ã¯ããã«
ãããããäžéšã®èªè ã¯ãVHDã€ã¡ãŒãžããWindowsãããŒãããããšã«å°å¿µãããªãœãŒã¹ã«é¢ããç§ã®æåã®èšäºãæãåºãã§ãããã ãããããèªå® ã®ã³ã³ãã¥ãŒã¿ãŒã§ãã®æè¡ãç¹°ãè¿ã䜿çšããããšãã人ãããªãã£ããããã®ãããã¯ã«ã¯æ»ããªãã§ãããã åœç¶ããã®ãœãªã¥ãŒã·ã§ã³ã®å®è£ ã§ã¯ãäž»ã«bootmgrãäœãæ°ã«å ¥ããªãå Žåã«åãåºããšã©ãŒã«é¢ããåé¡ãçºçããŸããã ã°ãŒã°ã«ã§0xc03a0003ã®ãããªèªã¿èŸŒã¿ãšã©ãŒãè§£éããããšããŠããç¹ã«äŸ¡å€ã®ããçµæã¯åŸãããããã®ä»¶ã«é¢ããMicrosoftã®ããã¥ã¡ã³ãã¯æå³ã®ããæ²é»ã®ãŸãŸã§ãã çŽæ¥æ å ±ãåãåã£ããã€ãŸãããŒããŒèªäœããVHDç»åãåŠçããããã»ã¹ãç ç©¶ãããšããã¢ã€ãã¢ããããŸããã
ãããã¯ãŒã¯äžã§ãã§ã«å©çšå¯èœãªæ å ±ã«ç®ãåãããšãçŽ æŽãããããã°ãWindowsã«é¢ããEnikeyschikã®ã¡ã¢ããããããã®ããŒãžïŒ 1ã2ã3 ïŒã¯ãç§ã®æèŠã§ã¯ãbootmgrããã€ã¹ã«é¢ããæã䟡å€ã®ããæ å ±ã§ãã èè ã¯ãMBRããã³PBRã³ãŒãã®èª¿æ»ãbootmbræ§é ã«çŠç¹ãåããããã®æäœäžã«çºçããããã»ã¹ãç°¡åã«èª¬æãããªã©ãããŒãããã»ã¹ã詳现ã«èª¿æ»ããŸããã
ããã«å ã«é²ã¿ãŸã-ããŒãããŒããŒããã€ã¹ã®ç ç©¶ã«äœ¿çšã§ããããŒã«ã«ã€ããŠèª¬æããèå³ã®ããã¢ã«ãŽãªãºã ã®ããã€ãã«å¯ŸåŠããŠã¿ãŸãã ãã®ãããªç³ãåºã誰ãã«ãšã£ãŠè峿·±ããšæãããå Žåãããªãã¯ç«ã®äžã§æè¿ãããŠããŸã
1.ã·ã¹ãã ããBootmgrã³ãŒããååŸããŸã
BootmgrããŒãããŒããŒã¯ãWindows Vista以éãWindowsãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã«å°å ¥ãããŠããŸãã éçºã®çç±ã¯ãNTã©ã€ã³ã§äœ¿çšãããŠããå€ãè¯ãntldrããUEFIãæèŒãããã¶ãŒããŒããæèŒããã³ã³ãã¥ãŒã¿ãŒã§ã·ã¹ãã ãèµ·åã§ããªãã£ããšããäºå®ã§ããïŒåœæïŒïŒ2005幎ïŒã
ããã©ã«ãã§ã¯ãæšæºã€ã³ã¹ããŒã«ã§ã¯ããã®ããŒãããŒããŒã¯HDDã®å é ã«ããå¥ã®ããŒãã£ã·ã§ã³ã«é 眮ãããbootmgrèªäœãšãã®æ§æãã¡ã€ã«ãå容ããã®ã«ååãªãµã€ãºã«ãªã£ãŠããŸãã ãã®ã»ã¯ã·ã§ã³ã¯ãã·ã¹ãã ã®éåžžã¢ãŒãã§ã¯ããŠã³ããããããã©ã€ãæåã¯å²ãåœãŠãããŸããã MBRã·ã¹ãã ã§ã¯ãäºåã«ããŒãã£ã·ã§ã³åãããã©ãŒããããããHDDã«Windowsãã€ã³ã¹ããŒã«ããããšã«ããããã®ããŒãã£ã·ã§ã³ã®äœæãåé¿ã§ããŸãã ãã®å ŽåãããŒãããŒããŒã¯OSãã¡ã€ã«ãšåãã»ã¯ã·ã§ã³ã«é 眮ãããŸãã EFI + GPTãæèŒããã·ã¹ãã ã§ã¯ãæåã«ã¿ã€ã0xefã®ããŒãã£ã·ã§ã³ãå¿ èŠã§ãFATã§ãã©ãŒããããããŠããŸãã
