Compare commits

...

33 Commits

Author SHA1 Message Date
gbrochar c9d07e22a9 feat(print.s): decypher blocks 2024-06-15 12:43:59 +02:00
gbrochar 109ceeab53 Merge branch 'rsa' into rot1 2024-05-23 13:32:29 +02:00
gbrochar 48020cc5da clean: rsa64 comments 2024-05-23 13:21:06 +02:00
gbrochar 2303d0cb2c clean: remove old rsa 2024-05-23 13:14:37 +02:00
gbrochar d429e2921d clean: rsa64 2024-05-19 08:37:43 +02:00
gbrochar 032dd53abf merge: update rsa 2024-04-18 08:00:02 +02:00
gbrochar 6dcf29d9b8 feat: rsa 32bits (16 bits msg no padding) 2024-04-11 14:39:27 +02:00
gbrochar 17cd4fde5b feat: rsa 64bits prime gen 2024-04-09 16:55:13 +02:00
gbrochar ee899b8c8c clean: miller-rabin sep fn + set e=65537 2024-02-19 15:15:02 +01:00
gbrochar b4a0432d33 feat: check first primes before miller rabin 2024-02-19 13:01:51 +01:00
gbrochar 0bc6bf62a4 fix: unused return value 2024-02-19 13:00:55 +01:00
gbrochar badc3fd399 opti: remove many memcpy 2024-02-18 18:06:18 +01:00
gbrochar 1d9e2936ac opti: rm malloc in mul and useless cmp in modulo 2024-02-18 17:14:48 +01:00
gbrochar 365c98be7c clean: remove comments 2024-02-18 16:40:16 +01:00
gbrochar 81f8fb3c1f opti: remove many mallocs 2024-02-18 16:38:30 +01:00
gbrochar d368c925fb opti: is_not_zero 2024-02-18 15:55:05 +01:00
gbrochar 2f7d2922c7 fix: substraction 2024-02-18 15:37:37 +01:00
gbrochar c8e5e6bf67 opti: cache left_shifts in multiplication 2024-02-18 14:16:28 +01:00
gbrochar fa5c3d7f96 refacto: make more numbers same length 2024-02-18 02:41:48 +01:00
gbrochar ed45a04df2 chore: PHONY rule 2024-02-18 02:17:52 +01:00
gbrochar 585f9750df fix: put correct flag for opti................. 2024-02-18 00:46:50 +01:00
gbrochar 4c53350bd5 refacto: faster 2024-02-18 00:46:21 +01:00
gbrochar 7d0c774cb7 refacto: speed x10 2024-02-17 20:50:05 +01:00
gbrochar 4a3cbd75b5 fix: leaks 2024-02-16 17:33:46 +01:00
gbrochar 52f65086c2 remove unused func and comments 2024-02-16 16:48:25 +01:00
gbrochar 6806db1c6f feat: prime working rly slow and leaks 2024-02-16 15:57:11 +01:00
gbrochar a000c56ce5 clean: remove comments 2024-02-16 13:33:59 +01:00
gbrochar 3883287e8d feat: square and multiply, a^e mod n 2024-02-16 13:32:06 +01:00
gbrochar 5028b0dd9f rsa reborn mod working 2024-02-15 21:26:40 +01:00
gbrochar 6a077bca3f rsa branch backup 2024-02-15 21:25:35 +01:00
gbrochar 038719bb26 fix: malloc size was too small 2024-02-14 17:18:09 +01:00
gbrochar adf7a34fa6 feat: rsa compiles 2024-02-14 17:17:11 +01:00
gbrochar 5cf2bc357b feat: rsa doesnt compile lol 2024-02-14 17:14:03 +01:00
17 changed files with 3852 additions and 41 deletions

3
.gitignore vendored
View File

@ -1,3 +1,6 @@
rsa/rsa
rsa64/rsa
*.swp
*.o *.o
*.a *.a
woody_woodpacker woody_woodpacker

