Page 1 of 2

Calling API Hookeds Problem

Posted: Sun Feb 12, 2023 7:51 am
by fuzzing
After protect a file (.EXE on this case), .EXE calls MessageBoxA and that API can be hooked to log or alter his params.
If there any chance to make on VMProtect a API Wrapper to avoid calling the original hooked API?

Re: Calling API Hookeds Problem

Posted: Sun Feb 12, 2023 1:10 pm
by Catharsis
For MessageBox you can use the same trick as VMProtect.
A simple example:

Code: Select all

#include <windows.h>
#include <winternl.h>

#pragma comment(lib, "ntdll.lib")

extern "C" NTSTATUS NTAPI ZwRaiseHardError(LONG ErrorStatus, ULONG NumberOfParameters, ULONG UnicodeStringParameterMask,
    PULONG_PTR Parameters, ULONG ValidResponseOptions, PULONG Response);

int main()
{
    UNICODE_STRING msgBody;
    UNICODE_STRING msgCaption;

    ULONG ErrorResponse;

   const wchar_t cBody[] = L"Some message";
    msgBody.Length = sizeof(cBody) - sizeof(wchar_t);
    msgBody.MaximumLength = msgBody.Length;
    msgBody.Buffer = (wchar_t*)cBody;

   const wchar_t cCaption[] = L"Caption";
    msgCaption.Length = sizeof(cCaption) - sizeof(wchar_t);
    msgCaption.MaximumLength = msgCaption.Length;
    msgCaption.Buffer = (wchar_t*)cCaption;

    const ULONG_PTR msgParams[] = {
        (ULONG_PTR)&msgBody,
        (ULONG_PTR)&msgCaption,
        (ULONG_PTR)(MB_OK | MB_ICONWARNING)
    };

    ZwRaiseHardError(0x50000018L, 0x00000003L, 3, (PULONG_PTR)msgParams, NULL, &ErrorResponse);
    return 0;
}
Under certain conditions this trick does not work correctly, but these conditions are so rare that you can ignore it.

Re: Calling API Hookeds Problem

Posted: Sun Feb 12, 2023 1:13 pm
by Catharsis
This example can be improved by performing a manual map for ntdll

Re: Calling API Hookeds Problem

Posted: Sun Feb 12, 2023 3:27 pm
by Admin
Catharsis wrote: Under certain conditions this trick does not work correctly, but these conditions are so rare that you can ignore it.
Because your msgParams have wrong structure. They must have 4 parameters (the latest parameter specifies the timeout and usually it equals INFINITE):
const ULONG_PTR msgParams[] = {
(ULONG_PTR)&msgBody,
(ULONG_PTR)&msgCaption,
(ULONG_PTR)(MB_OK | MB_ICONWARNING),
INFINITE
};
ZwRaiseHardError(0x50000018L, 4, 3, (PULONG_PTR)msgParams, NULL, &ErrorResponse); // 0x50000018L = STATUS_SERVICE_NOTIFICATION | HARDERROR_OVERRIDE_ERRORMODE

Re: Calling API Hookeds Problem

Posted: Sun Feb 12, 2023 4:49 pm
by Catharsis
Возможно с количеством параметров Вы правы, так как код не мой, а был взят с одного из форумов, но с 3 параметрами тоже работает (видимо из-за счастливого стечения обстоятельств).
Под редким условием я подразумевал настройку ACL для процесса. Окно отображается, но оно пустое (без нужного текста).
При надобности я могу зарепортить в отдельной теме с демкой для воспроизведения проблемы

Re: Calling API Hookeds Problem

Posted: Sun Feb 12, 2023 5:08 pm
by Admin
Без нужного текста - это скорее всего проблемы с инициализацией UNICODE_STRING, либо с массивом аргументов (например сам массив не выровнен на границу 4/8 байт).

Code: Select all

__forceinline void InitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
{
	if (SourceString)
		DestinationString->MaximumLength = (DestinationString->Length = (USHORT)(wcslen(SourceString) * sizeof(WCHAR))) + sizeof(UNICODE_NULL);
	else
		DestinationString->MaximumLength = DestinationString->Length = 0;

	DestinationString->Buffer = (PWCH)SourceString;
}

Re: Calling API Hookeds Problem

Posted: Sun Feb 12, 2023 9:19 pm
by fuzzing
MessageBox was just a example, what we can do with anothers APIs ?
Can VMP add a API Wrapping?

Re: Calling API Hookeds Problem

Posted: Mon Feb 13, 2023 10:23 am
by Catharsis
Admin wrote:Без нужного текста - это скорее всего проблемы с инициализацией UNICODE_STRING, либо с массивом аргументов (например сам массив не выровнен на границу 4/8 байт).
Для реализации в VMP эта проблема тоже актуальна. Отправил репорт на info@vmpsoft.com с описанием и файлами для демонстрации (Subject письма: "ZwRaiseHardError bug")

Re: Calling API Hookeds Problem

Posted: Wed Feb 15, 2023 4:26 am
by fuzzing
Any news or plans?

Re: Calling API Hookeds Problem

Posted: Wed Feb 15, 2023 1:15 pm
by Admin
VMProtect doesn't protect system DLLs against hooks.

Re: Calling API Hookeds Problem

Posted: Thu Feb 16, 2023 11:15 am
by fuzzing
Admin wrote:VMProtect doesn't protect system DLLs against hooks.
Its there any chance to add a API Wrapper ?

Re: Calling API Hookeds Problem

Posted: Thu Feb 16, 2023 11:23 am
by Catharsis
fuzzing wrote: Its there any chance to add a API Wrapper ?
What prevents you from implementing a check for the most common hooks yourself?

Re: Calling API Hookeds Problem

Posted: Sat Feb 18, 2023 12:08 pm
by fuzzing
Catharsis wrote:
fuzzing wrote: Its there any chance to add a API Wrapper ?
What prevents you from implementing a check for the most common hooks yourself?
Because there are too many ways of hook a APi.
Checking for 0xE9 or things like that can be bypassed just changing the instruction hooking method.

Re: Calling API Hookeds Problem

Posted: Sun Feb 19, 2023 2:36 pm
by Catharsis
fuzzing wrote:Because there are too many ways of hook a APi.
You have now answered your own question

Re: Calling API Hookeds Problem

Posted: Sun Feb 19, 2023 9:59 pm
by fuzzing
Catharsis wrote:
fuzzing wrote:Because there are too many ways of hook a APi.
You have now answered your own question
Nope, patching the first bytes of a API can be avoided by making somewhat type of API Wrapper like Themida does, but honestly i don't like Themida, i don't use it and i will not use it, im on the VMProtect way, and will be nice if it can add somewhat of API Wrapper too!