ãããã£ãŠãæåã®ã¿ã¹ã¯ã¯bootmgrãååŸããããšã§ãã ãã¹ã察象ãšããŠæ©èœããã·ã¹ãã ããååŸããããšããå§ãããŸãã ãããè¡ãã«ã¯ãä»®æ³ãã·ã³ã«Windowsãã€ã³ã¹ããŒã«ããŸãã VirtualBoxãVMwareãQEMUã®ãããã§ãæ§ããŸããããã¹ãŠã¯ã䜿çšããŠããä»®æ³åããŒã«ã«äŸåããŸãã ç§ã¯äž»ã«Linuxã§åããŠãããäž»ã«ããã§äœ¿çšãããããŒã«ã«çŠç¹ãåãããŸãããWindowsã«ã泚æãæããŸãã
ãããã£ãŠãWindows 7ïŒx86ïŒãã€ã³ã¹ããŒã«ãããä»®æ³ãã·ã³ïŒVMïŒããããšããŸãã ãã£ã¹ã¯ã®ããŒãã£ã·ã§ã³åå²ã¯MBRã«åºã¥ããŠãããã·ã¹ãã ã¯1ã€ã®ããŒãã£ã·ã§ã³ã«ã€ã³ã¹ããŒã«ãããŸãã ãããQEMUã§ãããšããŸãããã¹ããã€ã³ã¹ããŒã«ãããŠãããã£ã¹ã¯ã®åœ¢åŒã¯rawã§ãã ã€ãŸããéåžžã®ãã€ããªã€ã¡ãŒãžã§ãã ãã®ç»åãããŠã³ã
$ sudo modprobe -r loop $ sudo modprobe loop max_part=15 $ sudo losetup -f win7.hdd $ sudo mount /dev/loop0p1 ~/virt-win $ ls -l ~/virt-win
ããŠã³ããããã»ã¯ã·ã§ã³ã«ã¯ã次ã®å 容ã衚瀺ãããŸã
5504541 -rwxrwxrwx 1 root root 24 11 2009 autoexec.bat drwxrwxrwx 1 root root 4096 21 09:08 Boot -rwxrwxrwx 1 root root 391640 21 2015 bootmgr -rwxrwxrwx 1 root root 8192 21 09:08 BOOTSECT.BAK -rwxrwxrwx 1 root root 10 11 2009 config.sys lrwxrwxrwx 2 root root 60 14 2009 'Documents and Settings' -> /home/maisvendoo/virt-win/Users -rwxrwxrwx 1 root root 2415517696 21 09:26 hiberfil.sys -rwxrwxrwx 1 root root 3220692992 21 09:26 pagefile.sys drwxrwxrwx 1 root root 0 14 2009 PerfLogs drwxrwxrwx 1 root root 4096 21 09:14 ProgramData drwxrwxrwx 1 root root 4096 12 2011 'Program Files' drwxrwxrwx 1 root root 0 21 09:14 Recovery drwxrwxrwx 1 root root 0 21 09:14 '$Recycle.Bin' drwxrwxrwx 1 root root 4096 21 09:09 'System Volume Information' drwxrwxrwx 1 root root 4096 21 09:14 Users drwxrwxrwx 1 root root 16384 21 09:09 Windows
bootmgrãã¡ã€ã«ã¯èå³ã®å¯Ÿè±¡ã§ãã ãã ãã以åã¯ãŸã£ããå¿ èŠãããŸããã§ãããã32ãããã®bootmgr.exeããŒãããŒããŒã€ã¡ãŒãžã¯ããã±ãŒãžåœ¢åŒã§bootmgrã«ãããŸãã è§£åããã«ã¯ãWindowsåãã«äžè¬çã«æžãããŠããbmzipãŠãŒãã£ãªãã£ã䜿çšããå¿ èŠããããŸãïŒLinuxãããŒãããã¢ã»ã³ãã«ããããšã¯ã§ããŸããã§ããïŒããããã£ãŠãä»®æ³ãã·ã³ã§è§£åããŸãã éåžžã¯æ©èœãããã®ãŠãŒãã£ãªãã£ã®ãã€ããªã¢ã»ã³ããªã¯ããªã³ã¯ã«ãããããããèŠã€ããã®ãããªãé£ããããšãããããŸããã ãã®çµæãããã±ãŒãžã¯bootmgrã®ã«ã¹ã¿ãã€ãºå°çšãµã€ãã®1ã€ã§èŠã€ãããŸããã bmzipãæ©èœããã«ã¯ãMSCompression.dllã©ã€ãã©ãªãå¿ èŠã§ããã ããã«äœ¿çšã§ããããã±ãŒãžãããããããŠã³ããŒãã§ããŸã ã