View File

@ -5,7 +5,9 @@ SRCS_PATH = srcs/
SRCS = $(SRCS_PATH)main.c \ SRCS = $(SRCS_PATH)main.c \
$(SRCS_PATH)utils.c \ $(SRCS_PATH)utils.c \
$(SRCS_PATH)woody.c \ $(SRCS_PATH)woody.c \
$(SRCS_PATH)encrypt.c $(SRCS_PATH)encrypt.c \
$(SRCS_PATH)rsa.c \
$(SRCS_PATH)primes.c
OBJS = ${SRCS:.c=.o} OBJS = ${SRCS:.c=.o}
@ -23,7 +25,7 @@ all: ${NAME}
.c.o: .c.o:
${CC} ${INCLUDES} ${DEFINES} ${CFLAGS} -c $< -o $@ ${CC} ${INCLUDES} ${DEFINES} ${CFLAGS} -c $< -o $@
$(NAME): ${OBJS} $(NAME): ${OBJS} includes/woody.h
make -C ft_printf make -C ft_printf
${CC} ${OBJS} ${LIBFT_FLAGS} -o ${NAME} ${CC} ${OBJS} ${LIBFT_FLAGS} -o ${NAME}
@ -31,11 +33,11 @@ clean:
make -C ft_printf clean make -C ft_printf clean
${RM} ${OBJS} ${RM} ${OBJS}
fclean: fclean: clean
make -C ft_printf fclean make -C ft_printf fclean
${RM} ${NAME} ${RM} ${NAME}
re: fclean re: fclean
make all make all
.PHONY : all clean fclean re .PHONY : all clean fclean re

29
includes/rsa.h Normal file
View File

@ -0,0 +1,29 @@
#ifndef _RSA_H
#define _RSA_H 1
#include <stdint.h>
#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>
#define RSA_BLOCK_SIZE 128
typedef struct rsa_s {
uint64_t n;
uint64_t d;
} rsa_t;
void *protected_malloc(size_t size);
rsa_t rsa_generate_keys();
uint16_t generate_prime();
uint64_t pow_mod(uint64_t nn, uint64_t e, uint64_t mm);
uint16_t get_random_bytes(int fd);
#endif

View File

@ -1,6 +1,8 @@
#ifndef WOODY_H #ifndef WOODY_H
#define WOODY_H #define WOODY_H
#include "rsa.h"
#include "../ft_printf/includes/ft_printf.h" #include "../ft_printf/includes/ft_printf.h"
#include <stdbool.h> #include <stdbool.h>
#include <unistd.h> #include <unistd.h>
@ -17,10 +19,11 @@
#define JUMP "\xe9" #define JUMP "\xe9"
#define WOODY "....WOODY...." #define WOODY "....WOODY...."
#define JUMP_VALUE "\xda\xda\xda" #define JUMP_VALUE "\xda\xda"
#define TEXT_OFFSET "\xba\xba\xba\xba\xba\xba\xba\xba" #define TEXT_OFFSET "\xba\xba\xba\xba\xba\xba\xba\xba"
#define SECTION_SIZE "\xca\xca\xca\xca\xca\xca\xca\xca" #define SECTION_SIZE "\xca\xca\xca\xca\xca\xca\xca\xca"
#define PRIVATE_KEY "\xcd\xab\xef\xcd\xab\xef\xcd\xab"
typedef struct payload typedef struct payload
{ {
@ -49,7 +52,7 @@ int get_symbols_count(int sh_size, int sh_entsize);
int prepare_injection(t_elf_content *woody); int prepare_injection(t_elf_content *woody);
// encrypt.c // encrypt.c
void encrypt(char *file, unsigned long int offset, unsigned long int size); unsigned long encrypt(char *file, unsigned long int offset, unsigned long int size, rsa_t rsa);
#endif #endif

