mirror of
https://github.com/morluto/rea.git
synced 2026-10-19 04:19:54 -05:00
Ysopwnable
2b5ee72d26
Admit Windows ARMNT/Thumb-2 and ARM64 PE targets using preserved COFF machine facts. Keep unsupported machine gates explicit and distinguish loader-selected versus configured language provenance. Verified with real Windows Ghidra 12.1.4 CLI/MCP workflows, ARM fixtures and Microsoft-signed Coreinfo ARM64 / MSVCR120 ARM inputs. Resource limits, analyzer overrides, startup timeout observations and verification gaps are documented in the PR. Final CI and automated review passed. Fixes #2186
253 lines
9.3 KiB
JavaScript
253 lines
9.3 KiB
JavaScript
import { mkdir, writeFile } from "node:fs/promises";
|
|
import { dirname, resolve } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { writeWindowsGhidraByteSearchFixture } from "./lib/ghidra-windows-byte-search.mjs";
|
|
|
|
import {
|
|
WINDOWS_GHIDRA_FIXTURE_ARCHITECTURES,
|
|
windowsGhidraFixtureOptions,
|
|
} from "./lib/ghidra-windows-fixture-options.mjs";
|
|
|
|
const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
|
|
// Source-owned static fixtures: no compiler, target loading or execution.
|
|
for (const architecture of WINDOWS_GHIDRA_FIXTURE_ARCHITECTURES) {
|
|
for (const dll of [false, true]) {
|
|
const x86 = architecture === "x86";
|
|
const arm = architecture === "arm";
|
|
const arm64 = architecture === "arm64";
|
|
const fixture = windowsGhidraFixtureOptions([
|
|
...(architecture === "x86_64" ? [] : [`--${architecture}`]),
|
|
...(dll ? ["--dll"] : []),
|
|
]);
|
|
const pe32 = fixture.pe32;
|
|
const output = resolve(root, "build", "fixtures", fixture.filename);
|
|
const bytes = Buffer.alloc(dll ? 1024 : 1536);
|
|
const peOffset = 0x80;
|
|
const optionalHeader = peOffset + 24;
|
|
const optionalHeaderSize = pe32 ? 0xe0 : 0xf0;
|
|
const sectionTable = optionalHeader + optionalHeaderSize;
|
|
const directories = optionalHeader + (pe32 ? 96 : 112);
|
|
|
|
bytes.write("MZ", 0, "ascii");
|
|
bytes.writeUInt32LE(peOffset, 0x3c);
|
|
bytes.write("PE\0\0", peOffset, "binary");
|
|
// The fixture descriptor owns COFF machine, width and function coordinates.
|
|
bytes.writeUInt16LE(fixture.machine, peOffset + 4);
|
|
bytes.writeUInt16LE(dll ? 1 : 2, peOffset + 6);
|
|
bytes.writeUInt16LE(optionalHeaderSize, peOffset + 20);
|
|
bytes.writeUInt16LE(
|
|
(pe32 ? 0x102 : 0x22) | (dll ? 0x2000 : 0),
|
|
peOffset + 22,
|
|
);
|
|
|
|
// ARM64 PE uses the PE32+ optional header (magic 0x20b), like x86-64.
|
|
bytes.writeUInt16LE(pe32 ? 0x10b : 0x20b, optionalHeader);
|
|
bytes.writeUInt32LE(0x200, optionalHeader + 4);
|
|
if (!dll) bytes.writeUInt32LE(0x200, optionalHeader + 8);
|
|
bytes.writeUInt32LE(dll ? 0 : arm ? 0x1001 : 0x1000, optionalHeader + 16);
|
|
bytes.writeUInt32LE(0x1000, optionalHeader + 20);
|
|
if (pe32)
|
|
bytes.writeUInt32LE(Number(fixture.imageBase), optionalHeader + 28);
|
|
else bytes.writeBigUInt64LE(fixture.imageBase, optionalHeader + 24);
|
|
bytes.writeUInt32LE(0x1000, optionalHeader + 32);
|
|
bytes.writeUInt32LE(0x200, optionalHeader + 36);
|
|
bytes.writeUInt16LE(6, optionalHeader + 40);
|
|
bytes.writeUInt16LE(6, optionalHeader + 48);
|
|
bytes.writeUInt32LE(dll ? 0x2000 : 0x3000, optionalHeader + 56);
|
|
bytes.writeUInt32LE(0x200, optionalHeader + 60);
|
|
bytes.writeUInt16LE(3, optionalHeader + 68);
|
|
bytes.writeUInt16LE(pe32 ? 0x8140 : 0x8160, optionalHeader + 70);
|
|
if (pe32) {
|
|
bytes.writeUInt32LE(0x10_0000, optionalHeader + 72);
|
|
bytes.writeUInt32LE(0x1000, optionalHeader + 76);
|
|
bytes.writeUInt32LE(0x10_0000, optionalHeader + 80);
|
|
bytes.writeUInt32LE(0x1000, optionalHeader + 84);
|
|
bytes.writeUInt32LE(16, optionalHeader + 92);
|
|
} else {
|
|
bytes.writeBigUInt64LE(0x10_0000n, optionalHeader + 72);
|
|
bytes.writeBigUInt64LE(0x1000n, optionalHeader + 80);
|
|
bytes.writeBigUInt64LE(0x10_0000n, optionalHeader + 88);
|
|
bytes.writeBigUInt64LE(0x1000n, optionalHeader + 96);
|
|
bytes.writeUInt32LE(16, optionalHeader + 108);
|
|
}
|
|
|
|
bytes.write(".text", sectionTable, "ascii");
|
|
bytes.writeUInt32LE(0x200, sectionTable + 8);
|
|
bytes.writeUInt32LE(0x1000, sectionTable + 12);
|
|
bytes.writeUInt32LE(0x200, sectionTable + 16);
|
|
bytes.writeUInt32LE(0x200, sectionTable + 20);
|
|
bytes.writeUInt32LE(0x6000_0020, sectionTable + 36);
|
|
|
|
// EXE entry returns zero. DLL caller adds one to the callee's 42.
|
|
if (arm) {
|
|
// ARMNT uses Thumb instructions and low-bit-tagged PE entry/export RVAs.
|
|
// PUSH keeps SP aligned and preserves LR across BL from 0x1002 to 0x1020.
|
|
bytes.set(
|
|
[
|
|
0x10,
|
|
0xb5,
|
|
0x00,
|
|
0xf0,
|
|
0x0d,
|
|
0xf8,
|
|
dll ? 0x01 : 0x00,
|
|
dll ? 0x30 : 0x20,
|
|
0x10,
|
|
0xbd,
|
|
],
|
|
0x200,
|
|
);
|
|
bytes.set([0x2a, 0x20, 0x70, 0x47], 0x220);
|
|
} else if (arm64) {
|
|
// Preserve the caller's frame/link registers across BL. The callee
|
|
// starts at RVA 0x1020, outside the five-instruction caller.
|
|
const instructions = [
|
|
0xa9bf7bfd, // STP X29, X30, [SP, #-16]!
|
|
0x94000007, // BL +0x1c from RVA 0x1004 to RVA 0x1020
|
|
dll ? 0x11000400 : 0x52800000, // ADD W0,W0,#1 / MOV W0,#0
|
|
0xa8c17bfd, // LDP X29, X30, [SP], #16
|
|
0xd65f03c0, // RET
|
|
];
|
|
for (const [index, instruction] of instructions.entries())
|
|
bytes.writeUInt32LE(instruction, 0x200 + index * 4);
|
|
bytes.set([0x40, 0x05, 0x80, 0x52, 0xc0, 0x03, 0x5f, 0xd6], 0x220);
|
|
} else {
|
|
bytes.set(
|
|
dll
|
|
? [0xe8, 0x0b, 0, 0, 0, 0x83, 0xc0, 1, 0xc3]
|
|
: [0xe8, 0x0b, 0, 0, 0, 0xe8, 0x16, 0, 0, 0, 0x31, 0xc0, 0xc3],
|
|
0x200,
|
|
);
|
|
bytes.set(
|
|
x86 && !dll
|
|
? [0xb8, 0x2a, 0, 0, 0, 0xe8, 0x66, 0, 0, 0, 0xc3]
|
|
: [0xb8, 0x2a, 0, 0, 0, 0xc3],
|
|
0x210,
|
|
);
|
|
}
|
|
|
|
if (x86 && !dll) {
|
|
// A statically analyzed Borland-style SEH registration whose handler
|
|
// entry is referenced but is not part of the registering function body.
