gbrochar
/
woody-woodpacker
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

Reset to help behaviour without text section

This commit is contained in:
pbonilla 2024-07-24 16:59:27 +02:00
parent 8756c0a8fa
commit fb51b9d0d2
5 changed files with 48 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
print.s
View File

@ -11,7 +11,7 @@ _start:
lea rsi, [rel msg] lea rsi, [rel msg]
mov rax, rsi mov rax, rsi
sub rax, qword [rel text_section] ;text_section address sub rax, qword [rel text_section] ;text_section address
mov r8, qword [rel section_sisze] ;text_section size mov r8, qword [rel section_size] ;text_section size
mov r9, 0 ;increment register mov r9, 0 ;increment register
xor r10, r10 xor r10, r10
encrypt: encrypt:
@ -34,4 +34,4 @@ _start:
jmp 0xdadadada jmp 0xdadadada
msg db "....WOODY....",10 msg db "....WOODY....",10
text_section dq 0xbabababababababa text_section dq 0xbabababababababa
section_sisze dq 0xcacacacacacacaca section_size dq 0xcacacacacacacaca

2
srcs/main.c
View File

@ -110,12 +110,10 @@ int main(int ac, char **av)
int inject_error = -1; int inject_error = -1;
if (elfclass == ELFCLASS32) if (elfclass == ELFCLASS32)
{ {
encrypt(woody.file, woody.elf32->text_section->sh_offset, woody.elf32->text_section->sh_size);
inject_error = inject32(&woody); inject_error = inject32(&woody);
} }
else if (elfclass == ELFCLASS64) else if (elfclass == ELFCLASS64)
{ {
encrypt(woody.file, woody.elf64->text_section->sh_offset, woody.elf64->text_section->sh_size);
inject_error = inject64(&woody); inject_error = inject64(&woody);
} }
if (inject_error) if (inject_error)

5
srcs/payload.c
View File

@ -46,6 +46,11 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi
int32_t jump_value = ((payload_position + jmp_index + 5) - e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand) int32_t jump_value = ((payload_position + jmp_index + 5) - e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value)); ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));
printf("jump_value = %d (%x)\n", jump_value, jump_value);
printf("jmp_index = %d (%x)\n", jmp_index, jmp_index);
printf("payload_position = %ld (%lx)\n", payload_position, payload_position);
printf("e_entry = %d (%x)\n", e_entry, e_entry);
int64_t text_index = ptr_text_section - payload->payload; int64_t text_index = ptr_text_section - payload->payload;
int64_t text_value = payload_position - p_offset + woody_index; int64_t text_value = payload_position - p_offset + woody_index;
ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value)); ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));

