Makefile

@@ -4,9 +4,7 @@ SRCS_PATH	= srcs/
 
 SRCS  =		$(SRCS_PATH)main.c \
 			$(SRCS_PATH)utils.c \
-			$(SRCS_PATH)payload.c \
+			$(SRCS_PATH)woody.c \
-			$(SRCS_PATH)woody32.c \
-			$(SRCS_PATH)woody64.c \
 			$(SRCS_PATH)encrypt.c
 
 

includes/woody.h

@@ -28,29 +28,19 @@ typedef struct payload
 	int len;
 }	t_payload;
 
-typedef struct elf32
-{
-	Elf32_Ehdr *Ehdr;
-	Elf32_Phdr *Phdr;
-	Elf32_Shdr *Shdr;
-	Elf32_Shdr *text_section;
-} t_elf32;
-
-typedef struct elf64
-{
-	Elf64_Ehdr *Ehdr;
-	Elf64_Phdr *Phdr;
-	Elf64_Shdr *Shdr;
-	Elf64_Shdr *text_section;
-} t_elf64;
-
 typedef struct elf_content
 {
 	long unsigned int file_size;
 	char *file_path;
 	char *file;
-	t_elf32 *elf32;
+	Elf64_Ehdr *Ehdr;
-	t_elf64 *elf64;
+	Elf64_Phdr *Phdr;
+	Elf64_Shdr *Shdr;
+	Elf64_Shdr *symbols_table;
+	int num_symbols;
+	Elf64_Shdr *text_section;
+	Elf64_Sym  *symbols;
+	char *Sshstrtab;
 } t_elf_content;
 
 // utils.c
@@ -59,19 +49,10 @@ int ft_put_error(char *str);
 char *get_string(char *str, char *end_file);
 int	get_symbols_count(int sh_size, int sh_entsize);
 char *get_section_name(t_elf_content *woody, int section_index);
-int elf_magic_numbers(char *str);
 
-// payload.c
+// woody.c
-t_payload *get_payload();
+int	inject(t_elf_content *woody);
-int	insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, unsigned int e_entry, unsigned int p_offset, unsigned int p_memsz);
+int get_elf_sections(t_elf_content *woody);
-
-// woody32.c
-int get_elf_sections32(t_elf_content *woody);
-int	inject32(t_elf_content *woody);
-
-// woody64.c
-int get_elf_sections64(t_elf_content *woody);
-int	inject64(t_elf_content *woody);
 
 
 // encrypt.c

print.s

@@ -18,7 +18,7 @@ _start:
 		cmp r8, r9
 		je end_encrypt
 		movzx r10, byte[rax + r9]
-		inc r10b ;rot + 1
+		;inc r10b ;rot + 1
 		mov byte[rax + r9], r10b
 		inc r9
 		jmp encrypt

srcs/encrypt.c

@@ -5,7 +5,11 @@ void	encrypt(char *file, unsigned long int offset, unsigned long int size)
 	size_t i = 0;
 	while (i < size)
 	{
-		file[offset + i] = file[offset + i] - 1;
+		file[offset + i] = file[offset + i];// - 1;
 		++i;
 	}
+	printf("\nENCRYPTION : \n");
+	printf("	File encrypted from %ld (%lx) to %ld (%lx)\n", offset, offset, offset + size, offset + size);
+	printf("	Size of encryption = %ld (%lx)\n", size, size);
+	printf("\n");
 }

srcs/main.c

@@ -1,12 +1,5 @@
 #include "../includes/woody.h"
 
