gbrochar
/
woody-woodpacker
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

Compare commits

base: gbrochar:d72905c8876118639b9895070d672f923f0caa2f
Branches Tags
gbrochar:master
gbrochar:refacto
gbrochar:rsa-asm
gbrochar:rot1
gbrochar:rsa
...
compare: gbrochar:0ddaef8b12b80a0d8bfa92021d372ec56197ac4a
Branches Tags
gbrochar:refacto
gbrochar:rsa-asm
gbrochar:master
gbrochar:rot1
gbrochar:rsa

13 Commits
d72905c887 ... 0ddaef8b12

Author SHA1 Message Date
gbrochar 0ddaef8b12 Merge branch 'rsa-asm' 2024-08-20 16:36:54 +02:00
gbrochar 270479ced3 Merge pull request 'rot1' (#2) from rot1 into master 
Reviewed-on: #2
Reviewed-by: gbrochar <gaetanbrochard@protonmail.com>
 2024-08-20 13:52:23 +00:00
pbonilla fb51b9d0d2 Reset to help behaviour without text section 2024-07-24 16:59:27 +02:00
pbonilla 8756c0a8fa update encrypt 2024-06-19 17:12:30 +02:00
pbonilla 1c9ce75873 32 bits management 2024-06-19 15:21:28 +02:00
pbonilla 3dfc4c27d2 refactoring and removing code cave creation 2024-06-18 18:11:20 +02:00
pbonilla 8c994bb196 update entry of .got .dynamic 2024-06-17 19:28:54 +02:00
pbonilla 8571953eb3 entry of relat section offset 2024-06-16 16:30:50 +02:00
pbonilla 7d417ac4e7 Offset more datas on codecave creation 2024-06-12 13:40:57 +02:00
pbonilla ff92116756 Modify test file 2024-06-12 13:39:57 +02:00
pbonilla 3300cea9c6 Fix Makefile 2024-06-12 13:39:29 +02:00
pbonilla 1bdcef2b95 test file added 2024-06-12 13:38:39 +02:00
pbonilla b167573925 Refactoring : code cave creation 2024-05-23 13:37:43 +02:00
24 changed files with 3427 additions and 3779 deletions
Show Stats Expand all files Collapse all files

7
Makefile
View File

@ -4,7 +4,9 @@ SRCS_PATH = srcs/
SRCS = $(SRCS_PATH)main.c \
$(SRCS_PATH)utils.c \
$(SRCS_PATH)woody.c \
$(SRCS_PATH)payload.c \
$(SRCS_PATH)woody32.c \
$(SRCS_PATH)woody64.c \
$(SRCS_PATH)encrypt.c \
$(SRCS_PATH)rsa.c \
$(SRCS_PATH)primes.c
@ -18,7 +20,7 @@ RM = rm -f
LIBFT_FLAGS = ft_printf/libftprintf.a
CFLAGS = -Wall -Wextra -Werror -g3
CFLAGS = -Wall -Wextra -Werror
all: ${NAME}
@ -35,6 +37,7 @@ clean:
fclean: clean
make -C ft_printf fclean
make clean
${RM} ${NAME}
re: fclean

BIN
big_sample Executable file
View File

Binary file not shown.

1257
big_sample.hex Normal file
View File

File diff suppressed because it is too large Load Diff

40
includes/woody.h
View File

@ -28,18 +28,32 @@
typedef struct payload
{
char *payload;
size_t len;
int len;
} t_payload;
typedef struct elf32
{
Elf32_Ehdr *Ehdr;
Elf32_Phdr *Phdr;
Elf32_Shdr *Shdr;
Elf32_Shdr *text_section;
} t_elf32;
typedef struct elf64
{
Elf64_Ehdr *Ehdr;
Elf64_Phdr *Phdr;
Elf64_Shdr *Shdr;
Elf64_Shdr *text_section;
} t_elf64;
typedef struct elf_content
{
long unsigned int file_size;
char *file_path;
char *file;
Elf64_Ehdr *Ehdr;
Elf64_Phdr *Phdr;
Elf64_Shdr *Shdr;
char *extra_data;
t_elf32 *elf32;
t_elf64 *elf64;
} t_elf_content;
// utils.c
@ -47,9 +61,21 @@ void *fetch(char *file, unsigned long file_size, unsigned long offset_to_data, u
int ft_put_error(char *str);
char *get_string(char *str, char *end_file);
int get_symbols_count(int sh_size, int sh_entsize);
char *get_section_name(t_elf_content *woody, int section_index);
int elf_magic_numbers(char *str);
// payload.c
t_payload *get_payload();
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, unsigned int e_entry, unsigned int p_offset, unsigned int p_memszi, rsa_t rsa);
// woody32.c
int get_elf_sections32(t_elf_content *woody);
int inject32(t_elf_content *woody);
// woody64.c
int get_elf_sections64(t_elf_content *woody);
int inject64(t_elf_content *woody);
// woody.c
int prepare_injection(t_elf_content *woody);
// encrypt.c
unsigned long encrypt(char *file, unsigned long int offset, unsigned long int size, rsa_t rsa);

