.vscode/settings.json

@@ -1,7 +0,0 @@
-{
-	"files.associations": {
-		"stdio.h": "c",
-		"mman.h": "c",
-		"stdint.h": "c"
-	}
-}

Makefile

@@ -4,8 +4,7 @@ SRCS_PATH	= srcs/
 
 SRCS  =		$(SRCS_PATH)main.c \
 			$(SRCS_PATH)utils.c \
-			$(SRCS_PATH)woody.c \
+			$(SRCS_PATH)woody.c
-			$(SRCS_PATH)encrypt.c
 
 
 OBJS		= ${SRCS:.c=.o}
@@ -38,4 +37,4 @@ fclean:
 re:		fclean
 		make all
 
-.PHONY : all clean fclean re
+.PHONY : all clean fclean re

README

@@ -1,5 +0,0 @@
-Transform payload code in hexa :
-
-nasm -f elf64 -o print.o print.s && ld -o print print.o && nasm -f bin -o payload print.s && hexdump -v -e '"\\\x\" 1/1 "%02x"' payload
-
-Append : | xclip -sel clip to directly get it in clipboard

diff.txt

@@ -1,4 +0,0 @@
-2c2
-< resources/sample64:     file format elf64-x86-64
----
-> woody:     file format elf64-x86-64

ft_printf/libft/Makefile

@@ -41,7 +41,6 @@ SRCS  =		$(SRCS_PATH)ft_atoi.c \
 			$(SRCS_PATH)ft_bzero.c \
 			$(SRCS_PATH)ft_strdup.c \
 			$(SRCS_PATH)ft_strnstr.c \
-			$(SRCS_PATH)ft_strnstr_nullterminated.c \
 			$(SRCS_PATH)ft_calloc.c \
 			$(SRCS_PATH)ft_substr.c \
 			$(SRCS_PATH)ft_strjoin.c \

ft_printf/libft/ft_strnstr_nullterminated.c

@@ -1,17 +0,0 @@
-#include "libft.h"
-
-char	*ft_strnstr_nullterminated(const char *big, const char *little, size_t len)
-{
-	size_t	len_l;
-
-	if (*little == 0)
-		return ((char *)big);
-	len_l = ft_strlen(little);
-	while (len-- >= len_l)
-	{
-		if (*big == *little && ft_strncmp(big, little, len_l) == 0)
-			return ((char *)big);
-		big++;
-	}
-	return (NULL);
-}

ft_printf/libft/libft.h

@@ -37,7 +37,6 @@ int				ft_strncmp(const char *s1, const char *s2, size_t n);
 size_t			ft_strlcpy(char *dst, const char *src, size_t size);
 size_t			ft_strlcat(char *dst, const char *src, size_t size);
 char			*ft_strnstr(const char *big, const char *little, size_t len);
-char			*ft_strnstr_nullterminated(const char *big, const char *little, size_t len);
 int				ft_atoi(const char *nptr);
 char			*ft_substr(char const *s, unsigned int start, size_t len);
 char			*ft_strjoin(char const *s1, char const *s2);
@@ -56,7 +55,6 @@ void			*ft_calloc(size_t nmemb, size_t size);
 char			*ft_convert_base(char *nbr, char *base_from, char *base_to);
 char			*ft_u_convert(char *nbr, char *base_from, char *base_to);
 void			ft_rev_int_tab(char *tab, int size);
-
 typedef struct	s_list
 {
 	void			*content;

includes/woody.h

@@ -2,7 +2,6 @@
 # define WOODY_H
 
 #include "../ft_printf/includes/ft_printf.h"
-#include <stdbool.h> 
 #include <unistd.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -12,30 +11,21 @@
 #include <sys/mman.h>
 #include <fcntl.h>
 #include <elf.h>
-#include <stdint.h>
-
-#define PAYLOAD "\x50\x57\x56\x52\x53\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x0c\x00\x00\x00\x0f\x05\x5b\x5a\x5e\x5f\x58\xe9\xdf\xff\xff\xff\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a"
-#define JUMP "\xe9";//\xdf\xff\xff\xff";
 
 typedef struct efl_content
 {
 	long unsigned int file_size;
 	char	*file_path;
 	char	*file;
-	Elf64_Ehdr	*Ehdr;
-	Elf64_Phdr	*Phdr;
 	char	*extra_data;
 }				t_efl_content;
 
 
 // utils.c
-void	*fetch(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size);
+void	*secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size);
 int		ft_put_error(char *str);
 
 // woody.c
-int prepare_injection(t_efl_content *woody);
+int woody(t_efl_content *file_content);
-
-// encrypt.c
-void	encrypt(char *file, unsigned long int offset, unsigned long int size);
 
