144 lines
4.3 KiB
C
144 lines
4.3 KiB
C
#include "../includes/woody.h"
|
|
|
|
int elf_magic_numbers(char *str)
|
|
{
|
|
return (!ft_strncmp(str, ELFMAG, SELFMAG));
|
|
}
|
|
|
|
int get_load_segment(t_elf_content *woody, int start, bool executable)
|
|
{
|
|
for (int i = start; i < woody->Ehdr->e_phnum; i++)
|
|
{
|
|
if (woody->Phdr[i].p_type == PT_LOAD)
|
|
{
|
|
if (executable)
|
|
{
|
|
if (woody->Phdr[i].p_flags & PF_X)
|
|
return i;
|
|
}
|
|
else
|
|
return i;
|
|
}
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
t_payload *get_payload()
|
|
{
|
|
t_payload *payload = malloc(sizeof(t_payload));
|
|
if (!payload)
|
|
return NULL;
|
|
char buffer[1024];
|
|
int fd = open("payload", O_RDONLY);
|
|
if (fd == -1) {
|
|
ft_put_error("Failed to open payload");
|
|
free(payload);
|
|
close(fd);
|
|
return NULL;
|
|
}
|
|
payload->len = read(fd, buffer, 1024);
|
|
if (payload->len == -1)
|
|
{
|
|
ft_put_error("Failed to read payload");
|
|
free(payload);
|
|
close(fd);
|
|
return NULL;
|
|
}
|
|
close(fd);
|
|
payload->payload = malloc(sizeof(char) * payload->len);
|
|
if (!payload->payload)
|
|
{
|
|
ft_put_error("Allocation error");
|
|
free(payload);
|
|
return NULL;
|
|
}
|
|
ft_memcpy(payload->payload, buffer, payload->len);
|
|
return payload;
|
|
}
|
|
|
|
int insert_payload(t_elf_content *woody, t_payload *payload, size_t payload_position, int load_segment_index)
|
|
{
|
|
char *ptr_jmp_value = ft_strnstr_nullterminated(payload->payload, JUMP_VALUE, payload->len);
|
|
char *ptr_woody = ft_strnstr_nullterminated(payload->payload, WOODY, payload->len);
|
|
char *ptr_text_section = ft_strnstr_nullterminated(payload->payload, TEXT_OFFSET, payload->len);
|
|
char *ptr_section_size = ft_strnstr_nullterminated(payload->payload, SECTION_SIZE, payload->len);
|
|
if (ptr_jmp_value && ptr_woody && ptr_text_section && ptr_section_size)
|
|
{
|
|
int32_t woody_index = ptr_woody - payload->payload;
|
|
int32_t jmp_index = ptr_jmp_value - sizeof(JUMP) - payload->payload;
|
|
int32_t jump_value = ((payload_position + jmp_index + 5) - woody->Ehdr->e_entry) * -1; // 5 = JUMP SIZE (OPCODE + 4 bytes operand)
|
|
ft_memcpy(&payload->payload[jmp_index + 1], &jump_value, sizeof(jump_value));
|
|
|
|
int64_t text_index = ptr_text_section - payload->payload;
|
|
int64_t text_value = payload_position - woody->Phdr[load_segment_index].p_offset + woody_index;
|
|
ft_memcpy(&payload->payload[text_index], &text_value, sizeof(text_value));
|
|
|
|
int64_t section_index = ptr_section_size - payload->payload;
|
|
int64_t section_value = woody->Phdr[load_segment_index].p_memsz;
|
|
ft_memcpy(&payload->payload[section_index], §ion_value, sizeof(section_value));
|
|
|
|
ft_memcpy(woody->file + payload_position, payload->payload, payload->len);
|
|
return EXIT_SUCCESS;
|
|
}
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
int inject(t_elf_content *woody)
|
|
{
|
|
t_payload *payload = get_payload();
|
|
if (!payload)
|
|
return EXIT_FAILURE;
|
|
|
|
int i = get_load_segment(woody, 0, true);
|
|
int j = get_load_segment(woody, i + 1, false);
|
|
|
|
if (i == -1 || j != i + 1)
|
|
{
|
|
free(payload->payload);
|
|
free(payload);
|
|
return ft_put_error("PT_LOAD segment missing");
|
|
}
|
|
|
|
size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
|
|
size_t payload_position = woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz;
|
|
|
|
if (code_cave_size < (size_t)payload->len)
|
|
{
|
|
free(payload->payload);
|
|
free(payload);
|
|
return ft_put_error("Unable to insert payload, not enough space for code cave");
|
|
}
|
|
|
|
woody->Phdr[i].p_filesz += payload->len;
|
|
woody->Phdr[i].p_memsz += payload->len;
|
|
|
|
if (insert_payload(woody, payload, payload_position, i))
|
|
{
|
|
free(payload->payload);
|
|
free(payload);
|
|
return ft_put_error("Unable to insert payload, please regenerate it");
|
|
}
|
|
|
|
woody->Ehdr->e_entry = payload_position;
|
|
woody->Phdr[i].p_flags = PF_X | PF_W | PF_R;
|
|
free(payload->payload);
|
|
free(payload);
|
|
return EXIT_SUCCESS;
|
|
}
|
|
|
|
int get_elf_sections(t_elf_content *woody)
|
|
{
|
|
woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
|
|
if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != ELFCLASS64)
|
|
{
|
|
printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
|
|
|
|
woody->Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
|
|
if (!woody->Shdr|| !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
|
|
return EXIT_FAILURE;
|
|
return EXIT_SUCCESS;
|
|
}
|