VMãã£ã¹ã¯ã«utilsãã©ã«ããŒãäœæããMSCompression.dllãšãšãã«bmzip.exeãããã«ã³ããŒããŸãã ã€ã¡ãŒãžãã¢ã³ããŠã³ãããVMãèµ·åããŸãã 管çè ãšããŠã³ãã³ãã©ã€ã³ãå®è¡ããŸãã 誀ã£ãŠããŒãããŒããŒãå°ç¡ãã«ããªãããã«ããããã³ããŒããŠãã ãã
C:\ Windows\System32>cd c:\ C:\ xcopy bootmgr utils\bootmgr /h
ããŒãããŒããŒãã¡ã€ã«ã¯é衚瀺ã§äœç³»çã§ããããããããã®å±æ§ãåé€ããŸãã
C:\ cd utils C:\ attrib -S -H /s
ããŒãããŒããŒã鿢±ããŸã
C:\ bmzip bootmgr bootmgr.exe
ãã®çµæãè§£åãããbootmgr.exeã€ã¡ãŒãžãååŸããŸã
VMã®é»æºãåãããã®ãã£ã¹ã¯ãLinuxã«å床ããŠã³ãããŸãã ããŒããŒãéã¢ã»ã³ãã©ãŒã§åæããå±éãããã€ã¡ãŒãžãããã«ã³ããŒãããã©ã«ããŒãäœæããŸããã
$ mkdir -p ~/work/bootmgr/ $ cp ~/virt-win/utils/bootmgr.exe ~/work/bootmgr/
2. bootmgr.exeãéã¢ã»ã³ãã«ããŸã
次ã«ãçµæã®å®è¡å¯èœãã¡ã€ã«ãéã¢ã»ã³ãã©ã«ãã£ãŒãããŸãã ããšãã°ãIDA Proã ãgoããå®è¡ãããã®äžã«æœåºããããã¡ã€ã«ãéããŸãã
IDAã¯ããã¡ã€ã«ã32ãããPE圢åŒã®å®è¡å¯èœãã¡ã€ã«ãšããŠæ£ããèå¥ããŸãã OKãã¯ãªãã¯ããŸãã ããã§ãpdb-filesãæäœããããã®ãã©ã°ã€ã³ãIDA Proã«ã€ã³ã¹ããŒã«ãããŠããå Žåãã©ãããã§ãMicrosoftãµã€ããããåè§£äžã«ãããã°ã·ã³ãã«ãããŠã³ããŒãã§ããŸãã
ç§ãã¡ã¯åæãããã®ãããªåçãåŸã
ãããå·ŠåŽã«ã¯ããããã°ã·ã³ãã«ã®èªã¿èŸŒã¿ã«åæãããšããäºå®ã®ããã調æ»äžã®ãã¡ã€ã«ã«å«ãŸãã颿°ã®ãããã¿ã€ãããããŸãã ããã«ããããã®åŸã®äœæ¥ãå€§å¹ ã«å®¹æã«ãªããŸãã ãããŸã§ã®éãããŒããŒã³ãŒããžã®ãšã³ããªãã€ã³ããæ±ºå®ããŸããããããBmMainïŒïŒé¢æ°ã«ãªããšæšæž¬ããã®ã¯ç°¡åã§ãã ãã ããåœç¶ã®ããšã§ã¯ãªããCtrl + EãæŒããŸã
æšæž¬ãæ£ããããšã確èªããŸã-BmMainïŒïŒã¯0x401000ã«ãããšã³ããªãã€ã³ãã§ãã [OK]ãã¯ãªãã¯ããŠãã³ãŒãã®å é ã«ç§»åããŸã
BmMainïŒïŒé¢æ°ã®ããããŒã«ã¯ãããŒã«ã«å€æ°ã®å°è±¡çãªãªã¹ããããã颿°ã³ãŒãèªäœã®ããäžã«ãããŸã
ã¢ã»ã³ãã©ãŒã³ãŒãã®ããã·ã¥ãçè§£ããããšã¯éåžžã«å°é£ã§ãã ãŸããåŠç¿ãããããŒãããŒããŒæ©èœã決å®ããŸãã VHDã«ã€ããŠäœãèšããŸãããïŒ ããŠãä»®æ³ãã£ã¹ã¯ã«é¢é£ããã³ãŒããæ¢ããŠã¿ãŸãããã å·ŠåŽã®é¢æ°ã®ãªã¹ããå³ã¯ãªãã¯ããŠããããã¢ããã³ã³ããã¹ãã¡ãã¥ãŒã§[ã¯ã€ãã¯ãã£ã«ã¿ãŒ]ãéžæããŸãïŒãŸãã¯ãããã¿ã€ããŠã£ã³ããŠã«ç§»åããŠCtrl + FãæŒããŸãïŒã æ€çŽ¢ããŒã«ãvhdããšå ¥åããŠ...
