Using golang to call the api in pe-sieve64.dll

[wh0im1]

Hi, recently I want to use golang to call the api in pe-sieve64.dll, I tried to convert this demo to golang code(https://github.com/hasherezade/pe-sieve/wiki/5.-API
), but there is a problem running, it should be the problem of passing parameters, but I do not know where the problem is. Could you help me out? Any help would be greatly appreciated.
Here is the code.

package main

import (
	"fmt"
	"syscall"
	"unsafe"
)

var (
	peSieveDll  = syscall.NewLazyDLL("pe-sieve64.dll")
	peSieveScan = peSieveDll.NewProc("PESieve_scan_ex")
)

const (
	ERROR_SCAN_FAILURE = ^uint32(0)
	MAX_PATH            = 260
)

type PEsieveRtype int
const (
	ReportNone      PEsieveRtype = iota
	ReportScanned
	ReportDumped
	ReportAll
)

type ParamString struct {
	Length uint32
	Buffer *byte
}

type DotnetPolicy int
const (
	PeDnetNone DotnetPolicy = iota
	PeDnetSkipMapping
	PeDnetSkipShc
	PeDnetSkipHooks
	PeDnetSkipAll
	PeDnetCount
)

type ImprecMode int
const (
	PeImprecNone ImprecMode = iota
	PeImprecAuto
	PeImprecUnerase
	PeImprecRebuild0
	PeImprecRebuild1
	PeImprecRebuild2
	PeImprecModesCount
)

type OutputFilter int
const (
	OutFull OutputFilter = iota
	OutNoDumps
	OutNoDir
	OutFiltersCount
)

type IatScanMode int
const (
	PeIatsNone IatScanMode = iota
	PeIatsCleanSysFiltered
	PeIatsAllSysFiltered
	PeIatsUnfiltered
	PeIatsModesCount
)

type DataScanMode int
const (
	PeDataNoScan DataScanMode = iota
	PeDataScanDotnet
	PeDataScanNoDep
	PeDataScanAlways
	PeDataScanInaccessible
	PeDataScanInaccessibleOnly
	PeDataCount
)

type DumpMode int
const (
	PeDumpAuto DumpMode = iota
	PeDumpVirtual
	PeDumpUnmap
	PeDumpRealign
	PeDumpModesCount
)

type JsonLevel int
const (
	JsonBasic JsonLevel = iota
	JsonDetails
	JsonDetails2
	JsonLvlCount
)

type PEsieveParams struct {
	Pid          uint32
	TDotnetPolicy  DotnetPolicy
	TImprecMode   ImprecMode
	Quiet        bool
	TOutputFilter  OutputFilter
	Nohooks  bool
	Shellcode bool
	Threads  bool
	Iat IatScanMode
	Data         DataScanMode
	Minidump bool
	TDumpMode    DumpMode
	JsonOutput bool
	MakeReflection bool
	UseCache bool
	TJsonLevel JsonLevel
	OutputDir   [MAX_PATH + 1]byte
	ModulesIgnored ParamString
}

type PEsieveReport struct {
	Pid          uint32
	IsManaged    bool
	Is64bit      bool
	IsReflection bool
	Scanned      uint32
	Suspicious   uint32
	Replaced     uint32
	HdrMod       uint32
	UnreachableFile uint32
	Patched      uint32
	IatHooked    uint32
	Implanted    uint32
	ImplantedPe  uint32
	ImplantedShc uint32
	Other        uint32
	Skipped      uint32
	Errors       uint32
}

func main() {
	// Set up the scan parameters
	pp := PEsieveParams{
		Pid:      uint32(syscall.Getpid()), // scan current process
		Threads:  true,
		Shellcode: true,
		Quiet:    true,
	}

	const rtype = ReportAll

	// Prepare the buffer for the output report
	const bufSize uint = 0x1000
	jsonBuf := make([]byte, bufSize)
	neededSize := uint32(0)

	// Perform the scan:
	ret, _, _ := peSieveScan.Call(
		uintptr(unsafe.Pointer(&pp)),
		uintptr(rtype),
		uintptr(unsafe.Pointer(&jsonBuf[0])),
		uintptr(bufSize),
		uintptr(unsafe.Pointer(&neededSize)),
	)
	if neededSize > uint32(bufSize) {
		// The supplied buffer was too small to fit in the whole JSON report
		fmt.Printf("Couldn't retrieve the full buffer. Needed size: %x\n", neededSize)
	}

	// Print the obtained report:
	fmt.Println(string(jsonBuf))
	fmt.Println(ret)
}

[hasherezade]

hi @wh0im1 ! thank you for reporting! I will check it and get back to you soon!

[hasherezade]

