You are browsing the archive for Batch Analysis.

Da Li’L World of DLL Exports and Entry Points, Part 4

April 3, 2020 in Batch Analysis

Looong time ago I wrote a couple of posts about DLLs and their exports. I decided to return to this series as I have some new notes jotted down about the subject…

The extraordinary way we can run Rundll32 with ordinals gave me an idea to check if commonly exported functions are following some sort of… export order. That is, if we look at e.g. COM DLLs, I tried to check if we always see the same export ordinal mapping of DllCanUnloadNow, DllGetClassObject, DllRegisterServer, etc. .

It turns out that this is usually the case:

 237607 DllCanUnloadNow	1
  19736 DllCanUnloadNow	2
   8665 DllCanUnloadNow	3
   2763 DllCanUnloadNow	5
   2411 DllCanUnloadNow	4

 234844 DllGetClassObject	2
  16700 DllGetClassObject	3
   9188 DllGetClassObject	4
   5669 DllGetClassObject	1
   3402 DllGetClassObject	6

 167356 DllRegisterServer	3
  67396 DllRegisterServer	4
   6308 DllRegisterServer	5
   3427 DllRegisterServer	7
   2026 DllRegisterServer	2

 164710 DllUnregisterServer	4
  66457 DllUnregisterServer	5
   6327 DllUnregisterServer	6
   3304 DllUnregisterServer	8
   1909 DllUnregisterServer	7

  30159 DllMain	3
  24334 DllMain	1
   5503 DllMain	20
   5299 DllMain	2
   2387 DllMain	4

  29805 DllInstall	3
   3014 DllInstall	4
    239 DllInstall	18
    188 DllInstall	5
    169 DllInstall	30

These are pretty consistent:

  • DllCanUnloadNow 1
  • DllGetClassObject 2
  • DllRegisterServer 3
  • DllUnregisterServer 4

As such, one could use them instead of actual API names. Not a biggie, but could confuse some naive detection rules…

Going BAT…mode crazy

March 12, 2020 in Anti-*, Anti-Forensics, Batch Analysis, File Formats ZOO, Random ideas

What will the following bat file print? Foo, or Bar?

@echo off

 mode con cp select=65000 > nul
 set jump=+ACQ-
 mode con cp select=437 > nul
 goto %jump%

:+ACQ-
 echo Foo
 goto :eof

:$
 echo Bar
 goto :eof

Here’s the answer:

Batch files can be saved as text files using different encodings, including UTF7, and UTF8 as well as MBCS/DBCS characters sets.

One can therefore enforce encoding and change it not only outside of a batch file, but also on the fly, as is the case in the example above. As a result, the part of the code that executes after first ‘mode’ is encoded in UTF7 (‘+ACQ-‘ is an encoded ‘$’ sign), and the second is OEM-US English.

The below example replaces UTF7 in the above example with Traditional Chinese:

@echo off

 mode con cp select=950 > nul
 set jump=§A¦n
 mode con cp select=65001 > nul
 goto %jump%

:§A¦n
 echo Foo
 goto :eof

:你好
 echo Bar
 goto :eof

If you look at this code using 950 character set (big5) you will see this:

@echo off

 mode con cp select=950 > nul
 set jump=你好
 mode con cp select=65001 > nul
 goto %jump%

:你好
 echo Foo
 goto :eof

:雿末
 echo Bar
 goto :eof

and if you choose to preview as UTF8:

@echo off

 mode con cp select=950 > nul
 set jump=§A¦n
 mode con cp select=65001 > nul
 goto %jump%

:§A¦n
 echo Foo
 goto :eof

:你好
 echo Bar
 goto :eof

Misleading, isn’t it?

When you run this version of script you will see an error from the interpreter – this is a result of it interpreting superfluous UTF8 prefixes that seem to be appearing out of nowhere within the interpreter. Perhaps further study of cmd.exe internals can help to eliminate this quirk. Still, the jump goes to the proper label & errors can be always hidden with standard error redirection: