chaos

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+	"files.associations": {
+		"stdio.h": "c",
+		"mman.h": "c"
+	}
+}

Makefile

@@ -37,4 +37,4 @@ fclean:
 re:		fclean
 		make all
 
-.PHONY : all clean fclean re
+.PHONY : all clean fclean re

includes/woody.h

@@ -2,6 +2,7 @@
 # define WOODY_H
 
 #include "../ft_printf/includes/ft_printf.h"
+#include <stdbool.h> 
 #include <unistd.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -17,15 +18,17 @@ typedef struct efl_content
 	long unsigned int file_size;
 	char	*file_path;
 	char	*file;
+	Elf64_Ehdr	*Ehdr;
+	Elf64_Phdr	*Phdr;
 	char	*extra_data;
 }				t_efl_content;
 
 
 // utils.c
-void	*secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size);
+void	*secure_jump(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size);
 int		ft_put_error(char *str);
 
 // woody.c
-int woody(t_efl_content *file_content);
+int inject(t_efl_content *woody);
 
 #endif

print.s

@@ -0,0 +1,27 @@
+bits 64
+default rel
+global _start
+
+;     rdi   rsi    rdx
+;      v     v      v
+;write(fd,   msg,   len);
+
+_start:
+        xor     eax, eax
+        cdq
+        mov     dl, 10         ;3eme argument (rdx)
+        inc     eax            ;eax = 1 (syscall)
+        mov     edi, eax       ;1er argument rdi = 1
+        lea     rsi, [rel msg] ;2eme arg
+        syscall
+        mov     dl, 42         ;petit registre pour enregistrer 42 sans 0x00
+        xor     eax, eax
+        inc     eax
+        mul     dl             ;multiplier 42 * rax (rax = 1), resultat dans rax
+        mov     edi, eax       ;bouger la valeur 42 de rax à rdi
+        xor     eax, eax
+		syscall
+
+msg     db "..WOODY..",10
+
+

shellcode_test.c

@@ -0,0 +1,26 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+// Define the shellcode
+char code[] = "\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x12\x00\x00\x00\x0f\x05\xb2\x2a\x31\xc0\xff\xc0\xf6\xe2\x89\xc7\x31\xc0\xb0\x3c\x0f\x05\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a";
+
+// Declare a function pointer with no arguments and no return value
+typedef void (*ShellcodeFunc)();
+
+int main() {
+    // Create a function pointer of the appropriate type and point it to the shellcode
+    ShellcodeFunc func = (ShellcodeFunc)code;
+
+    // Make the memory containing the shellcode executable
+    // Using a reasonable default page size
+    size_t pagesize = 4096; // 4KB, a common page size
+    uintptr_t page_start = (uintptr_t)code & ~(pagesize - 1);
+    mprotect((void *)page_start, pagesize, PROT_READ | PROT_EXEC);
+
+    // Call the shellcode
+    func();
+
+    return 0;
+}

srcs/main.c

@@ -1,29 +1,29 @@
 #include "../includes/woody.h"
 
-int get_elf_file(t_efl_content *file_content)
+int get_elf_file(t_efl_content *woody)
 {
 	int fd;
 	off_t off;
 
-	fd = open(file_content->file_path, O_RDONLY);
+	fd = open(woody->file_path, O_RDONLY);
 	if (fd < 0)
 	{
-		ft_printf("Error: Failed to open \'%s\'\n", file_content->file_path);
+		ft_printf("Error: Failed to open \'%s\'\n", woody->file_path);
 		return EXIT_FAILURE;
 	}
 	off = lseek(fd, 0, SEEK_END);
     if (off == -1)
     {
 		close(fd);
-		ft_printf("Error: Failed to read file offset \'%s\'\n", file_content->file_path);
+		ft_printf("Error: Failed to read file offset \'%s\'\n", woody->file_path);
         return EXIT_FAILURE;
     }
-	file_content->file_size = off;
-	file_content->file = mmap(NULL, file_content->file_size, PROT_READ, MAP_PRIVATE, fd, 0);
-    if (file_content->file  == MAP_FAILED)
+	woody->file_size = off;
+	woody->file = mmap(NULL, woody->file_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
+    if (woody->file  == MAP_FAILED)
 	{
 		close(fd);
-		ft_printf("Error: Failed to map file \'%s\'\n", file_content->file_path);
+		ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path);
 		return EXIT_FAILURE;
     }
     close(fd);
@@ -32,15 +32,14 @@ int get_elf_file(t_efl_content *file_content)
 
