woody-woodpacker/srcs/woody.c

#include "../includes/woody.h"


int elf_magic_numbers(char *str)
{
	return (!ft_strncmp(str, ELFMAG, SELFMAG));
}

int		save_elf(char *path, char *file, unsigned long int size)
{
	int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
    if (fd == -1) {
		ft_printf("Error: Failed to create new file \'%s\'\n", path);
		return EXIT_FAILURE;
    }

    if (write(fd, file, size) == -1) {
        close(fd);
        ft_printf("Error: Failed to write new file \'%s\'\n", path);
        return EXIT_FAILURE;
    }

    if (close(fd) == -1) {
		ft_printf("Error: Failed to close new file \'%s\'\n", path);
        return EXIT_FAILURE;
    }
	return EXIT_SUCCESS;
}

int	get_load_segment(t_efl_content *woody, int start, bool executable)
{
	for (int i = start; i < woody->Ehdr->e_phnum; i++)
	{
		if (woody->Phdr[i].p_type == PT_LOAD)
		{
			if (executable)
			{
				if (woody->Phdr[i].p_flags & PF_X)
					return i;
			}
			else
				return i;
		}
	}
	return -1;
}

int32_t find_jmp(char *code, size_t len)
{
	char *jump = JUMP;
	char *ptr = ft_strnstr_nullterminated(code, jump, len);
	if (ptr)
	{
		return ptr - code;
	}
	return 0;
}

void	inject(t_efl_content *woody)
{
	char payload[] = PAYLOAD;
    size_t len_payload = sizeof(PAYLOAD) - 1;
	woody->Phdr = (Elf64_Phdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));

	int i = get_load_segment(woody, 0, true);	
	int j = get_load_segment(woody, i + 1, false);
	
	size_t code_cave_size = woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz);
	size_t payload_off = woody->Phdr[i].p_offset + woody->Phdr[i].p_memsz;
	
	printf("Old entry : %ld\n", woody->Ehdr->e_entry);
	printf("Code_cave_start = %ld\n", payload_off);
	printf("Code_cave_size = %ld\n", code_cave_size);
	printf("Payload size = %ld\n", len_payload);
	
	int32_t jmp_index = find_jmp(payload, len_payload);
	int32_t backward_len = ((payload_off + len_payload) - woody->Ehdr->e_entry) * -1;

	ft_memcpy(&payload[jmp_index + 1], &backward_len, sizeof(backward_len));
	ft_memcpy(woody->file + payload_off, payload, len_payload);
	
	printf("Backward offset = %d (%x)\n", backward_len, backward_len);

	woody->Ehdr->e_entry = payload_off;
	woody->Phdr[i].p_filesz += len_payload;
	woody->Phdr[i].p_memsz += len_payload;

	printf("New entry = %ld\n", woody->Ehdr->e_entry);
}

int get_elf_sections(t_efl_content *woody)
{
	woody->Ehdr = (Elf64_Ehdr *)fetch(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
	if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != ELFCLASS64)
	{
		ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
		return EXIT_FAILURE;
	}

	Elf64_Shdr *Shdr = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
	if (Shdr == NULL || !fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
	{
		return ft_put_error("Corrupted file");
	}

	Elf64_Shdr *symbols_table = NULL;
    for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
		if (Shdr[i].sh_type == SHT_SYMTAB) {
            symbols_table = fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
        }
    }
	if (symbols_table == NULL)
		return ft_put_error("No symbols");

	if (!fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
		return ft_put_error("Corrupted file");

	char *Sshstrtab = (char *)fetch(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
	if (Sshstrtab == NULL)
		return ft_put_error("Corrupted file");

    Elf64_Shdr *strtab_header = (Elf64_Shdr *)fetch(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr)); 
	if (!strtab_header)
		return ft_put_error("Corrupted file");

    char *strtab = fetch(woody->file, woody->file_size, strtab_header->sh_offset, 0);
	if (strtab == NULL)
		return ft_put_error("Corrupted file");
    Elf64_Sym *symbols = (Elf64_Sym *)fetch(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym));
	if (symbols == NULL)
		return ft_put_error("Corrupted file");

	return EXIT_SUCCESS;
}

int prepare_injection(t_efl_content *woody)
{
	int elf_statut = get_elf_sections(woody);
	if (elf_statut)
		return elf_statut;

	inject(woody);

	char *woody_file;
	if (!(woody_file = malloc(woody->file_size)))
		return ft_put_error("Allocation error");

	ft_memcpy(woody_file, woody->file, woody->file_size);

	// encrypt(woody_file, strtab_header->sh_offset , strtab_header->sh_size);
	munmap(woody_file, woody->file_size);
	save_elf("woody", woody_file, woody->file_size);
	free(woody_file);
	return EXIT_SUCCESS;
}