERNAME=DESKTOP",
+        L"ComSpec=C:\\Windows\\system32\\cmd.exe",
+        L"HOMEDRIVE=C:",
+        L"HOMEPATH=\\Users\\User",
+        L"LOCALAPPDATA=C:\\Users\\User\\AppData\\Local",
+        L"NUMBER_OF_PROCESSORS=8",
+        L"OS=Windows_NT",
+        L"Path=C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem",
+        L"PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC",
+        L"PROCESSOR_ARCHITECTURE=AMD64",
+        L"ProgramData=C:\\ProgramData",
+        L"ProgramFiles=C:\\Program Files",
+        L"PROMPT=$P$G",
+        L"SystemDrive=C:",
+        L"SystemRoot=C:\\Windows",
+        L"TEMP=C:\\Users\\User\\AppData\\Local\\Temp",
+        L"TMP=C:\\Users\\User\\AppData\\Local\\Temp",
+        L"USERDOMAIN=DESKTOP",
+        L"USERNAME=User",
+        L"USERPROFILE=C:\\Users\\User",
+        L"windir=C:\\Windows"};
    auto ResoveImport() -> void;
    auto SetupVirtualMachine() -> void;
    auto PushModuleToVM(const char* dllName, uint64_t moduleBase) -> void;
--- a/ai_anti_malware/sandbox_api_emu.cpp
+++ b/ai_anti_malware/sandbox_api_emu.cpp
@@ -1891,6 +1891,130 @@ auto Api_WideCharToMultiByte(void* sandbox, uc_engine* uc, uint64_t address)
                 &result);
 }

+// 实现 InitializeSListHead API
+auto Api_InitializeSListHead(void* sandbox, uc_engine* uc, uint64_t address)
+    -> void {
+    auto context = static_cast<Sandbox*>(sandbox);
+    uint64_t ListHead = 0;
+
+    // 获取参数
+    if (context->GetPeInfo()->isX64) {
+        // x64: rcx = ListHead
+        uc_reg_read(uc, UC_X86_REG_RCX, &ListHead);
+    } else {
+        // x86: 从栈上读取参数
+        uint32_t esp_address = 0;
+        uint32_t temp_listhead = 0;
+        uc_reg_read(uc, UC_X86_REG_ESP, &esp_address);
+        esp_address += 0x4;  // 跳过返回地址
+        uc_mem_read(uc, esp_address, &temp_listhead, sizeof(uint32_t));
+        ListHead = temp_listhead;
+    }
+
+    if (ListHead != 0) {
+        if (context->GetPeInfo()->isX64) {
+            // 64位系统的SLIST_HEADER结构 (16字节对齐)
+            struct SLIST_HEADER64 {
+                union {
+                    struct {
+                        ULONGLONG Alignment;
+                        ULONGLONG Region;
+                    } DUMMYSTRUCTNAME;
+                    struct {
+                        ULONGLONG Depth : 16;
+                        ULONGLONG Sequence : 48;
+                        ULONGLONG Reserved : 4;
+                        ULONGLONG NextEntry : 60;
+                    } HeaderX64;
+                };
+            } header = {0};
+
+            // 初始化Depth和Sequence为0
+            header.HeaderX64.Depth = 0;
+            header.HeaderX64.Sequence = 0;
+            header.HeaderX64.Reserved = 0;
+            header.HeaderX64.NextEntry = 0;
+
+            // 写入初始化的结构
+            uc_mem_write(uc, ListHead, &header, sizeof(SLIST_HEADER64));
+        } else {
+            // 32位系统的SLIST_HEADER结构 (8字节)
+            struct SLIST_HEADER32 {
+                union {
+                    ULONGLONG Alignment;
+                    struct {
+                        SLIST_ENTRY* Next;
+                        WORD Depth;
+                        WORD Sequence;
+                    } Header32;
+                };
+            } header = {0};
+
+            // 初始化Next、Depth和Sequence为0
+            header.Header32.Next = nullptr;
+            header.Header32.Depth = 0;
+            header.Header32.Sequence = 0;
+
+            // 写入初始化的结构
+            uc_mem_write(uc, ListHead, &header, sizeof(SLIST_HEADER32));
+        }
+    }
+
+    printf("[*] InitializeSListHead: ListHead=0x%llx\n", ListHead);
+}
+
+// 实现 GetEnvironmentStringsW API
+auto Api_GetEnvironmentStringsW(void* sandbox, uc_engine* uc, uint64_t address)
+    -> void {
+    auto context = static_cast<Sandbox*>(sandbox);
+    uint64_t envBlock = context->GetEnvBlockBase();
+    uc_reg_write(uc,
+                 context->GetPeInfo()->isX64 ? UC_X86_REG_RAX : UC_X86_REG_EAX,
+                 &envBlock);
+}
+
+// 实现 FreeEnvironmentStringsW API
+auto Api_FreeEnvironmentStringsW(void* sandbox, uc_engine* uc, uint64_t address)
+    -> void {
+    auto context = static_cast<Sandbox*>(sandbox);
+    uint64_t lpszEnvironmentBlock = 0;
+
+    // 获取参数
+    if (context->GetPeInfo()->isX64) {
+        // x64: rcx = lpszEnvironmentBlock
+        uc_reg_read(uc, UC_X86_REG_RCX, &lpszEnvironmentBlock);
+    } else {
+        // x86: 从栈上读取参数
+        uint32_t esp_address = 0;
+        uint32_t temp_block = 0;
+        uc_reg_read(uc, UC_X86_REG_ESP, &esp_address);
+        esp_address += 0x4;  // 跳过返回地址
+        uc_mem_read(uc, esp_address, &temp_block, sizeof(uint32_t));
+        lpszEnvironmentBlock = temp_block;
+    }
+
+    // 检查传入的地址是否是我们之前分配的环境块地址
+    BOOL success = (lpszEnvironmentBlock == context->GetEnvBlockBase());
+
+    if (!success) {
+        // 如果地址无效，设置错误码
+        DWORD error = ERROR_INVALID_PARAMETER;
+        if (context->GetPeInfo()->isX64) {
+            context->GetTeb64()->LastErrorValue = error;
+        } else {
+            context->GetTeb32()->LastErrorValue = error;
+        }
+    }
+
+    printf("[*] FreeEnvironmentStringsW: Block=0x%llx, Success=%d\n",
+           lpszEnvironmentBlock, success);
+
+    // 返回操作是否成功
+    uc_reg_write(uc,
+                 context->GetPeInfo()->isX64 ? UC_X86_REG_RAX : UC_X86_REG_EAX,
+                 &success);
+}
+
 auto Sandbox::InitApiHooks() -> void {
    auto FakeApi_GetSystemTimeAsFileTime =
        _fakeApi{.func = Api_GetSystemTimeAsFileTime, .paramCount = 1};
@@ -1949,6 +2073,12 @@ auto Sandbox::InitApiHooks() -> void {
        _fakeApi{.func = Api_AreFileApisANSI, .paramCount = 0};
    auto FakeApi_WideCharToMultiByte =
        _fakeApi{.func = Api_WideCharToMultiByte, .paramCount = 8};
+    auto FakeApi_InitializeSListHead =
+        _fakeApi{.func = Api_InitializeSListHead, .paramCount = 1};
+    auto FakeApi_GetEnvironmentStringsW =
+        _fakeApi{.func = Api_GetEnvironmentStringsW, .paramCount = 0};
+    auto FakeApi_FreeEnvironmentStringsW =
+        _fakeApi{.func = Api_FreeEnvironmentStringsW, .paramCount = 1};