BIN
not_that_big Executable file
View File

Binary file not shown.

1001
not_that_big.hex Normal file
View File

File diff suppressed because it is too large Load Diff

412
resources/big_sample.c Normal file
View File

@ -0,0 +1,412 @@
#include <stdio.h>
int main(void) {
printf("Hello, World!\n");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
return (0);
}

332
resources/not_that_big.c Normal file
View File

@ -0,0 +1,332 @@
#include <stdio.h>
int main(void) {
printf("Hello, World!\n");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
return (0);
}

7
resources/sample.c
View File

@ -1,7 +1,6 @@
#include <stdio.h>
int
main(void) {
ft_printf("Hello, World!\n");
return (0x0);
int main(void) {
printf("Hello, World!\n");
return (0);
}

43
rsa64/Makefile
View File

@ -1,43 +0,0 @@
NAME = rsa
SRC = \
main.c \
rsa.c \
utils.c \
primes.c \
all: $(NAME)
$(NAME):
gcc -Wall -Wextra -Werror -Wunused-function $(SRC) -o $(NAME)
fast:
gcc -Wall -Wextra -Werror -Wunused-function -O3 $(SRC) -o $(NAME)
fast-info:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -fopt-info $(SRC) -o $(NAME)
really-fast:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -march=native $(SRC) -o $(NAME)
really-fast-info:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -march=native -fopt-info $(SRC) -o $(NAME)
profile:
gcc -Wall -Wextra -Werror -Wunused-function -pg $(SRC) -o $(NAME)
profile-clang:
clang -Wall -Wextra -Werror -Wunused-function -pg $(SRC) -o $(NAME)
profile-fast:
gcc -Wall -Wextra -Werror -Wunused-function -O3 -pg $(SRC) -o $(NAME)
profile-fast-clang:
clang -Wall -Wextra -Werror -Wunused-function -O3 -pg $(SRC) -o $(NAME)
fclean:
rm -rf $(NAME)
re: fclean all
.PHONY: all fast profile profile-fast fclean re

14
rsa64/main.c
View File

@ -1,14 +0,0 @@
#include "rsa.h"
int main(int ac, char **av) {
if (ac == 2) {
(void)av;
rsa_t rsa = rsa_generate_keys();
(void)rsa;
}
else {
printf("usage: ./rsa message\n");
}
return 0;
}

3245
rsa64/primes.0000
View File

File diff suppressed because it is too large Load Diff

74
rsa64/primes.c
View File

@ -1,74 +0,0 @@
#include "rsa.h"
uint16_t get_random_bytes(int fd) {
uint16_t ret;
if (read(fd, &ret, sizeof(uint16_t)) == -1) {
exit(1);
}
return ret;
}
// n pow e mod m
uint64_t pow_mod(uint64_t n, uint64_t e, uint64_t m) {
uint64_t y = 1;
while (e > 1) {
if (e & 1) {
y = (y * n) % m;
}
n = (n * n) % m;
e = e >> 1;
}
return (n * y) % m;
}
bool is_prime(uint16_t n, size_t k_max, int fd) {
uint16_t a = get_random_bytes(fd);
uint16_t d = n - 1;
uint16_t s = 0;
while ((d & 1) == 0) {
s++;
d = d >> 1;
}
for (size_t k = 0; k < k_max; k++) {
a = 0;
while (a < 2 || a > (n - 2)) {
a = get_random_bytes(fd);
}
uint16_t x = pow_mod(a, d, n);
uint16_t y;
for (uint16_t i = 0; i < s; i++) {
y = pow_mod(x, 2, n);
if (y == 1 && x != 1 && x != n - 1)
return false;
x = y;
}
if (y != 1) {
return false;
}
}
return true;
}
uint16_t generate_prime_fd(int fd) {
uint16_t n = get_random_bytes(fd);
n |= 1 << 15;
n |= 1;
while (!is_prime(n, 16, fd)) {
n = get_random_bytes(fd);
n |= 1 << 15;
n |= 1;
}
return n;
}
uint16_t generate_prime() {
int fd = open("/dev/urandom", O_RDONLY);
uint16_t n = generate_prime_fd(fd);
close(fd);
return n;
}

