search

mandiant / speakeasy

Windows kernel and user mode emulation.
MIT License
1.53k stars 232 forks source link

Bug in read string from UNICODE_STRING and ANSI_STRING #224

Closed HongThatCong closed 1 year ago

HongThatCong commented 1 year ago

LdrLoadDll and LdrGetProcedureAddress in winenv\api\usermode\ntdll.py will failed when the unicode string and ansi string which not NULL terminated. UNICODE_STRING and ANSI_STRING don't enforce to have NULL char at end. The len of them is the field Length in UNICODE_STRING and ANSI_STRING.

HongThatCong commented 1 year ago

I fixed in winenv\api\api.py image

HongThatCong commented 1 year ago

And in winenv\api\usermode\ntdll.py image

Lophiel commented 1 year ago

Dear mentors, may I work on this issue and is there any test examples you have that essentially trigger the aforementioned issue ?

williballenthin commented 1 year ago

go ahead and work on the issue.

i don't have any examples offhand. @HongThatCong do you?

HongThatCong commented 1 year ago

To @williballenthin, @Lophiel: sample: "ce1cdb8895c7fbda1dc1d3e8a027d0b4310e956acffa75326281670f8e2b6226"