118
print.s
View File

@ -2,36 +2,108 @@ bits 64
global _start global _start
_start: _start:
push rax push rbp
push rdi push rsp
push rsi push rbx
push rdx push r12
push r13
push r14
push r15
mov rdi, 1 mov rdi, 1
lea rsi, [rel msg] lea rsi, [rel msg]
mov rax, rsi mov rbx, rsi
sub rax, qword [rel text_section] ;text_section address sub rbx, qword [rel text_section] ;text_section address because of this and that
mov r8, qword [rel section_sisze] ;text_section size mov r8, qword [rel section_size] ;text_section size
mov r9, 0 ;increment register mov r9, 0 ;increment register
mov r10, 0 ;increment register
xor r10, r10 xor r10, r10
encrypt: xor r13, r13
cmp r8, r9 mov r13d, dword [rel private_key]
je end_encrypt xor r12, r12
movzx r10, byte[rax + r9] mov r12d, dword [rel private_key + 4]
inc r10b ;rot + 1 ;shr r12, 32
mov byte[rax + r9], r10b push r13 ; push rsa.d
inc r9 push r12 ; push rsa.n
jmp encrypt jmp decrypt_loop
end_encrypt:
; rbx is adress of text(encrypted) section
; r8 is section size
; r9 is index
; rax is cypher that needs to be converted to message
; dword [rsp + 16] is rsa.d
; dword [rsp + 8] is rsa.n
; qword [rsp] is cypher backup
decrypt_once:
mov r11, 0x100000000
sq_mul_bit_index:
shr r11, 1
mov r12, r11
and r12, qword [rsp + 16]
jz sq_mul_bit_index
sq_mul_loop:
shr r11, 1
cmp r11, 0
je decrypt_loop2
mul rax,
; modulo n ...
mov r13, qword [rsp + 8]
xor rdx, rdx
div r13
mov rax, rdx
; modulo n ...
mov r12, r11
and r12, qword [rsp + 16]
cmp r12, 0
je sq_mul_loop
mov r13, qword [rsp]
mul r13
; modulo n ...
mov r13, qword [rsp + 8]
xor rdx, rdx
div r13
mov rax, rdx
; modulo n ...
jmp sq_mul_loop
decrypt_loop:
cmp r8, r10
je end_decrypt
xor rax, rax
mov eax, dword [rbx + r9]
push rax
;push r10
jmp decrypt_once
decrypt_loop2:
sub rax, 42 ; remove 42 of result (avoid 0 values)
sub rax, r10 ; remove index of result (caesar like cypher so 0/42 values are differents)
; unpadding and write back here
;mov [rbx + r9], rax
; unpadding and write back here
pop rax
add r9, 4
inc r10
jmp decrypt_loop
end_decrypt:
mov rdx, 14 mov rdx, 14
mov rax, 1 mov rax, 1
syscall syscall
pop rdx
pop rsi
pop rdi
pop rax
jmp 0xdadadada pop r12 ; pop rsa.n
msg db "....WOODY....",10 pop r12 ; pop rsa.d
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rsp
pop rbp
jmp 0xdadadada ; this needs to be just before that
msg db "....WOODY....",10 ; that needs to be just after this
text_section dq 0xbabababababababa text_section dq 0xbabababababababa
section_sisze dq 0xcacacacacacacaca section_size dq 0xcacacacacacacaca
private_key dq 0xabcdefabcdefabcd

43
rsa64/Makefile Normal file
View File

@ -0,0 +1,43 @@
NAME = rsa
SRC = \
main.c \
rsa.c \
utils.c \
primes.c \
all: $(NAME)
$(NAME):
gcc -Wall -Wextra -Werror -Wunused-function $(SRC) -o $(NAME)
fast:
gcc -Wall -Wextra -Werror -Wunused-function -O3 $(SRC) -o $(NAME)
fast-info:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -fopt-info $(SRC) -o $(NAME)
really-fast:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -march=native $(SRC) -o $(NAME)
really-fast-info:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -march=native -fopt-info $(SRC) -o $(NAME)
profile:
gcc -Wall -Wextra -Werror -Wunused-function -pg $(SRC) -o $(NAME)
profile-clang:
clang -Wall -Wextra -Werror -Wunused-function -pg $(SRC) -o $(NAME)
profile-fast:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -pg $(SRC) -o $(NAME)
profile-fast-clang:
clang -Wall -Wextra -Werror -Wunused-function -O3 -pg $(SRC) -o $(NAME)
fclean:
rm -rf $(NAME)
re: fclean all
.PHONY: all fast profile profile-fast fclean re

