lelong

http://www.ehsanauctioneers.com/home/auction_listing.asp?StartPage=3&sltPropertyType=0&
http://www.auctions.com.my/
http://www.ngchanmau.com/listing_browse.php?address=&audate=08-Sep-2012&Type=Residential&price=100000&State=Selangor&submit.x=56&submit.y=13

blog
http://mylife-wakif.blogspot.com/search?updated-max=2012-06-28T10:15:00%2B08:00&max-results=4&start=4&by-date=false
http://faridzaswadi.blogspot.com/2012/03/cerita-lelongan-bulan-feb.html
http://tuanbri.com/blog/
http://www2.pie2020.com/blog/page/10/


seremban2
http://www.auctions.com.my/ASP/list-details-current.asp?RefNo=PAH16224&Key=75470

jejak ralat libemu

1) run python dlm gdb(maksudnya, debug mode)

# gdb /usr/bin/python

2) Start python

(gdb) run

3) Jika nama file libemu_test.py, maka

>> import libemu_test
0x401019L hex: A83D asm: test al,0x3d

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()

4) Back trace

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff58650f6 in emu_cpu_step (c=0xc3fb40) at emu_cpu.c:839
#2  0x00007ffff5b51fbb in __pyx_pf_8pylibemu_8Emulator_25cpu_step (__pyx_v_self=, unused=)
    at src/pylibemu.c:6735
#3  0x000000000042afec in PyEval_EvalFrameEx ()
#4  0x00000000004317f2 in PyEval_EvalCodeEx ()
#5  0x000000000054a078 in PyImport_ExecCodeModuleEx ()
#6  0x000000000050d091 in ?? ()
#7  0x000000000050da8b in ?? ()

5) tukar kepada frame 1  (frame ni refering to stack) (rasanya lah:))

(gdb) frame 1
#1  0x00007ffff58650f6 in emu_cpu_step (c=0xc3fb40) at emu_cpu.c:839
839                     ret = c->cpu_instr_info->function(c, &c->instr.cpu);

6)

(gdb) ptype c
type = struct emu_cpu {
    struct emu *emu;
    struct emu_memory *mem;
    uint32_t debugflags;
    uint32_t eip;
    uint32_t eflags;
    uint32_t reg[8];
    uint16_t *reg16[8];
    uint8_t *reg8[8];
    struct emu_instruction instr;
    struct emu_cpu_instruction_info *cpu_instr_info;
    uint32_t last_fpu_instr[2];
    char *instr_string;
    _Bool repeat_current_instr;
    struct emu_track_and_source *tracking;
} *

7)

(gdb) print c
$1 = (struct emu_cpu *) 0xc3fb40

8)

(gdb) print c->cpu_instr_info
$2 = (struct emu_cpu_instruction_info *) 0x7ffff5aedbc0

9)

(gdb) print c->cpu_instr_info->function
$3 = (int32_t (*)(struct emu_cpu *, struct emu_cpu_instruction *)) 0

sah yang problem adalah kat sini, sebab value adalah 0 (kosong)(yg paling kanan). Maksudnya pointer fungsi 'function' point to null.

Maka kena semak code yang initialize cpu_instr_info-> function

10)

(gdb) ptype c->cpu_instr_info
type = struct emu_cpu_instruction_info {
    int32_t (*function)(struct emu_cpu *, struct emu_cpu_instruction *);
    const char *name;
    struct {
        uint8_t s_bit : 1;
        uint8_t w_bit : 1;
        uint8_t modrm_byte : 4;
        uint8_t imm_data : 3;
        uint8_t disp_data : 3;
        uint8_t level : 2;
        uint8_t type : 2;
        uint8_t fpu_info : 1;
    } format;
} *

jelajah PEB

1) struktur: PEB_LDR_DATA

typedef struct _PEB_LDR_DATA
{
0x0      ULONG Length;
0x4      BOOLEAN Initialized;
0x8      PVOID SsHandle;
0xc      LIST_ENTRY InLoadOrderModuleList;
0x14     LIST_ENTRY InMemoryOrderModuleList;
0x1c     LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;