 #endif

print.s

@@ -1,28 +0,0 @@
-bits 64
-default rel
-global _start
-
-_start:
-		push rax
-		push rdi
-		push rsi
-		push rdx
-		push rbx
-
-        xor     eax, eax
-        cdq
-        mov     dl, 10
-        inc     eax
-        mov     edi, eax
-        lea     rsi, [rel msg]
-        syscall
-		pop rbx
-		pop rdx
-		pop rsi
-		pop rdi
-		pop rax
-		jmp 0x00000000
-		
-msg     db "..WOODY..",10
-
-

shellcode_test.c

@@ -1,17 +0,0 @@
-#include <stdio.h>
-#include <stdint.h>
-#include <unistd.h>
-#include <sys/mman.h>
-
-char code[] = "\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x12\x00\x00\x00\x0f\x05\xb2\x2a\x31\xc0\xff\xc0\xf6\xe2\x89\xc7\x31\xc0\xb0\x3c\x0f\x05\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a";
-typedef void (*ShellcodeFunc)();
-
-int main() {
-    ShellcodeFunc func = (ShellcodeFunc)code;
-
-    size_t pagesize = 4096; // 4KB, a common page size
-    uintptr_t page_start = (uintptr_t)code & ~(pagesize - 1);
-    mprotect((void *)page_start, pagesize, PROT_READ | PROT_EXEC);
-    func();
-    return 0;
-}

srcs/encrypt.c

@@ -1,11 +0,0 @@
-#include "../includes/woody.h"
-
-void	encrypt(char *file, unsigned long int offset, unsigned long int size)
-{
-	size_t i = 0;
-	while (i < size)
-	{
-		file[offset + i] = 0;
-		++i;
-	}
-}

srcs/main.c

@@ -1,29 +1,29 @@
 #include "../includes/woody.h"
 
-int get_elf_file(t_efl_content *woody)
+int get_elf_file(t_efl_content *file_content)
 {
 	int fd;
 	off_t off;
 
-	fd = open(woody->file_path, O_RDONLY);
+	fd = open(file_content->file_path, O_RDONLY);
 	if (fd < 0)
 	{
-		ft_printf("Error: Failed to open \'%s\'\n", woody->file_path);
+		ft_printf("Error: Failed to open \'%s\'\n", file_content->file_path);
 		return EXIT_FAILURE;
 	}
 	off = lseek(fd, 0, SEEK_END);
     if (off == -1)
     {
 		close(fd);
-		ft_printf("Error: Failed to read file offset \'%s\'\n", woody->file_path);
+		ft_printf("Error: Failed to read file offset \'%s\'\n", file_content->file_path);
         return EXIT_FAILURE;
     }
-	woody->file_size = off;
+	file_content->file_size = off;
-	woody->file = mmap(NULL, woody->file_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+	file_content->file = mmap(NULL, file_content->file_size, PROT_READ, MAP_PRIVATE, fd, 0);
-    if (woody->file  == MAP_FAILED)
+    if (file_content->file  == MAP_FAILED)
 	{
 		close(fd);
-		ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path);
+		ft_printf("Error: Failed to map file \'%s\'\n", file_content->file_path);
 		return EXIT_FAILURE;
     }
     close(fd);
@@ -32,14 +32,15 @@ int get_elf_file(t_efl_content *woody)
 
 int main(int ac, char **av)
 {
-	t_efl_content woody;
+	t_efl_content file_content;
 	if (ac != 2)
 	{
 		return ft_put_error("Woody_woodpacker take 1 argument\n");
 	}
-	woody.file_path = av[1];
+	file_content.file_path = av[1];
-	int ret = get_elf_file(&woody);
+	int ret = get_elf_file(&file_content);
 	if (ret == EXIT_FAILURE)
 		return ret;
-	return prepare_injection(&woody);
+	
+	return woody(&file_content);
 }

srcs/utils.c

@@ -1,6 +1,6 @@
 #include "../includes/woody.h"
 
-void	*fetch(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size)
+void	*secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size)
 {
 	if (file_size > offset_to_data && file_size >= (offset_to_data + supposed_data_size))
 		return (file + offset_to_data);

srcs/woody.c

@@ -1,11 +1,20 @@
 #include "../includes/woody.h"
 
-
 int elf_magic_numbers(char *str)
 {
 	return (!ft_strncmp(str, ELFMAG, SELFMAG));
 }
 
+void	encrypt_zone(char *file, unsigned long int offset, unsigned long int size)
+{
+	size_t i = 0;
+	while (i < size)
+	{
+		file[offset + i] = 0;
+		++i;
+	}
+}
+
 int		save_elf(char *path, char *file, unsigned long int size)
 {
 	int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
@@ -27,132 +36,49 @@ int		save_elf(char *path, char *file, unsigned long int size)
 	return EXIT_SUCCESS;
 }
 
