Practical Appcall examples [Archive] - RCE Messageboard's Regroupment

Hex Blog

January 18th, 2010, 07:17

Last week we introduced the new Appcall feature ("http://hexblog.com/2010/01/introducing_the_appcall_featur_1.html") in IDA Pro 5.6. Today we will talk a little about how it's implemented and describe some of the uses of Appcall in various scenarios.</p>How Appcall works

Given a function with a correct prototype, the Appcall mechanism works like this:

Save the current thread context
Serialize the parameters (we do not allocate memory for the parameters, we use the debuggee's stack)
Modify the input registers in question
Set the instruction pointer to the beginning of the function to be called
Adjust the return address so it points to a special area where we have a breakpoint (we refer to it as control breakpoint)
Resume the program and wait until we get an exception or the control breakpoint (inserted in the previous step)Deserialize back the input (only for parameters passed by reference) and save the return value

In the case of a manual Appcall, the debugger module will do all but the last two steps, thus giving you a chance to debug interactively the function in question.
When you encounter the control breakpoint:

http://hexblog.com/ida_pro/pix/appcall_manual_control.gif

you can issue the CleanupAppcall() IDC command to restore the previously saved thread context and resume your debugging session. Using the debuggee functions

Sometimes it is useful to call certain functions from inside your debuggee's context:

Functions that you identified as cryptographic functions: encrypt/decrypt/hashing functions
Explicitly call not-so-popular functions: instead of waiting the program to call a certain function, simply call it directly
Change the program logic: by calling certain debuggee functions it is possible to change the logic and the internal state of the program
Extend your program: since Appcall can be used inside the condition expression of a conditional breakpoint, it is possible to extend applications that way
Fuzzing applications: easily fuzz your program on a function level...

Let's take a program that contains a decryption routine that we want to use:

http://hexblog.com/ida_pro/pix/appcall_xdecrypt.gif

In IDC, you can do something like:

Code:

auto s_in = "SomeEncryptedBuffer", s_out = strfill(SizeOfBuffer);

decrypt_buffer(&s_in, &s_out, SizeOfBuffer);

Or in Python:

Code:

# Explicitly create the buffer as a byref object

s_in = Appcall.byref("SomeEncryptedBuffer"

# Buffers are always returned byref

s_out = Appcall.buffer(" ", SizeOfBuffer)

# Call the debuggee

Appcall.decrypt_buffer(s_in, s_out, SizeOfBuffer)

# Print the result

print "decrypted=", s_out.value

Function level fuzzing

Instead of generating input strings and passing them to the application as command line arguments, input files, etc...it is also possible to test the application on a function level using Appcall.
It is sufficient to find the functions we want to test, give them appropriate prototypes and Appcall each one of these functions with the desired set of (malformed) input.

Code:

def fuzz_func1():

  """

  Finds functions with one parameter that take a string buffer and tries to see if one

  of these functions will crash if a malformed input was passed

  """

  

  # prepare functions search criteria

  tps  = ['LPCWSTR', 'LPCSTR', 'char *', 'const char *', 'wchar_t *']

  tpsf = [1    , 0     , 0     , 0       , 1]

  pat  = r'\((%s)\s*\w*\)' % "|".join(tps).replace('*', r'\*')



  # set Appcall options

  old_opt = Appcall.set_appcall_options(Appcall.APPCALL_DEBEV)



  # Enumerate all functions

  for x in Functions():

    # Get the type string

    t = GetType(x)

    if not t:

      continue

    # Try to parse its declaration

    t = re.search(pat, t)

    if not t:

      continue



    # Check if the parameter is a unicode string or not

    is_unicode = tpsf[tps.index(t.group(1))]



    

    # Form the input string: here we can generate mutated input

    # and keep on looping until our input pool for this function is exhausted.

    # For demonstration purposes only one string is passed to the Appcalled functions

    s = "A" * 1000

    # Do the Appcall but protect it with try/catch to receive the exceptions

    try:

      # Create the buffer appropriately

      if is_unicode:

        buf = Appcall.unicode(s)

      else:

        buf = Appcall.buffer(s)

      print "%x: calling. unicode=%d" % (x, is_unicode)

      # Call the function in question

      r = Appcall[x](buf)

    except OSError, e:

      exc_code = idaapi.as_uint32(e.args[0].code)

      print "%X: Exception %X occurred @ %X. Info: <%s>\n" % (x, 

        exc_code, e.args[0].ea, e.args[0].info)

      # stop the test

      break

    except Exception, e:

      print "%x: Appcall failed!" % x

      break

  # Restore Appcall options

  Appcall.set_appcall_options(old_opt)