LoadLibrary is a repository contains a library that allows native Linux programs to load and call functions from a Windows DLL.
How does it work?
The peloader directory contains a custom PE/COFF loader derived from ndiswrapper. The library will process the relocations and imports, then provide a dlopen-like API. The code supports debugging with gdb (including symbols), basic block coverage collection, and runtime hooking and patching.
The intention is to allow scalable and efficient fuzzing of self-contained Windows libraries on Linux. Good candidates might be video codecs, decompression libraries, virus scanners, image decoders, and so on.
+ C++ exception dispatch and unwinding.
+ Loading additional symbols from IDA.
+ Debugging with gdb (including symbols), breakpoints, stack traces, etc.
+ Runtime hooking and patching.
+Support for ASAN and Valgrind to detect subtle memory corruption bugs.
If you need to add support for any external imports, writing stubs is usually quick and easy.
Distributed, scalable fuzzing on Windows can be challenging and inefficient. This is especially true for endpoint security products, which use complex interconnected components that span across kernel and user space. This often requires spinning up an entire virtualized Windows environment to fuzz them or collect coverage data.
This is less of a problem on Linux, and I’ve found that porting components of Windows Antivirus products to Linux is often possible. This allows me to run the code I’m testing in minimal containers with very little overhead, and easily scale up testing.
MsMpEng is the Malware Protection service that is enabled by default on Windows 8, 8.1, 10, Windows Server 2016, and so on. Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various other Microsoft security products share the same core engine.
The core component of MsMpEng responsible for scanning and analysis is called mpengine. Mpengine is a vast and complex attack surface, comprising of handlers for dozens of esoteric archive formats, executable packers, full system emulators for various architectures and interpreters for various languages. All of this code is accessible to remote attackers
+ glibc-devel.i686(Fedora/Redhat) or libc6-dev:i386(Debian/Ubuntu)
+ libgcc.i686(Fedora/Redhat) or gcc-multilib(Debian/Ubuntu)
+ readline-devel.i686(Fedora/Redhat) or libreadline-dev:i386(Debian/Ubuntu)
+ dbg and ida (for Debugging)
+ mpam-fe.exe https://go.microsoft.com/fwlink/?LinkID=121721&arch=x86
git clone https://github.com/taviso/loadlibrary && cd loadlibrary
then extract to engine
exiftool mpengine.dll | grep 'Product Version Number'
generate map and idb files:
ida -A -P+ -S"createmap.idc mpengine.map" mpengine.dll
generate the map files on Windows:
gdb -q ./mpclient