DCAgent Exploit Kernel32.dll Offset Generator

calc_magic.rb

#!/usr/bin/env ruby

require 'pedump'
require 'colorize'

@lang = {
  0x0401 => 'ar',
  0x0415 => 'pl',
  0x0402 => 'bg',
  0x0416 => 'pt-br',
  0x0403 => 'ca',
  0x0417 => 'rm',
  0x0404 => 'zh',
  0x0418 => 'ro',
  0x0405 => 'cs',
  0x0419 => 'ru',
  0x0406 => 'da',
  0x041A => 'bs',
  0x0407 => 'de',
  0x041B => 'sk',
  0x0408 => 'el',
  0x041C => 'sq',
  0x0409 => 'en',
  0x041D => 'sv',
  0x040A => 'es-es',
  0x0C0A => 'es',
  0x041E => 'th',
  0x040B => 'fi',
  0x041F => 'tr',
  0x040C => 'fr',
  0x0420 => 'ur',
  0x040D => 'he',
  0x0421 => 'id',
  0x040E => 'hu',
  0x0804 => 'zh-Hans',
  0x040F => 'is',
  0x0807 => 'de-che',
  0x0410 => 'it',
  0x0809 => 'en-uk',
  0x0411 => 'jp',
  0x080A => 'en-mx',
  0x0412 => 'ko',
  0x080C => 'fr-be',
  0x0413 => 'nl',
  0x0C0C => 'fr-can',
  0x0414 => 'no',
  0x100C => 'fr-che',
  0x0810 => 'it-che',
  0x0816 => 'pt',
  0x0813 => 'no-be',
  0x081A => 'hr',
  0x0814 => 'no-ny'
}

def parse_dll(dll)
  delta = {}
  begin
    if `file #{dll}` =~ /Intel 80386 32-bit/
      dllfile = File.open(dll, 'rb')
      pedump = PEdump.new(dllfile)
      vi = pedump.resources.find_all{ |r| r.type == 'VERSION'}.first.data.first
      version = [
        vi.Value.dwFileVersionMS.to_i >> 16,
        vi.Value.dwFileVersionMS.to_i &  0xffff,
        vi.Value.dwFileVersionLS.to_i >> 16,
        vi.Value.dwFileVersionLS.to_i &  0xffff
      ].join('.')
      lang_id  = pedump.resources.find_all{ |r| r.type == 'VERSION'}.first['lang']
      language = @lang[lang_id]
      puts "No langugage found for 0x%04x" % [lang_id] unless language
      key = "#{version}_#{language}"

      winexec = pedump.exports.functions.find { |f| f.name == 'WinExec' }.va
      gettzi  = pedump.exports.functions.find { |f| f.name == 'GetTimeZoneInformation' }.va
      dllfile.close
      
      diff = winexec - gettzi
      magic = "0x%08x" % [-diff & ((1 << 32) - 1)]
      delta[key] = magic
    
      puts "Found #{key} delta #{magic}".colorize(:light_blue)
    else
      puts "Not Intel 80386 32-bit file".colorize(:red)
    end
  rescue Exception => e
    dllfile.close if dllfile; puts e.message.colorize(:red)
  end
  
  delta
end

p parse_dll(ARGV[0])