woody-woodpacker/srcs/woody.c

#include "../includes/woody.h"

int elf_magic_numbers(char *str)
{
	return (!ft_strncmp(str, ELFMAG, SELFMAG));
}

int save_elf(char *path, char *file, unsigned long int size)
{
	int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
    if (fd == -1) {
		printf("Error: Failed to create new file \'%s\'\n", path);
		return EXIT_FAILURE;
    }

    if (write(fd, file, size) == -1) {
        close(fd);
        printf("Error: Failed to write new file \'%s\'\n", path);
        return EXIT_FAILURE;
    }

    if (close(fd) == -1) {
		printf("Error: Failed to close new file \'%s\'\n", path);
        return EXIT_FAILURE;
    }
	return EXIT_SUCCESS;
}

int	get_load_segment(t_elf_content *woody, int start, bool executable)
{
	for (int i = start; i < woody->Ehdr->e_phnum; i++)
	{
		if (woody->Phdr[i].p_type == PT_LOAD)
		{
			if (executable)
			{
				if (woody->Phdr[i].p_flags & PF_X)
					return i;
			}
			else
				return i;
		}
	}
	return -1;
}

void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offset_ammount)
{
	for (int i = 0; i < woody->Ehdr->e_phnum; i++)
	{
		if (woody->Phdr[i].p_offset >= from)	
		{
			woody->Phdr[i].p_offset += offset_ammount;
			woody->Phdr[i].p_vaddr += offset_ammount;
			woody->Phdr[i].p_paddr += offset_ammount;
		}
	}
	for (int i = 0; i < woody->Ehdr->e_shnum; i++)
	{
		if (woody->Shdr[i].sh_offset >= from)
		{
			woody->Shdr[i].sh_offset += offset_ammount;
			woody->Shdr[i].sh_addr += offset_ammount;
		}
	}
	for (int i = 1; i < woody->num_symbols; i++)
	{
		if (woody->symbols[i].st_value >= from)
		{
			woody->symbols[i].st_value += offset_ammount;
		}
	}
    for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
		if (woody->Shdr[i].sh_type == SHT_REL)
		{
			printf("SHT_RE = %ld  %ld\n", sizeof(Elf64_Rel), woody->Shdr[i].sh_entsize);
			int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize;
            for (int j = 0; j < num_entries; j++) {
				Elf64_Rel *rel = (Elf64_Rel *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset + (j * woody->Shdr[i].sh_entsize), sizeof(Elf64_Rel));
				rel->r_offset += offset_ammount;
                // printf("  Offset: 0x%lx, Info: 0x%lx, Type: %u, Symbol: %u\n",
                //        (unsigned long)rel[j].r_offset, (unsigned long)rel[j].r_info,
                //        (unsigned int)ELF64_R_TYPE(rel[j].r_info), (unsigned int)ELF64_R_SYM(rel[j].r_info));
            }
		}
		if (woody->Shdr[i].sh_type == SHT_RELA)
		{
			// printf("SHT_RELA = %ld  %ld\n", sizeof(Elf64_Rela), woody->Shdr[i].sh_entsize);
			int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize;
            for (int j = 0; j < num_entries; j++) {
					Elf64_Rela *rela  = (Elf64_Rela *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset + (j * woody->Shdr[i].sh_entsize), sizeof(Elf64_Rela));
					rela->r_offset += offset_ammount;
					// printf("  Offset: 0x%lx, Info: 0x%lx, Type: %u, Symbol: %u, Addend: %ld\n",
					// 	(unsigned long)rela[j].r_offset, (unsigned long)rela[j].r_info,
					// 	(unsigned int)ELF64_R_TYPE(rela[j].r_info), (unsigned int)ELF64_R_SYM(rela[j].r_info),
					// 	(long)rela[j].r_addend);
					if (rela->r_addend >= from)
					{
						rela->r_addend += offset_ammount;
					}

            }
		}
	}
		
}

void	create_codecave(t_elf_content *woody, t_payload *payload, size_t enlarge_position)
{
	const unsigned int page_size = 4096; // getpagesize(); not authorized
	unsigned int padding_size = ((payload->len / page_size) + 1) * page_size;
	printf("padding size = %d\n", padding_size);
	offset_sections(woody, enlarge_position, padding_size);
	char *new_woody = malloc(woody->file_size + padding_size);
	ft_bzero(new_woody, woody->file_size + padding_size);
	if (!new_woody)
		return ;
	ft_memcpy(new_woody, woody->file, enlarge_position);
	ft_memcpy(new_woody + enlarge_position + padding_size,  woody->file + enlarge_position, woody->file_size - enlarge_position);
	munmap(woody->file, woody->file_size);
	woody->file = new_woody;
	woody->file_size += padding_size;
	woody->Ehdr = (Elf64_Ehdr *)new_woody;
	woody->Ehdr->e_shoff += padding_size;
	woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
	woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
}