ã¯ãããã®ãããªæ©èœã¯33åã®éã§å©çšå¯èœã§ãã ãã®ãã¡ã VhdOpenïŒïŒã¯æããã«ä»®æ³ãã£ã¹ã¯ãéã圹å²ãæãããŸãããããšãã°ã VhdiVerifyVhdFooterïŒïŒã®é£²ã¿æ¹ã¯ãVHDãã£ã¹ã¯ã®ããã¿ãŒã®æ£ç¢ºãã確èªãã圹å²ãæãããŸãã ã€ãŸãããããã¬ã§ãã¬ãŒã¯ãã€ã³ããèšå®ããå Žæã倧ãŸãã«æ³åããŸãã ãšããã§ããããã°ã«ã€ããŠè©±ãæéã§ã
3. QEMU + IDA Proãã³ãã«ã§ã®Bootmgrã®ãããã°
-s -Sã¹ã€ããã䜿çšããŠä»®æ³ãã·ã³ãèµ·åããŸã-ããã«ããããããã°ã¢ãŒããæå¹ã«ãªããŸã
$ qemu-system-x86_64 ~/VM/qemu/win7-efi/win-x86.hdd -m 4096 -s -S
VMãèµ·åããŠããã«äžæåæ¢ãããããã¬ãŒã®æ¥ç¶ãåŸ æ©ããŸã
éèŠïŒ ããŒããŠã§ã¢ä»®æ³åã䜿çšããŠ-enable-kvmã¹ã€ããã䜿çšããªãã§ãã ããã ããã䜿çšãããšãQEMUã§ã®ãããã°ã¯æ©èœããŸããã
IDAã®ããŒã«ããŒã§ãããªã¢ãŒãGDBãããã¬ãŒããéžæããŸã
ããã€ãã®è³ªåã«ãã¯ãããšçãããšããŠã£ã³ããŠã衚瀺ãããŸã
æ¥ç¶ãã©ã¡ãŒã¿ãŒãVMã«æ¥ç¶ããŸãïŒããŒã1234ã®localhostã[OK]ãã¯ãªãã¯ããŸãã ããã€ãã®ããã»ã¹ãæ¢ã«éå§ãããŠããããããã¬ãŒãæ¥ç¶ããã®ãåŸ ã£ãŠããããšãéç¥ãããŸã-åå ããŸããïŒ ãã¡ããè¡ããŸãïŒ
ãããã£ãŠããã¯ãããšçãããš...
ä»®æ³ãã·ã³ã®BIOSã®æåã®ã©ããã§äžæåæ¢ããŸãã ãã°ãããã§ãããä»åºŠã¯bootmgrãéå§ããå Žæã«å°éããå¿ èŠããããŸãã BmMainïŒïŒé¢æ°ã«ãã¬ãŒã¯ãã€ã³ããèšå®ããŸãã ããŒã«ããŒã®ãã¬ãŒã¯ãã€ã³ãã®ãªã¹ããã¯ãªãã¯ããããŒããŒãã®[æ¿å ¥]ãã¯ãªãã¯ããŠãã³ãŒãã®å®è¡ãäžæããŠãããã°ã«å ¥ãã¢ãã¬ã¹ãæå®ããŸãã
ã¢ãã¬ã¹0x401000ãé§åããŸãã å¿ èŠãªé¢æ°ã«ãã¬ãŒã«ãŒãèšå®ããå Žåã¯ãã¡ã€ã³ã¡ãã¥ãŒã«ç§»åãããããã°ã»ãã·ã§ã³ã§é¢æ°ã®ãªã¹ããéããŸãïŒ[衚瀺]-> [ãµããã¥ãŒãéã]-> [颿°]ã 衚瀺ããããªã¹ãã§ãã³ã³ããã¹ãã¡ãã¥ãŒãå³ã¯ãªãã¯ãã[ãã¬ãŒã¯ãã€ã³ãã®è¿œå ]ãéžæããŸãã ããã§F9ãæŒããšãå°ãåŸ ã£ãŠããããŒãããŒããŒã³ãŒãã®æåã«å°éããŸãã
ããã§ãã³ãŒããæ®µéçã«ç¢ºèªããã¬ãžã¹ã¿ãšã¹ã¿ãã¯ã®å€ã確èªããåŒã³åºãã¹ã¿ãã¯ã远跡ããããšãã§ããŸãã ããçšåºŠãŸã§ãIDAã«çµã¿èŸŒãŸãããããã¬ãŒã¯äŸ¿å©ã§çŽæçã§ãã
ãããã圌ãã¯ç§ã«å°ããã§ããã-GDBã䜿çšããããšã¯å¯èœã§ããïŒ ãããã°ã¢ãŒãã§VMãå®è¡ããã³ã³ãœãŒã«ã§gdbãå®è¡ã§ããŸã
$ gdb -q
ãªã¢ãŒãVMã»ãã·ã§ã³ã«æ¥ç¶ãã
(gdb) target remote localhost:1234
éã¢ã»ã³ãã«ãããåœä»€ã®è¡šç€ºããªã³ã«ããŸã
(gdb) display/4i $pc
ATïŒTæ§æã«æ £ããŠããªãå Žåã¯ãIntelã«åãæ¿ããŠãã ãã
(gdb) set disassembly-flavor intel
BmMainïŒïŒã«ãã¬ãŒã¯ãã€ã³ããèšå®ããå®è¡ãéå§ããŸã
(gdb) b *0x401000 Breakpoint 1 at 0x401000 (gdb) c Continuing. Breakpoint 1, 0x00401000 in ?? () 1: x/4i $pc => 0x401000: mov edi,edi 0x401002: push ebp 0x401003: mov ebp,esp 0x401005: and esp,0xfffffff8 (gdb)