48
srcs/woody32.c
View File

@ -35,7 +35,6 @@ int inject32(t_elf_content *woody)
free(payload); free(payload);
return ft_put_error("PT_LOAD segment missing"); return ft_put_error("PT_LOAD segment missing");
} }
size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz); size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz);
size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz; size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz;
@ -46,17 +45,23 @@ int inject32(t_elf_content *woody)
return ft_put_error("Unable to insert payload, not enough space for code cave"); return ft_put_error("Unable to insert payload, not enough space for code cave");
} }
elf->Phdr[i].p_filesz += payload->len; encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz);
elf->Phdr[i].p_memsz += payload->len;
elf->Ehdr->e_entry = payload_position;
if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz)) if (insert_payload(woody, payload, payload_position, elf->text_section->sh_offset, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz))
{ {
free(payload->payload); free(payload->payload);
free(payload); free(payload);
return ft_put_error("Unable to insert payload, please regenerate it"); return ft_put_error("Unable to insert payload, please regenerate it");
} }
printf("code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size);
printf("payload_position = %ld (%lx)\n", payload_position, payload_position);
printf("elf->Phdr[i].p_offset = %d (%x)\n", elf->Phdr[i].p_offset, elf->Phdr[i].p_offset);
printf("elf->Phdr[i].p_filesz = %d (%x)\n", elf->Phdr[i].p_filesz, elf->Phdr[i].p_filesz);
printf("elf->Phdr[j].p_offset = %d (%x)\n", elf->Phdr[j].p_offset, elf->Phdr[j].p_offset);
elf->Phdr[i].p_filesz += payload->len;
elf->Phdr[i].p_memsz += payload->len;
elf->Phdr[i].p_flags = PF_X | PF_W | PF_R; elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
free(payload->payload); free(payload->payload);
free(payload); free(payload);
@ -65,16 +70,37 @@ int inject32(t_elf_content *woody)
int get_elf_sections32(t_elf_content *woody) int get_elf_sections32(t_elf_content *woody)
{ {
woody->elf32->Ehdr = (Elf32_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf32_Ehdr)); t_elf32 *elf = woody->elf32;
if (!woody->elf32->Ehdr)
elf->Ehdr = (Elf32_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf32_Ehdr));
if (!elf->Ehdr)
return EXIT_FAILURE; return EXIT_FAILURE;
woody->elf32->Phdr = (Elf32_Phdr *)fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_phoff, sizeof(Elf32_Phdr)); elf->Phdr = (Elf32_Phdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_phoff, sizeof(Elf32_Phdr));
if (!woody->elf32->Phdr) if (!elf->Phdr)
return EXIT_FAILURE; return EXIT_FAILURE;
woody->elf32->Shdr = (Elf32_Shdr *)fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_shoff, sizeof(Elf32_Shdr)); elf->Shdr = (Elf32_Shdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, sizeof(Elf32_Shdr));
if (!woody->elf32->Shdr || !fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_shoff, woody->elf32->Ehdr->e_shnum * sizeof(Elf32_Shdr))) if (!elf->Shdr || !fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, elf->Ehdr->e_shnum * sizeof(Elf32_Shdr)))
return EXIT_FAILURE; return EXIT_FAILURE;
if (!fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff + (elf->Ehdr->e_shstrndx * sizeof(Elf32_Shdr)), sizeof(Elf32_Shdr)))
return EXIT_FAILURE;
char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, elf->Shdr[elf->Ehdr->e_shstrndx].sh_offset, 0);
if (Sshstrtab == NULL)
return EXIT_FAILURE;
for (int i = 0; i < elf->Ehdr->e_shnum;i++)
{
if (elf->Shdr[i].sh_type == SHT_PROGBITS && elf->Shdr[i].sh_flags & SHF_EXECINSTR && elf->Shdr[i].sh_flags & SHF_ALLOC && elf->Shdr[i].sh_flags & SHF_EXECINSTR)
{
if (Sshstrtab + elf->Shdr[i].sh_name < (char *)woody->file + woody->file_size && !ft_strncmp(".text\0", Sshstrtab + elf->Shdr[i].sh_name, 6))
{
elf->text_section = &elf->Shdr[i];
return EXIT_SUCCESS; return EXIT_SUCCESS;
} }
}
}
return EXIT_FAILURE;
}

3
srcs/woody64.c
View File

@ -45,7 +45,7 @@ int inject64(t_elf_content *woody)
free(payload); free(payload);
return ft_put_error("Unable to insert payload, not enough space for code cave"); return ft_put_error("Unable to insert payload, not enough space for code cave");
} }
encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz);
if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz)) if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz))
{ {
@ -58,7 +58,6 @@ int inject64(t_elf_content *woody)
elf->Phdr[i].p_filesz += payload->len; elf->Phdr[i].p_filesz += payload->len;
elf->Phdr[i].p_memsz += payload->len; elf->Phdr[i].p_memsz += payload->len;
elf->Phdr[i].p_flags = PF_X | PF_W | PF_R; elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
elf->text_section->sh_size += payload->len;
free(payload->payload); free(payload->payload);
free(payload); free(payload);
return EXIT_SUCCESS; return EXIT_SUCCESS;