fortra / nanodump

The swiss army knife of LSASS dumping

Home Page:https://www.coresecurity.com/core-labs/articles/nanodump-red-team-approach-minidumps

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Compile Environment?

Mofisto opened this issue · comments

I'm not saying that Makfile.mingw doesn't work; I'm just curious about how to make Makefile.clang work properly. This might go beyond the scope of the project itself, but I am really curious about it.

make -f Makefile.clang
rm -f dist/*
###### RELEASE ######
clang -target x86_64-w64-windows-gnu source/spoof_callstack.c source/hw_breakpoint.c source/shtinkering.c source/dinvoke.c source/utils.c source/handle.c source/impersonate.c source/modules.c source/syscalls.c source/token_priv.c source/malseclogon.c source/nanodump.c source/werfault.c source/entry.c -o dist/nanodump.x64.exe -Wall -I include -Xclang -DNANO -DEXE -g0
source/nanodump.c:422:11: warning: variable 'number_of_ranges' set but not used [-Wunused-but-set-variable]
    DWORD number_of_ranges = 0;
          ^
1 warning generated.
/usr/bin/ld: cannot find -lgcc: No such file or directory
/usr/bin/ld: cannot find -lgcc_eh: No such file or directory
/usr/bin/ld: cannot find -lgcc: No such file or directory
/usr/bin/ld: cannot find -lgcc_eh: No such file or directory
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make: *** [Makefile.clang:12: nanodump] Error 1



clang -target x86_64-w64-windows-gnu source/spoof_callstack.c source/hw_breakpoint.c source/shtinkering.c source/dinvoke.c source/utils.c source/handle.c source/impersonate.c source/modules.c source/syscalls.c source/token_priv.c source/malseclogon.c source/nanodump.c source/werfault.c source/entry.c -o dist/nanodump.x64.exe -Wall -I include -Xclang -DNANO -DEXE -g0 -v

/.......

End of search list.
 "/usr/bin/ld" -m i386pep -Bdynamic -o dist/nanodump.x64.exe /usr/x86_64-w64-mingw32/lib/crt2.o /usr/x86_64-w64-mingw32/lib/crtbegin.o -L/usr/x86_64-w64-mingw32/lib -L/usr/x86_64-w64-mingw32/mingw/lib -L/usr/lib -L/usr/x86_64-w64-mingw32/sys-root/mingw/lib /tmp/spoof_callstack-3e5e01.o /tmp/hw_breakpoint-8f67b0.o /tmp/shtinkering-0b743d.o /tmp/dinvoke-711304.o /tmp/utils-4758a8.o /tmp/handle-684d22.o /tmp/impersonate-279d84.o /tmp/modules-a153eb.o /tmp/syscalls-32ce70.o /tmp/token_priv-2ea7ed.o /tmp/malseclogon-bbfa28.o /tmp/nanodump-9071b4.o /tmp/werfault-9699fd.o /tmp/entry-964bf4.o -lmingw32 -lgcc -lgcc_eh -lmoldname -lmingwex -lmsvcrt -ladvapi32 -lshell32 -luser32 -lkernel32 -lmingw32 -lgcc -lgcc_eh -lmoldname -lmingwex -lmsvcrt -lkernel32 /usr/x86_64-w64-mingw32/lib/crtend.o
/usr/bin/ld: cannot find -lgcc: No such file or directory
/usr/bin/ld: cannot find -lgcc_eh: No such file or directory
/usr/bin/ld: cannot find -lgcc: No such file or directory
/usr/bin/ld: cannot find -lgcc_eh: No such file or directory
clang: error: linker command failed with exit code 1 (use -v to see invocatio

I noticed that you provide clang in your repository for cross-platform Windows binary compilation. I tried to compile it on my Ubuntu but encountered errors.

I would like to know how you compiled it as I suspect that I might be missing some toolchains and cross-platform libraries. For example, the gcc and gcc_eh cross-platform libraries. I have tried many approaches but still failed to compile successfully. I even tried to replicate this behavior on MSYS2 in Windows, but unfortunately, I still failed.

I realize that I have never understood the cross-platform compilation behavior of clang.

I have been searching for a long time and have not found the correct documentation to solve this question. I realize that clang can provide more help for cross-platform compilation.

I would like to know the answer. Please let me know how you made the Makefile.clang work properly.

hi there, sorry for taking so long to answer, I don't really remember which commands I used to install the toolchain, all I can tell you is that I used Arch for most of the time and that all I did is simply google searches to know what to install. Best of luck!

i have same problem.