GDBã®ãã¹ãŠã®æ©èœãåããªãããIDAã§èŠããã®ãšã»ãŒåããã®ãã芧ãã ããã ã»ãšãã©ãããã§ã¯Microsoftã®ãããã°ã·ã³ãã«ã䜿çšã§ããŸãããGDBãããããçè§£ããŠããªãããã§ãã ããããGDBã®æ©èœã¯ããããã°ããã»ã¹ãšãã®èªååã«é¢ããŠãIDAã®æ©èœãããæ±ºããŠåºãããã§ã¯ãããŸããã
ãã ããç¡èŠã§ããªãå¥ã®ãããã°æ©èœããããŸãã
3. WinDbg + VirtualBoxã䜿çšãããããã°
Windowsçšã®ãã©ã€ããŒãéçºããŠãã人ã¯ããã®çŽ æŽããããããã¬ãŒã«ç¢ºãã«ç²ŸéããŠããŸãã Linux GDBã®æ©èœã«å¹æµããæ©èœãåããŠãããšããç¹ã§æ³šç®ã«å€ããŸãã å¯äžã®æ¬ ç¹ã¯ãã€ã³ã¿ãŒãã§ãŒã¹ãã«ã¹ã¿ãã€ãºããã²ã©ãæ¹æ³ã§ãã ãã ãããããã®ç¹ãçç¥ãã解決ããã¿ã¹ã¯ã®ãã®ãããã¬ãŒã®æ©èœã䜿çšããŸãã
ããã§ã¯ãVirtualBoxã«åºã¥ããVMãçšæããŸãããã æ¬¡ã®ãã©ã¡ãŒã¿ãŒã䜿çšããŠããã®VMã®COMããŒããäœæããŸã
ããã¯ãååä»ããã€ãã«è»¢éãããä»®æ³COMããŒãã§ãã ã·ãªã¢ã«ããŒãçµç±ã§ãããã°ããã«ã¯ãããã«å¿ããŠä»®æ³ãã·ã³ãæ§æããå¿ èŠããããŸãã ãããããŠã³ããŒããã管çè æš©éã§ã³ã³ãœãŒã«ãå®è¡ããŸãã ããã䜿çšããŠããããã°çšã®ããŒãããŒããŒèšå®ã³ãã³ããå ¥åããŸã
c:\ Windows\system32> bcdedit /bootdebug {bootmgr} on
ãã®ã³ãã³ãã¯ãããŒãããŒããŒã®ãããã°ãæå¹ã«ããŸãã æ¬¡ã«ããããã°çšã«ããŒããæ§æããŸãã
c:\ Windows\system32> bcdedit /dbgsettings serial debugport:1 baudrate:115200
COM1ã115200ããŒã§äœ¿çšããŠããããšã瀺ããŠããŸãã çŽ æŽããããVMããªãã«ããŠãããã¬ãŒãå®è¡ããŸãã
WinDbgãããã¬ãŒã¯ããã©ã€ããŒéçºããããšäžç·ã«Microsoft Webãµã€ãããå ¬åŒã«ããŠã³ããŒãã§ããŸãã ãã ãããã®ãããã¬ãŒã¢ã»ã³ããªã«ã¯åé¡ããããŸããã¬ãžã¹ã¿å€ã®è¡šç€ºã«äžå ·åããããŸãã ãããã£ãŠãç¹å®ã®Dominic Wongã®ãã¥ã€ãŒã¿ãŒãããªã³ã¯ãããŠããåãRedmodovãµã€ãããããŠã³ããŒãããã¢ã»ã³ããªã䜿çšããŸãã ãã®ãã«ãã«ã¯ãã®ãã°ããããŸããã æ¬¡ã®ã³ãã³ãã§WinDbgãèµ·åããŸã
c:\Wingdbx86> windbg -b -k com:pipe,port=\\.\pipe\com1,resets=0,reconnect
ä»ã®ãã©ã¡ãŒã¿ãŒã®äžã§ãç¹ã«ãMicrosoftãµãŒããŒãããããã°ã·ã³ãã«ãããŒãããããã®ãã¹http://msdl.microsoft.com/download/symbolsãä¿åãããŠããã€ã³ã¿ãŒãã§ã€ã¹èšå®ïŒ[ãã¡ã€ã«]-> [ãã¡ã€ã«ã§ã¯ãŒã¯ã¹ããŒã¹ãéã]ïŒãéããŸãã ãã®ãã¹ãèšå®ã«äºåã«çµã¿èŸŒã¿ïŒãã¡ã€ã«->ã·ã³ãã«ãã¡ã€ã«ãã¹ïŒãWinDbgã®ããŒãã«ä¿åããŸãã ãã®èšå®ã«ãããããŒãããŒããŒã®ãããã°æ å ±ãèªåçã«åä¿¡ã§ããŸãã
次ã«ãVMãå®è¡ããŸãã ããã«äžæåæ¢ãããããã¬ãŒãŠã£ã³ããŠã«æ¬¡ã®ç»åã衚瀺ãããŸãã
ããããããã¬ãŒã¯VMã«æ¥ç¶ãããã€ã¯ããœãããã芪åã«æäŸããããã€ã³ãã«ç«ã£ãŠããŸããã ããŠãããã§windbgã䜿çšããŠãã¹ãŠã®ãããã°ãªãã·ã§ã³ã䜿çšã§ããŸãã