14
rsa64/main.c Normal file
View File

@ -0,0 +1,14 @@
#include "rsa.h"
int main(int ac, char **av) {
if (ac == 2) {
(void)av;
rsa_t rsa = rsa_generate_keys();
(void)rsa;
}
else {
printf("usage: ./rsa message\n");
}
return 0;
}

3245
rsa64/primes.0000 Normal file

File diff suppressed because it is too large Load Diff

74
rsa64/primes.c Normal file
View File

@ -0,0 +1,74 @@
#include "rsa.h"
uint16_t get_random_bytes(int fd) {
uint16_t ret;
if (read(fd, &ret, sizeof(uint16_t)) == -1) {
exit(1);
}
return ret;
}
// n pow e mod m
uint64_t pow_mod(uint64_t n, uint64_t e, uint64_t m) {
uint64_t y = 1;
while (e > 1) {
if (e & 1) {
y = (y * n) % m;
}
n = (n * n) % m;
e = e >> 1;
}
return (n * y) % m;
}
bool is_prime(uint16_t n, size_t k_max, int fd) {
uint16_t a = get_random_bytes(fd);
uint16_t d = n - 1;
uint16_t s = 0;
while ((d & 1) == 0) {
s++;
d = d >> 1;
}
for (size_t k = 0; k < k_max; k++) {
a = 0;
while (a < 2 || a > (n - 2)) {
a = get_random_bytes(fd);
}
uint16_t x = pow_mod(a, d, n);
uint16_t y;
for (uint16_t i = 0; i < s; i++) {
y = pow_mod(x, 2, n);
if (y == 1 && x != 1 && x != n - 1)
return false;
x = y;
}
if (y != 1) {
return false;
}
}
return true;
}
uint16_t generate_prime_fd(int fd) {
uint16_t n = get_random_bytes(fd);
n |= 1 << 15;
n |= 1;
while (!is_prime(n, 16, fd)) {
n = get_random_bytes(fd);
n |= 1 << 15;
n |= 1;
}
return n;
}
uint16_t generate_prime() {
int fd = open("/dev/urandom", O_RDONLY);
uint16_t n = generate_prime_fd(fd);
close(fd);
return n;
}

111
rsa64/rsa.c Normal file
View File

@ -0,0 +1,111 @@
#include "rsa.h"
int64_t euler(int64_t r0, int64_t r1) {
int64_t s0 = 1;
int64_t s1 = 0;
int64_t t0 = 0;
int64_t t1 = 1;
int64_t q0 = 0;
while (r1 != 0) {
q0 = r0 / r1;
int64_t tmp = r0 % r1;
r0 = r1;
r1 = tmp;
tmp = s0 - q0 * s1;
s0 = s1;
s1 = tmp;
tmp = t0 - q0 * t1;
t0 = t1;
t1 = tmp;
}
return s0;
}
rsa_t rsa_generate_keys(void) {
for (int try = 0; try < 1000; try++) {
if (try % 100 == 0)
printf("try: %d\n", try);
int64_t p = (uint64_t)generate_prime();
int64_t q = (uint64_t)generate_prime();
int64_t ln = (p - 1) * (q - 1);
int64_t e = 11317;
while (ln % e == 0 || p == q) {
p = generate_prime();
q = generate_prime();
ln = (p - 1) * (q - 1);
}
if (q > p) {
uint64_t tmp = p;
p = q;
q = tmp;
}
int64_t n = p * q;
int64_t r0 = e;
int64_t r1 = ln;
int64_t s0 = 1;
int64_t s1 = 0;
int64_t t0 = 0;
int64_t t1 = 1;
int64_t q0 = 0;
while (r1 != 0) {
q0 = r0 / r1;
int64_t tmp = r0 % r1;
r0 = r1;
r1 = tmp;
tmp = s0 - q0 * s1;
s0 = s1;
s1 = tmp;
tmp = t0 - q0 * t1;
t0 = t1;
t1 = tmp;
}
int64_t d = euler(e, ln) + ln;
if (d > n) {
d -= ln;
}
/* printf("p: %ld\n", p);
printf("q: %ld\n", q);
printf("ln: %ld\n", ln);
printf("n: %ld\n", n);
printf("d: %ld\n", d);
printf("e: %ld\n", e);
printf("d * e %% ln = %ld\n", (d*e)%ln);*/
for (uint64_t m = 0; m < 16384; m++) {
//uint64_t m = get_random_bytes(fd2);
uint64_t c = pow_mod(m, e, n);
uint64_t m2 = pow_mod(c, d, n);
if (m != m2) {
printf("ERROR try: %d\nround: n/a\nmsg: %ld\ncypher: %ld\ndecrypted: %ld\nd: %ld\ne: %ld\np: %lu\nq: %lu\nn: %lu\n", try, m, c, m2, d, e, p, q, n);
break;
}
}
//int64_t m = 42;
/*
for (int64_t m = 41; m < 43; m++) {
int64_t c = pow_mod(m, e, n);
int64_t m2 = pow_mod(c, d, n);
if (d < 0) {
int64_t c2 = euler(c, n);
printf("c2: %ld\n", c2);
printf("c2 * c %% n = %ld\n", ((c2 + n)*c)%n);
printf("c2 * c %% n = %ld\n", ((c2)*c)%n);
m2 = pow_mod(c2 + n, -d, n);
}
printf("message: %ld\n", m);
printf("cypher: %ld\n", c);
printf("decrypted: %ld\n", m2);
}*/
}
rsa_t rsa;
rsa.p.len = 42;
return rsa;
}