111
rsa64/rsa.c
View File

@ -1,111 +0,0 @@
#include "rsa.h"
int64_t euler(int64_t r0, int64_t r1) {
int64_t s0 = 1;
int64_t s1 = 0;
int64_t t0 = 0;
int64_t t1 = 1;
int64_t q0 = 0;
while (r1 != 0) {
q0 = r0 / r1;
int64_t tmp = r0 % r1;
r0 = r1;
r1 = tmp;
tmp = s0 - q0 * s1;
s0 = s1;
s1 = tmp;
tmp = t0 - q0 * t1;
t0 = t1;
t1 = tmp;
}
return s0;
}
rsa_t rsa_generate_keys(void) {
for (int try = 0; try < 1000; try++) {
if (try % 100 == 0)
printf("try: %d\n", try);
int64_t p = (uint64_t)generate_prime();
int64_t q = (uint64_t)generate_prime();
int64_t ln = (p - 1) * (q - 1);
int64_t e = 11317;
while (ln % e == 0 || p == q) {
p = generate_prime();
q = generate_prime();
ln = (p - 1) * (q - 1);
}
if (q > p) {
uint64_t tmp = p;
p = q;
q = tmp;
}
int64_t n = p * q;
int64_t r0 = e;
int64_t r1 = ln;
int64_t s0 = 1;
int64_t s1 = 0;
int64_t t0 = 0;
int64_t t1 = 1;
int64_t q0 = 0;
while (r1 != 0) {
q0 = r0 / r1;
int64_t tmp = r0 % r1;
r0 = r1;
r1 = tmp;
tmp = s0 - q0 * s1;
s0 = s1;
s1 = tmp;
tmp = t0 - q0 * t1;
t0 = t1;
t1 = tmp;
}
int64_t d = euler(e, ln) + ln;
if (d > n) {
d -= ln;
}
/* printf("p: %ld\n", p);
printf("q: %ld\n", q);
printf("ln: %ld\n", ln);
printf("n: %ld\n", n);
printf("d: %ld\n", d);
printf("e: %ld\n", e);
printf("d * e %% ln = %ld\n", (d*e)%ln);*/
for (uint64_t m = 0; m < 16384; m++) {
//uint64_t m = get_random_bytes(fd2);
uint64_t c = pow_mod(m, e, n);
uint64_t m2 = pow_mod(c, d, n);
if (m != m2) {
printf("ERROR try: %d\nround: n/a\nmsg: %ld\ncypher: %ld\ndecrypted: %ld\nd: %ld\ne: %ld\np: %lu\nq: %lu\nn: %lu\n", try, m, c, m2, d, e, p, q, n);
break;
}
}
//int64_t m = 42;
/*
for (int64_t m = 41; m < 43; m++) {
int64_t c = pow_mod(m, e, n);
int64_t m2 = pow_mod(c, d, n);
if (d < 0) {
int64_t c2 = euler(c, n);
printf("c2: %ld\n", c2);
printf("c2 * c %% n = %ld\n", ((c2 + n)*c)%n);
printf("c2 * c %% n = %ld\n", ((c2)*c)%n);
m2 = pow_mod(c2 + n, -d, n);
}
printf("message: %ld\n", m);
printf("cypher: %ld\n", c);
printf("decrypted: %ld\n", m2);
}*/
}
rsa_t rsa;
rsa.p.len = 42;
return rsa;
}

34
rsa64/rsa.h
View File

@ -1,34 +0,0 @@
#ifndef _RSA_H
#define _RSA_H 1
#include <stdint.h>
#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>
#define RSA_BLOCK_SIZE 128
typedef struct bigint_s {
uint32_t *data;
size_t len;
} bigint_t;
typedef struct rsa_s {
bigint_t p;
bigint_t q;
} rsa_t;
void *protected_malloc(size_t size);
rsa_t rsa_generate_keys();
uint16_t generate_prime();
uint64_t pow_mod(uint64_t nn, uint64_t e, uint64_t mm);
uint16_t get_random_bytes(int fd);
#endif

