Simple Loader (Alt. API Hashing)
This is a Simple DLL Loader that demonstrates alternatives to ror13 API hashing.
Project Files
How to use
cpl link loader.spec /path/to/file.dll out.bin %apihash="djb2"
Valid algorithms are: djb2, fnv1a, and sdbm.
Notes
loader.c is unchanged from our Simple DLL Loader project. What's different here is loader.spec. Instead of the command dfr "resolver" "ror13", we call "apihash.spec" %apihash. The call command loads another file and executes the callable label specified as its first argument.
Callable labels are defined as name.arch: in a .spec file. apihash.spec has x86 and x64 callable label definitions for djb2, fnv1a, and sdbm hashes.
apihash.spec uses redirect "hash_module" "algorithm_module" to redirect calls and references for the local function hash_module to our alternate API hashing implementation.
hash_function and hash_module are ror13 hashing functions used by LibTCG's findModuleByHash and findFunctionByHash to lookup Win32 APIs.
The hash_function contract is easiest. It expects a NULL-terminated ASCII string as its argument. The function simply walks individual bytes until the NULL terminator is encountered.
The hash_module contract is weirder. The module string is a UTF16-LE encoded MODULE.DLL string with a set length. This function must uppercase its argument (without modifying it) and walk the length count number of individual bytes.
apihash.c implements Crystal Palace DFR-compatible hash_function and hash_module for djb2, fnv1a, and sdbm algorithms.
Conversation
- Exploiting Weak Shellcode Hashes to Thwart Module Discovery; or, Go Home, Malware, You're Drunk! (see pg. 57) (2016) by Mike Myers and Evan Sultanik describes a shellcode detection method relying on collissions in ror13 and other hash algorithms to load "decoy modules" that catch shellcode API resolvers.
License
This project is licensed under the BSD License.