Return value and follow args

[maxspl]

Hi!

I tried to add these two options in a fork:

1. Log return value of syscall and function call

Enabled in the .ini file using LOG_RETURN_VALUE.

I'v used this logic:

• For function calls:
  • Store the return address at call time.
  • Compare it with each instruction via CheckIfFunctionReturned. If one of the instructions after the call is the return one, it indicates we're at the function return.
  • I've tried this with MonitorFunctionArgs and IPOINT_AFTER, but it doesn't work for some functions.
• For syscalls:
  • Simpler logic using SyscallCalledAfter.

Output Example

The output looks like this:
GetProcAddress:
	Arg[0] = ptr 0x00007ff8acab0000 -> {MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00}
	Arg[1] = ptr 0x00007ff78683400a -> "NtAllocateVirtualMemory"

GetProcAddress
	returned: ptr 0x00007ff8acb4d7e0 -> {L\x8b\xd1\xb8\x18\x00\x00\x00\xf6\x04%\x08\x03\xfe\x7f\x01}

2. Follow the args and return value

Enabled in the .ini file via FOLLOW_ARGS_RETURN

The goal is to track args and returns (if they are valid pointers) of all calls to detect any change (ex: log the first bytes of the allocated memory by VirtualAlloc when filled).

This is done like that :

• Each call is described in a struct (ID (unique per thread), name, return adress, args, return value...)
• At an arbitrarily chosen point in the code (I've chosen every time any function specified in params.txt is called, but this can be changed), the saved calls are scanned and their args (if valid pointer) and return value (if valid pointer) are checked: a comparison is made between the current pointed value and the initial value. If a change is detected, it is logged.

The output looks like this for a new value pointed to by an arg :

CreateProcessA:
	Arg[0] = ptr 0x000000ef813ff750 -> "C:\Windows\System32\cmd.exe"
	Arg[1] = 0
	Arg[2] = 0
	Arg[3] = 0
	Arg[4] = 0x0000000300000000 = 12884901888
	Arg[5] = 0
	Arg[6] = 0
	Arg[7] = 0
	Arg[8] = ptr 0x000000ef813ff790 -> L"h"
	Arg[9] = ptr 0x000000ef813ff770 -> {\x00\x00\x00\x00\x00\x00\x00\x00}

CreateProcessA
	returned: 0x0000000000000001 = 1

[...]

VirtualAlloc:
	Arg[0] = 0
	Arg[1] = 0x00000000000001b2 = 434
	Arg[2] = 0x0000000000003000 = 12288
	Arg[3] = 0x0000000000000040 = 64

CreateProcessA, Arg[0] Pointer: 0x000000ef813ff750 changed:
	Old: {ptr 0x000000ef813ff750 -> "C:\Windows\System32\cmd.exe"}
	New: {ptr 0x000000ef813ff750 -> "C:\temp.exe"}
CreateProcessA, Arg[9] Pointer: 0x000000ef813ff770 changed:
	Old: {ptr 0x000000ef813ff770 -> {\x00\x00\x00\x00\x00\x00\x00\x00}}
	New: {ptr 0x000000ef813ff770 -> {\x0c\x01\x00\x00\x00\x00\x00\x00}}

The output looks like this for a new value pointed to by a return pointer:

[...]
CreateProcessA:
	Arg[0] = ptr 0x000000ef813ff750 -> "C:\temp.exe"
	Arg[1] = 0
	Arg[2] = 0
	Arg[3] = 0
	Arg[4] = 0x0000000300000000 = 12884901888
	Arg[5] = 0
	Arg[6] = 0
	Arg[7] = 0
	Arg[8] = ptr 0x000000ef813ff790 -> L"h"
	Arg[9] = ptr 0x000000ef813ff770 -> {\x0c\x01\x00\x00\x00\x00\x00\x00}

VirtualAlloc, Return Pointer: 0x1f26bb00000 changed:
	Old: {ptr 0x000001f26bb00000 -> {\x00\x00\x00\x00\x00\x00\x00\x00}}
	New: {ptr 0x000001f26bb00000 -> {H\x83\xec(H\x83\xe4\xf0}}

CreateProcessA
	returned: 0

I plan to add another feature that will enrich the tracking of args and return values: PE and shellcode detection, memory extraction etc.

I hope all this is understandable, but before making a PR, I wanted to submit the idea here and find out if it might be possible to integrate these additions. The changes can be found on this fork (cf. the last two commits): https://github.com/maxspl/tiny_tracer.

Thanks in advance :)