-void free_elf_content(t_elf_content *woody)
-{
-	if (woody->elf32)
-		free(woody->elf32);
-	else if (woody->elf64)
-		free(woody->elf64);
-}
 int get_elf_file(t_elf_content *woody)
 {
 	int fd;
@@ -41,13 +34,13 @@ int save_file(char *path, char *file, unsigned long int size)
 {
 	int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
     if (fd == -1) {
-		ft_printf("Error: Failed to create new file \'%s\'\n", path);
+		printf("Error: Failed to create new file \'%s\'\n", path);
 		return EXIT_FAILURE;
     }
 
     if (write(fd, file, size) == -1) {
         close(fd);
-        ft_printf("Error: Failed to write new file \'%s\'\n", path);
+        printf("Error: Failed to write new file \'%s\'\n", path);
         return EXIT_FAILURE;
     }
     close(fd);
@@ -73,7 +66,7 @@ int save_woody(t_elf_content *woody)
 
 int main(int ac, char **av)
 {
-	t_elf_content woody = {0};
+	t_elf_content woody;
 	if (ac != 2)
 	{
 		return ft_put_error("Woody_woodpacker take 1 argument\n");
@@ -82,48 +75,15 @@ int main(int ac, char **av)
 	int elf_error = get_elf_file(&woody);
 	if (elf_error)
 		return elf_error;
-	if (woody.file_size < sizeof(Elf32_Ehdr) || !elf_magic_numbers(woody.file))
+	elf_error = get_elf_sections(&woody);
-	{
-		ft_printf("Error: \'%s\' is not a valid ELF file\n", woody.file_path);
-		return EXIT_FAILURE;
-	}
-	int elfclass = woody.file[4];
-	if (elfclass == ELFCLASS32)
-	{
-		if (!(woody.elf32 = malloc(sizeof(t_elf32))))
-			return ft_put_error("Allocation error");
-		elf_error = get_elf_sections32(&woody);
-	}
-	else if (elfclass == ELFCLASS64)
-	{
-		if (!(woody.elf64 = malloc(sizeof(t_elf64))))
-			return ft_put_error("Allocation error");
-		elf_error = get_elf_sections64(&woody);
-	}
-	else
-	{
-		elf_error = EXIT_FAILURE;
-		ft_printf("Error: \'%s\' is not a valid ELF file\n", woody.file_path);
-	}
 	if (elf_error)
 		return elf_error;
-	int inject_error = -1;
+
-	if (elfclass == ELFCLASS32)
+	int inject_error = inject(&woody);
+	if (!inject_error)
 	{
-		encrypt(woody.file, woody.elf32->text_section->sh_offset, woody.elf32->text_section->sh_size);
+		return save_woody(&woody);
-		inject_error = inject32(&woody);
 	}
-	else if (elfclass == ELFCLASS64)
+	return EXIT_SUCCESS;
-	{
+}
-		encrypt(woody.file, woody.elf64->text_section->sh_offset, woody.elf64->text_section->sh_size);
+
-		inject_error = inject64(&woody);
-	}
-	if (inject_error)
-	{
-		free_elf_content(&woody);
-		return inject_error;
-	}
-	int save_error = save_woody(&woody);
-	free_elf_content(&woody);
-	return save_error;
-}

srcs/payload.c

@@ -1,61 +0,0 @@
-
-#include "../includes/woody.h"
-
-t_payload *get_payload()
-{
-	t_payload *payload = malloc(sizeof(t_payload));
-	if (!payload)
-		return NULL;
-	char buffer[1024];
-	int fd = open("payload", O_RDONLY);
-	if (fd == -1) {
-		ft_put_error("Failed to open payload");
-		free(payload);
-		return NULL;
-	}
-	payload->len = read(fd, buffer, 1024);
-	if (payload->len == -1)
-	{
-		ft_put_error("Failed to read payload");
-		free(payload);
-		close(fd);
-		return NULL;
-	}
-	close(fd);
-	payload->payload = malloc(sizeof(char) * payload->len);
-	if (!payload->payload)
-	{
-		ft_put_error("Allocation error");
-		free(payload);
-		return NULL;
-	}
-	ft_memcpy(payload->payload, buffer, payload->len);
-	return payload;
-}
-
-int	insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, unsigned int e_entry, unsigned int p_offset, unsigned int p_memsz)
-{
-	char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
-	char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
-	char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
-	char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
-	if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size)
-	{
-		int32_t woody_index = ptr_woody - payload->payload;
-		int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
-		int32_t jump_value = ((payload_position + jmp_index + 5) - e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
-		ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));
-
-		int64_t text_index = ptr_text_section - payload->payload;
-		int64_t text_value = payload_position - p_offset + woody_index;
-		ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
-
-		int64_t section_index = ptr_section_size - payload->payload;
-		int64_t section_value = p_memsz;
-		ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
-
-		ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
-		return EXIT_SUCCESS;
-	}
-	return EXIT_FAILURE;
-}

