hooking sleep & beep syscalls

Question

I have a binary which is playing a Morse code using calls to Beep & Sleep.

This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04).

How can I extract the arguments which passed to Sleep or Beep whenever is been invoked ?

Ideal result will be to open the file from terminal and each time Sleep is called it will log

• Sleep ( Milliseconds )
• Beep ( Frequency , Duration )

The binary is packed & obfuscated, can I edit the Kernel32.dll & extend those methods ?

• Can I use strace ? if so, how do I filter Sleep & Beep ?

Answer 1

If you're using Wine, you just need to enable the trace. Do the following:

$ WINEDEBUG="trace+msvcrt" wine your_binary.exe

Taking a look to the Wine's source code I verified that both Sleep and Beep are being traced.

Beep:

void CDECL MSVCRT__beep( unsigned int freq, unsigned int duration)
{
    TRACE(":Freq %d, Duration %d\n",freq,duration);
    Beep(freq, duration);
}

Sleep:

void CDECL MSVCRT__sleep(MSVCRT_ulong timeout)
{
  TRACE("_sleep for %d milliseconds\n",timeout);
  Sleep((timeout)?timeout:1);
}

Naturally, you will need to filter out many other messages. Simply doing "grep -v" should be enough.

Answer 2

not sure what you mean
dot will always sound like dot wont it ? so logically it will always have the same frequency and same duration ?

like wise dash will always sound like dash ?
if it varied like monkeydash , goatdash , pigdash each time it sounded then it wont be morse code ....
so logically dash will have the same frequency and duration

so logical conclusion would be if you log them once you logged them forever in a specific program

does it mage sense ?

now that set aside why would you need to edit system dlls ? cant you run a debugger and set a breakpoint on the binary? why ?
is it because it is packed and obfuscated and has heavy anti-debugging measures including checking for breakpoints on system dlls?

if so you can try some thing like frida

suppose you have some code like this

#include <windows.h>
#include <stdio.h>
void beepchar(char letter) {
    char *beeps[] = { 
        ".-","-...","-.-.","-..",".","..-.","--.","....","..",
        ".---","-.-",".-..","--",        "-.","---",".--.","--.-",
        ".-.","...","-","..-","...-",".--","-..-","-.--","--.."
    };
    char *curbeep= (beeps[(letter -'a')]);
    printf("%s " , curbeep);
    while(*curbeep) {
        if( *curbeep == '.') {
            printf ("dot "); Beep(440,200);
        } else {
            printf("dash "); Beep(440,400);
        } curbeep++;
    }printf("\n");
}
int main (int argc , char* argv[]) {
    if(argc !=2) {
        printf ("usage %s some string\n",argv[0]);
        exit(0);
    } char *letter = argv[1];
    while(*letter) {
        unsigned char temp = *(unsigned char *)letter;
        if(isalpha(temp))        {
            beepchar((char)tolower(temp));
        } else {
            printf("not an alphabet\n");
        } letter++;
    } return 0;
}

when compiled and executed you should get an output like this along with sound

:\>morsebeeper.exe
usage morsebeeper.exe some string
:\>morsebeeper.exe "Hello World"
.... dot dot dot dot
. dot
.-.. dot dash dot dot
.-.. dot dash dot dot
--- dash dash dash
not an alphabet
.-- dot dash dash
--- dash dash dash
.-. dot dash dot
.-.. dot dash dot dot
-.. dash dot dot

:\>

you can use frida-trace to log the beeps

just run frida-trace -i "Beep" .\yourexe

and edit the auto generated handler as you wish dynamically and reload it

:\>frida-trace -i "Beep" .\morsebeeper.exe Hello
Instrumenting functions...
Beep: Loaded handler at "xxx\__handlers__\kernel32.dll\Beep.js"
Beep: Loaded handler at "xxx\__handlers__\KERNELBASE.dll\Beep.js"
Started tracing 2 functions. Press Ctrl+C to stop.
           /* TID 0xf44 */
   109 ms  Beep()
   110 ms     | Beep(440 , 200) << dot
   314 ms  Beep()
   315 ms     | Beep(440 , 200) << dot
   547 ms  Beep()
   547 ms     | Beep(440 , 200) << dot
   800 ms  Beep()
   800 ms     | Beep(440 , 200) << dot   
   four dots above = h          <<<<<<<<<<<<<<<<
  1093 ms  Beep()
  1094 ms     | Beep(440 , 200) << dot
  one dot above is e            <<<<<<<<<<<<<<<<<<

  l
  1382 ms  Beep()
  1382 ms     | Beep(440 , 200) << dot
  1609 ms  Beep()
  1609 ms     | Beep(440 , 400) << dash
  2104 ms  Beep()
  2104 ms     | Beep(440 , 200)
  2333 ms  Beep()
  2333 ms     | Beep(440 , 200)
  l
  2614 ms  Beep()
  2614 ms     | Beep(440 , 200)
  2895 ms  Beep()
  2896 ms     | Beep(440 , 400)
  3301 ms  Beep()
  3302 ms     | Beep(440 , 200)
  3503 ms  Beep()
  3503 ms     | Beep(440 , 200)
  o
  3705 ms  Beep()
  3705 ms     | Beep(440 , 400)
  4197 ms  Beep()
  4198 ms     | Beep(440 , 400)
  4604 ms  Beep()
  4604 ms     | Beep(440 , 400)
stdout> .... dot dot dot dot
stdout> . dot
stdout> .-.. dot dash dot dot
stdout> .-.. dot dash dot dot
stdout> --- dash dash dash
stdout>
stderr>
Process terminated

:\>