9
rsa64/utils.c
View File

@ -1,9 +0,0 @@
#include "rsa.h"
void *protected_malloc(size_t size) {
void *ptr = malloc(size);
if (!ptr) {
printf("malloc returned NULL");
}
return ptr;
}

1
srcs/encrypt.c
View File

@ -49,4 +49,3 @@ unsigned long encrypt(char *file, unsigned long int offset, unsigned long int si
printf("\n");
return offset + padded_len * sizeof(uint32_t);
}

99
srcs/main.c
View File

@ -1,5 +1,12 @@
#include "../includes/woody.h"
void free_elf_content(t_elf_content *woody)
{
if (woody->elf32)
free(woody->elf32);
else if (woody->elf64)
free(woody->elf64);
}
int get_elf_file(t_elf_content *woody)
{
int fd;
@ -8,14 +15,14 @@ int get_elf_file(t_elf_content *woody)
fd = open(woody->file_path, O_RDONLY);
if (fd < 0)
{
printf("Error: Failed to open \'%s\'\n", woody->file_path);
ft_printf("Error: Failed to open \'%s\'\n", woody->file_path);
return EXIT_FAILURE;
}
off = lseek(fd, 0, SEEK_END);
if (off == -1)
{
close(fd);
printf("Error: Failed to read file offset \'%s\'\n", woody->file_path);
ft_printf("Error: Failed to read file offset \'%s\'\n", woody->file_path);
return EXIT_FAILURE;
}
woody->file_size = off;
@ -23,24 +30,98 @@ int get_elf_file(t_elf_content *woody)
if (woody->file == MAP_FAILED)
{
close(fd);
printf("Error: Failed to map file \'%s\'\n", woody->file_path);
ft_printf("Error: Failed to map file \'%s\'\n", woody->file_path);
return EXIT_FAILURE;
}
close(fd);
return EXIT_SUCCESS;
}
int save_file(char *path, char *file, unsigned long int size)
{
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
if (fd == -1) {
ft_printf("Error: Failed to create new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (write(fd, file, size) == -1) {
close(fd);
ft_printf("Error: Failed to write new file \'%s\'\n", path);
return EXIT_FAILURE;
}
close(fd);
return EXIT_SUCCESS;
}
int save_woody(t_elf_content *woody)
{
char *woody_file = malloc(woody->file_size);
if (!woody_file)
return ft_put_error("Allocation error");
ft_memcpy(woody_file, woody->file, woody->file_size);
if (munmap(woody->file, woody->file_size))
return ft_put_error("Umapping error");
int save_error = save_file("woody", woody_file, woody->file_size);
if (save_error)
return save_error;
free(woody_file);
return EXIT_SUCCESS;
}
int main(int ac, char **av)
{
t_elf_content woody;
t_elf_content woody = {0};
if (ac != 2)
{
return ft_put_error("Woody_woodpacker take 1 argument\n");
}
woody.file_path = av[1];
int ret = get_elf_file(&woody);
if (ret == EXIT_FAILURE)
return ret;
return prepare_injection(&woody);
int elf_error = get_elf_file(&woody);
if (elf_error)
return elf_error;
if (woody.file_size < sizeof(Elf32_Ehdr) || !elf_magic_numbers(woody.file))
{
ft_printf("Error: \'%s\' is not a valid ELF file\n", woody.file_path);
return EXIT_FAILURE;
}
int elfclass = woody.file[4];
if (elfclass == ELFCLASS32)
{
if (!(woody.elf32 = malloc(sizeof(t_elf32))))
return ft_put_error("Allocation error");
elf_error = get_elf_sections32(&woody);
}
else if (elfclass == ELFCLASS64)
{
if (!(woody.elf64 = malloc(sizeof(t_elf64))))
return ft_put_error("Allocation error");
elf_error = get_elf_sections64(&woody);
}
else
{
elf_error = EXIT_FAILURE;
ft_printf("Error: \'%s\' is not a valid ELF file\n", woody.file_path);
}
if (elf_error)
return elf_error;
int inject_error = -1;
if (elfclass == ELFCLASS32)
{
inject_error = inject32(&woody);
}
else if (elfclass == ELFCLASS64)
{
inject_error = inject64(&woody);
}
if (inject_error)
{
free_elf_content(&woody);
return inject_error;
}
int save_error = save_woody(&woody);
free_elf_content(&woody);
return save_error;
}

