供应链攻击之编译环境

靶场Windows靶机

任意版本visual studio

MSVC组件

#define _SCRT_STARTUP_MAIN
#include "exe_common.inl"
extern "C" DWORD mainCRTStartup(LPVOID)
{
   return __scrt_common_main();
}

static __declspec(noinline) int __cdecl __scrt_common_main_seh()
{
   if (!__scrt_initialize_crt(__scrt_module_type::exe))
       __scrt_fastfail(FAST_FAIL_FATAL_APP_EXIT);

   bool has_cctor = false;
   __try
  {
       bool const is_nested = __scrt_acquire_startup_lock();

       if (__scrt_current_native_startup_state == __scrt_native_startup_state::initializing)
      {
           __scrt_fastfail(FAST_FAIL_FATAL_APP_EXIT);
      }
       else if (__scrt_current_native_startup_state == __scrt_native_startup_state::uninitialized)
      {
           __scrt_current_native_startup_state = __scrt_native_startup_state::initializing;

           if (_initterm_e(__xi_a, __xi_z) != 0)
               return 255;

           _initterm(__xc_a, __xc_z);

           __scrt_current_native_startup_state = __scrt_native_startup_state::initialized;
      }
       else
      {
           has_cctor = true;
      }

       __scrt_release_startup_lock(is_nested);

       // If this module has any dynamically initialized __declspec(thread)
       // variables, then we invoke their initialization for the primary thread
       // used to start the process:
       _tls_callback_type const* const tls_init_callback = __scrt_get_dyn_tls_init_callback();
       if (*tls_init_callback != nullptr && __scrt_is_nonwritable_in_current_image(tls_init_callback))
      {
          (*tls_init_callback)(nullptr, DLL_THREAD_ATTACH, nullptr);
      }

       // If this module has any thread-local destructors, register the
       // callback function with the Unified CRT to run on exit.
       _tls_callback_type const * const tls_dtor_callback = __scrt_get_dyn_tls_dtor_callback();
       if (*tls_dtor_callback != nullptr && __scrt_is_nonwritable_in_current_image(tls_dtor_callback))
      {
           _register_thread_local_exe_atexit_callback(*tls_dtor_callback);
      }

       //
       // Initialization is complete; invoke main...
       //

       int const main_result = invoke_main();

       //
       // main has returned; exit somehow...
       //

       if (!__scrt_is_managed_app())
           exit(main_result);

       if (!has_cctor)
           _cexit();

       // Finally, we terminate the CRT:
       __scrt_uninitialize_crt(true, false);
       return main_result;
  }
   __except (_seh_filter_exe(GetExceptionCode(), GetExceptionInformation()))
  {
       // Note: We should never reach this except clause.
       int const main_result = GetExceptionCode();

       if (!__scrt_is_managed_app())
           _exit(main_result);

       if (!has_cctor)
           _c_exit();

       return main_result;
  }
}



// This is the common main implementation to which all of the CRT main functions
// delegate (for executables; DLLs are handled separately).
static __forceinline int __cdecl __scrt_common_main()
{
   // The /GS security cookie must be initialized before any exception handling
   // targeting the current image is registered. No function using exception
   // handling can be called in the current image until after this call:
   __security_init_cookie();

   return __scrt_common_main_seh();
}

//
// dyn_tls_init.c
//
// Copyright (c) Microsoft Corporation. All rights reserved.
//
// This source file provides a fallback definition of __dyn_tls_init_callback,
// used whenever TLS initialization is not required.
//
// This relies on a feature of the C compiler known as "communal variables."
// This does not work in C++, and the linker's alternatename features is not
// sufficient here.
//
#include <Windows.h>

#pragma warning(disable: 4132) // const object should be initialized
const PIMAGE_TLS_CALLBACK __dyn_tls_init_callback;

PIMAGE_TLS_CALLBACK const* __cdecl __scrt_get_dyn_tls_init_callback()
{
    return &__dyn_tls_init_callback;
}

#include <Windows.h>

#pragma warning(disable: 4132) // const object should be initialized
const PIMAGE_TLS_CALLBACK __dyn_tls_init_callback;
add(int x,int y){
    return x + y;
}
PIMAGE_TLS_CALLBACK const* __cdecl __scrt_get_dyn_tls_init_callback()
{
    int x = 1;
    int y = 2;
    int z = add(x, y);
    return &__dyn_tls_init_callback;
}

link -lib "XX:XXXmsvcrt.lib" -remove:D:a_work1sIntermediatecrtvcstartupbuildmdmsvcrt_kernel32msvcrt_kernel32.nativeprojobjrx86dyn_tls_init.obj

lib "XX:XXXmsvcrt.lib" "D:a_work1sIntermediatecrtvcstartupbuildmdmsvcrt_kernel32msvcrt_kernel32.nativeprojobjrx86dyn_tls_init.obj”

call    ___scrt_release_startup_lock
pop ecx
call    sub_401CD0
mov esi, eax
xor     edi, edi
cmp [esi], edi
jz short loc_401783
push esi
call    ___scrt_is_nonwritable_in_current_image
pop ecx
test    al, al
jz short loc_401783
mov esi, [esi]
push edi
push 2
push edi
mov ecx, esi
call    ds:___guard_check_icall_fptr
call    esi
call    sub_401D0B
mov esi, eax
cmp [esi], edi
jz short loc_4017A1
push esi
call    ___scrt_is_nonwritable_in_current_image
pop ecx
test    al, al
jz short loc_4017A1
push dword ptr [esi] ; Callback
call    _register_thread_local_exe_atexit_callback
pop ecx
call    _get_initial_narrow_environment
mov edi, eax
call    __p___argv
mov esi, [eax]
call    __p___argc
push edi ; envp
push esi ; argv
push dword ptr [eax] ; argc
call    _main