diff --git a/print.s b/print.s index 0b5475f..01bce95 100644 --- a/print.s +++ b/print.s @@ -11,7 +11,7 @@ _start: lea rsi, [rel msg] mov rax, rsi sub rax, qword [rel text_section] ;text_section address - mov r8, qword [rel section_sisze] ;text_section size + mov r8, qword [rel section_size] ;text_section size mov r9, 0 ;increment register xor r10, r10 encrypt: @@ -33,5 +33,5 @@ _start: jmp 0xdadadada msg db "....WOODY....",10 - text_section dq 0xbabababababababa - section_sisze dq 0xcacacacacacacaca + text_section dq 0xbabababababababa + section_size dq 0xcacacacacacacaca diff --git a/srcs/main.c b/srcs/main.c index 542e77d..69c7219 100644 --- a/srcs/main.c +++ b/srcs/main.c @@ -110,12 +110,10 @@ int main(int ac, char **av) int inject_error = -1; if (elfclass == ELFCLASS32) { - encrypt(woody.file, woody.elf32->text_section->sh_offset, woody.elf32->text_section->sh_size); inject_error = inject32(&woody); } else if (elfclass == ELFCLASS64) { - encrypt(woody.file, woody.elf64->text_section->sh_offset, woody.elf64->text_section->sh_size); inject_error = inject64(&woody); } if (inject_error) diff --git a/srcs/payload.c b/srcs/payload.c index aca3fdf..fe7dea2 100644 --- a/srcs/payload.c +++ b/srcs/payload.c @@ -46,6 +46,11 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi int32_t jump_value = ((payload_position + jmp_index + 5) - e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand) ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value)); + printf("jump_value = %d (%x)\n", jump_value, jump_value); + printf("jmp_index = %d (%x)\n", jmp_index, jmp_index); + printf("payload_position = %ld (%lx)\n", payload_position, payload_position); + printf("e_entry = %d (%x)\n", e_entry, e_entry); + int64_t text_index = ptr_text_section - payload->payload; int64_t text_value = payload_position - p_offset + woody_index; ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value)); diff --git a/srcs/woody32.c b/srcs/woody32.c index 1d8d8ce..7d26238 100644 --- a/srcs/woody32.c +++ b/srcs/woody32.c @@ -35,7 +35,6 @@ int inject32(t_elf_content *woody) free(payload); return ft_put_error("PT_LOAD segment missing"); } - size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz); size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz; @@ -46,17 +45,23 @@ int inject32(t_elf_content *woody) return ft_put_error("Unable to insert payload, not enough space for code cave"); } - elf->Phdr[i].p_filesz += payload->len; - elf->Phdr[i].p_memsz += payload->len; - elf->Ehdr->e_entry = payload_position; + encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz); - if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz)) + if (insert_payload(woody, payload, payload_position, elf->text_section->sh_offset, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz)) { free(payload->payload); free(payload); return ft_put_error("Unable to insert payload, please regenerate it"); } + printf("code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size); + printf("payload_position = %ld (%lx)\n", payload_position, payload_position); + printf("elf->Phdr[i].p_offset = %d (%x)\n", elf->Phdr[i].p_offset, elf->Phdr[i].p_offset); + printf("elf->Phdr[i].p_filesz = %d (%x)\n", elf->Phdr[i].p_filesz, elf->Phdr[i].p_filesz); + printf("elf->Phdr[j].p_offset = %d (%x)\n", elf->Phdr[j].p_offset, elf->Phdr[j].p_offset); + + elf->Phdr[i].p_filesz += payload->len; + elf->Phdr[i].p_memsz += payload->len; elf->Phdr[i].p_flags = PF_X | PF_W | PF_R; free(payload->payload); free(payload); @@ -65,16 +70,37 @@ int inject32(t_elf_content *woody) int get_elf_sections32(t_elf_content *woody) { - woody->elf32->Ehdr = (Elf32_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf32_Ehdr)); - if (!woody->elf32->Ehdr) + t_elf32 *elf = woody->elf32; + + elf->Ehdr = (Elf32_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf32_Ehdr)); + if (!elf->Ehdr) return EXIT_FAILURE; - woody->elf32->Phdr = (Elf32_Phdr *)fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_phoff, sizeof(Elf32_Phdr)); - if (!woody->elf32->Phdr) + elf->Phdr = (Elf32_Phdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_phoff, sizeof(Elf32_Phdr)); + if (!elf->Phdr) return EXIT_FAILURE; - - woody->elf32->Shdr = (Elf32_Shdr *)fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_shoff, sizeof(Elf32_Shdr)); - if (!woody->elf32->Shdr || !fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_shoff, woody->elf32->Ehdr->e_shnum * sizeof(Elf32_Shdr))) + + elf->Shdr = (Elf32_Shdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, sizeof(Elf32_Shdr)); + if (!elf->Shdr || !fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, elf->Ehdr->e_shnum * sizeof(Elf32_Shdr))) return EXIT_FAILURE; - return EXIT_SUCCESS; + + if (!fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff + (elf->Ehdr->e_shstrndx * sizeof(Elf32_Shdr)), sizeof(Elf32_Shdr))) + return EXIT_FAILURE; + + char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, elf->Shdr[elf->Ehdr->e_shstrndx].sh_offset, 0); + if (Sshstrtab == NULL) + return EXIT_FAILURE; + + for (int i = 0; i < elf->Ehdr->e_shnum;i++) + { + if (elf->Shdr[i].sh_type == SHT_PROGBITS && elf->Shdr[i].sh_flags & SHF_EXECINSTR && elf->Shdr[i].sh_flags & SHF_ALLOC && elf->Shdr[i].sh_flags & SHF_EXECINSTR) + { + if (Sshstrtab + elf->Shdr[i].sh_name < (char *)woody->file + woody->file_size && !ft_strncmp(".text\0", Sshstrtab + elf->Shdr[i].sh_name, 6)) + { + elf->text_section = &elf->Shdr[i]; + return EXIT_SUCCESS; + } + } + } + return EXIT_FAILURE; } \ No newline at end of file diff --git a/srcs/woody64.c b/srcs/woody64.c index e26b79f..08b80cf 100644 --- a/srcs/woody64.c +++ b/srcs/woody64.c @@ -45,7 +45,7 @@ int inject64(t_elf_content *woody) free(payload); return ft_put_error("Unable to insert payload, not enough space for code cave"); } - + encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz); if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz)) { @@ -58,7 +58,6 @@ int inject64(t_elf_content *woody) elf->Phdr[i].p_filesz += payload->len; elf->Phdr[i].p_memsz += payload->len; elf->Phdr[i].p_flags = PF_X | PF_W | PF_R; - elf->text_section->sh_size += payload->len; free(payload->payload); free(payload); return EXIT_SUCCESS;