71
srcs/payload.c Normal file
View File

@ -0,0 +1,71 @@
#include "../includes/woody.h"
t_payload *get_payload()
{
t_payload *payload = malloc(sizeof(t_payload));
if (!payload)
return NULL;
char buffer[1024];
int fd = open("payload", O_RDONLY);
if (fd == -1) {
ft_put_error("Failed to open payload");
free(payload);
return NULL;
}
payload->len = read(fd, buffer, 1024);
if (payload->len == -1)
{
ft_put_error("Failed to read payload");
free(payload);
close(fd);
return NULL;
}
close(fd);
payload->payload = malloc(sizeof(char) * payload->len);
if (!payload->payload)
{
ft_put_error("Allocation error");
free(payload);
return NULL;
}
ft_memcpy(payload->payload, buffer, payload->len);
return payload;
}
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, unsigned int e_entry, unsigned int p_offset, unsigned int p_memsz, rsa_t rsa)
{
char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
char *ptr_private_key = ft_strnstr_nullterminated(payload->payload, PRIVATE_KEY, payload->len);
char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size)
{
int32_t woody_index = ptr_woody - payload->payload;
int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
int32_t jump_value = ((payload_position + jmp_index + 5 - 1) - e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
ft_memcpy(&payload->payload[jmp_index + 1 - 1], &jump_value, sizeof(jump_value));
printf("jump_value = %d (%x)\n", jump_value, jump_value);
printf("jmp_index = %d (%x)\n", jmp_index, jmp_index);
printf("payload_position = %ld (%lx)\n", payload_position, payload_position);
printf("e_entry = %d (%x)\n", e_entry, e_entry);
int64_t text_index = ptr_text_section - payload->payload;
int64_t text_value = payload_position - p_offset + woody_index;
ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
int64_t section_index = ptr_section_size - payload->payload;
int64_t section_value = p_memsz * 33/32 + 1; //woody->text_section->sh_size;
ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
int64_t private_key_index = ptr_private_key - payload->payload;
int64_t private_key_value = (rsa.n << 32) + rsa.d;
ft_memcpy(&payload->payload[private_key_index], &private_key_value, sizeof(uint64_t));
ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
return EXIT_SUCCESS;
}
return EXIT_FAILURE;
}

6
srcs/utils.c
View File

@ -7,6 +7,11 @@ void *fetch(char *file, unsigned long file_size, unsigned long offset_to_data, u
return NULL;
}
int elf_magic_numbers(char *str)
{
return (!ft_strncmp(str, ELFMAG, SELFMAG));
}
int get_symbols_count(int sh_size, int sh_entsize)
{
if (sh_size <= 0 || sh_entsize <= 0)
@ -22,7 +27,6 @@ char *get_string(char *str, char *end_file)
if (*search_end == 0)
return str;
++search_end;
}
return NULL;
}