34
rsa64/rsa.h Normal file
View File

@ -0,0 +1,34 @@
#ifndef _RSA_H
#define _RSA_H 1
#include <stdint.h>
#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>
#define RSA_BLOCK_SIZE 128
typedef struct bigint_s {
uint32_t *data;
size_t len;
} bigint_t;
typedef struct rsa_s {
bigint_t p;
bigint_t q;
} rsa_t;
void *protected_malloc(size_t size);
rsa_t rsa_generate_keys();
uint16_t generate_prime();
uint64_t pow_mod(uint64_t nn, uint64_t e, uint64_t mm);
uint16_t get_random_bytes(int fd);
#endif

9
rsa64/utils.c Normal file
View File

@ -0,0 +1,9 @@
#include "rsa.h"
void *protected_malloc(size_t size) {
void *ptr = malloc(size);
if (!ptr) {
printf("malloc returned NULL");
}
return ptr;
}

View File

@ -1,15 +1,38 @@
#include "../includes/woody.h" #include "../includes/woody.h"
#include "../includes/rsa.h"
void encrypt(char *file, unsigned long int offset, unsigned long int size) unsigned long encrypt(char *file, unsigned long int offset, unsigned long int size, rsa_t rsa)
{ {
size_t padded_len = size * sizeof(char) * 33 / sizeof(uint32_t) / 32 + 1; // every 32 octet one padding octet, plus one for the remainder (uses too much memory for size % 128 == 0 but fuck you)
uint32_t *padded = (uint32_t *)malloc(sizeof(uint32_t) * padded_len);
for (size_t i = 0; i < padded_len; i++) {
padded[padded_len] = 0;
}
(void)rsa;
size_t i = 0; size_t i = 0;
while (i < size) while (i < size) {
{ size_t j = 0;
file[offset + i] = file[offset + i] - 1; while (j < 8) {
size_t bit_index = i * 8 * sizeof(char) + j;
//printf("bit_index : %ld\n", bit_index);
padded[bit_index / 31] += (1 & (file[bit_index / 8] >> j)) << (bit_index % 31);
j++;
}
//file[offset + i] = file[offset + i] - 1;
++i; ++i;
} }
for (size_t i = 0; i < padded_len; i++) {
printf("block : %x\n", padded[i]);//, padded[i]);
padded[i] = pow_mod(padded[i] + 42 + i, 11317, rsa.n);
printf("encrypted block : %x\n\n", padded[i]);//, padded[i]);
//printf("decipher block : %lu (%lx)\n", pow_mod(padded[i], rsa.d, rsa.n) - 42 - i, pow_mod(padded[i], rsa.d, rsa.n) - 42 - i);
}
memcpy(&file[offset], padded, padded_len * sizeof(uint32_t));
printf("\nENCRYPTION : \n"); printf("\nENCRYPTION : \n");
printf(" File encrypted from %ld (%lx) to %ld (%lx)\n", offset, offset, offset + size, offset + size); printf(" File encrypted from %ld (%lx) to %ld (%lx)\n", offset, offset, offset + size, offset + size);
printf(" Size of encryption = %ld (%lx)\n", size, size); printf(" Size of encryption = %ld (%lx)\n", size, size);
printf(" Size of padded encryption = %ld (%lx)\n", padded_len * sizeof(uint32_t), padded_len * sizeof(uint32_t));
printf("\n"); printf("\n");
} return offset + padded_len * sizeof(uint32_t);
}

