gbrochar
/
woody-woodpacker
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

encrypt text section

This commit is contained in:
pbonilla 2024-04-11 12:20:44 +02:00
parent 2a20011050
commit fba60ca76e
9 changed files with 63 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.gitignore vendored
View File

@ -1,4 +1,7 @@
*.o
*.a
woody_woodpacker
woody
woody
asm
payload
print

8
.vscode/settings.json vendored
View File

@ -1,8 +0,0 @@
{
"files.associations": {
"stdio.h": "c",
"mman.h": "c",
"stdint.h": "c",
"compare": "c"
}
}

5
includes/woody.h
View File

@ -15,6 +15,8 @@
#include <stdint.h>
#define JUMP "\xe9"
// #define TEXT_OFFSET "\xba\xba\xba\xba\xba\xba\xba\xba"
// #define SECTION_SIZE "\xca\xca\xca\xca\xca\xca\xca\xca"
typedef struct payload
{
@ -30,12 +32,15 @@ typedef struct elf_content
Elf64_Ehdr *Ehdr;
Elf64_Phdr *Phdr;
Elf64_Shdr *Shdr;
Elf64_Shdr *text_section;
char *extra_data;
} t_elf_content;
// utils.c
void *fetch(char *file, unsigned long file_size, unsigned long offset_to_data, unsigned long supposed_data_size);
int ft_put_error(char *str);
char *get_string(char *str, char *end_file);
int get_symbols_count(int sh_size, int sh_entsize);
// woody.c
int prepare_injection(t_elf_content *woody);

5
print.s
View File

@ -7,11 +7,6 @@ _start:
push rsi
push rdx
mov rdi, 1
mov rdi, 1
mov rdi, 1
mov rdi, 1
mov rdi, 1
mov rdi, 1
lea rsi, [rel msg]
mov rdx, 10

BIN
srcs/.woody.c.swp
View File

Binary file not shown.

2
srcs/encrypt.c
View File

@ -5,7 +5,7 @@ void encrypt(char *file, unsigned long int offset, unsigned long int size)
size_t i = 0;
while (i < size)
{
file[offset + i] = 0;
file[offset + i] = file[offset + i] + 1;
++i;
}
}

2
srcs/main.c
View File

@ -20,7 +20,7 @@ int get_elf_file(t_elf_content *woody)
}
woody->file_size = off;
woody->file = mmap(NULL, woody->file_size, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE, fd, 0);
if (woody->file == MAP_FAILED)
if (woody->file == MAP_FAILED)
{
close(fd);
ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path);

20
srcs/utils.c
View File

@ -7,6 +7,26 @@ void *fetch(char *file, unsigned long file_size, unsigned long offset_to_data, u
return NULL;
}
int get_symbols_count(int sh_size, int sh_entsize)
{
if (sh_size <= 0 || sh_entsize <= 0)
return 0;
return (sh_size / sh_entsize);
}
char *get_string(char *str, char *end_file)
{
char *search_end = str;
while (search_end < end_file)
{
if (*search_end == 0)
return str;
++search_end;
}
return NULL;
}
int ft_put_error(char *str)
{
ft_putstr_fd("Error: ", STDERR_FILENO);

72
srcs/woody.c
View File

@ -6,7 +6,7 @@ int elf_magic_numbers(char *str)
return (!ft_strncmp(str, ELFMAG, SELFMAG));
}
int save_elf(char *path, char *file, unsigned long int size)
int save_elf(char *path, char *file, unsigned long int size)
{
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
if (fd == -1) {
@ -113,7 +113,6 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi
printf("Code cave start = %ld (%lx)\n", payload_position, payload_position);
printf("Payload size = %ld (%lx)\n", payload->len, payload->len);
printf("Backwar d offset = %d (%x)\n", jump_value, jump_value);
return EXIT_SUCCESS;
}
return EXIT_FAILURE;
@ -122,7 +121,6 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi
void inject(t_elf_content *woody)
{
t_payload *payload = get_payload();
int i = get_load_segment(woody, 0, true);
int j = get_load_segment(woody, i + 1, false);
@ -149,6 +147,14 @@ void inject(t_elf_content *woody)
printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
}
int is_special_section_indice(uint16_t section_index) {
return (section_index == SHN_LOPROC || section_index == SHN_BEFORE ||
section_index == SHN_AFTER || section_index == SHN_HIPROC ||
section_index == SHN_LOOS || section_index == SHN_HIOS ||
section_index == SHN_ABS || section_index == SHN_COMMON ||
section_index == SHN_XINDEX || section_index == SHN_HIRESERVE);
}
int get_elf_sections(t_elf_content *woody)
{
woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
@ -160,40 +166,30 @@ int get_elf_sections(t_elf_content *woody)
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
if (woody->Shdr == NULL || !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
if (!fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
{
return ft_put_error("Corrupted file");
return EXIT_FAILURE;
}
char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, woody->Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
if (Sshstrtab == NULL)
{
return EXIT_FAILURE;
}
for (int j = 0; j < woody->Ehdr->e_shnum;j++)
{
if (woody->Shdr[j].sh_name > woody->Shdr[woody->Ehdr->e_shstrndx].sh_size) return EXIT_FAILURE;
if (woody->Shdr[j].sh_type == SHT_PROGBITS && woody->Shdr[j].sh_flags & SHF_EXECINSTR &&
woody->Shdr[j].sh_flags & SHF_ALLOC &&
Sshstrtab + woody->Shdr[j].sh_name < (char *)woody->file + woody->file_size &&
!ft_strncmp(".text\0", Sshstrtab + woody->Shdr[j].sh_name, 6))
{
woody->text_section = &woody->Shdr[j];
break;
}
}
// Elf64_Shdr *symbols_table = NULL;
// for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
// if (Shdr[i].sh_type == SHT_SYMTAB) {
// symbols_table = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
// }
// }
// if (symbols_table == NULL)
// return ft_put_error("No symbols");
// if (!fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
// return ft_put_error("Corrupted file");
// char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
// if (Sshstrtab == NULL)
// return ft_put_error("Corrupted file");
// Elf64_Shdr *strtab_header = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr));
// if (!strtab_header)
// return ft_put_error("Corrupted file");
// char *strtab = fetch(woody->file, woody->file_size, strtab_header->sh_offset, 0);
// if (strtab == NULL)
// return ft_put_error("Corrupted file");
// Elf64_Sym *symbols = (Elf64_Sym *)fetch(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym));
// if (symbols == NULL)
// return ft_put_error("Corrupted file");
return EXIT_SUCCESS;
}
@ -202,16 +198,12 @@ int prepare_injection(t_elf_content *woody)
int elf_statut = get_elf_sections(woody);
if (elf_statut)
return elf_statut;
inject(woody);
// encrypt(woody->file, woody->text_section->sh_offset, woody->text_section->sh_size);
char *woody_file;
if (!(woody_file = malloc(woody->file_size)))
return ft_put_error("Allocation error");
ft_memcpy(woody_file, woody->file, woody->file_size);
// encrypt(woody_file, strtab_header->sh_offset , strtab_header->sh_size);
munmap(woody_file, woody->file_size);
save_elf("woody", woody_file, woody->file_size);
free(woody_file);