219
srcs/woody.c
View File

@ -1,219 +0,0 @@
#include "../includes/woody.h"
#include "../includes/rsa.h"
int elf_magic_numbers(char *str)
{
return (!ft_strncmp(str, ELFMAG, SELFMAG));
}
int save_elf(char *path, char *file, unsigned long int size)
{
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
if (fd == -1) {
printf("Error: Failed to create new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (write(fd, file, size) == -1) {
close(fd);
printf("Error: Failed to write new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (close(fd) == -1) {
printf("Error: Failed to close new file \'%s\'\n", path);
return EXIT_FAILURE;
}
return EXIT_SUCCESS;
}
int get_load_segment(t_elf_content *woody, int start, bool executable)
{
for (int i = start; i < woody->Ehdr->e_phnum; i++)
{
if (woody->Phdr[i].p_type == PT_LOAD)
{
if (executable)
{
if (woody->Phdr[i].p_flags & PF_X)
return i;
}
else
return i;
}
}
return -1;
}
void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offset_ammount)
{
for (int i = 0; i < woody->Ehdr->e_phnum; i++)
{
if (woody->Phdr[i].p_offset > from)
woody->Phdr[i].p_offset += offset_ammount;
}
for (int i = 0; i < woody->Ehdr->e_shnum; i++)
{
if (woody->Shdr[i].sh_offset > from)
woody->Shdr[i].sh_offset += offset_ammount;
}
}
size_t create_codecave(t_elf_content *woody, Elf64_Phdr *load_segment, t_payload *payload)
{
const unsigned int page_size = 4096; // getpagesize(); not authorized
unsigned int padding_size = ((payload->len / page_size) + 1) * page_size;
unsigned int codecave_start = load_segment->p_offset + load_segment->p_filesz;
offset_sections(woody, codecave_start, padding_size);
char *new_woody = malloc(woody->file_size + padding_size);
if (!new_woody)
return 0;
ft_memcpy(new_woody, woody->file, codecave_start);
ft_bzero(new_woody + codecave_start, padding_size);
ft_memcpy(new_woody + codecave_start + padding_size, woody->file + codecave_start, woody->file_size - codecave_start);
munmap(woody->file, woody->file_size);
woody->file = new_woody;
woody->file_size += padding_size;
woody->Ehdr = (Elf64_Ehdr *)new_woody;
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
return codecave_start;
}
t_payload *get_payload()
{
t_payload *payload = malloc(sizeof(t_payload));
if (!payload)
return NULL;
char buffer[1024];
int fd = open("payload", O_RDONLY);
if (fd == -1) {
perror("error opening payload");
free(payload);
exit(1);
}
payload->len = read(fd, buffer, 1024);
printf("payload len%ld\n", payload->len);
payload->payload = malloc(sizeof(char) * payload->len);
ft_memcpy(payload->payload, buffer, payload->len);
return payload;
}
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, int load_segment_index, rsa_t rsa)
{
(void)rsa;
//printf("salut %s\n", JUMP_VALUE);
/*for (size_t i = 0; i < payload->len; i++) {
printf("%c", *(payload->payload + i));
}*/
char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
char *ptr_private_key = ft_strnstr_nullterminated(payload->payload, PRIVATE_KEY, payload->len);
char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size && ptr_private_key)
{
printf("payload position %ld (%lx)\n", payload_position, payload_position);
printf("ptr_woody : %p\n", ptr_woody);
printf("ptr_section_size: %p\n", ptr_section_size);
printf("ptr_text_section : %p\n", ptr_text_section);
printf("ptr_jmp_value : %p\n", ptr_jmp_value);
printf("ptr_private_key: %p\n", ptr_private_key);
int32_t woody_index = ptr_woody - payload->payload;
int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
int32_t jump_value = ((payload_position + jmp_index + 5 - 1) - woody->Ehdr->e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
ft_memcpy(&payload->payload[jmp_index + 1 - 1], &jump_value, sizeof(jump_value));
int64_t text_index = ptr_text_section - payload->payload;
int64_t text_value = payload_position - woody->Phdr[load_segment_index].p_offset + woody_index;
ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
int64_t section_index = ptr_section_size - payload->payload;
int64_t section_value = woody->Phdr[load_segment_index].p_memsz * 33/32 + 1; //woody->text_section->sh_size;
ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
int64_t private_key_index = ptr_private_key - payload->payload;
int64_t private_key_value = (rsa.n << 32) + rsa.d;
ft_memcpy(&payload->payload[private_key_index], &private_key_value, sizeof(uint64_t));
ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
printf("Code cave start = %ld (%lx)\n", payload_position, payload_position);
printf("Payload size = %ld (%lx)\n", payload->len, payload->len);
printf("Backward offset = %d (%x)(%x)\n", jump_value, jump_value, -jump_value);
return EXIT_SUCCESS;
}
printf("c'est la merde\n");
printf("ptr_woody : %p\n", ptr_woody);
printf("ptr_section_size: %p\n", ptr_section_size);
printf("ptr_text_section : %p\n", ptr_text_section);
printf("ptr_jmp_value : %p\n", ptr_jmp_value);
printf("ptr_private_key: %p\n", ptr_private_key);
return EXIT_FAILURE;
}
void inject(t_elf_content *woody)
{
t_payload *payload = get_payload();
int i = get_load_segment(woody, 0, true);
int j = get_load_segment(woody, i + 1, false);
size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
size_t payload_position;
printf("load position = : %ld (%lx)\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_offset);
printf("load size = : %ld (%lx)\n", woody->Phdr[i].p_filesz, woody->Phdr[i].p_filesz);
if (code_cave_size > payload->len) // inverse here to test the other technique
{
payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_memsz;
printf("Code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size);
}
else
{
payload_position = create_codecave(woody, &woody->Phdr[i], payload);
}
rsa_t rsa = rsa_generate_keys();
printf("key n : %ld (%lx) key d %ld (%lx), key total : %ld (%lx)\n", rsa.n, rsa.n, rsa.d, rsa.d, (rsa.n << 32) + rsa.d, (rsa.n << 32) + rsa.d);
payload_position = encrypt(woody->file, woody->Phdr[i].p_offset, woody->Phdr[i].p_memsz, rsa);
printf("Payload position : %ld (%lx)\n", payload_position, payload_position);
insert_payload(woody, payload, payload_position, i, rsa);
woody->Ehdr->e_entry = payload_position;
woody->Phdr[i].p_filesz += payload->len + 15;
woody->Phdr[i].p_memsz += payload->len + 15;
woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
}
int get_elf_sections(t_elf_content *woody)
{
woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != ELFCLASS64)
{
printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
return EXIT_FAILURE;
}
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
return EXIT_SUCCESS;
}
int prepare_injection(t_elf_content *woody)
{
int elf_statut = get_elf_sections(woody);
if (elf_statut)
return elf_statut;
inject(woody);
char *woody_file;
if (!(woody_file = malloc(woody->file_size)))
return ft_put_error("Allocation error");
ft_memcpy(woody_file, woody->file, woody->file_size);
munmap(woody_file, woody->file_size);
save_elf("woody", woody_file, woody->file_size);
free(woody_file);
return EXIT_SUCCESS;
}