`┌──(kali㉿kali)-[~/Desktop/Client/nanodump]
└─$ sudo make -f Makefile.mingw
[sudo] password for kali:
rm -f dist/*

RELEASE

x86_64-w64-mingw32-gcc source/spoof_callstack.c source/hw_breakpoint.c source/shtinkering.c source/dinvoke.c source/utils.c source/handle.c source/impersonate.c source/modules.c source/syscalls.c source/token_priv.c source/malseclogon.c source/nanodump.c source/werfault.c source/entry.c -o dist/nanodump.x64.exe -masm=intel -Wall -I include -Wl,--dynamicbase -DNANO -DEXE
x86_64-w64-mingw32-strip --strip-all dist/nanodump.x64.exe
i686-w64-mingw32-gcc source/spoof_callstack.c source/hw_breakpoint.c source/shtinkering.c source/dinvoke.c source/utils.c source/handle.c source/impersonate.c source/modules.c source/syscalls.c source/token_priv.c source/malseclogon.c source/nanodump.c source/werfault.c source/entry.c -o dist/nanodump.x86.exe -masm=intel -Wall -I include -Wl,--dynamicbase -DNANO -DEXE
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from include/spoof_callstack.h:9,
from source/spoof_callstack.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/spoof_callstack.h:6:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from include/dinvoke.h:6,
from include/hw_breakpoint.h:4,
from source/hw_breakpoint.c:2:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/dinvoke.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from include/dinvoke.h:6,
from include/shtinkering.h:6,
from source/shtinkering.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/shtinkering.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from include/dinvoke.h:6,
from source/dinvoke.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/dinvoke.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from source/utils.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/nanodump.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from source/handle.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/nanodump.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from include/dinvoke.h:6,
from include/impersonate.h:6,
from source/impersonate.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/impersonate.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from source/modules.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from source/syscalls.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/nanodump.h:4,
from include/utils.h:3,
from include/syscalls.h:11:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
source/syscalls.c:2726:28: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
2726 | __declspec(naked) NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from include/token_priv.h:6,
from source/token_priv.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/token_priv.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/malseclogon.h:6,
from source/malseclogon.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/malseclogon.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from source/nanodump.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/nanodump.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from include/utils.h:3,
from include/dinvoke.h:6,
from include/werfault.h:7,
from source/werfault.c:1:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/werfault.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/modules.h:7,
from include/nanodump.h:19,
from source/entry.c:6:
include/syscalls.h:528:19: error: conflicting types for ‘NtSetInformationThread’; have ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
528 | EXTERN_C NTSTATUS NtSetInformationThread(
| ^~~~~~~~~~~~~~~~~~~~~~
In file included from include/nanodump.h:4:
/usr/share/mingw-w64/include/winternl.h:1103:18: note: previous declaration of ‘NtSetInformationThread’ with type ‘NTSTATUS(void *, THREADINFOCLASS, void *, ULONG)’ {aka ‘long int(void *, THREADINFOCLASS, void *, long unsigned int)’}
1103 | NTSTATUS NTAPI NtSetInformationThread(HANDLE ThreadHandle,THREADINFOCLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength);
| ^~~~~~~~~~~~~~~~~~~~~~
make: *** [Makefile.mingw:15: nanodump] Error 1

┌──(kali㉿kali)-[~/Desktop/Client/nanodump]
└─$ make -f Makefile.clang
rm -f dist/*

RELEASE

clang -target x86_64-w64-windows-gnu source/spoof_callstack.c source/hw_breakpoint.c source/shtinkering.c source/dinvoke.c source/utils.c source/handle.c source/impersonate.c source/modules.c source/syscalls.c source/token_priv.c source/malseclogon.c source/nanodump.c source/werfault.c source/entry.c -o dist/nanodump.x64.exe -Wall -I include -Xclang -DNANO -DEXE -g0
source/nanodump.c:422:11: warning: variable 'number_of_ranges' set but not used [-Wunused-but-set-variable]
DWORD number_of_ranges = 0;
^
1 warning generated.
/usr/bin/ld: cannot find -lgcc: No such file or directory
/usr/bin/ld: cannot find -lgcc_eh: No such file or directory
/usr/bin/ld: cannot find -lgcc: No such file or directory
/usr/bin/ld: cannot find -lgcc_eh: No such file or directory
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make: *** [Makefile.clang:12: nanodump] Error 1

┌──(kali㉿kali)-[~/Desktop/Client/nanodump]
`

@sec13b The issues with the make command on Makefile.mingw are due to conflicting type definitions for the NtSetInformationThread function. According to MSDN docs, the function definition should be NTSTATUS NTAPI NtSetInformationThread, instead of just NTSTATUS NtSetInformationThread.

You'll need to update the function definitions in syscalls.h and syscalls.c and then re-run the make command, should work fine after that.

Happy to submit a PR for this.