[ekt0]

Hello,

I am using IDA Pro 7.0.
I have a weird behaviour with IDAPython. I need to allocate some memory in order to execute malware's shellcode from my IDAPython script. I was trying to execute VirtualAlloc of ctypes but it only returns 0 (which is unusable of course). It only happens when I execute it on IDA:

Code: Select all

Python>import ctypes
Python>ctypes.windll.kernel32.VirtualAlloc(0,192,0x1000,0)
0

Have you ever encountered this issue?

ekt0

[EP_X0FF]

If VirtualAlloc params is what you supplied then it is invalid call due to Protect flag you set to 0. If you want to execute something it should be at least PAGE_EXECUTE_READWRITE assuming you will do Read/Write to that region next.

[ekt0]

That's a good point, I forgot to add the flag on my example. However, I do use the flag PAGE_EXECUTE_READWRITE on my script. Executing VirtualAlloc with those parameters works well when executed on a Python interpreter, outside of IDA.

If you don't have the same issue than I, can you provide the version number of IDA you are using please?

Thanks.

[EP_X0FF]

I don't have any script. If this API fails then look on GetLastError result value after failed call.

[ekt0]

If you want to check if you have the same issue, just execute the following lines on IDA's Python command line (assuming you have IDAPython) :

Code: Select all

import ctypes
lpAddress = 0
size = 0x100
flAllocationType = 0x1000
flProtect = 0x40
mem = ctypes.windll.kernel32.VirtualAlloc(lpAddress, size, flAllocationType, flProtect)
if mem == 0:
    print("KO")
else:
    print("OK")

That prints KO for me.

Workaround
So, I found out that when I set the argument types myself, it actually works. I don't really understand why though. GetLastError outputs Invalid Handle message. Also, I have exactly the same behaviour between IDA and IDA64.
Here is how I "fixed" the issue:

Code: Select all

import ctypes
from ctypes import wintypes
hex(ctypes.windll.kernel32.VirtualAlloc(0,192,0x1000,0x40))
# Result: 0x0, which is wrong
ctypes.windll.kernel32.VirtualAlloc.argtypes = (wintypes.LPVOID,wintypes.c_size_t,wintypes.DWORD,wintypes.DWORD)
hex(ctypes.windll.kernel32.VirtualAlloc(0,192,0x1000,0x40))
# Result: 0x5bbb0000, which is fine

I would be curious to know if you guys have the same issue.

[R136a1]

If you want to check if you have the same issue, just execute the following lines on IDA's Python command line (assuming you have IDAPython) :

Code: Select all

import ctypes
lpAddress = 0
size = 0x100
flAllocationType = 0x1000
flProtect = 0x40
mem = ctypes.windll.kernel32.VirtualAlloc(lpAddress, size, flAllocationType, flProtect)
if mem == 0:
    print("KO")
else:
    print("OK")

That prints KO for me.

Workaround
So, I found out that when I set the argument types myself, it actually works. I don't really understand why though. GetLastError outputs Invalid Handle message. Also, I have exactly the same behaviour between IDA and IDA64.
Here is how I "fixed" the issue:

Code: Select all

import ctypes
from ctypes import wintypes
hex(ctypes.windll.kernel32.VirtualAlloc(0,192,0x1000,0x40))
# Result: 0x0, which is wrong
ctypes.windll.kernel32.VirtualAlloc.argtypes = (wintypes.LPVOID,wintypes.c_size_t,wintypes.DWORD,wintypes.DWORD)
hex(ctypes.windll.kernel32.VirtualAlloc(0,192,0x1000,0x40))
# Result: 0x5bbb0000, which is fine

I would be curious to know if you guys have the same issue.

All these examples work for me. Which Python and IDAPython versions are you using?

[ekt0]

IDA : 7.0.170914
Python 2.7.13
IDAPython v1.7.0 final (serial 0)

[R136a1]

You're on Windows 10, right?

I have tested your set up on Windows 7 and Windows 10 and can confirm. On Windows 7, all of the above examples work. On Windows 10, only the last example works. I have also tested latest IDA Pro (7.2) on Windows 10 and it suffers from the sam issue. I guess the bug is in IDA Python though, but I'm not really sure.

[ekt0]

Yep, Windows 10 ! I thought about that too but I was too lazy to setup a Win7 VM. Weird bug. Maybe I should contact them about that in case it's because of IDAPython, I don't know how though.

[R136a1]

That's a good question. I would contact Hex-Rays and report to them. They seem to fix IDA Python bugs regularly by looking at IDA Pro version history.