{"id":6958,"date":"2020-02-04T23:43:24","date_gmt":"2020-02-04T23:43:24","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6958"},"modified":"2020-02-04T23:43:26","modified_gmt":"2020-02-04T23:43:26","slug":"sleeping-dll-beauties","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/02\/04\/sleeping-dll-beauties\/","title":{"rendered":"Sleeping DLL beauties"},"content":{"rendered":"\n<p>How do we sleep?<\/p>\n\n\n\n<p>We do one of these:<\/p>\n\n\n\n<ul><li>kernel32\/kernelbase ! Sleep<\/li><li>kernel32\/kernelbase !  SleepEx<\/li><li>ntdll ! ZwDelayExecution<\/li><\/ul>\n\n\n\n<p>but&#8230; not only.<\/p>\n\n\n\n<p>Windows 10 offers more libs with more sleeping goodness:<\/p>\n\n\n\n<ul><li>staterepository.core.dll ! sqlite3_win32_sleep<\/li><li>winsqlite3.dll ! sqlite3_win32_sleep<\/li><li>number of tools e.g. Visual Studio offer access to e_sqlite3.dll   ! sqlite3_win32_sleep, Python to sqlite3.dll !  sqlite3_win32_sleep <\/li><\/ul>\n\n\n\n<p>These are actually identical SQLite functions exported by various libraries. <\/p>\n\n\n\n<p>And then you may have LibreSSL on your system (c:\\windows\\system32\\libcrypto.dll), so you can use:<\/p>\n\n\n\n<ul><li>libcrypto.dll, sleep<\/li><\/ul>\n\n\n\n<p>All of them can be used as a lame anti-sandbox\/anti-analysis alternative to traditional delay functions listed at the top of the post. And as a random, but lasting very long delay replacing a never ending loop in batch files, or if lucky, maybe even ping 127.0.0.1. <\/p>\n\n\n\n<p>How? <\/p>\n\n\n\n<p>By executing these APIs via rundll32:<\/p>\n\n\n\n<ul><li>start \/wait rundll32 kernel32.dll, Sleep<\/li><li>start \/wait rundll32 kernelbase.dll, Sleep<\/li><li>start \/wait rundll32 kernel32.dll, SleepEx<\/li><li>start \/wait rundll32 kernelbase.dll, SleepEx<\/li><li>start \/wait rundll32 staterepository.core.dll, sqlite3_win32_sleep<\/li><li>start \/wait rundll32 winsqlite3.dll, sqlite3_win32_sleep <\/li><li>start \/wait rundll32 sqlite3.dll, sqlite3_win32_sleep <\/li><li> start \/wait rundll32 e_sqlite3.dll, sqlite3_win32_sleep  <\/li><li>start \/wait rundll32 libcrypto.dll, sleep<\/li><\/ul>\n\n\n\n<p>In these cases the argument to functions will be pretty high numbers (taken from stack and kinda random), but it&#8217;s not about logic, is it? \ud83d\ude09<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How do we sleep? We do one of these: kernel32\/kernelbase ! Sleep kernel32\/kernelbase ! SleepEx ntdll ! ZwDelayExecution but&#8230; not only. Windows 10 offers more libs with more sleeping goodness: staterepository.core.dll ! sqlite3_win32_sleep winsqlite3.dll ! sqlite3_win32_sleep number of tools e.g. &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/02\/04\/sleeping-dll-beauties\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[58,18,67],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6958"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6958"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6958\/revisions"}],"predecessor-version":[{"id":6959,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6958\/revisions\/6959"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}