相比于直接fuzzing大型程序本身，针对程序的某一特定功能写wrapper后再fuzzing则要高效的多。网上搜了下，仅有两篇关于foxit reader的wrapper文章，一个用python，另外一个用C++，而且针对的foxit reader版本也比较旧。本篇的目的通过分析C++的wrapper原理，来写出最新版foxit reader（Version: 9.1.0.5096）的ConvertToPDF功能的wrapper。
首先看下ConvertToPDF_x86.dll插件的反汇编部分
刚开始分配0x2760h大小的内存，然后可以看到
.text:10015BC7 mov ecx, eax
.text:10015BC9 call sub_100150C0
从这两句可以猜测ConvertToPDF_x86.dll插件中存在虚函数，因为ecx中存储有类实例的this指针，它作为隐藏的第一个参数传递给sub_100150C0。具体原理可参考http://www.openrce.org/articles/full_view/23。然后继续跟进sub_100150C0函数，如下
根据这段代码可以确定esi中存储有虚函数表的首地址，虚函数表的具体函数如下：
ConvertToPDF_x86.dll插件的主要构成函数如上图，我们只需函数之间的确定执行流程、每个函数的主要参数内容及个数即可完成wrapper。
主要的函数流程依次为
ConvertToPDF_x86!CreateFXURLToHtml+0x450
ConvertToPDF_x86!CreateFXURLToHtml+0xc90
ConvertToPDF_x86!CreateFXPDFConvertor+0x90
参数个数的确定，因为函数的调用约定遵循thiscall，所以每次调用完函数后，由被调用函数自动清除函数参数，具体代码为ret xx
64dd020c 0000000a
::x86> bp ConvertToPDF_x86!CreateFXURLToHtml+0x450
::x86> g
Breakpoint hit
ConvertToPDF_x86!CreateFXURLToHtml+0x450:
64a73f10 push ebp
::x86> uf ConvertToPDF_x86!CreateFXURLToHtml+0x450
ConvertToPDF_x86!CreateFXURLToHtml+0x450:
64a73f10 push ebp
64a73f11 8bec mov ebp,esp
64a73f13 6aff push 0FFFFFFFFh
64a73f15 68a804dc64 push offset ConvertToPDF_x86!ConnectedPDF::ConnectedPDFSDK::FCP_SendEmailNotification+0x2cc28 (64dc04a8)
64a73f1a 64a100000000 mov eax,dword ptr fs:[00000000h]
64a73f20 push eax
64a73f21 83ec14 sub esp,14h
64a73f24 push ebx
。。。。。。。。。。。。。。。。。。
ConvertToPDF_x86!CreateFXURLToHtml+0xb70:
64a74630 33c0 xor eax,eax
64a74632 8b4df4 mov ecx,dword ptr [ebp-0Ch]
64a74635 64890d00000000 mov dword ptr fs:[],ecx
64a7463c pop ecx
64a7463d 5f pop edi
64a7463e 5e pop esi
64a7463f 5b pop ebx
64a74640 8be5 mov esp,ebp
64a74642 5d pop ebp
64a74643 c20400 ret 4 //参数个数为1
参数内容为0x2
据此可以确定另外两个函数的参数个数和内容。
网上参考的的wrapper的具体代码内容如下
/*
foxit-fuzz.cpp - simple console wrapper for ConvertToPDF_x86.dll
@richinseattle / [email protected] NOTES: Must install the foxit pdf printer globally
Harness targets foxit 9.0 API by default
Can target 7.3.4 if FOXIT_734 is defined and ConvertToPDF_x86.734.dll is in path afl-fuzz.exe -i %INPUT_DIR% -o foxit_out -D %DynamoRIO_ROOT%\bin32 -t 20000 -- -coverage_module ConvertToPDF.dll -target_module foxit-fuzz.exe -target_method convert_to_pdf -nargs 2 -fuzz_iterations 5000 -- %CD%\foxit-fuzz.exe @@ NUL
*/ #include <Windows.h>
#include <String.h>
#include <iostream>
using namespace std; typedef void * (__stdcall *CreateFXPDFConvertor_t)();
typedef int(__thiscall *InitLocale_t)(void *_this, int, wchar_t * lc_str);
typedef int(__thiscall *InitPrinter_t)(void* _this, wchar_t *printer_name);
typedef int(__thiscall *InitPdfConverter_t)(void* _this, int mode);
#ifdef FOXIT_734
typedef int(__thiscall *ConvertToPdf_t)(void* _this, wchar_t *convert_buf, int p2, int p3);
#else
typedef int(__thiscall *ConvertToPdf_t)(void* _this, wchar_t *convert_buf, int p2, int p3, int p4, int p5, int p6, int p7, int p8);
#endif typedef struct ConverterFuncTable_t
{
ConvertToPdf_t ConvertToPdf;
InitPdfConverter_t InitPdfConverter;
InitPrinter_t InitPrinter;
//InitLocale_t InitLocale; } ConverterFuncTable; typedef struct ConverterClass_t
{
ConverterFuncTable_t *vfp_table;
} ConverterClass; #ifdef FOXIT_734
char *target_library = "ConvertToPDF_x86.734.dll";
#else
char *target_library = "ConvertToPDF_x86.dll";
#endif
char *target_function = "CreateFXPDFConvertor"; wchar_t * printer_name = L"Foxit Reader PDF Printer"; ConverterClass *pdfconverter = NULL; int init_target_library()
{
