#include "../includes/woody.h" #define CODE_MACRO "\x50\x57\x56\x52\x53\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x09\x00\x00\x00\x0f\x05\x5a\x5b\x5a\x5e\x5f\x58\xc3\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a" char jmp[] = "\xe9\x00\x00\x00\x00"; int elf_magic_numbers(char *str) { return (!ft_strncmp(str, ELFMAG, SELFMAG)); } void encrypt_zone(char *file, unsigned long int offset, unsigned long int size) { size_t i = 0; while (i < size) { file[offset + i] = 0; ++i; } } int save_elf(char *path, char *file, unsigned long int size) { int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755); if (fd == -1) { ft_printf("Error: Failed to create new file \'%s\'\n", path); return EXIT_FAILURE; } if (write(fd, file, size) == -1) { close(fd); ft_printf("Error: Failed to write new file \'%s\'\n", path); return EXIT_FAILURE; } if (close(fd) == -1) { ft_printf("Error: Failed to close new file \'%s\'\n", path); return EXIT_FAILURE; } return EXIT_SUCCESS; } int get_load_segment(t_efl_content *woody, int start, bool executable) { for (int i = start; i < woody->Ehdr->e_phnum; i++) { if (woody->Phdr[i].p_type == PT_LOAD) { if (executable) { if (woody->Phdr[i].p_flags & PF_X) return i; } else return i; } } return -1; } void find_cave(t_efl_content *woody) { woody->Phdr = (Elf64_Phdr *)secure_jump(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr)); int i = get_load_segment(woody, 0, true); int j = get_load_segment(woody, i + 1, false); printf("%d %ld\n", i, woody->Phdr[i].p_align); printf("%d %ld\n", j, woody->Phdr[j].p_align); printf("code_cave_start = %lx, virtual adress = %lx\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_vaddr); printf("code_cave_size = %lx\n", woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz)); Elf64_Off payload_off = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz; size_t len = sizeof(CODE_MACRO) - 1; ft_memcpy(woody->file + payload_off, CODE_MACRO, len); printf("old entry : %lx\n", woody->Ehdr->e_entry); woody->Ehdr->e_entry = woody->Phdr[i].p_vaddr + woody->Phdr[i].p_filesz; woody->Phdr[i].p_filesz += len; woody->Phdr[i].p_memsz += len; printf("e_entry = %lx\n", woody->Ehdr->e_entry); printf("p_filesz = %lx\n", woody->Phdr[i].p_filesz); printf("p_memsz = %lx\n", woody->Phdr[i].p_memsz); } int inject(t_efl_content *woody) { woody->Ehdr = (Elf64_Ehdr *)secure_jump(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr)); if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != 2) { ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path); return EXIT_FAILURE; } printf("entry point = %ld\n", woody->Ehdr->e_entry); Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr)); if (Shdr == NULL || !secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr))) { return ft_put_error("Corrupted file"); } if (woody->file_size > woody->Ehdr->e_shoff + woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)) { printf("extra_data !\n"); // save it in woody->extra_data and append it to the end of the woody file ? Could be dangerous } Elf64_Shdr *symbols_table = NULL; for (int i = 0; i < woody->Ehdr->e_shnum; i++) { if (Shdr[i].sh_type == SHT_SYMTAB) { symbols_table = secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)); } } if (symbols_table == NULL) return ft_put_error("No symbols"); if (!secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr))) return ft_put_error("Corrupted file"); char *Sshstrtab = (char *)secure_jump(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0); if (Sshstrtab == NULL) return ft_put_error("Corrupted file"); for (int i = 0; i < woody->Ehdr->e_shnum; i++) { char *section_name = Sshstrtab + Shdr[i].sh_name; printf("%s : Offset: %lx | Size: %lx | Virtual adress: %lx\n", section_name, Shdr[i].sh_offset, Shdr[i].sh_size, Shdr[i].sh_addr); } // useless for now Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr)); if (!strtab_header) return ft_put_error("Corrupted file"); char *strtab = secure_jump(woody->file, woody->file_size, strtab_header->sh_offset, 0); if (strtab == NULL) return ft_put_error("Corrupted file"); Elf64_Sym *symbols = (Elf64_Sym *)secure_jump(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym)); if (symbols == NULL) return ft_put_error("Corrupted file"); // end useless woody->Ehdr->e_entry = find_cave(woody); char *woody_file = malloc(woody->file_size); ft_memcpy(woody_file, woody->file, woody->file_size); // encrypt_zone(woody_file, strtab_header->sh_offset , strtab_header->sh_size); return save_elf("woody", woody_file, woody->file_size); }