From 3dfc4c27d2c56f0635847e059b3c846d88d56231 Mon Sep 17 00:00:00 2001 From: pbonilla Date: Tue, 18 Jun 2024 18:11:20 +0200 Subject: [PATCH] refactoring and removing code cave creation --- includes/woody.h | 6 +- srcs/main.c | 57 ++++++++++-- srcs/woody.c | 230 +++++++++-------------------------------------- 3 files changed, 98 insertions(+), 195 deletions(-) diff --git a/includes/woody.h b/includes/woody.h index 6c516f8..b7b02f4 100644 --- a/includes/woody.h +++ b/includes/woody.h @@ -25,7 +25,7 @@ typedef struct payload { char *payload; - size_t len; + int len; } t_payload; typedef struct elf_content @@ -51,7 +51,9 @@ int get_symbols_count(int sh_size, int sh_entsize); char *get_section_name(t_elf_content *woody, int section_index); // woody.c -int prepare_injection(t_elf_content *woody); +int inject(t_elf_content *woody); +int get_elf_sections(t_elf_content *woody); + // encrypt.c void encrypt(char *file, unsigned long int offset, unsigned long int size); diff --git a/srcs/main.c b/srcs/main.c index 173f3e1..87ac802 100644 --- a/srcs/main.c +++ b/srcs/main.c @@ -8,14 +8,14 @@ int get_elf_file(t_elf_content *woody) fd = open(woody->file_path, O_RDONLY); if (fd < 0) { - printf("Error: Failed to open \'%s\'\n", woody->file_path); + ft_printf("Error: Failed to open \'%s\'\n", woody->file_path); return EXIT_FAILURE; } off = lseek(fd, 0, SEEK_END); if (off == -1) { close(fd); - printf("Error: Failed to read file offset \'%s\'\n", woody->file_path); + ft_printf("Error: Failed to read file offset \'%s\'\n", woody->file_path); return EXIT_FAILURE; } woody->file_size = off; @@ -23,13 +23,47 @@ int get_elf_file(t_elf_content *woody) if (woody->file == MAP_FAILED) { close(fd); - printf("Error: Failed to map file \'%s\'\n", woody->file_path); + ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path); return EXIT_FAILURE; } close(fd); return EXIT_SUCCESS; } +int save_file(char *path, char *file, unsigned long int size) +{ + int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755); + if (fd == -1) { + printf("Error: Failed to create new file \'%s\'\n", path); + return EXIT_FAILURE; + } + + if (write(fd, file, size) == -1) { + close(fd); + printf("Error: Failed to write new file \'%s\'\n", path); + return EXIT_FAILURE; + } + close(fd); + return EXIT_SUCCESS; +} + +int save_woody(t_elf_content *woody) +{ + char *woody_file = malloc(woody->file_size); + if (!woody_file) + return ft_put_error("Allocation error"); + ft_memcpy(woody_file, woody->file, woody->file_size); + + if (munmap(woody->file, woody->file_size)) + return ft_put_error("Umapping error"); + + int save_error = save_file("woody", woody_file, woody->file_size); + if (save_error) + return save_error; + free(woody_file); + return EXIT_SUCCESS; +} + int main(int ac, char **av) { t_elf_content woody; @@ -38,9 +72,18 @@ int main(int ac, char **av) return ft_put_error("Woody_woodpacker take 1 argument\n"); } woody.file_path = av[1]; - int ret = get_elf_file(&woody); - if (ret == EXIT_FAILURE) - return ret; - return prepare_injection(&woody); + int elf_error = get_elf_file(&woody); + if (elf_error) + return elf_error; + elf_error = get_elf_sections(&woody); + if (elf_error) + return elf_error; + + int inject_error = inject(&woody); + if (!inject_error) + { + return save_woody(&woody); + } + return EXIT_SUCCESS; } diff --git a/srcs/woody.c b/srcs/woody.c index 00cafba..c9d8fbe 100644 --- a/srcs/woody.c +++ b/srcs/woody.c @@ -5,27 +5,6 @@ int elf_magic_numbers(char *str) return (!ft_strncmp(str, ELFMAG, SELFMAG)); } -int save_elf(char *path, char *file, unsigned long int size) -{ - int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755); - if (fd == -1) { - printf("Error: Failed to create new file \'%s\'\n", path); - return EXIT_FAILURE; - } - - if (write(fd, file, size) == -1) { - close(fd); - printf("Error: Failed to write new file \'%s\'\n", path); - return EXIT_FAILURE; - } - - if (close(fd) == -1) { - printf("Error: Failed to close new file \'%s\'\n", path); - return EXIT_FAILURE; - } - return EXIT_SUCCESS; -} - int get_load_segment(t_elf_content *woody, int start, bool executable) { for (int i = start; i < woody->Ehdr->e_phnum; i++) @@ -44,114 +23,6 @@ int get_load_segment(t_elf_content *woody, int start, bool executable) return -1; } -void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offset_ammount) -{ - for (int i = 0; i < woody->Ehdr->e_shnum; i++) - { - if (woody->Shdr[i].sh_type == SHT_REL) - { - int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize; - Elf64_Rel *rel = (Elf64_Rel *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset, woody->Shdr[i].sh_size); - for (int j = 0; j < num_entries; j++) - { - rel[j].r_offset += offset_ammount; - printf(" Offset: 0x%lx, Info: 0x%lx, Type: %u, Symbol: %u\n", - (unsigned long)rel[j].r_offset, (unsigned long)rel[j].r_info, - (unsigned int)ELF64_R_TYPE(rel[j].r_info), (unsigned int)ELF64_R_SYM(rel[j].r_info)); - } - } - else if (woody->Shdr[i].sh_type == SHT_RELA) - { - int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize; - Elf64_Rela *rela = (Elf64_Rela *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset , woody->Shdr[i].sh_size); - for (int j = 0; j < num_entries; j++) - { - rela[j].r_offset += offset_ammount; - if (rela[j].r_addend >= from) - rela[j].r_addend += offset_ammount; - - // printf(" Offset: 0x%lx, Info: 0x%lx, Type: %u, Symbol: %u adden: 0x%lx\n", - // (unsigned long)rela[j].r_offset, (unsigned long)rela[j].r_info, - // (unsigned int)ELF64_R_TYPE(rela[j].r_info), (unsigned int)ELF64_R_SYM(rela[j].r_info), (unsigned long)rela[j].r_addend); - - - } - } else if (woody->Shdr[i].sh_type == SHT_DYNAMIC) - { - int num_dyn_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize; - Elf64_Dyn *dyn_entries = (Elf64_Dyn *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset , woody->Shdr[i].sh_size); - for (int j = 0; j < num_dyn_entries; j++) - { - // printf("dyn_entries[%d].d_tag = %lx ptr = %lx value = %lx\n",j, dyn_entries[j].d_tag, dyn_entries[j].d_un.d_ptr, dyn_entries[j].d_un.d_val); - if (dyn_entries[j].d_tag == DT_PLTGOT || dyn_entries[j].d_tag == DT_FINI || dyn_entries[j].d_tag == DT_INIT_ARRAY || dyn_entries[j].d_tag == DT_FINI_ARRAY) - { - dyn_entries[j].d_un.d_ptr += offset_ammount; - } - } - } - char *section_name = get_section_name(woody, i); - if (section_name && !ft_strcmp(".got", section_name)) - { - int num_entries = woody->Shdr[i].sh_size / woody->Shdr[i].sh_entsize; - Elf64_Addr *got_entri = (Elf64_Addr *)fetch(woody->file, woody->file_size, woody->Shdr[i].sh_offset, woody->Shdr[i].sh_size); - for (int j = 0; j < num_entries; j++) - { - if (got_entri[j]) - { - got_entri[j] += offset_ammount; - } - } - } - } - for (int i = 0; i < woody->Ehdr->e_phnum; i++) - { - if (woody->Phdr[i].p_offset >= from) - { - woody->Phdr[i].p_offset += offset_ammount; - woody->Phdr[i].p_vaddr += offset_ammount; - woody->Phdr[i].p_paddr += offset_ammount; - } - } - for (int i = 0; i < woody->Ehdr->e_shnum; i++) - { - if (woody->Shdr[i].sh_offset >= from) - { - woody->Shdr[i].sh_offset += offset_ammount; - woody->Shdr[i].sh_addr += offset_ammount; - } - } - for (int i = 1; i < woody->num_symbols; i++) - { - if (woody->symbols[i].st_value >= from) - { - woody->symbols[i].st_value += offset_ammount; - } - } - - -} - -void create_codecave(t_elf_content *woody, t_payload *payload, size_t enlarge_position) -{ - const unsigned int page_size = 4096; // getpagesize(); not authorized - unsigned int padding_size = ((payload->len / page_size) + 1) * page_size; - printf("padding size = %d\n", padding_size); - offset_sections(woody, enlarge_position, padding_size); - char *new_woody = malloc(woody->file_size + padding_size); - ft_bzero(new_woody, woody->file_size + padding_size); - if (!new_woody) - return ; - ft_memcpy(new_woody, woody->file, enlarge_position); - ft_memcpy(new_woody + enlarge_position + padding_size, woody->file + enlarge_position, woody->file_size - enlarge_position); - munmap(woody->file, woody->file_size); - woody->file = new_woody; - woody->file_size += padding_size; - woody->Ehdr = (Elf64_Ehdr *)new_woody; - woody->Ehdr->e_shoff += padding_size; - woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr)); - woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr)); -} - t_payload *get_payload() { t_payload *payload = malloc(sizeof(t_payload)); @@ -160,12 +31,27 @@ t_payload *get_payload() char buffer[1024]; int fd = open("payload", O_RDONLY); if (fd == -1) { - perror("error opening payload"); + ft_put_error("Failed to open payload"); free(payload); - exit(1); + close(fd); + return NULL; } payload->len = read(fd, buffer, 1024); + if (payload->len == -1) + { + ft_put_error("Failed to read payload"); + free(payload); + close(fd); + return NULL; + } + close(fd); payload->payload = malloc(sizeof(char) * payload->len); + if (!payload->payload) + { + ft_put_error("Allocation error"); + free(payload); + return NULL; + } ft_memcpy(payload->payload, buffer, payload->len); return payload; } @@ -188,45 +74,56 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value)); int64_t section_index = ptr_section_size - payload->payload; - int64_t section_value = woody->Phdr[load_segment_index].p_memsz; //woody->text_section->sh_size; + int64_t section_value = woody->Phdr[load_segment_index].p_memsz; ft_memcpy(&payload->payload[section_index], §ion_value, sizeof(section_value)); ft_memcpy(woody->file + payload_position, payload->payload, payload->len); - - printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry); - printf("Code cave start = %ld (%lx)\n", payload_position, payload_position); - printf("Payload size = %ld (%lx)\n", payload->len, payload->len); - printf("Backward offset = %d (%x)(%x)\n", jump_value, jump_value, -jump_value); return EXIT_SUCCESS; } return EXIT_FAILURE; } -void inject(t_elf_content *woody) +int inject(t_elf_content *woody) { t_payload *payload = get_payload(); + if (!payload) + return EXIT_FAILURE; + int i = get_load_segment(woody, 0, true); int j = get_load_segment(woody, i + 1, false); + if (i == -1 || j != i + 1) + { + free(payload->payload); + free(payload); + return ft_put_error("PT_LOAD segment missing"); + } + size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz); size_t payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz; - if (code_cave_size < payload->len) // inverse here to test the other technique + if (code_cave_size < (size_t)payload->len) { - printf("create code_Cave %ld\n", code_cave_size); - create_codecave(woody, payload, woody->Phdr[j].p_offset); + free(payload->payload); + free(payload); + return ft_put_error("Unable to insert payload, not enough space for code cave"); } woody->Phdr[i].p_filesz += payload->len; woody->Phdr[i].p_memsz += payload->len; - printf("%ld\n", woody->Phdr[i].p_align); - (void)payload_position; - insert_payload(woody, payload, payload_position, i); + + if (insert_payload(woody, payload, payload_position, i)) + { + free(payload->payload); + free(payload); + return ft_put_error("Unable to insert payload, please regenerate it"); + } + woody->Ehdr->e_entry = payload_position; - printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry); - printf("Load segment p_filesz = %lx\n", woody->Phdr[i].p_filesz); - printf("Load segment p_memsz = %lx\n", woody->Phdr[i].p_memsz); woody->Phdr[i].p_flags = PF_X | PF_W | PF_R; + free(payload->payload); + free(payload); + return EXIT_SUCCESS; } int get_elf_sections(t_elf_content *woody) @@ -242,44 +139,5 @@ int get_elf_sections(t_elf_content *woody) woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr)); if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr))) return EXIT_FAILURE; - - for (int i = 0; i < woody->Ehdr->e_shnum; i++) { - if (woody->Shdr[i].sh_type == SHT_SYMTAB) { - woody->symbols_table = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)); - } - if (woody->Shdr[i].sh_type == SHT_PROGBITS && (woody->Shdr[i].sh_flags & SHF_EXECINSTR) && (woody->Shdr[i].sh_flags & SHF_ALLOC)) { - woody->text_section = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)); - } - - } - if (woody->symbols_table == NULL || woody->text_section == NULL) - return EXIT_FAILURE; //Not sure about this - woody->symbols = (Elf64_Sym *)fetch(woody->file, woody->file_size, woody->symbols_table->sh_offset, sizeof(Elf64_Sym)); - if (woody->symbols == NULL) - return EXIT_FAILURE;//Not sure about this - woody->Sshstrtab = (char *)fetch(woody->file, woody->file_size, woody->Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0); - if (woody->Sshstrtab == NULL) - return EXIT_FAILURE; //Not sure about this - woody->num_symbols = get_symbols_count(woody->symbols_table->sh_size, woody->symbols_table->sh_entsize); - if (!fetch(woody->file, woody->file_size, woody->symbols_table->sh_offset + (sizeof(Elf64_Sym) * (woody->num_symbols)), 0)) - return EXIT_FAILURE; - return EXIT_SUCCESS; } - -int prepare_injection(t_elf_content *woody) -{ - int elf_statut = get_elf_sections(woody); - if (elf_statut) - return elf_statut; - inject(woody); - char *woody_file; - if (!(woody_file = malloc(woody->file_size))) - return ft_put_error("Allocation error"); - ft_memcpy(woody_file, woody->file, woody->file_size); - munmap(woody_file, woody->file_size); - save_elf("woody", woody_file, woody->file_size); - free(woody_file); - return EXIT_SUCCESS; -} -