---
# System prepended metadata

title: ghidra
tags: [malware]

---

---
title: ghidra
tags: malware
---
[TOC]

# WannaCry
[ghidra.ninja](https://www.ghidra.ninja/posts/03-wannacry-1/)

## 修改data type(Edit Function Signature)
- 找不到main -> 從entry開始看
- entry是microsoft的default
    - [csdn - OEP](https://blog.csdn.net/kkfd1002/article/details/79832269)
    - ![](https://i.imgur.com/DzwhLqv.png)
    - GetModuleHandleA 是啟動函數
    - exit(WinMain)
    - 所以 local_6c 就是 WinMain -> [MSDN](https://docs.microsoft.com/zh-tw/windows/win32/learnwin32/winmain--the-application-entry-point)
    - ```int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PWSTR pCmdLine, int nCmdShow);```
    - 去掉預設跟 c -> ```int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PWSTR pCmdLine, int nCmdShow)```

## Kill Switch
- WinMain 裡面可以看到，奇怪的 URL -> 這就是 kill switch 了
- change var name，fix data type 
- ![](https://i.imgur.com/ZXwlX9q.png)
- 這邊可以看到 只有兩行指令 -> 直接讀assembly的意思是重複的將一個var讀到記憶體區段 -> strcpy

## InterNetOpenA、InternetOpenUrlA
:::success
```c=
HINTERNET InternetOpenA(
  LPCSTR lpszAgent,
  DWORD  dwAccessType,
  LPCSTR lpszProxy,
  LPCSTR lpszProxyBypass,
  DWORD  dwFlags
);
```
:::
- 沒有對應的function type時，在data type自己新增
- ![](https://i.imgur.com/OuDqje2.png)

- fix data type
:::success
```c=
HINTERNET InternetOpenUrlA(
  HINTERNET hInternet,
  LPCSTR    lpszUrl,
  LPCSTR    lpszHeaders,
  DWORD     dwHeadersLength,
  DWORD     dwFlags,
  DWORD_PTR dwContext
);
```
:::
- fix data type
==**有時候MSDN上會有錯的 Function type  要注意!!!**==

## GetModuleFileNameA
:::info
GetModuleFileNameA
```cpp=
DWORD GetModuleFileNameA
(
HMODULE hModule,
LPSTR   lpFilename,
DWORD   nSize
);
```
![](https://i.imgur.com/Y6ZjaED.png)

lpFilename -> ExecutablePath
:::

## (int *)__p___argc();
![](https://i.imgur.com/x8i6WaL.png)
![](https://i.imgur.com/Dr9q5xX.png)
![](https://i.imgur.com/PWwHjfh.png)
![](https://i.imgur.com/ZYrQAB0.png)

|         | Release  | Debug    |
| --------| -------- | -------- |
| x64     | __p___argc() | j___p___argc |
| x86     | _get_wide_winmain_command_line | j__get_wide_winmain_command_line |

[stackoverflow](https://stackoverflow.com/questions/54655387/assembly-return-value-of-p-argv)
![](https://i.imgur.com/cyxQw17.png)
![](https://i.imgur.com/iz3sALz.png)
- 這邊可以 fix function type -> ```int * __p___argc (void)```

## Create_wannacry_service
:::success
![](https://i.imgur.com/3U3wo8w.png)

- sprintf -> 格式化字串
```c=
int sprintf(
   char *buffer,
   const char *format [,
   argument] ...
);
```
e.g:檔案路徑是 C:\Users\Dung\Desktop\Malware\test\wannacry.exe
buffer 會存
C:\Users\Dung\Desktop\Malware\test\wannacry.exe -m security
:::
:::info
![](https://i.imgur.com/1ge3f8h.png)