    api_map = {
        {"GetSystemTimeAsFileTime",
@@ -1999,6 +2129,12 @@ auto Sandbox::InitApiHooks() -> void {
         std::make_shared<_fakeApi>(FakeApi_AreFileApisANSI)},
        {"WideCharToMultiByte",
         std::make_shared<_fakeApi>(FakeApi_WideCharToMultiByte)},
+        {"InitializeSListHead",
+         std::make_shared<_fakeApi>(FakeApi_InitializeSListHead)},
+        {"GetEnvironmentStringsW",
+         std::make_shared<_fakeApi>(FakeApi_GetEnvironmentStringsW)},
+        {"FreeEnvironmentStringsW",
+         std::make_shared<_fakeApi>(FakeApi_FreeEnvironmentStringsW)},
    };
 }
 auto Sandbox::EmulateApi(uc_engine* uc, uint64_t address, uint64_t rip,
@@ -2023,10 +2159,10 @@ auto Sandbox::EmulateApi(uc_engine* uc, uint64_t address, uint64_t rip,
            uc_mem_read(uc, rsp, &return_address, 8);

            // x64下，前4个参数通过寄存器传递，超过的部分通过栈传递
-            int stack_params = (paramCount > 4) ? (paramCount - 4) : 0;
+            // int stack_params = (paramCount > 4) ? (paramCount - 4) : 0;
            // 调整栈指针：每个参数8字节 + 返回地址8字节
-            rsp += (stack_params * 8) + 8;
-
+            // rsp += (stack_params * 8) + 8;
+            rsp += 8;
            // 设置RIP为返回地址
            uc_reg_write(uc, UC_X86_REG_RIP, &return_address);
        } else {  // 32位系统
--- a/ai_anti_malware/sandbox_callbacks.cpp
+++ b/ai_anti_malware/sandbox_callbacks.cpp
@@ -47,7 +47,7 @@ void handleCodeRun(uc_engine* uc, uint64_t address, uint32_t size,
        }
        cs_free(instruction, instructionCount);

-        dumpVmenv(uc, userData);
+        // dumpVmenv(uc, userData);
    }
 }

@@ -75,7 +75,6 @@ void handleMemoryRead(uc_engine* uc, uc_mem_type type, uint64_t address,
            "[handleMemoryRead] Address: %p Size: %p Rax: %p Rip: %p Error: %d "
            "ReadData: %p Rbp: %p\n",
            address, size, regRax, regRip, readError, readAddress, regRbp);
-        sandboxCallbacks::dumpVmenv(uc, sandbox);
    }
 }
 void dumpVmenv(uc_engine* uc, void* userData) {