Cara nak dapatkan struktur ini adalah:
mov eax, fs:[30]  ; -> eax adalah lokasi PEB
mov eax, [ eax + 0xc] ; ->  eax adalah lokasi PEB_LDR_DATA berada

[PEB_LDR_DATA.InInitializationOrderModuleList] -> First LDR_DATA_TABLE_ENTRY struktur

2) struktur: LDR_DATA_TABLE_ENTRY

typedef struct _LDR_DATA_TABLE_ENTRY
{
0x0    LIST_ENTRY InLoadOrderLinks;
0x8    LIST_ENTRY InMemoryOrderLinks;
0x10   LIST_ENTRY InInitializationOrderLinks;
0x18   PVOID DllBase;
0x1c   PVOID EntryPoint;
0x20   ULONG SizeOfImage;
0x24   UNICODE_STRING FullDllName;
0x2c   UNICODE_STRING BaseDllName;
       ULONG Flags;
       WORD LoadCount;
       WORD TlsIndex;
       union
       {
            LIST_ENTRY HashLinks;
            struct
            {
                 PVOID SectionPointer;
                 ULONG CheckSum;
            };
       };
       union
       {
            ULONG TimeDateStamp;
            PVOID LoadedImports;
       };
       _ACTIVATION_CONTEXT * EntryPointActivationContext;
       PVOID PatchInformation;
       LIST_ENTRY ForwarderLinks;
       LIST_ENTRY ServiceTagLinks;
       LIST_ENTRY StaticLinks;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

FullDllName -> nama dll beserta lokasi file (UNICODE "C:\Windows\system32\kernel32.dll")
BaseDllName -> hanya nama dll   (UNICODE "kernel32.dll")

*note: dlm libemu, FullDllName adalah empty, so kalau shellcode guna FullDllName instead of BaseDllName, libemu tak dapat simulasikan shellcode. Boleh consider sebagai anti-libemu features


3) UNICODE_STRING (8 byte)

typedef struct _UNICODE_STRING
{
     WORD Length;                2 byte
     WORD MaximumLength;         2 byte
     WORD * Buffer;              4 byte (pointer to word)
} UNICODE_STRING, *PUNICODE_STRING;

Maka, offset utk BaseDLLName : 0x2c + 4 = 0x30


ref  http://undocumented.ntinternals.net/UserMode/Structures/PEB_LDR_DATA.html
ref >> http://www.nirsoft.net/kernel_struct/vista/LDR_DATA_TABLE_ENTRY.html

IMAGE_EXPORT_DIRECTORY (struktur)

public struct IMAGE_EXPORT_DIRECTORY
{
0x00    public UInt32 Characteristics;
0x04    public UInt32 TimeDateStamp;
0x08    public UInt16 MajorVersion;
0x0a    public UInt16 MinorVersion;
0x0c    public UInt32 Name;
0x10    public UInt32 Base;
0x14    public UInt32 NumberOfFunctions;
0x18    public UInt32 NumberOfNames;
0x1c    public UInt32 AddressOfFunctions; // RVA from base of image
0x20    public UInt32 AddressOfNames; // RVA from base of image
0x24    public UInt32 AddressOfNameOrdinals; // RVA from base of image
}

imageBase + DataDirectories[ExportDir RVA]  = adalah pointer kepada struktur kat atas

ref>>  http://pinvoke.net/default.aspx/Structures.IMAGE_EXPORT_DIRECTORY

opcode kepada assembly

objdump -b binary -m i386 -D shellcode.bin

refer to http://siperdana.blogspot.com/2012/05/convert-assembly-to-opcode.html

mysql hex dan reverse

SELECT HEX( 65 ) , CAST( 0x41 AS UNSIGNED )
>>

hex(65)	cast(0x41 as unsigned)
41	65

Rajah Import Address Table

ref: http://sandsprite.com/CodeStuff/Understanding_imports.html