srcs/utils.c

@@ -7,11 +7,6 @@ void	*fetch(char *file, unsigned long file_size, unsigned long offset_to_data, u
 	return NULL;
 }
 
-int elf_magic_numbers(char *str)
-{
-	return (!ft_strncmp(str, ELFMAG, SELFMAG));
-}
-
 int	get_symbols_count(int sh_size, int sh_entsize)
 {
 	if (sh_size <= 0 || sh_entsize <= 0)
@@ -27,10 +22,17 @@ char *get_string(char *str, char *end_file)
 		if (*search_end == 0)
 			return str;
 		++search_end;
+
 	}
 	return NULL;
 }
 
+char *get_section_name(t_elf_content *woody, int section_index)
+{
+	unsigned int shstrtabndx = woody->Shdr[section_index].sh_name;
+	return get_string(&woody->Sshstrtab[shstrtabndx], woody->file + woody->file_size);
+}
+
 int ft_put_error(char *str)
 {
 	ft_putstr_fd("Error: ", STDERR_FILENO);

srcs/woody.c

@@ -0,0 +1,143 @@
+#include "../includes/woody.h"
+
+int elf_magic_numbers(char *str)
+{
+	return (!ft_strncmp(str, ELFMAG, SELFMAG));
+}
+
+int	get_load_segment(t_elf_content *woody, int start, bool executable)
+{
+	for (int i = start; i < woody->Ehdr->e_phnum; i++)
+	{
+		if (woody->Phdr[i].p_type == PT_LOAD)
+		{
+			if (executable)
+			{
+				if (woody->Phdr[i].p_flags & PF_X)
+					return i;
+			}
+			else
+				return i;
+		}
+	}
+	return -1;
+}
+
+t_payload *get_payload()
+{
+	t_payload *payload = malloc(sizeof(t_payload));
+	if (!payload)
+		return NULL;
+	char buffer[1024];
+	int fd = open("payload", O_RDONLY);
+	if (fd == -1) {
+		ft_put_error("Failed to open payload");
+		free(payload);
+		close(fd);
+		return NULL;
+	}
+	payload->len = read(fd, buffer, 1024);
+	if (payload->len == -1)
+	{
+		ft_put_error("Failed to read payload");
+		free(payload);
+		close(fd);
+		return NULL;
+	}
+	close(fd);
+	payload->payload = malloc(sizeof(char) * payload->len);
+	if (!payload->payload)
+	{
+		ft_put_error("Allocation error");
+		free(payload);
+		return NULL;
+	}
+	ft_memcpy(payload->payload, buffer, payload->len);
+	return payload;
+}
+
+int	insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, int load_segment_index)
+{
+	char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
+	char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
+	char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
+	char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
+	if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size)
+	{
+		int32_t woody_index = ptr_woody - payload->payload;
+		int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
+		int32_t jump_value = ((payload_position + jmp_index + 5) - woody->Ehdr->e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
+		ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));
+
+		int64_t text_index = ptr_text_section - payload->payload;
+		int64_t text_value = payload_position - woody->Phdr[load_segment_index].p_offset + woody_index;
+		ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
+
+		int64_t section_index = ptr_section_size - payload->payload;
+		int64_t section_value = woody->Phdr[load_segment_index].p_memsz;
+		ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
+
+		ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
+		return EXIT_SUCCESS;
+	}
+	return EXIT_FAILURE;
+}
+
+int	inject(t_elf_content *woody)
+{
+	t_payload *payload = get_payload();
+	if (!payload)
+		return EXIT_FAILURE;
+
+	int i = get_load_segment(woody, 0, true);
+	int j = get_load_segment(woody, i + 1, false);
+
+	if (i == -1 || j != i + 1)
+	{
+		free(payload->payload);
+		free(payload);
+		return ft_put_error("PT_LOAD segment missing");
+	}
+
+	size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
+	size_t payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz;
+
+	if (code_cave_size < (size_t)payload->len)
+	{
+		free(payload->payload);
+		free(payload);
+		return ft_put_error("Unable to insert payload, not enough space for code cave");
+	}
+
+	woody->Phdr[i].p_filesz += payload->len;
+	woody->Phdr[i].p_memsz += payload->len;
+
+	if (insert_payload(woody, payload, payload_position, i))
+	{
+		free(payload->payload);
+		free(payload);
+		return ft_put_error("Unable to insert payload, please regenerate it");
+	}
+
+	woody->Ehdr->e_entry = payload_position;
+	woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
+	free(payload->payload);
+	free(payload);
+	return EXIT_SUCCESS;
+}
+
+int get_elf_sections(t_elf_content *woody)
+{
+	woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
+	if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != ELFCLASS64)
+	{
+		printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
+		return EXIT_FAILURE;
+	}
+	woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
+
+	woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
+	if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
+		return EXIT_FAILURE;
+	return EXIT_SUCCESS;
+}

