{"id":6238,"date":"2019-04-24T18:23:28","date_gmt":"2019-04-24T18:23:28","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6238"},"modified":"2019-08-20T23:11:49","modified_gmt":"2019-08-20T23:11:49","slug":"3-new-code-injection-tricks","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2019\/04\/24\/3-new-code-injection-tricks\/","title":{"rendered":"3 (4) new code injection tricks"},"content":{"rendered":"\n

Update<\/strong><\/p>\n\n\n\n

After I published it I got a few updates; a couple of guys successfully implemented POCs for some of the techniques in this series, this post itself was updated a few times as well. Finally, Alex Ionescu<\/a> also chipped in<\/a> to say that he used this technique as early as 2008 (or 2011?) and presented it at Recon that year. Unfortunately link to\/slides are not available online at the time of writing this update. Also, important to note that in my older post about WordWarper<\/a> I included an update about that technique being known as early as 2003!<\/p>\n\n\n\n

Old Post<\/strong><\/p>\n\n\n\n

I was planning to blog about various (Rich) Edit callback functions for a long time. Why? Because these callbacks allow us to remotely execute code inside processes that host these controls (sometimes these controls need to meet additional criteria). <\/p>\n\n\n\n

I eventually started<\/a> describing them yesterday. <\/p>\n\n\n\n

At first I planned to have a few posts, each dedicated to one callback (with a new cheezy ‘code injection’ name included), but then Csaba<\/a> discovered<\/a> EM_SETAUTOCORRECTPROC and then I felt that it’s just easier to wrap it up with a short post, and introduce them all in one go \ud83d\ude42<\/p>\n\n\n\n

So… why does it work? (Rich) edit includes a number of CallBack functions that can be modified from a different program thanks to windows messaging mechanism. These callbacks are simple pointers to functions and are called by the control windows procedure in response to various events. <\/p>\n\n\n\n

Below are the techniques I wanted to walk through – each one describes a message (or a pair of messages) that need(s) to be sent & a prototype for a callback procedure that will be executed by the (Rich) Edit windows procedure.<\/p>\n\n\n\n

Due to its nature it should work across 32- and 64- boundary same as Propagate<\/a>. Since the cat is out of the bag, I lost interest and have not tested it too much, but it should work.<\/p>\n\n\n\n

WordWarping (if works)<\/strong><\/p>\n\n\n\n

EM_SETWORDBREAKPROC<\/a> & EditWordBreakProc<\/a><\/p>\n\n\n\n

Hyphentension<\/strong> (if works)<\/strong> <\/p>\n\n\n\n

EM_SETHYPHENATEINFO<\/a> & HyphenateProc<\/a><\/p>\n\n\n\n

AutoCourgette (if works)<\/strong><\/p>\n\n\n\n

EM_SETAUTOCORRECTPROC<\/a> & AutoCorrectProc<\/a><\/p>\n\n\n\n

+ after I posted this Csaba<\/a> discovered a super-cool ‘feature’ that allows to actually call the AutoCorrectProc in a remote process — via EM_CALLAUTOCORRECTPROC<\/a>. This is a great find and simplifies execution (that otherwise requires GUI instrumentation).<\/p>\n\n\n\n

Streamception (if works)<\/strong><\/p>\n\n\n\n

EM_STREAMIN<\/a> or EM_STREAMOUT <\/a>& EditStreamCallback<\/a> <\/p>\n\n\n\n

Update: <\/strong><\/p>\n\n\n\n

After I posted this, I found one more callback function. So the title should be probably ‘4 more code injection tricks’ \ud83d\ude09<\/p>\n\n\n\n

Oleum (if works)<\/strong><\/p>\n\n\n\n

EM_SETOLECALLBACK<\/a> and IRichEditOleCallback<\/a><\/p>\n\n\n\n

Modexp shared a nice POC here<\/a>.
Csaba shared a nice POC here<\/a>. <\/p>\n","protected":false},"excerpt":{"rendered":"

Update After I published it I got a few updates; a couple of guys successfully implemented POCs for some of the techniques in this series, this post itself was updated a few times as well. Finally, Alex Ionescu also chipped … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[57],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6238"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6238"}],"version-history":[{"count":17,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6238\/revisions"}],"predecessor-version":[{"id":6678,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6238\/revisions\/6678"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}