@wh0im1 - I made some fixes in your code. It should work now.
Please check it out: https://gist.github.com/hasherezade/f6fafac2b7e452a36410c2c5583f9790

package main

import (
	"fmt"
	"syscall"
	"unsafe"
)

var (
	peSieveDll  = syscall.NewLazyDLL("pe-sieve64.dll")
	peSieveScanEx = peSieveDll.NewProc("PESieve_scan_ex")
)

const (
	ERROR_SCAN_FAILURE = ^uint32(0)
	MAX_PATH            = 260
)

type PEsieveRtype int32 // always use explicit integer types
const (
	ReportNone      PEsieveRtype = iota
	ReportScanned
	ReportDumped
	ReportAll
)

type ParamString struct {
	Length uint32
	Buffer *byte
}

type DotnetPolicy int32
const (
	PeDnetNone DotnetPolicy = iota
	PeDnetSkipMapping
	PeDnetSkipShc
	PeDnetSkipHooks
	PeDnetSkipAll
	PeDnetCount
)

type ImprecMode int32
const (
	PeImprecNone ImprecMode = iota
	PeImprecAuto
	PeImprecUnerase
	PeImprecRebuild0
	PeImprecRebuild1
	PeImprecRebuild2
	PeImprecModesCount
)

type OutputFilter int32
const (
	OutFull OutputFilter = iota
	OutNoDumps
	OutNoDir
	OutFiltersCount
)

type IatScanMode int32
const (
	PeIatsNone IatScanMode = iota
	PeIatsCleanSysFiltered
	PeIatsAllSysFiltered
	PeIatsUnfiltered
	PeIatsModesCount
)

type DataScanMode int32
const (
	PeDataNoScan DataScanMode = iota
	PeDataScanDotnet
	PeDataScanNoDep
	PeDataScanAlways
	PeDataScanInaccessible
	PeDataScanInaccessibleOnly
	PeDataCount
)

type DumpMode int32
const (
	PeDumpAuto DumpMode = iota
	PeDumpVirtual
	PeDumpUnmap
	PeDumpRealign
	PeDumpModesCount
)

type JsonLevel int32
const (
	JsonBasic JsonLevel = iota
	JsonDetails
	JsonDetails2
	JsonLvlCount
)

type PEsieveParams struct {
	Pid          uint32
	TDotnetPolicy  DotnetPolicy
	TImprecMode   ImprecMode
	Quiet        bool
	TOutputFilter  OutputFilter
	Nohooks  bool
	Shellcode bool
	Threads  bool
	Iat IatScanMode
	Data         DataScanMode
	Minidump bool
	TDumpMode    DumpMode
	JsonOutput bool
	MakeReflection bool
	UseCache bool
	TJsonLevel JsonLevel
	OutputDir   [MAX_PATH + 1]byte
	ModulesIgnored ParamString
}

type PEsieveReport struct {
	Pid          uint32
	IsManaged    bool
	Is64bit      bool
	IsReflection bool
	Scanned      uint32
	Suspicious   uint32
	Replaced     uint32
	HdrMod       uint32
	UnreachableFile uint32
	Patched      uint32
	IatHooked    uint32
	Implanted    uint32
	ImplantedPe  uint32
	ImplantedShc uint32
	Other        uint32
	Skipped      uint32
	Errors       uint32
}

func main() {
	// Set up the scan parameters
	pp := PEsieveParams{
		Pid:      uint32(syscall.Getpid()), // scan current process
		Threads:  true,
		Shellcode: true,
		Quiet:    true,
	}

	pr := PEsieveReport{}

	const rtype = ReportAll

	// Prepare the buffer for the output report
	const bufSize uint = 0x1000
	jsonBuf := make([]byte, bufSize)
	neededSize := uint32(0)
	
	// Perform the scan:
	ret, _, out2 := peSieveScanEx.Call(
		uintptr(unsafe.Pointer(&pr)), // first pass the return variable
		uintptr(unsafe.Pointer(&pp)), // then pass the typical arguments of the function
		uintptr(rtype),
		uintptr(unsafe.Pointer(&jsonBuf[0])),
		uintptr(bufSize),
		uintptr(unsafe.Pointer(&neededSize)),
	)
	if neededSize > uint32(bufSize) {
		// The supplied buffer was too small to fit in the whole JSON report
		fmt.Printf("Couldn't retrieve the full buffer. Needed size: %x\n", neededSize)
	}

	// Print the obtained report:
	var reportStr = string(jsonBuf[:neededSize])
	fmt.Println(reportStr)
	
	// Some additional returned stuff:
	if (uintptr(unsafe.Pointer(&pr)) == ret) {
		fmt.Println("Returned val OK")
	} else {
		fmt.Printf("Returned val invalid: %x vs %x\n", unsafe.Pointer(&pr) , ret)
	}
 
	fmt.Println("Info:", out2)

	fmt.Printf("Summary for PID %d:\n", pr.Pid)
	fmt.Printf("Scanned: %d\n", pr.Scanned)
	fmt.Printf("Detected: %d\n", pr.Suspicious)
}

[wh0im1]

Thank you very much, it really works. But there is a question, I saw the source code of PESieve_scan_ex function which has five parameters, why can the golang code pass it six parameters?

[hasherezade]

@wh0im1 : this is the calling convention, because it returns a complex variable (a structure), not just a value. So, the memory for this structure is allocated on the side of the caller, and it is passed as an (implicit) argument.

Look, this is a PE-sieve loader written in C++, that calls the function PESieve_scan. In the code we pass only one argument, because the compiler takes care of generating this additional, implicit argument.

But if we watch it under the debugger, we will see clearly what is going on: the parameter PEsieve_params that is a first argument in the API, is in fact passed as a second argument:

And this is how it looks after the function call returned - the first argument is filled with the output:

In Golang we just have to define this additional argument by our own, explicitly, rather than the compiler doing it for us.
I hope it answers your question!

[wh0im1]

Thank you very much. I get it.

[hasherezade]

@wh0im1 - look what I made, maybe this will help for the future:
https://github.com/hasherezade/pesieve-go
you can use it just like any other module now:
https://gist.github.com/hasherezade/d627851be8a4ef132e00fcc796912dee

[wh0im1]

Thank you, it's really nice you are!