srcs/woody32.c

@@ -1,80 +0,0 @@
-#include "../includes/woody.h"
-
-int	get_load_segment32(t_elf_content *woody, int start, bool executable)
-{
-	t_elf32 *elf = woody->elf32;
-	for (int i = start; i < elf->Ehdr->e_phnum; i++)
-	{
-		if (elf->Phdr[i].p_type == PT_LOAD)
-		{
-			if (executable)
-			{
-				if (elf->Phdr[i].p_flags & PF_X)
-					return i;
-			}
-			else
-				return i;
-		}
-	}
-	return -1;
-}
-
-int	inject32(t_elf_content *woody)
-{
-	t_elf32 *elf = woody->elf32;
-	t_payload *payload = get_payload();
-	if (!payload)
-		return EXIT_FAILURE;
-
-	int i = get_load_segment32(woody, 0, true);
-	int j = get_load_segment32(woody, i + 1, false);
-
-	if (i == -1 || j != i + 1)
-	{
-		free(payload->payload);
-		free(payload);
-		return ft_put_error("PT_LOAD segment missing");
-	}
-
-	size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz);
-	size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz;
-
-	if (code_cave_size < (size_t)payload->len)
-	{
-		free(payload->payload);
-		free(payload);
-		return ft_put_error("Unable to insert payload, not enough space for code cave");
-	}
-
-	elf->Phdr[i].p_filesz += payload->len;
-	elf->Phdr[i].p_memsz += payload->len;
-	elf->Ehdr->e_entry = payload_position;
-
-	if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz))
-	{
-		free(payload->payload);
-		free(payload);
-		return ft_put_error("Unable to insert payload, please regenerate it");
-	}
-
-	elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
-	free(payload->payload);
-	free(payload);
-	return EXIT_SUCCESS;
-}
-
-int get_elf_sections32(t_elf_content *woody)
-{
-	woody->elf32->Ehdr = (Elf32_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf32_Ehdr));
-	if (!woody->elf32->Ehdr)
-		return EXIT_FAILURE;
-
-	woody->elf32->Phdr = (Elf32_Phdr *)fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_phoff, sizeof(Elf32_Phdr));
-	if (!woody->elf32->Phdr)
-		return EXIT_FAILURE;
-		
-	woody->elf32->Shdr = (Elf32_Shdr *)fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_shoff, sizeof(Elf32_Shdr));
-	if (!woody->elf32->Shdr || !fetch(woody->file, woody->file_size, woody->elf32->Ehdr->e_shoff, woody->elf32->Ehdr->e_shnum * sizeof(Elf32_Shdr)))
-		return EXIT_FAILURE;
-	return EXIT_SUCCESS;
-}

