151 lines
8.4 KiB
C++
151 lines
8.4 KiB
C++
#include "PatchSolutions.hpp"
|
|
#include <xstring.hpp>
|
|
|
|
#undef NKG_CURRENT_SOURCE_FILE
|
|
#undef NKG_CURRENT_SOURCE_LINE
|
|
#define NKG_CURRENT_SOURCE_FILE() TEXT(".\\navicat-patcher\\PatchSolution4-amd64.cpp")
|
|
#define NKG_CURRENT_SOURCE_LINE() __LINE__
|
|
|
|
namespace nkg {
|
|
|
|
PatchSolution4::PatchSolution4(const ImageInterpreter& Image) :
|
|
_Image(Image),
|
|
_DisassemblyEngine(CS_ARCH_X86, CS_MODE_64),
|
|
_AssemblyEngine(KS_ARCH_X86, KS_MODE_64),
|
|
_pbPatchMachineCode(nullptr),
|
|
_pbPatchNewPublicKey(nullptr) { _DisassemblyEngine.Option(CS_OPT_DETAIL, CS_OPT_ON); }
|
|
|
|
PatchSolution4::PatchSolution4(const ImageInterpreter* Image) :
|
|
_Image(*Image),
|
|
_DisassemblyEngine(CS_ARCH_X86, CS_MODE_64),
|
|
_AssemblyEngine(KS_ARCH_X86, KS_MODE_64),
|
|
_pbPatchMachineCode(nullptr),
|
|
_pbPatchNewPublicKey(nullptr) { _DisassemblyEngine.Option(CS_OPT_DETAIL, CS_OPT_ON); }
|
|
|
|
bool PatchSolution4::FindPatchOffset() noexcept {
|
|
try {
|
|
_pbPatchMachineCode = _Image.SearchSection<uint8_t*>(".text", [](const uint8_t* p) {
|
|
__try {
|
|
return
|
|
p[0] == 0x48 && p[1] == 0x8d && // prefix of "lea rcx, [rbp+5Fh+var_38]"
|
|
p[4] == 0x48 && p[5] == 0x83 && // prefix of "cmp [rbp+5Fh+var_20], 10h"
|
|
p[9] == 0x48 && p[10] == 0x0f && p[11] == 0x43 && // prefix of "cmovnb rcx, [rbp+5Fh+var_38]"
|
|
p[14] == 0x48 && p[15] == 0x8d && // prefix of "lea rax, [rbp+5Fh+var_58]"
|
|
p[18] == 0x48 && p[19] == 0x83 && // prefix of "cmp [rbp+5Fh+var_40], 10h"
|
|
p[23] == 0x48 && p[24] == 0x0f && p[25] == 0x43 && // prefix of "cmovnb rax, [rbp+5Fh+var_58]"
|
|
p[28] == 0x44 && p[29] == 0x0f && p[30] == 0xb6 && // prefix of "movzx r8d, byte ptr [rax+rdi]"
|
|
p[33] == 0x44 && p[34] == 0x02 && // prefix of "add r8b, [rcx+rdi]"
|
|
p[37] == 0xba && // prefix of "mov edx, 1"
|
|
p[42] == 0x48 && p[43] == 0x8b && // prefix of "mov rcx, rbx"
|
|
p[45] == 0xe8; // prefix of "call sub_1806E65F0"
|
|
} __except (EXCEPTION_EXECUTE_HANDLER) {
|
|
return false;
|
|
}
|
|
});
|
|
|
|
auto RegisterIndex = X86_REG_INVALID;
|
|
auto Disassembler = _DisassemblyEngine.CreateDisassembler();
|
|
Disassembler.SetContext({ _pbPatchMachineCode, 45, _Image.PointerToVa(_pbPatchMachineCode) });
|
|
|
|
if (Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next() && Disassembler.Next()) {
|
|
auto lpInsn = Disassembler.GetInstruction();
|
|
if (_stricmp(lpInsn->mnemonic, "movzx") == 0 &&
|
|
lpInsn->detail->x86.op_count == 2 &&
|
|
lpInsn->detail->x86.operands[0].type == X86_OP_REG &&
|
|
lpInsn->detail->x86.operands[1].type == X86_OP_MEM &&
|
|
lpInsn->detail->x86.operands[1].size == 1 &&
|
|
lpInsn->detail->x86.operands[1].mem.scale == 1)
|
|
{
|
|
RegisterIndex = lpInsn->detail->x86.operands[1].mem.index;
|
|
} else {
|
|
throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Unexpected machine code."));
|
|
}
|
|
} else {
|
|
throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Disassemble failed."));
|
|
}
|
|
|
|
if (Disassembler.Next() && Disassembler.Next() && Disassembler.Next()) {
|
|
auto lpInsn = Disassembler.GetInstruction();
|
|
|
|
//
|
|
// The previous instruction of "call sub_1806E65F0" should set RCX register.
