LoadLibrary, a layer for loading Windows DLLs in Linux applications

Tavis Ormandy (Tavis Ormandy), a security researcher at Google, is developing a project LoadLibrary, aimed at porting libraries collected for Windows DLLs for use in applications for Linux. The project offers a wrapper library that allows you to load a DLL file in PE/COFF format and call specified functions within it. The PE/COFF loader is based on the code ndiswrapper. The project code of terjesztésre kerül GPLv2 licenc alatt.

LoadLibrary handles the functions of loading the library into memory and importing existing symbols, providing a Linux application with an API in the style of dlopen. The plug-in code can be debugged using gdb, ASAN, and Valgrind. There is an option to adjust executable code at runtime through hooking and applying patches (runtime patching). Exception handling and unwinding for C++ are supported.

The project's goal is to organize scalable and efficient distributed fuzzing testing of DLL libraries in a Linux-based environment. In Windows, conducting fuzzing and coverage testing fails to achieve adequate effectiveness and often requires running a separate virtualized instance of Windows, especially when attempting to analyze complicated products such as antivirus software that operate at both the kernel level and user space. With LoadLibrary, researchers from Google are looking for vulnerabilities in video codecs, antivirus scanners, data unpacking libraries, image decoders, and more.

For instance, using LoadLibrary, it became possible to port the Windows Defender antivirus engine to run on Linux. Analyzing mpengine.dll, which forms the basis of Windows Defender, allowed for the examination of a large number of complex handlers for various formats, file system emulators, and language interpreters, potentially providing vectors for possible attacks.

LoadLibrary was also used in identifying a remote vulnerability az Avast víruskereső csomagjában. A víruskereső DLL elemzése során kiderült, hogy a kulcsfontosságú jogosultságokkal rendelkező beolvasási folyamat teljes körű JavaScript értelmezőt tartalmaz, amelyet harmadik féltől származó JavaScript kód végrehajtásának emulálására használnak. Ez a folyamat nem elkülönített sandbox környezetben működik, nem csökkenti a jogosultságokat, és ellenőrizetlen külső adatok elemzését végzi a fájlrendszerből és a lehallgatott hálózati forgalomból. Mivel bármilyen sérülékenység ebben a bonyolult és védtelen folyamatban potenciálisan távoli kompromittáláshoz vezethet, a LoadLibrary alapján egy speciális burkolat került kifejlesztésre. avscript az Avast víruskereső sebezhetőségeinek elemzésére Linux alapú környezetben.

Forrás: opennet.ru