Atsika / pelib

Go module for parsing PE, including extensive Windows types and structures definitions.

PElib

PElib (Portable Executable library) is a Go module for parsing PE, including extensive Windows types and structures definitions.

Table of contents

• Features
  • NewDLL
  • NewProc
• Usage
• Changelog
• Used in
• License

Features

PElib exports multiple functions and structures related to PE parsing. The full list can be found here: pkg.go.dev/github.com/atsika/pelib

The most notable ones are:

• NewDLL
• NewProc

These functions are generic functions used to resolve module (DLL) handles and function (proc) addresses. They use Go reflection to determine the type of passed parameters.

They can be resolved by hash (API hashing), a common technique used in malware development. The hashing algorithm used is sdbm.

You can read more about those functions on my blog: https://blog.atsika.ninja/posts/custom_getmodulehandle_getprocaddress/

NewDLL

NewDLL accepts a string (DLL name) or a uint32 (DLL 32-bit hash). It returns a *windows.DLL. It retrieves a pointer to the PEB. Then, it parses the InLoadOrderModuleList by comparing the DLL name or hash with the given parameter. If the resolution fails, nil is returned.

NewProc

NewProc takes a *windows.DLL as first parameters and either a string (proc name), a uint16 (proc ordinal) or uint32 (proc 32-bit hash) as second parameter. It returns a *windows.Proc. It retrieves a pointer to the EXPORT_DIRECTORY of a module. It then parses it using the provided parameter to retrieve the function address. If the provided parameter is a string, then the resolution is done using binary search. Otherwise, a linear search is done. If the resolution fails, nil is returned.

Usage

1. Import the module in your project.

import (
    "github.com/atsika/pelib"
)

2. Resolve modules and functions.

kernel32 := pelib.NewDLL("kernel32.dll")
fmt.Printf("[string] kernel32 => %#2x\n", kernel32.Handle)

kernel32 = pelib.NewDLL(uint32(0x8f7ee672))
fmt.Printf("[hash]   kernel32 => %#2x\n", kernel32.Handle)

GetProcessHeap := pelib.NewProc(kernel32, "GetProcessHeap")
fmt.Printf("[string]  GetProcessHeap => %#2x\n", GetProcessHeap.Addr())

GetProcessHeap = pelib.NewProc(kernel32, uint16(0x2cc))
fmt.Printf("[ordinal] GetProcessHeap => %#2x\n", GetProcessHeap.Addr())

GetProcessHeap = pelib.NewProc(kernel32, uint32(0x4435efa5))
fmt.Printf("[hash]    GetProcessHeap => %#2x\n", GetProcessHeap.Addr())

hHeap, _ , _ := GetProcessHeap.Call()

3. Profit

An example of a classic process injection technique using this module and API hashing can be found in the example folder.

Changelog

• 31/08/2023: Added API sets V6 (Windows 10) resolution
• 21/08/2023: Export some useful functions (GetPEB, GetDosHeader, GetNtHeaders, GetDataDirectory,...)
• 01/08/2023: Initial release accompanying the blog post

Used in

• mkwinsyscall fork

License

This project is licensed under the MIT License - see the LICENSE file for details.