24jj: BIGKERNEL BODIES FOUND via runtime IAT resolve — 1803a06a0/180296c80/180323f20/1802dc0e0, real math functions with x87 transcendental pair (exp family); iat_name.py v2 with double-deref+PE exports

scripts/iat_name.py

@@ -83,6 +83,8 @@ t0=time.time(); host=None
 while time.time()-t0<30 and not host:
     host=find_host(); time.sleep(0.002)
 print('host',host,flush=True)
+import signal as sg
+os.kill(host,sg.SIGSTOP)
 fd=os.open('/proc/%d/mem'%host,os.O_RDONLY)
 
 # build module map
@@ -100,13 +102,27 @@ def owner(addr):
     return None
 
 targets={}
-for stub in (0x180140b30,0x180140b60,0x1801409e0,0x180140ad0,0x180140a40):
-    off=stub-BASE
-    b=data[off:off+7]
-    rel=struct.unpack('<i',b[3:7])[0]
-    tbl=stub+14+rel
-    v=rd(fd,tbl+4*8,8)
+TBL={0x180140b30:0x1826176c8,0x180140b60:0x182617708,0x1801409e0:0x182617508,
+     0x180140ad0:0x182617648,0x180140a40:0x182617588}
+for stub,tbl in TBL.items():
+    v=rd(fd,tbl+32,8)
     tgt=struct.unpack('<Q',v)[0] if v else 0
+    # second level: tgt code = mov rax,[rip+rel]; jmp rax -> IAT slot
+    print('  L2: tgt=%x' % tgt, flush=True)
+    if 0x180000000 <= tgt < 0x187000000:
+        off2=tgt-BASE
+        b2=data[off2:off2+7] if 0<=off2<len(data)-7 else rd(tgt,7)
+        if b2[:2]==b'\x48\x8b':
+            rel2=struct.unpack('<i',b2[3:7])[0]
+            slot=tgt+7+rel2
+            print('  L2: b2=%s rel2=%x slot=%x' % (b2.hex(),rel2&0xffffffff,slot), flush=True)
+            fv=rd(fd,slot,8)
+            if fv:
+                tgt=struct.unpack('<Q',fv)[0]
+            else:
+                print('   slot read FAIL',slot,flush=True)
+        else:
+            print('   no mov-rax pattern at %x: %s'%(tgt,b2[:3].hex() if b2 else '-'),flush=True)
     ow=owner(tgt)
     print('%x idx4->%x runtime=%x owner=%s' % (stub,tbl,tgt,ow[2] if ow else '?'),flush=True)
     if ow: