gbrochar
/
woody-woodpacker
1
0
Fork 0
Code Issues 1 Pull Requests 1 Packages Projects Releases Wiki Activity

rot1 #2

Merged
gbrochar merged 13 commits from rot1 into master 2024-08-20 13:52:23 +00:00
Conversation 1 Commits 13 Files Changed 16 +3424 -264
16 changed files with 3424 additions and 264 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
Makefile
View File

@ -4,7 +4,9 @@ SRCS_PATH = srcs/
SRCS = $(SRCS_PATH)main.c \
$(SRCS_PATH)utils.c \
$(SRCS_PATH)woody.c \
$(SRCS_PATH)payload.c \
$(SRCS_PATH)woody32.c \
$(SRCS_PATH)woody64.c \
$(SRCS_PATH)encrypt.c
@ -33,6 +35,7 @@ clean:
fclean:
make -C ft_printf fclean
make clean
${RM} ${NAME}
re: fclean

BIN
big_sample Executable file
View File

Binary file not shown.

1257
big_sample.hex Normal file
View File

File diff suppressed because it is too large Load Diff

47
includes/woody.h
View File

@ -16,26 +16,41 @@
#define JUMP "\xe9"
#define WOODY "..WOODY.."
#define WOODY "....WOODY...."
#define JUMP_VALUE "\xda\xda\xda"
#define TEXT_OFFSET "\xba\xba\xba\xba\xba\xba\xba\xba"
#define SECTION_SIZE "\xca\xca\xca\xca\xca\xca\xca\xca"
typedef struct payload
{
char *payload;
size_t len;
int len;
} t_payload;
typedef struct elf32
{
Elf32_Ehdr *Ehdr;
Elf32_Phdr *Phdr;
Elf32_Shdr *Shdr;
Elf32_Shdr *text_section;
} t_elf32;
typedef struct elf64
{
Elf64_Ehdr *Ehdr;
Elf64_Phdr *Phdr;
Elf64_Shdr *Shdr;
Elf64_Shdr *text_section;
} t_elf64;
typedef struct elf_content
{
long unsigned int file_size;
char *file_path;
char *file;
Elf64_Ehdr *Ehdr;
Elf64_Phdr *Phdr;
Elf64_Shdr *Shdr;
Elf64_Shdr *text_section;
char *extra_data;
t_elf32 *elf32;
t_elf64 *elf64;
} t_elf_content;
// utils.c
@ -43,9 +58,21 @@ void *fetch(char *file, unsigned long file_size, unsigned long offset_to_data, u
int ft_put_error(char *str);
char *get_string(char *str, char *end_file);
int get_symbols_count(int sh_size, int sh_entsize);
char *get_section_name(t_elf_content *woody, int section_index);
int elf_magic_numbers(char *str);
// payload.c
t_payload *get_payload();
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, unsigned int e_entry, unsigned int p_offset, unsigned int p_memsz);
// woody32.c
int get_elf_sections32(t_elf_content *woody);
int inject32(t_elf_content *woody);
// woody64.c
int get_elf_sections64(t_elf_content *woody);
int inject64(t_elf_content *woody);
// woody.c
int prepare_injection(t_elf_content *woody);
// encrypt.c
void encrypt(char *file, unsigned long int offset, unsigned long int size);

BIN
not_that_big Executable file
View File

Binary file not shown.

1001
not_that_big.hex Normal file
View File

File diff suppressed because it is too large Load Diff

26
print.s
View File

@ -11,18 +11,18 @@ _start:
lea rsi, [rel msg]
mov rax, rsi
sub rax, qword [rel text_section] ;text_section address
mov r8, qword [rel section_sisze] ;text_section size
mov r8, qword [rel section_size] ;text_section size
mov r9, 0 ;increment register
xor r10, r10
; encrypt:
; cmp r8, r9
; je end_encrypt
; mov r10b, byte[rax + r9]
; inc r10b ;rot + 1
; mov byte[rax + r9], r10b
; inc r9
; jmp encrypt
; end_encrypt:
encrypt:
cmp r8, r9
je end_encrypt
movzx r10, byte[rax + r9]
inc r10b ;rot + 1
mov byte[rax + r9], r10b
inc r9
jmp encrypt
end_encrypt:
mov rdx, 14
mov rax, 1
syscall
@ -31,7 +31,7 @@ _start:
pop rdi
pop rax
jmp 0x00000000 ;for now it needs to be the first jmp
jmp 0xdadadada
msg db "....WOODY....",10
text_section dq 0xbabababababababa
section_sisze dq 0xcacacacacacacaca
text_section dq 0xbabababababababa
section_size dq 0xcacacacacacacaca

412
resources/big_sample.c Normal file
View File

@ -0,0 +1,412 @@
#include <stdio.h>
int main(void) {
printf("Hello, World!\n");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
return (0);
}

332
resources/not_that_big.c Normal file
View File

@ -0,0 +1,332 @@
#include <stdio.h>
int main(void) {
printf("Hello, World!\n");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
printf(" ");
return (0);
}

5
resources/sample.c
View File

@ -1,7 +1,6 @@
#include <stdio.h>
int
main(void) {
int main(void) {
printf("Hello, World!\n");
return (0x0);
return (0);
}

95
srcs/main.c
View File

@ -1,5 +1,12 @@
#include "../includes/woody.h"
void free_elf_content(t_elf_content *woody)
{
if (woody->elf32)
free(woody->elf32);
else if (woody->elf64)
free(woody->elf64);
}
int get_elf_file(t_elf_content *woody)
{
int fd;
@ -30,17 +37,91 @@ int get_elf_file(t_elf_content *woody)
return EXIT_SUCCESS;
}
int save_file(char *path, char *file, unsigned long int size)
{
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
if (fd == -1) {
ft_printf("Error: Failed to create new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (write(fd, file, size) == -1) {
close(fd);
ft_printf("Error: Failed to write new file \'%s\'\n", path);
return EXIT_FAILURE;
}
close(fd);
return EXIT_SUCCESS;
}
int save_woody(t_elf_content *woody)
{
char *woody_file = malloc(woody->file_size);
if (!woody_file)
return ft_put_error("Allocation error");
ft_memcpy(woody_file, woody->file, woody->file_size);
if (munmap(woody->file, woody->file_size))
return ft_put_error("Umapping error");
int save_error = save_file("woody", woody_file, woody->file_size);
if (save_error)
return save_error;
free(woody_file);
return EXIT_SUCCESS;
}
int main(int ac, char **av)
{
t_elf_content woody;
t_elf_content woody = {0};
if (ac != 2)
{
return ft_put_error("Woody_woodpacker take 1 argument\n");
}
woody.file_path = av[1];
int ret = get_elf_file(&woody);
if (ret == EXIT_FAILURE)
return ret;
return prepare_injection(&woody);
}
int elf_error = get_elf_file(&woody);
if (elf_error)
return elf_error;
if (woody.file_size < sizeof(Elf32_Ehdr) || !elf_magic_numbers(woody.file))
{
ft_printf("Error: \'%s\' is not a valid ELF file\n", woody.file_path);
return EXIT_FAILURE;
}
int elfclass = woody.file[4];
if (elfclass == ELFCLASS32)
{
if (!(woody.elf32 = malloc(sizeof(t_elf32))))
return ft_put_error("Allocation error");
elf_error = get_elf_sections32(&woody);
}
else if (elfclass == ELFCLASS64)
{
if (!(woody.elf64 = malloc(sizeof(t_elf64))))
return ft_put_error("Allocation error");
elf_error = get_elf_sections64(&woody);
}
else
{
elf_error = EXIT_FAILURE;
ft_printf("Error: \'%s\' is not a valid ELF file\n", woody.file_path);
}
if (elf_error)
return elf_error;
int inject_error = -1;
if (elfclass == ELFCLASS32)
{
inject_error = inject32(&woody);
}
else if (elfclass == ELFCLASS64)
{
inject_error = inject64(&woody);
}
if (inject_error)
{
free_elf_content(&woody);
return inject_error;
}
int save_error = save_woody(&woody);
free_elf_content(&woody);
return save_error;
}

66
srcs/payload.c Normal file
View File

@ -0,0 +1,66 @@
#include "../includes/woody.h"
t_payload *get_payload()
{
t_payload *payload = malloc(sizeof(t_payload));
if (!payload)
return NULL;
char buffer[1024];
int fd = open("payload", O_RDONLY);
if (fd == -1) {
ft_put_error("Failed to open payload");
free(payload);
return NULL;
}
payload->len = read(fd, buffer, 1024);
if (payload->len == -1)
{
ft_put_error("Failed to read payload");
free(payload);
close(fd);
return NULL;
}
close(fd);
payload->payload = malloc(sizeof(char) * payload->len);
if (!payload->payload)
{
ft_put_error("Allocation error");
free(payload);
return NULL;
}
ft_memcpy(payload->payload, buffer, payload->len);
return payload;
}
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, unsigned int e_entry, unsigned int p_offset, unsigned int p_memsz)
{
char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size)
{
int32_t woody_index = ptr_woody - payload->payload;
int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
int32_t jump_value = ((payload_position + jmp_index + 5) - e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));
printf("jump_value = %d (%x)\n", jump_value, jump_value);
printf("jmp_index = %d (%x)\n", jmp_index, jmp_index);
printf("payload_position = %ld (%lx)\n", payload_position, payload_position);
printf("e_entry = %d (%x)\n", e_entry, e_entry);
int64_t text_index = ptr_text_section - payload->payload;
int64_t text_value = payload_position - p_offset + woody_index;
ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
int64_t section_index = ptr_section_size - payload->payload;
int64_t section_value = p_memsz;
ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
return EXIT_SUCCESS;
}
return EXIT_FAILURE;
}

6
srcs/utils.c
View File

@ -7,6 +7,11 @@ void *fetch(char *file, unsigned long file_size, unsigned long offset_to_data, u
return NULL;
}
int elf_magic_numbers(char *str)
{
return (!ft_strncmp(str, ELFMAG, SELFMAG));
}
int get_symbols_count(int sh_size, int sh_entsize)
{
if (sh_size <= 0 || sh_entsize <= 0)
@ -22,7 +27,6 @@ char *get_string(char *str, char *end_file)
if (*search_end == 0)
return str;
++search_end;
}
return NULL;
}

229
srcs/woody.c
View File

@ -1,229 +0,0 @@
#include "../includes/woody.h"
int elf_magic_numbers(char *str)
{
return (!ft_strncmp(str, ELFMAG, SELFMAG));
}
int save_elf(char *path, char *file, unsigned long int size)
{
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
if (fd == -1) {
ft_printf("Error: Failed to create new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (write(fd, file, size) == -1) {
close(fd);
ft_printf("Error: Failed to write new file \'%s\'\n", path);
return EXIT_FAILURE;
}
if (close(fd) == -1) {
ft_printf("Error: Failed to close new file \'%s\'\n", path);
return EXIT_FAILURE;
}
return EXIT_SUCCESS;
}
int get_load_segment(t_elf_content *woody, int start, bool executable)
{
for (int i = start; i < woody->Ehdr->e_phnum; i++)
{
if (woody->Phdr[i].p_type == PT_LOAD)
{
if (executable)
{
if (woody->Phdr[i].p_flags & PF_X)
return i;
}
else
return i;
}
}
return -1;
}
void offset_sections(t_elf_content *woody, unsigned int from, unsigned int offset_ammount)
{
for (int i = 0; i < woody->Ehdr->e_phnum; i++)
{
if (woody->Phdr[i].p_offset > from)
woody->Phdr[i].p_offset += offset_ammount;
}
for (int i = 0; i < woody->Ehdr->e_shnum; i++)
{
if (woody->Shdr[i].sh_offset > from)
woody->Shdr[i].sh_offset += offset_ammount;
}
}
size_t create_codecave(t_elf_content *woody, Elf64_Phdr *load_segment, t_payload *payload)
{
const unsigned int page_size = 4096; // getpagesize(); not authorized
unsigned int padding_size = ((payload->len / page_size) + 1) * page_size;
unsigned int codecave_start = load_segment->p_offset + load_segment->p_filesz;
offset_sections(woody, codecave_start, padding_size);
char *new_woody = malloc(woody->file_size + padding_size);
if (!new_woody)
return 0;
ft_memcpy(new_woody, woody->file, codecave_start);
ft_bzero(new_woody + codecave_start, padding_size);
ft_memcpy(new_woody + codecave_start + padding_size, woody->file + codecave_start, woody->file_size - codecave_start);
munmap(woody->file, woody->file_size);
woody->file = new_woody;
woody->file_size += padding_size;
woody->Ehdr = (Elf64_Ehdr *)new_woody;
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
return codecave_start;
}
t_payload *get_payload()
{
t_payload *payload = malloc(sizeof(t_payload));
if (!payload)
return NULL;
char buffer[1024];
int fd = open("payload", O_RDONLY);
if (fd == -1) {
perror("error opening payload");
free(payload);
exit(1);
}
payload->len = read(fd, buffer, 1024);
payload->payload = malloc(sizeof(char) * payload->len);
ft_memcpy(payload->payload, buffer, payload->len);
return payload;
}
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position)
{
char *ptr_jmp = ft_strnstr_nullterminated(payload->payload, JUMP, payload->len);
char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
if (ptr_jmp && ptr_woody && ptr_text_section && ptr_section_size)
{
int32_t woody_index = ptr_woody - payload->payload;
int32_t jmp_index = ptr_jmp - payload->payload;
int32_t jump_value = ((payload_position + jmp_index + 5) - woody->Ehdr->e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));
int64_t text_index = ptr_text_section - payload->payload;
int64_t text_value = payload_position - woody->Ehdr->e_entry + woody_index;
ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
int64_t section_index = ptr_section_size - payload->payload;
int64_t section_value = woody->text_section->sh_size;
ft_memcpy(&payload->payload[section_index], &section_value, sizeof(section_value));
ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
printf("jmp_index : %d (%x)\n", jmp_index, jmp_index);
printf("woody index :%d (%x)\n", woody_index, woody_index);
printf("jmp_index++ : %ld (%lx)\n", jmp_index + sizeof(JUMP) + sizeof(jump_value), jmp_index + sizeof(JUMP) + sizeof(jump_value) - 1);
printf("text_value : %ld (%lx)\n", text_value, text_value);
printf("Old entry : %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
printf("Code cave start = %ld (%lx)\n", payload_position, payload_position);
printf("Payload size = %ld (%lx)\n", payload->len, payload->len);
printf("Backward offset = %d (%x)(%x)\n", jump_value, jump_value, -jump_value);
return EXIT_SUCCESS;
}
return EXIT_FAILURE;
}
void inject(t_elf_content *woody)
{
t_payload *payload = get_payload();
int i = get_load_segment(woody, 0, true);
int j = get_load_segment(woody, i + 1, false);
size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
size_t payload_position;
printf("load position = : %ld (%lx)\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_offset);
printf("load size = : %ld (%lx)\n", woody->Phdr[i].p_filesz, woody->Phdr[i].p_filesz);
if (code_cave_size > payload->len) // inverse here to test the other technique
{
payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_memsz;
printf("Code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size);
}
else
{
payload_position = create_codecave(woody, &woody->Phdr[i], payload);
}
insert_payload(woody, payload, payload_position);
woody->Ehdr->e_entry = payload_position;
woody->Phdr[i].p_filesz += payload->len;
woody->Phdr[i].p_memsz += payload->len;
woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
woody->text_section->sh_size += payload->len;
printf("New entry = %ld (%lx)\n", woody->Ehdr->e_entry, woody->Ehdr->e_entry);
}
int is_special_section_indice(uint16_t section_index) {
return (section_index == SHN_LOPROC || section_index == SHN_BEFORE ||
section_index == SHN_AFTER || section_index == SHN_HIPROC ||
section_index == SHN_LOOS || section_index == SHN_HIOS ||
section_index == SHN_ABS || section_index == SHN_COMMON ||
section_index == SHN_XINDEX || section_index == SHN_HIRESERVE);
}
int get_elf_sections(t_elf_content *woody)
{
woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != ELFCLASS64)
{
ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
return EXIT_FAILURE;
}
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
if (!fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
{
return EXIT_FAILURE;
}
char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, woody->Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
if (Sshstrtab == NULL)
{
return EXIT_FAILURE;
}
for (int j = 0; j < woody->Ehdr->e_shnum;j++)
{
if (woody->Shdr[j].sh_name > woody->Shdr[woody->Ehdr->e_shstrndx].sh_size) return EXIT_FAILURE;
if (woody->Shdr[j].sh_type == SHT_PROGBITS && woody->Shdr[j].sh_flags & SHF_EXECINSTR &&
woody->Shdr[j].sh_flags & SHF_ALLOC &&
Sshstrtab + woody->Shdr[j].sh_name < (char *)woody->file + woody->file_size &&
!ft_strncmp(".text\0", Sshstrtab + woody->Shdr[j].sh_name, 6))
{
woody->text_section = &woody->Shdr[j];
break;
}
}
return EXIT_SUCCESS;
}
int prepare_injection(t_elf_content *woody)
{
int elf_statut = get_elf_sections(woody);
if (elf_statut)
return elf_statut;
inject(woody);
// encrypt(woody->file, woody->text_section->sh_offset, woody->text_section->sh_size);
char *woody_file;
if (!(woody_file = malloc(woody->file_size)))
return ft_put_error("Allocation error");
ft_memcpy(woody_file, woody->file, woody->file_size);
munmap(woody_file, woody->file_size);
save_elf("woody", woody_file, woody->file_size);
free(woody_file);
return EXIT_SUCCESS;
}