ãã ããããŒãããŒããŒã³ãŒãã®æåã§åæ¢ããã®ã§ã¯ãªããããå°ãå ã«åæ¢ããŸãã æ®µéçãªãããã°ã瀺ãããã«ãåææ©åšã®åæåãæäŸããBlInitializeLibraryïŒïŒé¢æ°ã®ããåŸãã«ããŸãã
ãŸããIDAã䜿çšããŠãããã°ããå Žåãããã«ã¯å°éããŸããã ãããã£ãŠãWinDbgã䜿çšããŠãããã°ããå Žåãbootmgrã¢ã¯ã·ã§ã³ã®äžéšã¯éå§çŽåŸã«åé¿ãããŸãã ããã¯ãMicrosoftãæäŸããæšæºã®ãããã°ããŒã«ã䜿çšããããšã®æ¬ ç¹ã§ãã ãã ããã¢ã¯ã»ã¹ã§ããªãã³ãŒãã¯ãIDAã䜿çšããŠãã€ã§ãåå¥ã«èª¿ã¹ãããšãã§ããŸãã
次ã«ãäŸãšããŠãbootmgrãåºå®ãµã€ãºã®VHDã€ã¡ãŒãžã§ã©ã®ããã«æ©èœããããèŠãŠã¿ãŸãããã
4. VHDããã®ããŒãã®ãããã°
以äžã¯ãã¹ãŠãVirtualBoxäžã®VMã«æ¥ç¶ãããWinDbgãããã¬ãŒã§èª¬æãããŠããŸãããæ©èœãèæ ®ããŠãä»ã®ãããã°æ¹æ³ã«ãåæ§ã«åœãŠã¯ãŸããŸãã ãã®äŸã§äœ¿çšããVMã«ã¯2ã€ã®ã·ã¹ãã ãå«ãŸããŠããŸãã1ã€ã¯HDDã«ã€ã³ã¹ããŒã«ããããã1ã€ã¯VHDã€ã¡ãŒãžã«ã€ã³ã¹ããŒã«ãããŸãã VhdOpenïŒïŒé¢æ°ã«ãã¬ãŒã¯ãã€ã³ãã眮ã
kd> bp VhdOpen
F5ãæŒããŸãã ãããã¬ãŒã¯æå®ããã颿°ã®äžã«ç«ã€
ããã«ã泚æ-ãŸã ããŒãã¡ãã¥ãŒã«ç§»åãããVHDããã®ããŒããéžæããŸããã§ããã ãããŠããã¯ãã¡ãã¥ãŒã衚瀺ããããã£ãšåã«VHDãã§ãã¯ãè¡ãããããšãæå³ããŸãã ããšãã°ãbootmgrã空ã®VHDã«ã¹ãªããããå Žåãªã©ãåãåäœã芳å¯ããŸãã ããŒãã¡ãã¥ãŒã¯ãŸã£ãã衚瀺ãããŸããããã³ãŒã0xc000000Fã®ãšã©ãŒã衚瀺ãããŸãã
F10ãæŒãããã³ãã³ãã©ã€ã³ã«pãå ¥åããŠããã«é²ãã§ã VhdiAllocateVhdDataïŒïŒãåŒã³åºããŸã -æããã«ãããã¯ã€ã¡ãŒãžãæäœããããã®ã¡ã¢ãªå ã«ããã€ãã®æ§é ãäœæããŠããŸã
ããå°ãäœãã®ã¯ã VhdiVerifyAndInitializeVhdïŒïŒã®åŒã³åºãã§ã-ç»åã®æ£ç¢ºããæããã«ç¢ºèªããŸãã ç§ã«ã¯é¢çœããã ã£ãã®ã§ãäžã«å ¥ããŸããïŒF11ïŒ
以äžã§ã¯ãããã€ãã®æºåæäœã®åŸãããŒãããŒããŒã¯ã€ã¡ãŒãžã®æåŸã®512ãã€ããèªã¿åããŸããããã«ã¯ãã€ã¡ãŒãžã®ãããããããã¿ãŒããå«ãŸãã VhdiReadVhdInformationïŒïŒé¢æ°ãåŒã³åºããŸãã å ãåž«ã«è¡ãå¿ èŠã¯ãããŸãã-颿°ã¯ããã¿ãŒããŒã¿ãå«ãæ§é äœãžã®ãã€ã³ã¿ãŒãè¿ããŸãã ç§ãèŠã€ããããã«ã VhdiReadVhdInformationïŒïŒãåŒã³åºããåŸããã®ãã€ã³ã¿ãŒã¯ecxã¬ãžã¹ã¿ãŒã«ãããŸãã ãã®å€ã¯0x110098ã§ãã ãã®ã¢ãã¬ã¹ã®ã¡ã¢ãªãèŠãŠã¿ãŸããã
kd> db 0x110098
ãã®ã³ãã³ãã¯ãæå®ãããã¢ãã¬ã¹ã®ã¡ã¢ãªãèªã¿åãããããã¬ãŠã£ã³ããŠã«äžé£ã®ãã€ããšããŠè¡šç€ºããŸãã