74
srcs/primes.c Normal file
View File

@ -0,0 +1,74 @@
#include "../includes/rsa.h"
uint16_t get_random_bytes(int fd) {
uint16_t ret;
if (read(fd, &ret, sizeof(uint16_t)) == -1) {
exit(1);
}
return ret;
}
// n pow e mod m
uint64_t pow_mod(uint64_t n, uint64_t e, uint64_t m) {
uint64_t y = 1;
while (e > 1) {
if (e & 1) {
y = (y * n) % m;
}
n = (n * n) % m;
e = e >> 1;
}
return (n * y) % m;
}
bool is_prime(uint16_t n, size_t k_max, int fd) {
uint16_t a = get_random_bytes(fd);
uint16_t d = n - 1;
uint16_t s = 0;
while ((d & 1) == 0) {
s++;
d = d >> 1;
}
for (size_t k = 0; k < k_max; k++) {
a = 0;
while (a < 2 || a > (n - 2)) {
a = get_random_bytes(fd);
}
uint16_t x = pow_mod(a, d, n);
uint16_t y;
for (uint16_t i = 0; i < s; i++) {
y = pow_mod(x, 2, n);
if (y == 1 && x != 1 && x != n - 1)
return false;
x = y;
}
if (y != 1) {
return false;
}
}
return true;
}
uint16_t generate_prime_fd(int fd) {
uint16_t n = get_random_bytes(fd);
n |= 1 << 15;
n |= 1;
while (!is_prime(n, 16, fd)) {
n = get_random_bytes(fd);
n |= 1 << 15;
n |= 1;
}
return n;
}
uint16_t generate_prime() {
int fd = open("/dev/urandom", O_RDONLY);
uint16_t n = generate_prime_fd(fd);
close(fd);
return n;
}

53
srcs/rsa.c Normal file
View File

@ -0,0 +1,53 @@
#include "../includes/rsa.h"
int64_t euler(int64_t r0, int64_t r1) {
int64_t s0 = 1;
int64_t s1 = 0;
int64_t t0 = 0;
int64_t t1 = 1;
int64_t q0 = 0;
while (r1 != 0) {
q0 = r0 / r1;
int64_t tmp = r0 % r1;
r0 = r1;
r1 = tmp;
tmp = s0 - q0 * s1;
s0 = s1;
s1 = tmp;
tmp = t0 - q0 * t1;
t0 = t1;
t1 = tmp;
}
return s0;
}
rsa_t rsa_generate_keys(void) {
int64_t p = (uint64_t)generate_prime();
int64_t q = (uint64_t)generate_prime();
int64_t ln = (p - 1) * (q - 1);
int64_t e = 11317;
while (ln % e == 0 || p == q) {
p = generate_prime();
q = generate_prime();
ln = (p - 1) * (q - 1);
}
if (q > p) {
uint64_t tmp = p;
p = q;
q = tmp;
}
int64_t n = p * q;
int64_t d = euler(e, ln) + ln;
if (d > n) {
d -= ln;
}
rsa_t rsa;
rsa.d = d;
rsa.n = n;
return rsa;
}