int retVal = ; CreateFXPDFConvertor_t CreateFXPDFConvertor = (CreateFXPDFConvertor_t)GetProcAddress(LoadLibraryA(target_library), target_function); // create an instance of CreateFXPDFConvertor
pdfconverter = (ConverterClass *)CreateFXPDFConvertor();
ConverterFuncTable *vfp_table = pdfconverter->vfp_table; cout << "Function table: " << endl;
cout << "CreateFXPDFConvertor: " << hex << CreateFXPDFConvertor << endl;
cout << "InitPdfConverter: " << hex << vfp_table->InitPdfConverter << " CreateFXPDFConvertor+0x" << hex << (unsigned long)vfp_table->InitPdfConverter - (unsigned long)CreateFXPDFConvertor << endl;
cout << "InitPrinter: " << hex << vfp_table->InitPrinter << " CreateFXPDFConvertor+0x" << hex << (unsigned long)vfp_table->InitPrinter - (unsigned long)CreateFXPDFConvertor << endl;
cout << "ConvertToPdf: " << hex << vfp_table->ConvertToPdf << " CreateFXPDFConvertor+0x" << hex << (unsigned long)vfp_table->ConvertToPdf - (unsigned long)CreateFXPDFConvertor << endl << endl; // init converter
retVal = vfp_table->InitPdfConverter(pdfconverter, );
if (retVal)
cout << "Error: InitPdfConverter(): " << retVal << endl; // init printer device
retVal = vfp_table->InitPrinter(pdfconverter, printer_name);
if (retVal)
cout << "Error: InitPrinter(): " << retVal << endl; return retVal;
} extern "C" __declspec(dllexport) int wmain(int argc, wchar_t *argv[]);
extern "C" __declspec(dllexport) int convert_to_pdf(ConvertToPdf_t convert, wchar_t * converter_buf); int convert_to_pdf(ConvertToPdf_t convert, wchar_t * converter_buf)
{
#ifdef FOXIT_734
return convert(pdfconverter, converter_buf, , );
#else
return convert(pdfconverter, converter_buf, , , , , , , );
#endif
} int wmain(int argc, wchar_t *argv[])
{
int retVal = ; int converter_buf_count = ;
int converter_buf_size = ;
wchar_t *converter_buf = NULL; wchar_t *input_path = NULL;
wchar_t *output_path = L"nul"; #ifdef FOXIT_734
cout << "foxit-fuzz (target v7.3.4) - [email protected]" << endl << endl;
#else
cout << "foxit-fuzz (target v9.0) - [email protected]" << endl << endl;
#endif if (argc < )
{
wcout << "usage: " << argv[] << " <input> [output]" << endl;
return -;
} if (GetFileAttributesW(argv[]) == -)
{
cout << "error: input file path" << endl;
return -;
}
input_path = argv[]; if (argc == )
output_path = argv[]; // setup buffer for converting PDF
converter_buf_count = 0x1000;
converter_buf_size = converter_buf_count * sizeof(wchar_t);
converter_buf = (wchar_t *)calloc(converter_buf_count, sizeof(wchar_t)); wcsncpy_s(converter_buf, converter_buf_count, input_path, wcslen(input_path));
wcsncpy_s(converter_buf + (0x208 / sizeof(wchar_t)), converter_buf_count - (0x208 / sizeof(wchar_t)), output_path, wcslen(output_path)); // create pdfconverter class and initialize library
if (init_target_library())
{
cout << "Error intializing target library" << endl;
return -;
} // execute wrapper for fuzzing
retVal = convert_to_pdf(pdfconverter->vfp_table->ConvertToPdf, converter_buf);
free(converter_buf); if (retVal)
{
cout << "Error: ConvertToPdf(): " << retVal << endl;
return -;
} return ;
}
重点说明的代码为
wcsncpy_s(converter_buf + (0x208 / sizeof(wchar_t)), converter_buf_count - (0x208 / sizeof(wchar_t)), output_path, wcslen(output_path));
其中0x208表示input_path与output_path的间隔距离。
其实不用更改上述的任何代码，直接编译即可使用
用winafl时注意命令行要改为
afl-fuzz.exe -i %INPUT_DIR% -o foxit_out -D %DynamoRIO_ROOT%\bin32 -t 20000 -- -coverage_module ConvertToPDF.dll -coverage_module foxit-fuzz.exe -target_module foxit-fuzz.exe -target_method convert_to_pdf -nargs 2 -fuzz_iterations 5000 -- %CD%\foxit-fuzz.exe @@ NUL
否则报错，运行结果如下图所示：
跑了三天，一个crash都没有，，，，，，，估计已经被很多人跑了，fuzz好难