108
srcs/woody32.c Normal file
View File

@ -0,0 +1,108 @@
#include "../includes/woody.h"
int get_load_segment32(t_elf_content *woody, int start, bool executable)
{
t_elf32 *elf = woody->elf32;
for (int i = start; i < elf->Ehdr->e_phnum; i++)
{
if (elf->Phdr[i].p_type == PT_LOAD)
{
if (executable)
{
if (elf->Phdr[i].p_flags & PF_X)
return i;
}
else
return i;
}
}
return -1;
}
int inject32(t_elf_content *woody)
{
t_elf32 *elf = woody->elf32;
t_payload *payload = get_payload();
if (!payload)
return EXIT_FAILURE;
int i = get_load_segment32(woody, 0, true);
int j = get_load_segment32(woody, i + 1, false);
if (i == -1 || j != i + 1)
{
free(payload->payload);
free(payload);
return ft_put_error("PT_LOAD segment missing");
}
size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz);
size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz;
rsa_t rsa = rsa_generate_keys();
printf("key n : %ld (%lx) key d %ld (%lx), key total : %ld (%lx)\n", rsa.n, rsa.n, rsa.d, rsa.d, (rsa.n << 32) + rsa.d, (rsa.n << 32) + rsa.d);
if (code_cave_size < (size_t)payload->len)
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, not enough space for code cave");
}
payload_position = encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz, rsa);
if (insert_payload(woody, payload, payload_position, elf->text_section->sh_offset, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz, rsa))
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, please regenerate it");
}
printf("code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size);
printf("payload_position = %ld (%lx)\n", payload_position, payload_position);
printf("elf->Phdr[i].p_offset = %d (%x)\n", elf->Phdr[i].p_offset, elf->Phdr[i].p_offset);
printf("elf->Phdr[i].p_filesz = %d (%x)\n", elf->Phdr[i].p_filesz, elf->Phdr[i].p_filesz);
printf("elf->Phdr[j].p_offset = %d (%x)\n", elf->Phdr[j].p_offset, elf->Phdr[j].p_offset);
elf->Phdr[i].p_filesz += payload->len;
elf->Phdr[i].p_memsz += payload->len;
elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
free(payload->payload);
free(payload);
return EXIT_SUCCESS;
}
int get_elf_sections32(t_elf_content *woody)
{
t_elf32 *elf = woody->elf32;
elf->Ehdr = (Elf32_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf32_Ehdr));
if (!elf->Ehdr)
return EXIT_FAILURE;
elf->Phdr = (Elf32_Phdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_phoff, sizeof(Elf32_Phdr));
if (!elf->Phdr)
return EXIT_FAILURE;
elf->Shdr = (Elf32_Shdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, sizeof(Elf32_Shdr));
if (!elf->Shdr || !fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, elf->Ehdr->e_shnum * sizeof(Elf32_Shdr)))
return EXIT_FAILURE;
if (!fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff + (elf->Ehdr->e_shstrndx * sizeof(Elf32_Shdr)), sizeof(Elf32_Shdr)))
return EXIT_FAILURE;
char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, elf->Shdr[elf->Ehdr->e_shstrndx].sh_offset, 0);
if (Sshstrtab == NULL)
return EXIT_FAILURE;
for (int i = 0; i < elf->Ehdr->e_shnum;i++)
{
if (elf->Shdr[i].sh_type == SHT_PROGBITS && elf->Shdr[i].sh_flags & SHF_EXECINSTR && elf->Shdr[i].sh_flags & SHF_ALLOC && elf->Shdr[i].sh_flags & SHF_EXECINSTR)
{
if (Sshstrtab + elf->Shdr[i].sh_name < (char *)woody->file + woody->file_size && !ft_strncmp(".text\0", Sshstrtab + elf->Shdr[i].sh_name, 6))
{
elf->text_section = &elf->Shdr[i];
return EXIT_SUCCESS;
}
}
}
return EXIT_FAILURE;
}