- OpenSCManagerA
![](https://i.imgur.com/zl7FVIZ.png)
- 0x0
    - the function connects to the service control manager on the local computer.
- 0x0
    -  If it is NULL, the SERVICES_ACTIVE_DATABASE database is opened by default.
- 0xf003f
    - ![](https://i.imgur.com/aTeRHLJ.png)
    - ![](https://i.imgur.com/uadSrGh.png)
:::
:::success
- 如果SCManager有被成功打開並返回SC_HANDLE
- CreateServiceA
```c=
SC_HANDLE CreateServiceA(
  SC_HANDLE hSCManager,
  LPCSTR    lpServiceName,
  LPCSTR    lpDisplayName,
  DWORD     dwDesiredAccess,
  DWORD     dwServiceType,
  DWORD     dwStartType,
  DWORD     dwErrorControl,
  LPCSTR    lpBinaryPathName,
  LPCSTR    lpLoadOrderGroup,
  LPDWORD   lpdwTagId,
  LPCSTR    lpDependencies,
  LPCSTR    lpServiceStartName,
  LPCSTR    lpPassword
);
```
- s_mssecsvc2.0_004312fc
    - lpServiceName
- s_Microsoft_Security_Center_(2.0)_S_00431308
    -  Microsoft Security Center(2.0)Service
- 0xf01ff 
    - ![](https://i.imgur.com/gonRh2X.png)
- 0x10
    - ![](https://i.imgur.com/o7rJrhN.png)
- 0x2 
    - SERVICE_AUTO_START
    - ![](https://i.imgur.com/eHJeqgX.png)
- 0x1
    - SERVICE_ERROR_NORMAL
    - ![](https://i.imgur.com/kziygsT.png)
- buffer_exec_with_path
    - ![](https://i.imgur.com/Ip2w1ho.png)
- 0x0
    - Specify NULL or an empty string if the service does not belong to a group.
- 0x0
    - pecify NULL if you are not changing the existing tag.
- 0x0
    - Specify NULL or an empty string if the service has no dependencies.
- 0x0
    - If this parameter is NULL, CreateService uses the LocalSystem account. If the service type specifies SERVICE_INTERACTIVE_PROCESS, the service must run in the LocalSystem account.
-> 基本上是已經使用拿到 administrator 的權限創造的 service 後面幾項都是填 null。創建的 service 會 auto run

:::

## 第二個func
![](https://i.imgur.com/yMqQkuh.png)

- 接著可以看到hModule在kernel32.dll
- 然後抓func的address
- 修參數名稱
![](https://i.imgur.com/UEBiYl8.png)
![](https://i.imgur.com/9NEXd8z.png)

## memset -> 待研究
- 這邊兩個 for loop 做的事情跟 memset 一樣



## sprintf
- ![](https://i.imgur.com/ya8HuPt.png)
- 這邊兩個 sprintf 的參數其實有多個 -> 修改 ghidra
- ![](https://i.imgur.com/q2zsSkj.png)
- ![](https://i.imgur.com/SserNQj.png)

## MoveFileExA
:::success
BOOL MoveFileExA(
  LPCSTR lpExistingFileName,
  LPCSTR lpNewFileName,
  DWORD  dwFlags
);
:::
- 先看dwFlags
- ![](https://i.imgur.com/qNMJtqs.png)
- MOVEFILE_REPLACE_EXISTING

# wannacry -> 無聊想修改的地方
## entry
- STARTUPINFOA
- ![](https://i.imgur.com/IrBUObf.png)

## SERVICE_TABLE_ENTRYA
- ![](https://i.imgur.com/8X6aHCB.png)
- retype Variable
- ![](https://i.imgur.com/ilzi2GL.png)
- ![](https://i.imgur.com/9bJugmU.png)
- service在撰寫的時候就規定最後一個要填 null
- ![](https://i.imgur.com/FitbJmL.png)


## ChangeServiceConfig2A
- ![](https://i.imgur.com/0yq5T1A.png)
- 位置接在這邊 -> 應該是sevice沒辦法open的時候做的事情
- ![](https://i.imgur.com/ON3jTtX.png)
[msdn](https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-changeserviceconfig2a) 
