{"action":"created","issue":{"url":"https://api.github.com/repos/IDArlingTeam/IDArling/issues/9","repository_url":"https://api.github.com/repos/IDArlingTeam/IDArling","labels_url":"https://api.github.com/repos/IDArlingTeam/IDArling/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/IDArlingTeam/IDArling/issues/9/comments","events_url":"https://api.github.com/repos/IDArlingTeam/IDArling/issues/9/events","html_url":"https://github.com/IDArlingTeam/IDArling/issues/9","id":347829811,"node_id":"MDU6SXNzdWUzNDc4Mjk4MTE=","number":9,"title":"Possible way to hook \"Change callee address\"","user":{"login":"NyaMisty","id":5344431,"node_id":"MDQ6VXNlcjUzNDQ0MzE=","avatar_url":"https://avatars1.githubusercontent.com/u/5344431?v=4","gravatar_id":"","url":"https://api.github.com/users/NyaMisty","html_url":"https://github.com/NyaMisty","followers_url":"https://api.github.com/users/NyaMisty/followers","following_url":"https://api.github.com/users/NyaMisty/following{/other_user}","gists_url":"https://api.github.com/users/NyaMisty/gists{/gist_id}","starred_url":"https://api.github.com/users/NyaMisty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NyaMisty/subscriptions","organizations_url":"https://api.github.com/users/NyaMisty/orgs","repos_url":"https://api.github.com/users/NyaMisty/repos","events_url":"https://api.github.com/users/NyaMisty/events{/privacy}","received_events_url":"https://api.github.com/users/NyaMisty/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-06T08:38:43Z","updated_at":"2018-08-08T08:10:21Z","closed_at":null,"author_association":"NONE","body":"We can introduce the **NetNode hook**\r\n```\r\nchar sub_15031020()\r\n{\r\n  int v0; // ecx\r\n  const char *v1; // rdx\r\n  unsigned int v2; // ebx\r\n  int v4; // eax\r\n  unsigned int v5; // eax\r\n  unsigned int v6; // [rsp+30h] [rbp-428h]\r\n  unsigned int v7; // [rsp+34h] [rbp-424h]\r\n  unsigned int v8; // [rsp+38h] [rbp-420h]\r\n  char v9; // [rsp+40h] [rbp-418h]\r\n\r\n  v0 = ph[1];\r\n  if ( v0 == 12 )\r\n  {\r\n    v1 = \"$ mips\";\r\n  }\r\n  else\r\n  {\r\n    v1 = \" $arm\";\r\n    if ( v0 != 13 )\r\n      v1 = \"$ vmm functions\";\r\n  }\r\n  qword_15034080 = (__int64)v1;\r\n  netnode_check(&v7, v1, 0i64, 0i64);\r\n  callui(11i64, &v8);\r\n  v2 = v8;\r\n  if ( (get_flags_ex(v8, 0i64) & 0x600) != 1536 )\r\n    return 0;\r\n  v4 = netnode_altval(v7, v2, 321i64);\r\n  v5 = node2ea((unsigned int)(v4 - 1));\r\n  v6 = v5;\r\n  if ( ph[1] == 13 )\r\n    v6 = v5 & 0xFFFFFFFE;\r\n  qsnprintf(\r\n    &v9,\r\n    1024i64,\r\n    \"HELP\\n%s\\nENDHELP\\nEnter the callee address\\n\\n  <~C~allee:$:500:40:::>\\n\\n\\n\",\r\n    \"This plugin allows the user to change the address of the called function\\n\"\r\n    \"in constructs like\\n\"\r\n    \"\\n\"\r\n    \"       call esi\\n\"\r\n    \"\\n\"\r\n    \"You can enter a function name instead of its address\\n\");\r\n  if ( !(unsigned int)KickUI((__int64)&v9) )\r\n    return 1;\r\n  if ( v6 == -1 )\r\n  {\r\n    netnode_supdel(v7, v2, 321i64);\r\n  }\r\n  else\r\n  {\r\n    if ( ph[1] == 13 && !(v6 & 1) )\r\n      get_sreg(v6, 0x14i64);\r\n    v8 = (unsigned __int64)ea2node() + 1;\r\n    netnode_supset(v7, v2, &v8, 4i64, 321);\r\n  }\r\n  auto_mark_range(v2, v2 + 1, 40i64);\r\n  return 1;\r\n}\r\n```\r\nThe `Change callee address` is provided by the plugin callee.dll & callee64.dll (in windows)\r\nWith the code above we can see that that function is achieved by setting netnode values, but sadly there aren't any notifications or hooks for netnode change natively in the IDA SDK.\r\nHowever as the IDA only runs on x64 platforms from version 7.0, we can use the `ctypes` module in python to hook the netnode functions ([sdk manual](https://www.hex-rays.com/products/ida/support/sdkdoc/netnode_8hpp.html)) and then sync some specific netnodes.\r\nAlso if we made it to sync netnodes, we can actually sync the internal storage of other plugins if needed :).\r\n\r\nApproach:\r\n1. Get the target functions' address with `ctypes`\r\n2. Insert trampolines use a disassembler and an assembler\r\n3. Call the `IDAPython_cli_execute_line` or `IDAPython_extlang_call_func` to call the python callback\r\n4. Process the change~"},"comment":{"url":"https://api.github.com/repos/IDArlingTeam/IDArling/issues/comments/411324178","html_url":"https://github.com/IDArlingTeam/IDArling/issues/9#issuecomment-411324178","issue_url":"https://api.github.com/repos/IDArlingTeam/IDArling/issues/9","id":411324178,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTMyNDE3OA==","user":{"login":"NeatMonster","id":775152,"node_id":"MDQ6VXNlcjc3NTE1Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/775152?v=4","gravatar_id":"","url":"https://api.github.com/users/NeatMonster","html_url":"https://github.com/NeatMonster","followers_url":"https://api.github.com/users/NeatMonster/followers","following_url":"https://api.github.com/users/NeatMonster/following{/other_user}","gists_url":"https://api.github.com/users/NeatMonster/gists{/gist_id}","starred_url":"https://api.github.com/users/NeatMonster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NeatMonster/subscriptions","organizations_url":"https://api.github.com/users/NeatMonster/orgs","repos_url":"https://api.github.com/users/NeatMonster/repos","events_url":"https://api.github.com/users/NeatMonster/events{/privacy}","received_events_url":"https://api.github.com/users/NeatMonster/received_events","type":"User","site_admin":false},"created_at":"2018-08-08T08:10:21Z","updated_at":"2018-08-08T08:10:21Z","author_association":"MEMBER","body":"I'm hesitant to implement this because so far we've tried to keep the plugin as unintrusive as possible. Still, we have already resorted to something similar for things that cannot be done in another way, like loading another database.\r\n\r\nIt would also allow us to hook some events (not even plugin-related) that we wouldn't normally have access to. If we do this, I would like to have some heuristic to find the address of the unexported functions (which doesn't apply here, I know), to avoid having to provide offsets for each IDA version.\r\n\r\nI will think about it some more, and maybe give it a try. It should probably be optional as tempering with the IDA library might not always be a good idea."}}
{"actor":{"display_login":"NeatMonster"}}