View File

@ -1,4 +1,5 @@
#include "../includes/woody.h" #include "../includes/woody.h"
#include "../includes/rsa.h"
int elf_magic_numbers(char *str) int elf_magic_numbers(char *str)
{ {
@ -92,18 +93,25 @@ t_payload *get_payload()
exit(1); exit(1);
} }
payload->len = read(fd, buffer, 1024); payload->len = read(fd, buffer, 1024);
printf("payload len%ld\n", payload->len);
payload->payload = malloc(sizeof(char) * payload->len); payload->payload = malloc(sizeof(char) * payload->len);
ft_memcpy(payload->payload, buffer, payload->len); ft_memcpy(payload->payload, buffer, payload->len);
return payload; return payload;
} }
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, int load_segment_index) int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, int load_segment_index, rsa_t rsa)
{ {
(void)rsa;
//printf("salut %s\n", JUMP_VALUE);
for (size_t i = 0; i < payload->len; i++) {
printf("%c", *(payload->payload + i));
}
char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len); char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len); char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len); char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
char *ptr_private_key = ft_strnstr_nullterminated(payload->payload, PRIVATE_KEY, payload->len);
char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len); char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size) if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size && ptr_private_key)
{ {
int32_t woody_index = ptr_woody - payload->payload; int32_t woody_index = ptr_woody - payload->payload;
int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload; int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
@ -118,14 +126,24 @@ int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_posi
int64_t section_value = woody->Phdr[load_segment_index].p_memsz; //woody->text_section->sh_size; int64_t section_value = woody->Phdr[load_segment_index].p_memsz; //woody->text_section->sh_size;
ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value)); ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
int64_t private_key_index = ptr_private_key - payload->payload;
int64_t private_key_value = (rsa.n << 32) + rsa.d;
ft_memcpy(&payload->payload[private_key_index], &private_key_value, sizeof(uint64_t));
ft_memcpy(woody->file + payload_position, payload->payload, payload->len); ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry); printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
printf("Code cave start = %ld (%lx)\n", payload_position, payload_position); printf("Code cave start = %ld (%lx)\n", payload_position, payload_position);
printf("Payload size = %ld (%lx)\n", payload->len, payload->len); printf("Payload size = %ld (%lx)\n", payload->len, payload->len);
printf("Backward offset = %d (%x)(%x)\n", jump_value, jump_value, -jump_value); printf("Backward offset = %d (%x)(%x)\n", jump_value, jump_value, -jump_value);
return EXIT_SUCCESS; return EXIT_SUCCESS;
} }
printf("c'est la merde\n");
printf("ptr_woody : %p\n", ptr_woody);
printf("ptr_section_size: %p\n", ptr_section_size);
printf("ptr_text_section : %p\n", ptr_text_section);
printf("ptr_jmp_value : %p\n", ptr_jmp_value);
printf("ptr_private_key: %p\n", ptr_private_key);
return EXIT_FAILURE; return EXIT_FAILURE;
} }
@ -148,12 +166,15 @@ void inject(t_elf_content *woody)
{ {
payload_position = create_codecave(woody, &woody->Phdr[i], payload); payload_position = create_codecave(woody, &woody->Phdr[i], payload);
} }
encrypt(woody->file, woody->Phdr[i].p_offset, woody->Phdr[i].p_memsz); rsa_t rsa = rsa_generate_keys();
insert_payload(woody, payload, payload_position, i); printf("key n : %ld (%lx) key d %ld (%lx), key total : %ld (%lx)\n", rsa.n, rsa.n, rsa.d, rsa.d, (rsa.n << 32) + rsa.d, (rsa.n << 32) + rsa.d);
payload_position = encrypt(woody->file, woody->Phdr[i].p_offset, woody->Phdr[i].p_memsz, rsa);
printf("Payload position : %ld (%lx)\n", payload_position, payload_position);
insert_payload(woody, payload, payload_position, i, rsa);
woody->Ehdr->e_entry = payload_position; woody->Ehdr->e_entry = payload_position;
woody->Phdr[i].p_filesz += payload->len; woody->Phdr[i].p_filesz += payload->len + 15;
woody->Phdr[i].p_memsz += payload->len; woody->Phdr[i].p_memsz += payload->len + 15;
woody->Phdr[i].p_flags = PF_X | PF_W | PF_R; woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry); printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
} }

1
zreset_woody.sh Executable file
View File

@ -0,0 +1 @@
./gen_payload.sh && rm -f woody && ./woody_woodpacker resources/sample64 | less