106
srcs/woody32.c Normal file
View File

@ -0,0 +1,106 @@
#include "../includes/woody.h"
int get_load_segment32(t_elf_content *woody, int start, bool executable)
{
t_elf32 *elf = woody->elf32;
for (int i = start; i < elf->Ehdr->e_phnum; i++)
{
if (elf->Phdr[i].p_type == PT_LOAD)
{
if (executable)
{
if (elf->Phdr[i].p_flags & PF_X)
return i;
}
else
return i;
}
}
return -1;
}
int inject32(t_elf_content *woody)
{
t_elf32 *elf = woody->elf32;
t_payload *payload = get_payload();
if (!payload)
return EXIT_FAILURE;
int i = get_load_segment32(woody, 0, true);
int j = get_load_segment32(woody, i + 1, false);
if (i == -1 || j != i + 1)
{
free(payload->payload);
free(payload);
return ft_put_error("PT_LOAD segment missing");
}
size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz);
size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz;
if (code_cave_size < (size_t)payload->len)
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, not enough space for code cave");
}
encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz);
if (insert_payload(woody, payload, payload_position, elf->text_section->sh_offset, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz))
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, please regenerate it");
}
printf("code_cave_size = %ld (%lx)\n", code_cave_size, code_cave_size);
printf("payload_position = %ld (%lx)\n", payload_position, payload_position);
printf("elf->Phdr[i].p_offset = %d (%x)\n", elf->Phdr[i].p_offset, elf->Phdr[i].p_offset);
printf("elf->Phdr[i].p_filesz = %d (%x)\n", elf->Phdr[i].p_filesz, elf->Phdr[i].p_filesz);
printf("elf->Phdr[j].p_offset = %d (%x)\n", elf->Phdr[j].p_offset, elf->Phdr[j].p_offset);
elf->Phdr[i].p_filesz += payload->len;
elf->Phdr[i].p_memsz += payload->len;
elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
free(payload->payload);
free(payload);
return EXIT_SUCCESS;
}
int get_elf_sections32(t_elf_content *woody)
{
t_elf32 *elf = woody->elf32;
elf->Ehdr = (Elf32_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf32_Ehdr));
if (!elf->Ehdr)
return EXIT_FAILURE;
elf->Phdr = (Elf32_Phdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_phoff, sizeof(Elf32_Phdr));
if (!elf->Phdr)
return EXIT_FAILURE;
elf->Shdr = (Elf32_Shdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, sizeof(Elf32_Shdr));
if (!elf->Shdr || !fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, elf->Ehdr->e_shnum * sizeof(Elf32_Shdr)))
return EXIT_FAILURE;
if (!fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff + (elf->Ehdr->e_shstrndx * sizeof(Elf32_Shdr)), sizeof(Elf32_Shdr)))
return EXIT_FAILURE;
char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, elf->Shdr[elf->Ehdr->e_shstrndx].sh_offset, 0);
if (Sshstrtab == NULL)
return EXIT_FAILURE;
for (int i = 0; i < elf->Ehdr->e_shnum;i++)
{
if (elf->Shdr[i].sh_type == SHT_PROGBITS && elf->Shdr[i].sh_flags & SHF_EXECINSTR && elf->Shdr[i].sh_flags & SHF_ALLOC && elf->Shdr[i].sh_flags & SHF_EXECINSTR)
{
if (Sshstrtab + elf->Shdr[i].sh_name < (char *)woody->file + woody->file_size && !ft_strncmp(".text\0", Sshstrtab + elf->Shdr[i].sh_name, 6))
{
elf->text_section = &elf->Shdr[i];
return EXIT_SUCCESS;
}
}
}
return EXIT_FAILURE;
}