 int main(int ac, char **av)
 {
-	t_efl_content file_content;
+	t_efl_content woody;
 	if (ac != 2)
 	{
 		return ft_put_error("Woody_woodpacker take 1 argument\n");
 	}
-	file_content.file_path = av[1];
-	int ret = get_elf_file(&file_content);
+	woody.file_path = av[1];
+	int ret = get_elf_file(&woody);
 	if (ret == EXIT_FAILURE)
 		return ret;
-	
-	return woody(&file_content);
+	return inject(&woody);
 }

srcs/utils.c

@@ -1,6 +1,6 @@
 #include "../includes/woody.h"
 
-void	*secure_access(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size)
+void	*secure_jump(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size)
 {
 	if (file_size > offset_to_data && file_size >= (offset_to_data + supposed_data_size))
 		return (file + offset_to_data);

srcs/woody.c

@@ -1,5 +1,7 @@
 #include "../includes/woody.h"
 
+#define CODE_MACRO "\x31\xc0\x99\xb2\x0a\xff\xc0\x89\xc7\x48\x8d\x35\x10\x00\x00\x00\x0f\x05\xb2\x2a\x31\xc0\xff\xc0\xf6\xe2\x89\xc7\x31\xc0\x0f\x05\x2e\x2e\x57\x4f\x4f\x44\x59\x2e\x2e\x0a"
+
 int elf_magic_numbers(char *str)
 {
 	return (!ft_strncmp(str, ELFMAG, SELFMAG));
@@ -36,49 +38,122 @@ int		save_elf(char *path, char *file, unsigned long int size)
 	return EXIT_SUCCESS;
 }
 
-int woody(t_efl_content *file_content)
+int	get_load_segment(t_efl_content *woody, int start, bool executable)
 {
-	Elf64_Ehdr *Ehdr = (Elf64_Ehdr *)secure_access(file_content->file, file_content->file_size, 0, sizeof(Elf64_Ehdr));
-
-	if (!Ehdr || !elf_magic_numbers(file_content->file) || Ehdr->e_ident[EI_CLASS] != 2)
+	for (int i = start; i < woody->Ehdr->e_phnum; i++)
 	{
-		ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", file_content->file_path);
+		if (woody->Phdr[i].p_type == PT_LOAD)
+		{
+			if (executable)
+			{
+				if (woody->Phdr[i].p_flags & PF_X)
+					return i;
+			}
+			else
+				return i;
+		}
+	}
+	return -1;
+}
+
+void	find_cave(t_efl_content *woody)
+{
+	woody->Phdr = (Elf64_Phdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
+
+	int i = get_load_segment(woody, 0, true);	
+	int j = get_load_segment(woody, i + 1, false);
+	
+	printf("%d %ld\n", i, woody->Phdr[i].p_align);
+	printf("%d %ld\n", j, woody->Phdr[j].p_align);
+	printf("code_cave_start = %lx, virtual adress = %lx\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_vaddr);
+	printf("code_cave_size = %lx\n", woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz));
+
+
+// static void inject(t_woody64 *woody, const t_patch *patch) {
+//   char payload[] = PAYLOAD;
+
+	Elf64_Off payload_off = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz;
+
+//   ft_memcpy((void *)woody->file + payload_off, payload, PAYLOAD_SIZE);
+//   ft_memcpy(
+//       (void *)woody->file + payload_off + (PAYLOAD_SIZE - sizeof(t_patch)),
+//       patch, sizeof(t_patch));
+
+//   woody->file->e_entry = woody->load_seg->p_vaddr + woody->load_seg->p_filesz;
+//   woody->load_seg->p_filesz += PAYLOAD_SIZE;
+//   woody->load_seg->p_memsz += PAYLOAD_SIZE;
+// }
+
+    size_t len = sizeof(CODE_MACRO) - 1;
+	ft_memcpy(woody->file + payload_off, CODE_MACRO, len);
+
+	woody->Ehdr->e_entry = woody->Phdr[i].p_vaddr +  woody->Phdr[i].p_filesz;
+	woody->Phdr[i].p_filesz += len;
+	woody->Phdr[i].p_memsz += len;
+}
+
+
+int inject(t_efl_content *woody)
+{
+	woody->Ehdr = (Elf64_Ehdr *)secure_access(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
+	if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != 2)
+	{
+		ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
 		return EXIT_FAILURE;
 	}
 
-	Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, sizeof(Elf64_Shdr));
-	if (Shdr == NULL || !secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff, Ehdr->e_shnum * sizeof(Elf64_Shdr)))
+	printf("entry point = %ld\n", woody->Ehdr->e_entry);
+	Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
+	if (Shdr == NULL || !secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
 	{
 		return ft_put_error("Corrupted file");
 	}
-	if (file_content->file_size > Ehdr->e_shoff + Ehdr->e_shnum * sizeof(Elf64_Shdr))
+	if (woody->file_size > woody->Ehdr->e_shoff + woody->Ehdr->e_shnum * sizeof(Elf64_Shdr))
 	{
-		printf("extra_data !\n"); // save it in file_content->extra_data and append it to the end of the woody file ? Could be dangerous
+		printf("extra_data !\n"); // save it in woody->extra_data and append it to the end of the woody file ? Could be dangerous
 	}
 
 	Elf64_Shdr *symbols_table = NULL;
-    for (int i = 0; i < Ehdr->e_shnum; i++) {
+    for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
 		if (Shdr[i].sh_type == SHT_SYMTAB) {
-            symbols_table = secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
+            symbols_table = secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
         }
     }
 	if (symbols_table == NULL)
+		return ft_put_error("No symbols");
+
+	if (!secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
 		return ft_put_error("Corrupted file");
 
-    Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_access(file_content->file, file_content->file_size, Ehdr->e_shoff + (symbols_table->sh_link * Ehdr->e_shentsize), sizeof(Elf64_Shdr)); 
+	char *Sshstrtab = (char *)secure_access(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
+	if (Sshstrtab == NULL)
+		return ft_put_error("Corrupted file");
+
+	for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
+		char *section_name = Sshstrtab + Shdr[i].sh_name;
+		printf("%s : Offset: %lx | Size: %lx | Virtual adress: %lx\n", section_name, Shdr[i].sh_offset, Shdr[i].sh_size, Shdr[i].sh_addr);
+	}	
+
+	// useless for now
+    Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_access(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr)); 
 	if (!strtab_header)
 		return ft_put_error("Corrupted file");
 
+    char *strtab = secure_access(woody->file, woody->file_size, strtab_header->sh_offset, 0);
+	if (strtab == NULL)
+		return ft_put_error("Corrupted file");
+    Elf64_Sym *symbols = (Elf64_Sym *)secure_access(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym));
+	if (symbols == NULL)
+		return ft_put_error("Corrupted file");
+	// end useless	woody->Ehdr->e_entry = 
 
-	if (strtab_header->sh_offset + strtab_header->sh_size > file_content->file_size)
-	{
-		return ft_put_error("Encrypt after the end of the file");
-	}
+	find_cave(woody);
 
-	char *woody = malloc(file_content->file_size);
-	ft_memcpy(woody, file_content->file, file_content->file_size);
+	char *woody_file = malloc(woody->file_size);
 
-	encrypt_zone(woody, strtab_header->sh_offset , strtab_header->sh_size);
+	ft_memcpy(woody_file, woody->file, woody->file_size);
+
+	encrypt_zone(woody_file, strtab_header->sh_offset , strtab_header->sh_size);
 	
-	return save_elf("woody", woody, file_content->file_size);
+	return save_elf("woody", woody_file, woody->file_size);
 }