tramper.py

# tramper.py

# Relocates bytes of an API and creates a jump from those bytes to the original API affectively negating a hook.

# TODO !Recalculate Relocated Relative jmp and call addresses. 

# public domain code.



from ctypes import *

from win32api import *

from pytcc import pytcc

from struct import pack, unpack

from win32gui import PyGetString, PySetMemory, PySetString

from win32con import MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE, PROCESS_ALL_ACCESS



from distorm import Decode

from patcher import OpenProcess, readMemory, writeMemory, allocate, transport





DEBUG  = True

def DB (msg):

    global DEBUG

    if DEBUG: print (msg)



















def tramper (apiaddress, hook_size, apiname=None, dllname="kernel32"):

    """tramper (apiaddress, hook_size, apiname=None, dllname="kernel32"):

Creates a duplicate API using the trampoline method and returns its address.

    """

    

    if DEBUG: global hprocess, landing_offset, instructions, landing_address, tramp_memory, tramp_code, original_bytes



    if not apiaddress:

        dll = LoadLibrary (dllname)

        apiaddress = GetProcAddress (dll, apiname)

    

    landing_offset = 0 

    hprocess = OpenProcess ()

    original_bytes = PyGetString (apiaddress, 300)



    tramp_memory = allocate (len (original_bytes) + 50, hprocess)

    print "Tramp memory: %s    %s." % (tramp_memory, hex (tramp_memory))



    instructions = Decode (apiaddress, original_bytes)

    sizes = iter ([X[1] for X in instructions])





    while landing_offset < hook_size:



        landing_offset += sizes.next ()





    landing_address = apiaddress + landing_offset

    

    DB ("Landing offset : %s    %s" % (landing_offset, hex (landing_offset)))

    DB ("Landing address: %s    %s"  % (landing_address, hex (landing_address)))



    distance = landing_address - (tramp_memory +landing_offset)

    DB ("Distance: %s    %s." % (distance, hex (distance)))

    

    tramp_code = original_bytes [:landing_offset] # api start - past hook - to start of instruction

    instructions = Decode (apiaddress, tramp_code)



           

    boffset = 0

    for offset, size, instruction, hexstr in instructions:

     

        if filter (lambda x:x.lower() in instruction.lower(), ["call", "jmp"]):

            raise "[not supported yet] Cannot relocate CALL/JMP Instructions. Address: %s"% (apiaddress + boffset)



        boffset += size





    #

    # TODO !Recalculate Relocated Relative jmp and call addresses. 

    #





    jump_code = '\xe9' + pack ("i", distance - 5)   # bytes = jmp (distance - size of jump)   

    tramp_code += jump_code



    # DEBUG

    DB ("Tramp [size]: %s [bytes]; %s" % (len(tramp_code), (repr(tramp_code))))

    DB ("Tramper api decode.")

    if DEBUG:    dprint (apiaddress, tramp_code)

    # # # #



    writeMemory (hprocess, tramp_memory, tramp_code)

    CloseHandle (hprocess)



    return tramp_memory

















def dprint (a, c):

    """ pretty print disassembled bytes. dprint (offset, bytes)."""



    x = Decode (a, c)

    print "[deci addr  :  hexi addr] [size]       instruction\n" 



    for offset, size, instruction, hexstr in x:



        print "[%s : %s]  [%s]        %s" % (a,hex (a), size, instruction)

        a += size

        













if __name__ == "__main__":

    

    # Test.



    lib = LoadLibrary ("kernel32")

    OpenProcessAddr = GetProcAddress (lib, "OpenProcess")

    FreeLibrary (lib)



    

    trampAddr = tramper (\



        apiaddress=OpenProcessAddr,  # (optional if apiname is defined) API address to duplicate.

        hook_size=10, # size of our API jmp code. (minimum size of relocated API bytes)

        apiname=None, # (optional)

        dllname="kernel32") # (optional / defaults to kernel32)







    # Prototype the OpenProcess trampoline.

    duplicate_OpenProcess = WINFUNCTYPE (c_int, c_int, c_int, c_int) (trampAddr)



    pid = GetCurrentProcessId ()



    print "Calling duplicate OpenProcess with pid: %s" % pid

    phandle = duplicate_OpenProcess (0x1f0fff, 0, pid)

    print "Return value: %s." %phandle



    if phandle: CloseHandle (phandle)

    



    



#cad