|
|
//
|
|
if (_stricmp(lpInsn->mnemonic, "mov") != 0 ||
|
|
lpInsn->detail->x86.op_count < 1 ||
|
|
lpInsn->detail->x86.operands[0].type != X86_OP_REG ||
|
|
lpInsn->detail->x86.operands[0].reg != X86_REG_RCX)
|
|
{
|
|
throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Unexpected machine code."));
|
|
}
|
|
} else {
|
|
throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Disassemble failed."));
|
|
}
|
|
|
|
for (size_t i = 0; i < _Image.NumberOfSections(); ++i) {
|
|
auto lpSectionHeader = _Image.ImageSectionHeader(i);
|
|
if (lpSectionHeader->SizeOfRawData > lpSectionHeader->Misc.VirtualSize) {
|
|
auto cbReserved =
|
|
lpSectionHeader->SizeOfRawData -
|
|
lpSectionHeader->Misc.VirtualSize;
|
|
|
|
if (cbReserved >= 0x188) {
|
|
_pbPatchNewPublicKey = _Image.ImageSectionView<uint8_t*>(lpSectionHeader, lpSectionHeader->Misc.VirtualSize);
|
|
|
|
auto Assembler = _AssemblyEngine.CreateAssembler();
|
|
_NewMachineCode = Assembler.GenerateMachineCode(
|
|
std::xstring::format(
|
|
TEXT(
|
|
"lea rax, qword ptr[0x%.16llx];"
|
|
"mov r8b, byte ptr[rax + %hs];"
|
|
"mov edx, 1;"
|
|
),
|
|
_Image.PointerToVa(_pbPatchNewPublicKey),
|
|
_DisassemblyEngine.GetRegisterName(RegisterIndex)
|
|
).explicit_string().c_str(),
|
|
_Image.PointerToVa(_pbPatchMachineCode)
|
|
);
|
|
|
|
// >>>>>>>>>>>> .text:00000001819B02C0 48 8D 4D 27 lea rcx, [rbp + 5Fh + var_38]
|
|
// .text:00000001819B02C4 48 83 7D 3F 10 cmp[rbp + 5Fh + var_20], 10h
|
|
// 42 BYTES .text:00000001819B02C9 48 0F 43 4D 27 cmovnb rcx, [rbp + 5Fh + var_38]
|
|
// .text:00000001819B02CE 48 8D 45 07 lea rax, [rbp + 5Fh + var_58]
|
|
// THESE CODE .text:00000001819B02D2 48 83 7D 1F 10 cmp[rbp + 5Fh + var_40], 10h
|
|
// WILL BE .text:00000001819B02D7 48 0F 43 45 07 cmovnb rax, [rbp + 5Fh + var_58]
|
|
// REPLACED .text:00000001819B02DC 44 0F B6 04 38 movzx r8d, byte ptr[rax + rdi]
|
|
// .text:00000001819B02E1 44 02 04 39 add r8b, [rcx + rdi]
|
|
// <<<<<<<<<<<< .text:00000001819B02E5 BA 01 00 00 00 mov edx, 1
|
|
// .text:00000001819B02EA 48 8B CB mov rcx, rbx
|
|
// .text:00000001819B02ED E8 FE 62 D3 FE call sub_1806E65F0
|
|
while (_NewMachineCode.size() < 42) {
|
|
_NewMachineCode.emplace_back(0x90); // padding with "nop"
|
|
}
|
|
|
|
if (_NewMachineCode.size() != 42) {
|
|
throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Something unexpected happens."));
|
|
}
|
|
|
|
LOG_SUCCESS(0, "PatchSolution4 ...... Ready to apply");
|
|
LOG_HINT(4, "Machine code patch VA = 0x%zx", _Image.PointerToVa(_pbPatchMachineCode));
|
|
LOG_HINT(4, "New public key VA = 0x%zx", _Image.PointerToVa(_pbPatchNewPublicKey));
|
|
LOG_HINT(4, "New public key offset = 0x%zx", _Image.PointerToFileOffset(_pbPatchNewPublicKey));
|
|
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
|
|
throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("No space to store public key."));
|
|
} catch (nkg::Exception&) {
|
|
_pbPatchMachineCode = nullptr;
|
|
_pbPatchNewPublicKey = nullptr;
|
|
_NewMachineCode.clear();
|
|
|
|
LOG_FAILURE(0, "PatchSolution4 ...... Omitted");
|
|
|
|
return false;
|
|
}
|
|
}
|
|
|
|
}
|
|
|