104
srcs/woody64.c Normal file
View File

@ -0,0 +1,104 @@
#include "../includes/woody.h"
int get_load_segment64(t_elf_content *woody, int start, bool executable)
{
t_elf64 *elf = woody->elf64;
for (int i = start; i < elf->Ehdr->e_phnum; i++)
{
if (elf->Phdr[i].p_type == PT_LOAD)
{
if (executable)
{
if (elf->Phdr[i].p_flags & PF_X)
return i;
}
else
return i;
}
}
return -1;
}
int inject64(t_elf_content *woody)
{
t_elf64 *elf = woody->elf64;
t_payload *payload = get_payload();
if (!payload)
return EXIT_FAILURE;
int i = get_load_segment64(woody, 0, true);
int j = get_load_segment64(woody, i + 1, false);
if (i == -1 || j != i + 1)
{
free(payload->payload);
free(payload);
return ft_put_error("PT_LOAD segment missing");
}
size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz);
size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz;
rsa_t rsa = rsa_generate_keys();
printf("key n : %ld (%lx) key d %ld (%lx), key total : %ld (%lx)\n", rsa.n, rsa.n, rsa.d, rsa.d, (rsa.n << 32) + rsa.d, (rsa.n << 32) + rsa.d);
if (code_cave_size < (size_t)payload->len)
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, not enough space for code cave");
}
payload_position = encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz, rsa);
if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz, rsa))
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, please regenerate it");
}
elf->Ehdr->e_entry = payload_position;
elf->Phdr[i].p_filesz += payload->len;
elf->Phdr[i].p_memsz += payload->len;
elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
free(payload->payload);
free(payload);
return EXIT_SUCCESS;
}
int get_elf_sections64(t_elf_content *woody)
{
t_elf64 *elf = woody->elf64;
elf->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
if (!elf->Ehdr)
return EXIT_FAILURE;
elf->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_phoff, sizeof(Elf64_Phdr));
if (!elf->Phdr)
return EXIT_FAILURE;
elf->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, sizeof(Elf64_Shdr));
if (!elf->Shdr || !fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, elf->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
if (!fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff + (elf->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, elf->Shdr[elf->Ehdr->e_shstrndx].sh_offset, 0);
if (Sshstrtab == NULL)
return EXIT_FAILURE;
for (int i = 0; i < elf->Ehdr->e_shnum;i++)
{
if (elf->Shdr[i].sh_type == SHT_PROGBITS && elf->Shdr[i].sh_flags & SHF_EXECINSTR && elf->Shdr[i].sh_flags & SHF_ALLOC && elf->Shdr[i].sh_flags & SHF_EXECINSTR)
{
if (Sshstrtab + elf->Shdr[i].sh_name < (char *)woody->file + woody->file_size && !ft_strncmp(".text\0", Sshstrtab + elf->Shdr[i].sh_name, 6))
{
elf->text_section = &elf->Shdr[i];
return EXIT_SUCCESS;
}
}
}
return EXIT_FAILURE;
}