|
|
bytes.set(
|
|
[
|
|
0x55, // PUSH EBP
|
|
0x89,
|
|
0xe5, // MOV EBP, ESP
|
|
0x68,
|
|
0xc0,
|
|
0x10,
|
|
0x40,
|
|
0x00, // PUSH 0x4010c0
|
|
0x64,
|
|
0xff,
|
|
0x35,
|
|
0,
|
|
0,
|
|
0,
|
|
0, // PUSH DWORD PTR FS:[0]
|
|
0x64,
|
|
0x89,
|
|
0x25,
|
|
0,
|
|
0,
|
|
0,
|
|
0, // MOV DWORD PTR FS:[0], ESP
|
|
0x64,
|
|
0x8f,
|
|
0x05,
|
|
0,
|
|
0,
|
|
0,
|
|
0, // POP DWORD PTR FS:[0]
|
|
0x83,
|
|
0xc4,
|
|
0x04, // ADD ESP, 4
|
|
0x5d, // POP EBP
|
|
0xc3, // RET
|
|
],
|
|
0x280,
|
|
);
|
|
bytes.set([0xc3], 0x2c0);
|
|
}
|
|
|
|
if (!dll) {
|
|
const dataSection = sectionTable + 40;
|
|
bytes.write(".data", dataSection, "ascii");
|
|
bytes.writeUInt32LE(0x20, dataSection + 8);
|
|
bytes.writeUInt32LE(0x2000, dataSection + 12);
|
|
bytes.writeUInt32LE(0x200, dataSection + 16);
|
|
bytes.writeUInt32LE(0x400, dataSection + 20);
|
|
bytes.writeUInt32LE(0xc000_0040, dataSection + 36);
|
|
bytes.writeUInt32LE(0x1122_3344, 0x400);
|
|
const referenceInstructions = x86
|
|
? [
|
|
"ba00204000", // MOV EDX, address: DATA only.
|
|
"a100204000", // MOV EAX, [address]: READ.
|
|
"a304204000", // MOV [address], EAX: WRITE.
|
|
"ba10204000", // Indexed base, unknown ECX.
|
|
"85db", // TEST EBX, EBX: two candidate bases.
|
|
"7405", // JZ over the alternate base.
|
|
"ba18204000", // MOV EDX, alternate base.
|
|
"c6040a01", // MOV byte [EDX + ECX], 1.
|
|
"ffd7", // CALL EDI: unknown target.
|
|
"c3",
|
|
]
|
|
: arm
|
|
? ["7047"] // Thumb return; x86 reference-flow controls do not apply.
|
|
: arm64
|
|
? [
|
|
"010000b0", // ADRP X1, .data page (RVA 0x2000): DATA.
|
|
"200040b9", // LDR W0, [X1]: READ.
|
|
"200000b9", // STR W0, [X1]: WRITE.
|
|
"c0035fd6", // RET.
|
|
]
|
|
: [
|
|
"488d15d90f0000", // LEA RDX, [RIP + displacement]: DATA.
|
|
"8b05d30f0000", // MOV EAX, [RIP + displacement]: READ.
|
|
"8905d10f0000", // MOV [RIP + displacement], EAX: WRITE.
|
|
"488d15d60f0000", // Indexed base, unknown RCX.
|
|
"85db", // TEST EBX, EBX: two candidate bases.
|
|
"7407", // JZ over the alternate base.
|
|
"488d15d30f0000", // LEA RDX, alternate base.
|
|
"c6040a01", // MOV byte [RDX + RCX], 1.
|
|
"41ffd0", // CALL R8: unknown target.
|
|
"c3",
|
|
];
|
|
bytes.set(
|
|
Buffer.from(referenceInstructions.join(""), "hex"),
|
|
arm || arm64 ? 0x230 : 0x220,
|
|
);
|
|
}
|
|
|
|
if (dll) {
|
|
// Export both functions; an entry-point-free library is discovered by exports.
|
|
bytes.writeUInt32LE(0x1040, directories);
|
|
bytes.writeUInt32LE(0x130, directories + 4);
|
|
const exports = 0x240;
|
|
bytes.writeUInt32LE(0x1100, exports + 12);
|
|
bytes.writeUInt32LE(1, exports + 16);
|
|
bytes.writeUInt32LE(2, exports + 20);
|
|
bytes.writeUInt32LE(2, exports + 24);
|
|
bytes.writeUInt32LE(0x1080, exports + 28);
|
|
bytes.writeUInt32LE(0x1088, exports + 32);
|
|
bytes.writeUInt32LE(0x1090, exports + 36);
|
|
bytes.writeUInt32LE(arm ? 0x1001 : 0x1000, 0x280);
|
|
bytes.writeUInt32LE(fixture.calleeRva + (arm ? 1 : 0), 0x284);
|
|
bytes.writeUInt32LE(0x1120, 0x288);
|
|
bytes.writeUInt32LE(0x1140, 0x28c);
|
|
bytes.writeUInt16LE(0, 0x290);
|
|
bytes.writeUInt16LE(1, 0x292);
|
|
bytes.write("rea-fixture.dll\0", 0x300, "binary");
|
|
bytes.write("fixture_caller\0", 0x320, "binary");
|
|
bytes.write("fixture_return42\0", 0x340, "binary");
|
|
}
|
|
|
|
writeWindowsGhidraByteSearchFixture(bytes);
|
|
|
|
await mkdir(dirname(output), { recursive: true });
|
|
await writeFile(output, bytes);
|
|
if (architecture === "x86_64" && !dll) process.stdout.write(`${output}\n`);
|
|
}
|
|
}
|