{"id":9282,"date":"2024-07-07T00:04:13","date_gmt":"2024-07-07T00:04:13","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9282"},"modified":"2024-07-07T21:40:44","modified_gmt":"2024-07-07T21:40:44","slug":"writing-a-frida-based-vbs-api-monitor","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2024\/07\/07\/writing-a-frida-based-vbs-api-monitor\/","title":{"rendered":"Writing a Frida-based VBS API monitor"},"content":{"rendered":"\n

Update<\/strong><\/p>\n\n\n\n

See the updated version of the script here<\/a>.<\/p>\n\n\n\n

Old Post<\/strong><\/p>\n\n\n\n

I love experimenting with Frida and I have presented a few<\/a> different<\/a> API Monitoring prototypes based on this framework a few times before…<\/p>\n\n\n\n

Today I will demonstrate how to write a quick & dirty VBS\/VBScript (Visual Basic Script) API Monitor.<\/p>\n\n\n\n

As many of you probably know, when we execute .vbs<\/em> scripts via cscript.exe<\/em> or wscript.exe <\/em>the actual dirty work is done by the vbscript.dll<\/em>. From some quick poking around inside this library I can tell that many functions available to Visual Basic Script programmers are implemented as callbacks, and these callback routines rely on a VARIANT<\/a> structure. What it means in practice is that arguments are passed by means of using this structure, where the first field of the structure defines the type of the data being passed as an argument, followed by the actual data or offset to data. On a 64-bit version of Windows, and using the 64-bit version of vbscript.dll<\/em>, the first field of this VARIANT structure is 8-bytes long (qword).<\/p>\n\n\n\n

The below screenshot from XDBG shows an example of such structure as seen in memory:<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

The first qword is holding a value 8 which means it is a String. The address following this qword is the offset to the actual Unicode string.<\/p>\n\n\n\n

The VARIANT types are described all over the place, and sometimes these descriptions actually vary. This is because of the migration from the 32- to 64-bit architecture, plus some of the types have evolved over time. And on top of that, this is a shared commodity — win32 APIs use it, COM methods use it, VBS uses it, VB uses it and VBA as well. It’s a bit of a mess (f.ex. type ‘2’ may be a vbInteger<\/em> or vbShort<\/em>, depending on where you look).<\/p>\n\n\n\n

It doesn’t matter from our perspective too much as we can build a list of known values (this is not a final list!) that is good enough for our purposes:<\/p>\n\n\n\n