{"id":6034,"date":"2019-03-09T01:08:48","date_gmt":"2019-03-09T01:08:48","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6034"},"modified":"2019-03-09T01:34:40","modified_gmt":"2019-03-09T01:34:40","slug":"dictionary-files-dctx","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/03\/09\/dictionary-files-dctx\/","title":{"rendered":"Dictionary files (.dctx)"},"content":{"rendered":"\n<p>This is not a very important research really. Just a &#8216;blurb&#8217; of what I observed during my quick tests.<\/p>\n\n\n\n<p>So&#8230; <\/p>\n\n\n\n<p>First of all, I noticed that <em>.dctx<\/em> files are being handled by this program:<\/p>\n\n\n\n<ul><li>C:\\Windows\\System32\\IME\\shared\\IMEWDBLD.EXE<\/li><\/ul>\n\n\n\n<p>These are dictionary files (source) and are compiled to some other binary format (<em>.dctc<\/em> AFAICT). These dictionaries seem to be heavily used (and needed?) for Asian languages, so most of info on them can be found online on forums discussing Japanese and Chinese language keyboard input. <\/p>\n\n\n\n<p>Examples: <a href=\"https:\/\/github.com\/y-asaba\/WikipediaOED\">here<\/a>, and <a href=\"https:\/\/github.com\/kagurazakayashi\/nikki3words\/tree\/master\/thesaurus\">here<\/a>. <\/p>\n\n\n\n<p>When you open a <em>.dctx<\/em> file on Windows 10 you will be presented with this dialog box:<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/03\/DCTX1.png\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/03\/DCTX1.png\" alt=\"\" class=\"wp-image-6036\" width=\"500\" height=\"211\"\/><\/a><\/figure>\n\n\n\n<p>When we click OK, we will see another dialog box:<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/03\/DCTX2.png\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/03\/DCTX2.png\" alt=\"\" class=\"wp-image-6037\" width=\"379\" height=\"152\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/03\/DCTX2.png 379w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2019\/03\/DCTX2-300x120.png 300w\" sizes=\"(max-width: 379px) 100vw, 379px\" \/><\/a><\/figure>\n\n\n\n<p>I have not figured out what that means, but it seems to be a highly prevalent error and many users report it. I couldn&#8217;t  bypass it despite toying around with various parameters embedded inside my test <em>.dctx<\/em> file. I tried to use variations of English language (US vs. UK), different encoding, etc., but it always comes back with the same error. <\/p>\n\n\n\n<p>Also, after looking at IMEWDBLD.EXE, I noticed that it takes a <em>-v &lt;logfile&gt;<\/em> command line argument (where <em>-v<\/em> stands for <em>-verbose<\/em>, I guess). Using it during testing is a better alternative to that non-descriptive dialog box shown above. After trying to open the very same <em>.dctx<\/em> with <em>IMEWDBLD.EXE<\/em> and <em>-v<\/em> flag enabled I observed this in the ouput of the log file:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Error: Encountered fatal error(0x80070057:The parameter is incorrect.).<br>Error: There is a problem with the dictionary file. Please try to download again.<\/pre>\n\n\n\n<p>Unfortunately, this error is very prevalent inside the binary (<em>IMEWDBLD.EXE<\/em>), so I didn&#8217;t spend too much time trying to figure it out. Okay, if you must know, <em>0x80070057<\/em> stands for an invalid argument. Would be really handy to know which argument triggered it&#8230; hmm&#8230;..<\/p>\n\n\n\n<p>So, that&#8217;s it really. <\/p>\n\n\n\n<p>If you want to play around, this is a minimalistic <a href=\"https:\/\/hexacorn.com\/d\/sample.dctx\">sample .dctx file<\/a> you can try to import on your Windows 10 system. Download, and double click. That&#8217;s it.<\/p>\n\n\n\n<p><strong>Bonus<\/strong><\/p>\n\n\n\n<p>I think the IME components are not very well researched and can potentially offer mechanisms that will allow for less-known attacks focused on:<\/p>\n\n\n\n<ul><li>persistence<\/li><li>bypassing security controls<\/li><li>RCE<\/li><\/ul>\n\n\n\n<p>Why?<\/p>\n\n\n\n<p>They seem to be developed for a niche (but not negligible due to number!) group of users in Asia (Japanese, Chinese), and most likely have been poorly tested. The last IME-related research I could find is <a href=\"https:\/\/www.symantec.com\/avcenter\/reference\/ime.as.a.possible.keylogger.pdf\">here<\/a>.<\/p>\n\n\n\n<p>Why?<\/p>\n\n\n\n<p>If you look at  <em>IMEWDBLD.EXE<\/em>  binary you will notice a bunch of flags that are not documented anywhere on the internet. Hence, they could be limited to a test environment at MS, or only taken into account on OS versions that require IME. The lower the scope, the lower the testing priority. A.K.A. if it is not documented on the Internet, then it&#8217;s likely internal.<\/p>\n\n\n\n<p>Some food for a thought:<\/p>\n\n\n\n<ul><li>HKLM\\SOFTWARE\\Microsoft\\IME\\PlugInDict<\/li><li>EncryptAllPlugInDict<\/li><li>DisableAllPlugInDict<\/li><\/ul>\n\n\n\n<p>Command line arguments for <em>IMEWDBLD.EXE<\/em>:<\/p>\n\n\n\n<ul><li>-encrypt &lt;unknown&gt;<\/li><li>-pluginguid &lt;guid&gt;<\/li><li>-w  &lt;unknown&gt; <\/li><li>-pm  &lt;unknown&gt; <\/li><li>-v &lt;logfile&gt; &#8211; saves the verbose info to <em>logfile<\/em><\/li><li>-nofilter &lt;unknown&gt; <\/li><li>-testing &lt;unknown&gt; <\/li><\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is not a very important research really. Just a &#8216;blurb&#8217; of what I observed during my quick tests. So&#8230; First of all, I noticed that .dctx files are being handled by this program: C:\\Windows\\System32\\IME\\shared\\IMEWDBLD.EXE These are dictionary files (source) &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2019\/03\/09\/dictionary-files-dctx\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,84,56,58,80,44],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6034"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6034"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6034\/revisions"}],"predecessor-version":[{"id":6039,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6034\/revisions\/6039"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6034"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6034"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6034"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}