gbrochar
/
woody-woodpacker
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

Refactoring : code cave creation

This commit is contained in:
pbonilla 2024-05-23 13:37:43 +02:00
parent 2c14d6f0c5
commit b167573925
2 changed files with 14 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
includes/woody.h
View File

@ -36,7 +36,6 @@ typedef struct elf_content
Elf64_Ehdr *Ehdr; Elf64_Ehdr *Ehdr;
Elf64_Phdr *Phdr; Elf64_Phdr *Phdr;
Elf64_Shdr *Shdr; Elf64_Shdr *Shdr;
char *extra_data;
} t_elf_content; } t_elf_content;
// utils.c // utils.c

32
srcs/woody.c
View File

@ -49,7 +49,10 @@ void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offse
for (int i = 0; i < woody->Ehdr->e_phnum; i++) for (int i = 0; i < woody->Ehdr->e_phnum; i++)
{ {
if (woody->Phdr[i].p_offset > from) if (woody->Phdr[i].p_offset > from)
{
woody->Phdr[i].p_offset += offset_ammount; woody->Phdr[i].p_offset += offset_ammount;
woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
}
} }
for (int i = 0; i < woody->Ehdr->e_shnum; i++) for (int i = 0; i < woody->Ehdr->e_shnum; i++)
{ {
@ -58,25 +61,23 @@ void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offse
} }
} }
size_t create_codecave(t_elf_content *woody, Elf64_Phdr *load_segment, t_payload *payload) void create_codecave(t_elf_content *woody, t_payload *payload, size_t payload_position)
{ {
const unsigned int page_size = 4096; // getpagesize(); not authorized const unsigned int page_size = 4096; // getpagesize(); not authorized
unsigned int padding_size = ((payload->len / page_size) + 1) * page_size; unsigned int padding_size = ((payload->len / page_size) + 1) * page_size;
unsigned int codecave_start = load_segment->p_offset + load_segment->p_filesz; offset_sections(woody, payload_position, padding_size);
offset_sections(woody, codecave_start, padding_size);
char *new_woody = malloc(woody->file_size + padding_size); char *new_woody = malloc(woody->file_size + padding_size);
if (!new_woody) if (!new_woody)
return 0; return ;
ft_memcpy(new_woody, woody->file, codecave_start); ft_memcpy(new_woody, woody->file, payload_position);
ft_bzero(new_woody + codecave_start, padding_size); ft_bzero(new_woody + payload_position, padding_size);
ft_memcpy(new_woody + codecave_start + padding_size, woody->file + codecave_start, woody->file_size - codecave_start); ft_memcpy(new_woody + payload_position + padding_size, woody->file + payload_position, woody->file_size - payload_position);
munmap(woody->file, woody->file_size); munmap(woody->file, woody->file_size);
woody->file = new_woody; woody->file = new_woody;
woody->file_size += padding_size; woody->file_size += padding_size;
woody->Ehdr = (Elf64_Ehdr *)new_woody; woody->Ehdr = (Elf64_Ehdr *)new_woody;
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr)); woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr)); woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
return codecave_start;
} }
t_payload *get_payload() t_payload *get_payload()
@ -136,18 +137,13 @@ void inject(t_elf_content *woody)
int j = get_load_segment(woody, i + 1, false); int j = get_load_segment(woody, i + 1, false);
size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz); size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
size_t payload_position; size_t payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz;
printf("load position = : %ld (%lx)\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_offset);
printf("load size = : %ld (%lx)\n", woody->Phdr[i].p_filesz, woody->Phdr[i].p_filesz); if (code_cave_size < payload->len) // inverse here to test the other technique
if (code_cave_size > payload->len) // inverse here to test the other technique
{ {
payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_memsz; create_codecave(woody, payload, payload_position);
printf("Code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size);
}
else
{
payload_position = create_codecave(woody, &woody->Phdr[i], payload);
} }
encrypt(woody->file, woody->Phdr[i].p_offset, woody->Phdr[i].p_memsz); encrypt(woody->file, woody->Phdr[i].p_offset, woody->Phdr[i].p_memsz);
insert_payload(woody, payload, payload_position, i); insert_payload(woody, payload, payload_position, i);