srcs/woody64.c

@@ -1,102 +0,0 @@
-#include "../includes/woody.h"
-
-int	get_load_segment64(t_elf_content *woody, int start, bool executable)
-{
-	t_elf64 *elf = woody->elf64;
-	for (int i = start; i < elf->Ehdr->e_phnum; i++)
-	{
-		if (elf->Phdr[i].p_type == PT_LOAD)
-		{
-			if (executable)
-			{
-				if (elf->Phdr[i].p_flags & PF_X)
-					return i;
-			}
-			else
-				return i;
-		}
-	}
-	return -1;
-}
-
-int	inject64(t_elf_content *woody)
-{
-	t_elf64 *elf = woody->elf64;
-	t_payload *payload = get_payload();
-	if (!payload)
-		return EXIT_FAILURE;
-
-	int i = get_load_segment64(woody, 0, true);
-	int j = get_load_segment64(woody, i + 1, false);
-
-	if (i == -1 || j != i + 1)
-	{
-		free(payload->payload);
-		free(payload);
-		return ft_put_error("PT_LOAD segment missing");
-	}
-
-	size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz);
-	size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz;
-
-	if (code_cave_size < (size_t)payload->len)
-	{
-		free(payload->payload);
-		free(payload);
-		return ft_put_error("Unable to insert payload, not enough space for code cave");
-	}
-
-
-	if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz))
-	{
-		free(payload->payload);
-		free(payload);
-		return ft_put_error("Unable to insert payload, please regenerate it");
-	}
-
-	elf->Ehdr->e_entry = payload_position;
-	elf->Phdr[i].p_filesz += payload->len;
-	elf->Phdr[i].p_memsz += payload->len;
-	elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
-	elf->text_section->sh_size += payload->len;
-	free(payload->payload);
-	free(payload);
-	return EXIT_SUCCESS;
-}
-
-int get_elf_sections64(t_elf_content *woody)
-{
-	t_elf64 *elf = woody->elf64;
-	
-	elf->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
-	if (!elf->Ehdr)
-		return EXIT_FAILURE;
-
-	elf->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_phoff, sizeof(Elf64_Phdr));
-	if (!elf->Phdr)
-		return EXIT_FAILURE;
-
-	elf->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, sizeof(Elf64_Shdr));
-	if (!elf->Shdr || !fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, elf->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
-		return EXIT_FAILURE;
-
-	if (!fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff + (elf->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
-		return EXIT_FAILURE;
-
-	char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, elf->Shdr[elf->Ehdr->e_shstrndx].sh_offset, 0);
-	if (Sshstrtab == NULL)
-		return EXIT_FAILURE;
-
-	for (int i = 0; i < elf->Ehdr->e_shnum;i++)
-	{
-    	if (elf->Shdr[i].sh_type == SHT_PROGBITS && elf->Shdr[i].sh_flags & SHF_EXECINSTR && elf->Shdr[i].sh_flags & SHF_ALLOC && elf->Shdr[i].sh_flags & SHF_EXECINSTR)
-		{
-			if (Sshstrtab + elf->Shdr[i].sh_name < (char *)woody->file + woody->file_size && !ft_strncmp(".text\0", Sshstrtab + elf->Shdr[i].sh_name, 6))
-			{
-				elf->text_section = &elf->Shdr[i];
-				return EXIT_SUCCESS;
-			}
-		}
-	}
-	return EXIT_FAILURE;
-}