t_payload *get_payload()
{
	t_payload *payload = malloc(sizeof(t_payload));
	if (!payload)
		return NULL;
	char buffer[1024];
	int fd = open("payload", O_RDONLY);
	if (fd == -1) {
		perror("error opening payload");
		free(payload);
		exit(1);
	}
	payload->len = read(fd, buffer, 1024);
	payload->payload = malloc(sizeof(char) * payload->len);
	ft_memcpy(payload->payload, buffer, payload->len);
	return payload;
}

int	insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, int load_segment_index)
{
	char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
	char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
	char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
	char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
	if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size)
	{
		int32_t woody_index = ptr_woody - payload->payload;
		int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
		int32_t jump_value = ((payload_position + jmp_index + 5) - woody->Ehdr->e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
		ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));

		int64_t text_index = ptr_text_section - payload->payload;
		int64_t text_value = payload_position - woody->Phdr[load_segment_index].p_offset + woody_index;
		ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));

		int64_t section_index = ptr_section_size - payload->payload;
		int64_t section_value = woody->Phdr[load_segment_index].p_memsz; //woody->text_section->sh_size;
		ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));

		ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
		
		printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
		printf("Code cave start = %ld (%lx)\n", payload_position, payload_position);
		printf("Payload size = %ld (%lx)\n", payload->len, payload->len);
		printf("Backward offset = %d (%x)(%x)\n", jump_value, jump_value, -jump_value);
		return EXIT_SUCCESS;
	}
	return EXIT_FAILURE;
}

void	inject(t_elf_content *woody)
{
	t_payload *payload = get_payload();
	int i = get_load_segment(woody, 0, true);
	int j = get_load_segment(woody, i + 1, false);

	size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
	size_t payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz;

	// printf("Load segment p_offset = %lx\n", woody->Phdr[i].p_offset);
	// printf("Load segment p_filesz = %lx\n", woody->Phdr[i].p_filesz);
	// printf("Load segment p_memsz = %lx\n", woody->Phdr[i].p_memsz);
	
	// printf("Load segment p_offset = %lx\n", woody->Phdr[i + 1].p_offset);
	// printf("Load segment p_filesz = %lx\n", woody->Phdr[i + 1].p_filesz);
	// printf("Load segment p_memsz = %lx\n", woody->Phdr[i + 1].p_memsz);

	// printf("text section sh_offset = %lx\n", woody->text_section->sh_offset);
	// printf("text section sh_size = %lx\n", woody->text_section->sh_size);
	// printf("text section sh_addr = %lx\n", woody->text_section->sh_addr);

	if (code_cave_size < payload->len) // inverse here to test the other technique
	{
		printf("create code_Cave %ld\n", code_cave_size);
		create_codecave(woody, payload, woody->Phdr[j].p_offset);
	}

	woody->Phdr[i].p_filesz += payload->len;
	woody->Phdr[i].p_memsz += payload->len;
	printf("%ld\n", woody->Phdr[i].p_align);
	(void)payload_position;
	insert_payload(woody, payload, payload_position, i);
	//woody->Ehdr->e_entry = payload_position;
	printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
	printf("Load segment p_filesz = %lx\n", woody->Phdr[i].p_filesz);
	printf("Load segment p_memsz = %lx\n", woody->Phdr[i].p_memsz);
	woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
}

int get_elf_sections(t_elf_content *woody)
{
	woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
	if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != ELFCLASS64)
	{
		printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
		return EXIT_FAILURE;
	}
	woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));

	woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
	if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
		return EXIT_FAILURE;

    for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
		if (woody->Shdr[i].sh_type == SHT_SYMTAB) {
            woody->symbols_table = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
        }
		if (woody->Shdr[i].sh_type == SHT_PROGBITS && (woody->Shdr[i].sh_flags & SHF_EXECINSTR) && (woody->Shdr[i].sh_flags & SHF_ALLOC)) {
			woody->text_section = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
		}
    }
	if (woody->symbols_table == NULL || woody->text_section == NULL)
		return EXIT_FAILURE; //Not sure about this
	woody->symbols = (Elf64_Sym *)fetch(woody->file, woody->file_size, woody->symbols_table->sh_offset, sizeof(Elf64_Sym));
	if (woody->symbols == NULL)
		return EXIT_FAILURE;//Not sure about this
    woody->num_symbols = get_symbols_count(woody->symbols_table->sh_size, woody->symbols_table->sh_entsize);
	if (!fetch(woody->file, woody->file_size, woody->symbols_table->sh_offset + (sizeof(Elf64_Sym) * (woody->num_symbols)), 0))
		return EXIT_FAILURE;

	return EXIT_SUCCESS;
}

int prepare_injection(t_elf_content *woody)
{
	int elf_statut = get_elf_sections(woody);
	if (elf_statut)
		return elf_statut;
	inject(woody);
	char *woody_file;
	if (!(woody_file = malloc(woody->file_size)))
		return ft_put_error("Allocation error");
	ft_memcpy(woody_file, woody->file, woody->file_size);
	munmap(woody_file, woody->file_size);
	save_elf("woody", woody_file, woody->file_size);
	free(woody_file);
	return EXIT_SUCCESS;
}