-int	get_load_segment(t_efl_content *woody, int start, bool executable)
+int woody(t_efl_content *file_content)
 {
-	for (int i = start; i < woody->Ehdr->e_phnum; i++)
+	Elf64_Ehdr *Ehdr = (Elf64_Ehdr *)secure_access(file_content->file, file_content->file_size, 0, sizeof(Elf64_Ehdr));
+
+	if (!Ehdr || !elf_magic_numbers(file_content->file) || Ehdr->e_ident[EI_CLASS] != 2)
 	{
-		if (woody->Phdr[i].p_type == PT_LOAD)
+		ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", file_content->file_path);
-		{
-			if (executable)
-			{
-				if (woody->Phdr[i].p_flags & PF_X)
-					return i;
-			}
-			else
-				return i;
-		}
-	}
-	return -1;
-}
-
-
-int32_t find_jmp(char *code, size_t len)
-{
-	char *jump = JUMP;
-	char *ptr = ft_strnstr_nullterminated(code, jump, len);
-	if (ptr)
-	{
-		return ptr - code;
-	}
-	return 0;
-}
-
-void	inject(t_efl_content *woody)
-{
-	char payload[] = PAYLOAD;
-    size_t len_payload = sizeof(PAYLOAD) - 1;
-	woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
-
-	int i = get_load_segment(woody, 0, true);	
-	int j = get_load_segment(woody, i + 1, false);
-	
-	size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
-	size_t payload_off = woody->Phdr[i].p_offset + woody->Phdr[i].p_memsz;
-	
-	printf("Old entry : %ld\n", woody->Ehdr->e_entry);
-	printf("Code_cave_start = %ld\n", woody->Phdr[i].p_offset);
-	printf("Code_cave_size = %ld\n", code_cave_size);
-	printf("Payload size = %ld\n", len_payload);
-	
-	int32_t jmp_index = find_jmp(payload, len_payload);
-	int32_t backward_len = ((payload_off + len_payload) - woody->Ehdr->e_entry) * -1;
-
-	ft_memcpy(&payload[jmp_index + 1], &backward_len, sizeof(backward_len));
-	ft_memcpy(woody->file + payload_off, payload, len_payload);
-	
-	printf("Backward offset = %d\n", backward_len);
-
-	woody->Ehdr->e_entry = payload_off;
-	woody->Phdr[i].p_filesz += len_payload;
-	woody->Phdr[i].p_memsz += len_payload;
-	woody->file_size += len_payload;
-
-	printf("New entry = %ld\n", woody->Ehdr->e_entry);
-}
-
-int get_elf_sections(t_efl_content *woody)
-{
-	woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
-	if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != 2)
-	{
-		ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
 		return EXIT_FAILURE;
 	}
 
-	Elf64_Shdr *Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
+	Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, sizeof(Elf64_Shdr));
-	if (Shdr == NULL || !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
+	if (Shdr == NULL || !secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, Ehdr->e_shnum * sizeof(Elf64_Shdr)))
 	{
 		return ft_put_error("Corrupted file");
 	}
+	if (file_content->file_size > Ehdr->e_shoff + Ehdr->e_shnum * sizeof(Elf64_Shdr))
+	{
+		printf("extra_data !\n"); // save it in file_content->extra_data and append it to the end of the woody file ? Could be dangerous
+	}
 
 	Elf64_Shdr *symbols_table = NULL;
-    for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
+    for (int i = 0; i < Ehdr->e_shnum; i++) {
 		if (Shdr[i].sh_type == SHT_SYMTAB) {
-            symbols_table = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
+            symbols_table = secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
         }
     }
 	if (symbols_table == NULL)
-		return ft_put_error("No symbols");
-
-	if (!fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
 		return ft_put_error("Corrupted file");
 
-	char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
+    Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (symbols_table->sh_link * Ehdr->e_shentsize), sizeof(Elf64_Shdr)); 
-	if (Sshstrtab == NULL)
-		return ft_put_error("Corrupted file");
-
-    Elf64_Shdr *strtab_header = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr)); 
 	if (!strtab_header)
 		return ft_put_error("Corrupted file");
 
-    char *strtab = fetch(woody->file, woody->file_size, strtab_header->sh_offset, 0);
-	if (strtab == NULL)
-		return ft_put_error("Corrupted file");
-    Elf64_Sym *symbols = (Elf64_Sym *)fetch(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym));
-	if (symbols == NULL)
-		return ft_put_error("Corrupted file");
 
-	return EXIT_SUCCESS;
+	if (strtab_header->sh_offset + strtab_header->sh_size > file_content->file_size)
-}
+	{
+		return ft_put_error("Encrypt after the end of the file");
+	}
 
-int prepare_injection(t_efl_content *woody)
+	char *woody = malloc(file_content->file_size);
-{
+	ft_memcpy(woody, file_content->file, file_content->file_size);
-	int elf_statut = get_elf_sections(woody);
-	if (elf_statut)
-		return elf_statut;
 
-	inject(woody);
+	encrypt_zone(woody, strtab_header->sh_offset , strtab_header->sh_size);
-
-	char *woody_file;
-	if (!(woody_file = malloc(woody->file_size)))
-		return ft_put_error("Allocation error");
-
-	ft_memcpy(woody_file, woody->file, woody->file_size);
-
-	// encrypt(woody_file, strtab_header->sh_offset , strtab_header->sh_size);
 	
-	munmap(woody_file, woody->file_size);
+	return save_elf("woody", woody, file_content->file_size);
-	save_elf("woody", woody_file, woody->file_size);
-	free(woody_file);
-	return EXIT_SUCCESS;
 }