101
srcs/woody64.c Normal file
View File

@ -0,0 +1,101 @@
#include "../includes/woody.h"
int get_load_segment64(t_elf_content *woody, int start, bool executable)
{
t_elf64 *elf = woody->elf64;
for (int i = start; i < elf->Ehdr->e_phnum; i++)
{
if (elf->Phdr[i].p_type == PT_LOAD)
{
if (executable)
{
if (elf->Phdr[i].p_flags & PF_X)
return i;
}
else
return i;
}
}
return -1;
}
int inject64(t_elf_content *woody)
{
t_elf64 *elf = woody->elf64;
t_payload *payload = get_payload();
if (!payload)
return EXIT_FAILURE;
int i = get_load_segment64(woody, 0, true);
int j = get_load_segment64(woody, i + 1, false);
if (i == -1 || j != i + 1)
{
free(payload->payload);
free(payload);
return ft_put_error("PT_LOAD segment missing");
}
size_t code_cave_size = elf->Phdr[j].p_offset - (elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz);
size_t payload_position = elf->Phdr[i].p_offset + elf->Phdr[i].p_filesz;
if (code_cave_size < (size_t)payload->len)
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, not enough space for code cave");
}
encrypt(woody->file, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz);
if (insert_payload(woody, payload, payload_position, elf->Ehdr->e_entry, elf->Phdr[i].p_offset, elf->Phdr[i].p_memsz))
{
free(payload->payload);
free(payload);
return ft_put_error("Unable to insert payload, please regenerate it");
}
elf->Ehdr->e_entry = payload_position;
elf->Phdr[i].p_filesz += payload->len;
elf->Phdr[i].p_memsz += payload->len;
elf->Phdr[i].p_flags = PF_X | PF_W | PF_R;
free(payload->payload);
free(payload);
return EXIT_SUCCESS;
}
int get_elf_sections64(t_elf_content *woody)
{
t_elf64 *elf = woody->elf64;
elf->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
if (!elf->Ehdr)
return EXIT_FAILURE;
elf->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_phoff, sizeof(Elf64_Phdr));
if (!elf->Phdr)
return EXIT_FAILURE;
elf->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, sizeof(Elf64_Shdr));
if (!elf->Shdr || !fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff, elf->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
if (!fetch(woody->file, woody->file_size, elf->Ehdr->e_shoff + (elf->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
return EXIT_FAILURE;
char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, elf->Shdr[elf->Ehdr->e_shstrndx].sh_offset, 0);
if (Sshstrtab == NULL)
return EXIT_FAILURE;
for (int i = 0; i < elf->Ehdr->e_shnum;i++)
{
if (elf->Shdr[i].sh_type == SHT_PROGBITS && elf->Shdr[i].sh_flags & SHF_EXECINSTR && elf->Shdr[i].sh_flags & SHF_ALLOC && elf->Shdr[i].sh_flags & SHF_EXECINSTR)
{
if (Sshstrtab + elf->Shdr[i].sh_name < (char *)woody->file + woody->file_size && !ft_strncmp(".text\0", Sshstrtab + elf->Shdr[i].sh_name, 6))
{
elf->text_section = &elf->Shdr[i];
return EXIT_SUCCESS;
}
}
}
return EXIT_FAILURE;
}