{"id":9292,"date":"2024-07-07T18:34:33","date_gmt":"2024-07-07T18:34:33","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9292"},"modified":"2024-07-07T19:14:06","modified_gmt":"2024-07-07T19:14:06","slug":"writing-a-frida-based-vbs-api-monitor-take-two","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2024\/07\/07\/writing-a-frida-based-vbs-api-monitor-take-two\/","title":{"rendered":"Writing a Frida-based VBS API monitor, Take two"},"content":{"rendered":"\n<p>In my previous <a href=\"https:\/\/www.hexacorn.com\/blog\/2024\/07\/07\/writing-a-frida-based-vbs-api-monitor\/\" data-type=\"post\" data-id=\"9282\">post<\/a> I introduced a simple VBS API Monitor developed using Frida framework.<\/p>\n\n\n\n<p>Today I did some more code analysis of <em>vbscript.dll<\/em> and I realized that in my previous post I made a naive assumption that arguments are passed to VBS callback functions using the same conventions like Windows API.<\/p>\n\n\n\n<p>It turns out that the arguments are passed via the argument 2 (r8 on 64-bit Windows), and the number of arguments is passed in the argument 1 (rdx on 64-bit Windows). So, we can get the value of argument 1, and then use it to loop over the memory region pointed to by r8. All arguments are placed every 24 bytes (8&#215;3).<\/p>\n\n\n\n<p>Additionally, I discovered that there is one more VARIANT type that indicates string arguments passed by reference. I have added it to the code as well, so now all the functions show proper arguments.<\/p>\n\n\n\n<p>With these changes in place we get this (for the test script from the previous post):<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/07\/vbs8.png\"><img decoding=\"async\" loading=\"lazy\" width=\"424\" height=\"330\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/07\/vbs8.png\" alt=\"\" class=\"wp-image-9293\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/07\/vbs8.png 424w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/07\/vbs8-300x233.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2024\/07\/vbs8-385x300.png 385w\" sizes=\"(max-width: 424px) 100vw, 424px\" \/><\/a><\/figure>\n\n\n\n<p>The updated IDAPython script can be found <a href=\"https:\/\/hexacorn.com\/d\/vbs_frida_2.py\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In my previous post I introduced a simple VBS API Monitor developed using Frida framework. Today I did some more code analysis of vbscript.dll and I realized that in my previous post I made a naive assumption that arguments are &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2024\/07\/07\/writing-a-frida-based-vbs-api-monitor-take-two\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[92,41],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9292"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9292"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9292\/revisions"}],"predecessor-version":[{"id":9298,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9292\/revisions\/9298"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9292"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9292"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9292"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}