00110098 63 6f 6e 65 63 74 69 78-00 00 00 02 00 00 01 00 conectix........ 001100a8 ff ff ff ff ff ff ff ff-70 5e d3 1e 77 69 6e 20 ........p^..win 001100b8 00 06 00 01 57 69 32 6b-00 00 00 40 06 00 00 00 ....Wi2k...@.... 001100c8 00 00 00 40 06 00 00 00-cb 2c 10 3f 02 00 00 00 ...@.....,.?.... 001100d8 83 e6 ff ff 75 11 0a 5a-eb 03 c6 43 b9 c9 d6 df ....u..Z...C.... 001100e8 24 b6 76 57 00 00 00 00-00 00 00 00 00 00 00 00 $.vW............ 001100f8 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 00110108 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ãããããç¥ãããŠããåèªconectixããããŸãã ãã®ãã£ãŒã«ãã¯VHDã€ã¡ãŒãžããã¿ãŒã®åã«ãããCookieãšåŒã°ããMicrosoftãConectixããVHDãã¯ãããžãŒãè³Œå ¥ããå€ãMacintoshã³ã³ãã¥ãŒã¿ãŒçšã«ãã®ãã©ãŒãããã®ä»®æ³ãã£ã¹ã¯ãéçºããã¡ã¢ãªãä¿åããŸããäœæãããïŒWi2kïŒåå©ã·ãŒã±ã³ã¹ã¯ãVHDãWindowsã«ãã£ãŠäœæãããããšã瀺ããŸãã ã¯ããããã§ããã ããã«é²ãã§ãããã¿ãŒã®åœ¢åŒããã§ãã¯ããVhdiVerifyVhdFooterïŒïŒã®åŒã³åºãã«ééããŸãã ãã©ã¡ãŒã¿ãŒãšããŠãäœããã®çç±ã§ãesiã¬ãžã¹ã¿ïŒ???ïŒãä»ããŠäžèšã®æ§é äœãžã®ãã€ã³ã¿ãŒãåãåããŸãã
ãã®ã³ãŒãã¯ç§ã«æãèå³ãæã£ãŠããã®ã§ãã©ããã§IDA Proã䜿çšããã©ããã§æã䜿ã£ãŠãCã®æ¬äŒŒã³ãŒãã«å€æããŸããã
signed int __usercall VhdiVerifyVhdFooter(int footer) { signed int error_code; // Error code int cur_checksum; // Actual checksum, writed in VHD int calc_checksum; // Calculated checksum int disk_type; // Disk type int creator_host_os; // Creator host OS // Error code error_code = -1069940733; // 0xc03a0003 // Check cookie if ( RtlCompareMemory((const void *)footer, "conectix", 8) == 8 ) { // Store actual checksumm cur_checksum = *(_DWORD *)(footer + 64); // Write zero to checksum in footer structure *(_DWORD *)(footer + 64) = 0; // Calculate check summ calc_checksum = BlUtlCheckSum(0x40001, 0, footer, 0x200); // Restore checsum in footer *(_DWORD *)(footer + 64) = cur_checksum; // Checksum verify if ( calc_checksum == cur_checksum ) { // File type verify if ( *(_WORD *)(footer + 14) == 1 ) { // Check disk type disk_type = *(_DWORD *)(footer + 60); if ( disk_type == 2 || disk_type == 3 || disk_type == 4 ) { // Check creator host OS creator_host_os = *(_DWORD *)(footer + 36); if ( creator_host_os != 1798465879 && creator_host_os ) { error_code = -1073741637; // 0xc00000bb } // Check disk size (by integer sectors count) else if ( *(_DWORD *)(footer + 48) & 0x1FF || *(_DWORD *)(footer + 40) & 0x1FF ) { error_code = -1069940718; // 0xc03a0012 } else { error_code = 0; } } else { error_code = -1069940732; // 0xc03a0004 } } else { error_code = -1069940731; // 0xc03a0005 } } else { error_code = -1069940734; // 0xc03a0002 } } return error_code; }
