jlospinoso/gargoyle

A memory scanning evasion technique

Building gargoyle

gargoyle is only implemented for 32-bit Windows (64-bit Windows on Windows is fine). You must have the following installed:

• Visual Studio: 2017 Community is tested, but it may work for other versions.
• Netwide Assembler v2.12.02 x64 is tested, but it may work for other versions. Make sure nasm.exe is on your path.

Clone gargoyle:

git clone https://github.com/JLospinoso/gargoyle.git

Open Gargoyle.sln, build, and run. There is some harness code in main.cpp that configures the following three components:

• gargoyle stack trampoline, stack, and configuration (read/write memory on the heap)
• gargoyle position independent code (PIC) that receives the ROP gadget/stack trampoline and runs arbitrary code
• A ROP gadget. If you have mshtml.dll, gargoyle will load it into memory and use it. If it is not available, you will have to tell gargoyle to allocate its own (3-byte) ROP gadget on the heap:

// main.cpp
auto use_mshtml{ true };
auto gadget_memory = get_gadget(use_mshtml, gadget_pic_path);

Every 15 seconds, gargoyle will pop up a message box. When you click ok, gargoyle sets up the tail calls to mark itself non-executable and to wait for the timer. For fun, use Sysinternals's excellent VMMap tool to examine when gargoyle's PIC is executable. If a message box is active, gargoyle will be executable. If it is not, gargoyle should not be executable. The PIC's address is printed to stdout just before the harness calls into the PIC.

More information

See the blog post available at lospi.net for more information.

Also feel free to hop on gitter:

gargoyle's Issues

vs2013 build error

1>------ 已启动生成: 项目: Gargoyle, 配置: Debug Win32 ------
1> main.cpp
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(14): error C2146: 语法错误: 缺少“;”(在标识符“DWORD”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(14): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(15): error C2146: 语法错误: 缺少“;”(在标识符“size_t”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(15): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(15): error C2086: “int anonymous-namespace'::constexpr”: 重定义 1> c:\users\administrator\desktop\gargoyle-master\main.cpp(14) : 参见“anonymous-namespace'::constexpr”的声明
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(19): error C2146: 语法错误: 缺少“;”(在标识符“relative_offset”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(19): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(37): error C2440: “初始化”: 无法从“initializer-list”转换为“std::vector<anonymous-namespace'::VersionToOffset,std::allocator<_Ty>>” 1> with 1> [ 1> _Ty=anonymous-namespace'::VersionToOffset
1> ]
1> 无构造函数可以接受源类型，或构造函数重载决策不明确
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(40): error C2146: 语法错误: 缺少“;”(在标识符“initialized”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(40): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(42): error C2146: 语法错误: 缺少“;”(在标识符“setup_length”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(42): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(50): error C2146: 语法错误: 缺少“;”(在标识符“interval”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(50): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(52): error C2146: 语法错误: 缺少“;”(在标识符“shadow”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(52): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(60): error C2146: 语法错误: 缺少“;”(在标识符“size”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(60): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(61): error C2146: 语法错误: 缺少“;”(在标识符“protections”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(61): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(63): error C2146: 语法错误: 缺少“;”(在标识符“old_protections”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(63): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(69): error C2146: 语法错误: 缺少“;”(在标识符“stack”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(69): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(69): error C2057: 应输入常量表达式
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(97): error C2146: 语法错误: 缺少“;”(在标识符“get_mshtml_gadget_relative_offset”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(97): error C4430: 缺少类型说明符 - 假定为 int。注意: C++ 不支持默认 int
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(130): error C2146: 语法错误: 缺少“;”(在标识符“relative_offset”的前面)
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(130): error C2065: “relative_offset”: 未声明的标识符
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(133): error C2065: “relative_offset”: 未声明的标识符
1>c:\users\administrator\desktop\gargoyle-master\main.cpp(133): fatal error C1903: 无法从以前的错误中恢复；正在停止编译
========== 生成: 成功 0 个，失败 1 个，最新 0 个，跳过 0 个 ==========

I did not find a way to resolve it

Does not work with the current Windows 10 version of "mshtml.dll"

Current Windows 10 installations use mshtml.dll version 11.0.14393.953. The ROP gadget offset for this version is not the same as the default value (i.e. 0x006D55DD) used by Gargoyle. The correct offset for this version of mshtml.dll is 0x003CBD4D. Due to this discrepancy, the Gargoyle process just crashes when attempting to leverage the ROP gadget.

Implement 64-bit proof of concept

NULL PTR Issue (Bit Strange Windows 7)

Hello! Was hoping you'd have an idea to this

Your project is awesome btw, so I thought I'd try to use it in my own. However, one issue occurs on Windows 7 (x64). When running gargoyle.exe, itll pop the two messagebox's (the initial two) then immediate after the APC is queued, hop to a NULL address. This issue does not appear on any operating system. I tried debugging myself/finding the issue but unable to find it/fix it, so wanted to ask if you have an idea of how one could fix it?

Anyhow, I appreciate you're response, & thank you!

Search for the ROP gadget in "mshtml.dll" at run-time instead of using hard coded offsets

The Gargoyle ROP proof of concept uses an ROP gadget embedded in the "mshtml.dll" system DLL. About once a month, Microsoft releases a new version of this DLL. These releases may correspond to significant Windows milestone (e.g. "Anniversary Update", "Creators Update"), or just security patches. Unfortunately, each time the "mshtml.dll" system DLL is reissued, the location of the embedded ROP gadget shifts around a little. This causes Gargoyle to break.

To solve this, Gargoyle should load the "mshtml.dll" system DLL into memory and search the executable portions of its address space to find the offset of the ROP gadget. In this way, Gargoyle will become immune to the reissuance of "mshtml.dll" as long as the DLL is not changed at some point to eliminate the ROP gadget.