Vault7: CIA Hacking Tools Revealed

Navigation: » Latest version

Owner: User #3375374

Funny Code 2012

Funny Code post from 2012.

Checking Static Libraries for Architecture

While working on a project, I ran into this error and it as tricky to resolve.

"//fatal error C1905: Front end and back end not compatible (must target same processor).
LINK : fatal error LNK1257: code generation failed//"

Which module was responsible? Using the /VERBOSE switch can help as it
often shows the last library searched which most likely contains the code. My project had a large number of linked components that I wanted to test to ensure that the architecture matched so I used the following batch command.

for /r %f in (tmp\media\x64\.lib) do @echo %f && dumpbin /headers %f \| findstr /c:"machine (x64)" for /r %f in (tmp\media\x64\.lib) do @echo %f && dumpbin /headers %f \| findstr /c:"machine (x86)"

They were all correct and clean rebuilding did not clear up the problem. Turned off 'Link Time Code Generation' on the library that was searched last as identified by the /VERBOSE switch. Problem fixed!

Key Sorting

I ran into a tricky scenario with the error code convention below. In each file I wanted unqiueness in the error code. A global enum would work but then the same header has to be included in each file. It is straight forward to generate a list via grep. Unfortunately they came back unordered so its difficult to see if they are unique.

C:\Work\rdb\elsa\src\baes.cpp(113):#define BASE_ERROR(ln) RC_ERROR(5000, ln) C:\Work\rdb\elsa\src\baes.cpp(113):#define BASE_ERROR(ln) RC_ERROR(5000, ln) C:\Work\rdb\elsa\src\elsa.cpp(94):#define ELSA_ERROR(ln) RC_ERROR(451, ln) C:\Work\rdb\elsa\src\elsa_io.cpp(11):#define ELSA_IO_ERROR(ln) RC_ERROR(453,ln) C:\Work\rdb\elsa\src\elsa_io.cpp(11):#define ELSA_IO_ERROR(ln) RC_ERROR(453,ln)

Using python here is how ended up having to sort them.

def key(x): return x[x.find("RC_ERROR(")+9:x.find(",")] fd = open(r"C:\Work\unsorted.txt", "rb") l = sorted(set(fd.read().split("\n")), key=key) for i in l : print i fd.close()

Slow down a service starup so you can attach the debugger.

This snippet of code makes it easy to attach a debugger to a starting service.

#ifdef USE_BREAK_ON_SERVICE_START
// In WinXP at service start, on breakpoint hit cancel and select debugger
// In Vista at service start, Services are launched in the session 0 desktop
// while the interactive debugger is in the session 1 desktop. When the
// debugger is not attached the breakpoint is handled as an application
// exception e.g. exit process.
// Remote debugging at application start up, use the debug break to pause
// until the debugger is connected.
for (int bContinue = 1; bContinue && !IsDebuggerPresent(); )
Sleep(1000);
DebugBreak();
#endif // USE_BREAK_ON_SERVICE_START

Generating Error Codes

Proof of concept code to generate unique error codes and instrument a code path in a circular buffer.

#ifndef RC_BITS
#define RC_BITS 1
#define RC_BIT_ERROR_64 ((size_t)0x01 << ((sizeof(size_t) * 8) - 1))
#define RC_BIT_ERROR 0x80000000
#define RC_BIT_POS 0x40000000
#define RC_BIT_ARGS_MASK 0x30000000
#define RC_BIT_ARGS_EOF 0x20000000
#define RC_CODE_FILE(fc) ((0x0FFF & fc) << 16)
#define RC_CODE_LINE(ln) (0xFFFF & ln)
#define RC_CODE_NARGS(n) ((0x07 & n) << 28)
#ifdef USE_SIMPLE_SENTINEL_PATTERN
#define RC_ERROR(fc, ln) (-1)
#else // USE_SIMPLE_SENTINEL_PATTERN
#define RC_ERROR(fc, ln) (RC_BIT_ERROR | RC_CODE_FILE(fc)| RC_CODE_LINE(ln))
#endif // USE_SIMPLE_SENTINEL_PATTERN
#define RC_POS(fc, ln) (RC_BIT_POS | RC_CODE_FILE(fc)| RC_CODE_LINE(ln))
#endif // RC_BITS

const unsigned int TRACE_BUFFER_SIZE = 1024;
unsigned int TRACE_POS = 0;
unsigned int TRACE_BUFFER[TRACE_BUFFER_SIZE] = {0};
void RC_TRACE(unsigned int rc)
{
TRACE_BUFFER[ (TRACE_POS++ % TRACE_BUFFER_SIZE) ] = (rc|RC_CODE_NARGS(0));
}
void RC_TRACE1(unsigned int rc, unsigned int arg1)
{
TRACE_BUFFER[ (TRACE_POS++ % TRACE_BUFFER_SIZE) ] = (rc|RC_CODE_NARGS(1));
TRACE_BUFFER[ (TRACE_POS++ % TRACE_BUFFER_SIZE) ] = arg1;
}
void RC_TRACE2(unsigned int rc, unsigned int arg1, unsigned int arg2)
{
TRACE_BUFFER[ (TRACE_POS++ % TRACE_BUFFER_SIZE) ] = (rc|RC_CODE_NARGS(2));
TRACE_BUFFER[ (TRACE_POS++ % TRACE_BUFFER_SIZE) ] = arg1;
TRACE_BUFFER[ (TRACE_POS++ % TRACE_BUFFER_SIZE) ] = arg2;
}
</code>

Use the code as follows:

<code>
#define MAIN_ERROR(ln) RC_ERROR(10, ln)
#define MAIN_TRACE(ln) RC_TRACE(RC_POS(10, ln))
#define MAIN_TRACE1(ln,err) RC_TRACE1(RC_POS(10, ln), err)

int _tmain(int argc, _TCHAR* argv[])
{
int retval;

// default
retval = MAIN_ERROR(__LINE__);
MAIN_TRACE(__LINE__);

if (0 == strcmp(argv[0], "test1"))
{
       retval = MAIN_ERROR(__LINE__);
       MAIN_TRACE1(__LINE__,GetLastError());
}
else if (0 == strcmp(argv[0], "test2"))
{
       retval = MAIN_ERROR(__LINE__);
       MAIN_TRACE1(__LINE__,GetLastError());
}
else
{
       retval = 0;
}

MAIN_TRACE(__LINE__);
return retval;
}

Manually downloading KDBG

On the low side, clear the apt cache in '/var/cache/apt'
Run apt in download only mode 'sudo apt-get install --download-only kdbg=2.2.1-2_i386'
On the high side, run 'sudo dpkg --install kdbg_2.2.1-2_i386.User #75203'

Getting Centos minimal up an running for compiling

Run the following commands

yum install mlocate /etc/cron.daily/mlocate.cron yum install redhat-lsb yum install gcc-g++

Contact

Tor

Tails

Tips

1. Contact us if you have specific problems

2. What computer to use

3. Do not talk about your submission to others

After

1. Do not talk about your submission to others

2. Act normal

3. Remove traces of your submission

4. If you face legal action

Submit documents to WikiLeaks