VHDããã¿ãŒã¯æ¬¡ã®æ§é ãšããŠè¡šãããšãã§ããŸãïŒã³ã¡ã³ãã¯å é ããã®ãªãã»ããã瀺ããŸãïŒã
//----------------------------------------------------------------------------- // VHD foother's data //----------------------------------------------------------------------------- struct vhd_footer_t { char cookie[8]; // +0 uint32_t features; // +8 uint32_t file_format_version; // +12 uint64_t data_offset; // +16 uint32_t time_stamp; // +24 char creator_application[4]; // +28 uint32_t creator_version; // +32 char creator_host_os[4]; // +36 uint64_t original_size; // +40 uint64_t current_size; // +48 vhd_disk_geometry_t disk_geometry; // +56 uint32_t disk_type; // +60 uint32_t checksum; // +64 vhd_uuid_t unique_id; // +68 uint8_t saved_state; // +84 uint8_t reserved[427]; };
ãã®ããŒã¿ã䜿çšããŠãã©ã®bootmgrãã£ãŒã«ããã©ã®ããã¿ãŒãã£ãŒã«ããšã©ã®ãšã©ãŒãã¹ããŒãããã確èªã§ããŸãã æ£ããVHDã€ã¡ãŒãžã§ã¯ããã®é¢æ°ã¯ãŒããè¿ããŸããä»ã®å Žåãã¢ã©ã€ã¡ã³ãã¯æ¬¡ã®ããã«ãªããŸã
0xc03a0003 - cookie 0xc03a0002 - 0xc03a0005 - 0xc03a0004 - 0xc00000bb - Windows 0xc0300012 - 512 ( VHD)
ç§ãåãåã£ãæ å ±ã¯ãVHDããWindowsãèµ·åããæ¹æ³ãè°è«ãããã©ãŒã©ã ã§ååãšçããè«äºã解決ããŸããã VirtualBoxã«ãã£ãŠäœæãããã€ã¡ãŒãžãbootmgrã䜿çšããŠèµ·åããªãããšãèæ ®ããŠãç§ã¯ããã倱ããŸããã ãã®ãããªç»åãäœæããVirtualBoxã¯ãMicrosoftã®ä»æ§ã«åŸã£ãŠãã¹ãŠã®ãã£ãŒã«ããæžã蟌ã¿ãŸãããã ããcreator_applicationãã£ãŒã«ãã«ã¯ãvirtualboxã®å Žåã¯å ã®ç»åã®winãšvboxãå«ãŸããŸãã ãããããã®ãã£ãŒã«ãã¯bootmgrã«ãã£ãŠãã§ãã¯ãããªãããããã£ã¹ã¯ã¯æ©èœããŸããããŸã£ããç°ãªãçç±ã§æ©èœããŸããã§ããã
ãããã«
ãããããã®èšäºã¯ããæ··ä¹±ããŠããŸãã ãããã圌女ã¯ããããç¥ã«ãã£ãŠçŒãä»ããããŠããªããšèšããŸãããäœã¬ãã«ã®Windowsã³ãŒãã®ãããã°ã¯æè¡ã®åé¡ã§ãã ããªããèå³ãæã£ãŠããæ å ±ã¯ãããã«ããªãã®é ãšæãã€ãªãããšã«ãã£ãŠåžžã«åŸãããŸãã ãã®ããã¹ãã§ã¯ãbootmgrã®ãããã°ã®åé¡ã«é¢ããŠãããã¯ãŒã¯äžã§åéããããŸããŸãªæ å ±ãèŠçŽããããšããŸããã ç§ã¯æåããããšãé¡ã£ãŠããŸãããã¹ãŠã®èªè ã®æ³šæã«æè¬ããŸã...
ç¶ããããïŒ