174 lines
5.4 KiB
C
174 lines
5.4 KiB
C
#include "../includes/woody.h"
|
|
|
|
|
|
int elf_magic_numbers(char *str)
|
|
{
|
|
return (!ft_strncmp(str, ELFMAG, SELFMAG));
|
|
}
|
|
|
|
void encrypt_zone(char *file, unsigned long int offset, unsigned long int size)
|
|
{
|
|
size_t i = 0;
|
|
while (i < size)
|
|
{
|
|
file[offset + i] = 0;
|
|
++i;
|
|
}
|
|
}
|
|
|
|
int save_elf(char *path, char *file, unsigned long int size)
|
|
{
|
|
int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0755);
|
|
if (fd == -1) {
|
|
ft_printf("Error: Failed to create new file \'%s\'\n", path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
if (write(fd, file, size) == -1) {
|
|
close(fd);
|
|
ft_printf("Error: Failed to write new file \'%s\'\n", path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
if (close(fd) == -1) {
|
|
ft_printf("Error: Failed to close new file \'%s\'\n", path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
return EXIT_SUCCESS;
|
|
}
|
|
|
|
int get_load_segment(t_efl_content *woody, int start, bool executable)
|
|
{
|
|
for (int i = start; i < woody->Ehdr->e_phnum; i++)
|
|
{
|
|
if (woody->Phdr[i].p_type == PT_LOAD)
|
|
{
|
|
if (executable)
|
|
{
|
|
if (woody->Phdr[i].p_flags & PF_X)
|
|
return i;
|
|
}
|
|
else
|
|
return i;
|
|
}
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
|
|
int32_t find_jmp(char *code, size_t len)
|
|
{
|
|
char *jump = JUMP;
|
|
char *ptr = ft_strnstr_nullterminated(code, jump, len);
|
|
if (ptr)
|
|
{
|
|
return ptr - code;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
void find_cave(t_efl_content *woody)
|
|
{
|
|
woody->Phdr = (Elf64_Phdr *)secure_jump(woody->file, woody->file_size, woody->Ehdr->e_phoff, sizeof(Elf64_Phdr));
|
|
|
|
int i = get_load_segment(woody, 0, true);
|
|
int j = get_load_segment(woody, i + 1, false);
|
|
|
|
printf("%d %ld\n", i, woody->Phdr[i].p_align);
|
|
printf("%d %ld\n", j, woody->Phdr[j].p_align);
|
|
printf("code_cave_start = %lx, virtual adress = %lx\n", woody->Phdr[i].p_offset, woody->Phdr[i].p_vaddr);
|
|
printf("code_cave_size = %lx\n", woody->Phdr[j].p_offset - (woody->Phdr[i].p_offset + woody->Phdr[i].p_filesz));
|
|
|
|
Elf64_Off payload_off = woody->Phdr[i].p_offset + woody->Phdr[i].p_memsz;
|
|
|
|
size_t len = sizeof(PAYLOAD) - 1;
|
|
char payload[] = PAYLOAD;
|
|
int32_t jmp = find_jmp(payload, len);
|
|
|
|
printf("%ld\n", (long int)payload[jmp + 1]);
|
|
int32_t test = ((payload_off + len) - woody->Ehdr->e_entry) * -1;
|
|
|
|
ft_memcpy(&payload[jmp + 1], &test, sizeof(test));
|
|
|
|
ft_memcpy(woody->file + payload_off, payload, len);
|
|
|
|
printf("old entry : %lx\n", woody->Ehdr->e_entry);
|
|
printf("backward offset = %ld\n", (payload_off + len) - woody->Ehdr->e_entry);
|
|
woody->Ehdr->e_entry = payload_off;
|
|
woody->Phdr[i].p_filesz += len;
|
|
woody->Phdr[i].p_memsz += len;
|
|
|
|
|
|
printf("new entry = %lx\n", woody->Ehdr->e_entry);
|
|
|
|
printf("p_filesz = %lx\n", woody->Phdr[i].p_filesz);
|
|
printf("p_memsz = %lx\n", woody->Phdr[i].p_memsz);
|
|
woody->file_size += len;
|
|
|
|
}
|
|
|
|
|
|
int inject(t_efl_content *woody)
|
|
{
|
|
woody->Ehdr = (Elf64_Ehdr *)secure_jump(woody->file, woody->file_size, 0, sizeof(Elf64_Ehdr));
|
|
if (!woody->Ehdr || !elf_magic_numbers(woody->file) || woody->Ehdr->e_ident[EI_CLASS] != 2)
|
|
{
|
|
ft_printf("Error: \'%s\' is not a valid 64-bit ELF file\n", woody->file_path);
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
printf("entry point = %ld\n", woody->Ehdr->e_entry);
|
|
Elf64_Shdr *Shdr = (Elf64_Shdr *)secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff, sizeof(Elf64_Shdr));
|
|
if (Shdr == NULL || !secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff, woody->Ehdr->e_shnum * sizeof(Elf64_Shdr)))
|
|
{
|
|
return ft_put_error("Corrupted file");
|
|
}
|
|
if (woody->file_size > woody->Ehdr->e_shoff + woody->Ehdr->e_shnum * sizeof(Elf64_Shdr))
|
|
{
|
|
printf("extra_data !\n"); // save it in woody->extra_data and append it to the end of the woody file ? Could be dangerous
|
|
}
|
|
|
|
Elf64_Shdr *symbols_table = NULL;
|
|
for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
|
|
if (Shdr[i].sh_type == SHT_SYMTAB) {
|
|
symbols_table = secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff + (i * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr));
|
|
}
|
|
}
|
|
if (symbols_table == NULL)
|
|
return ft_put_error("No symbols");
|
|
|
|
if (!secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff + (woody->Ehdr->e_shstrndx * sizeof(Elf64_Shdr)), sizeof(Elf64_Shdr)))
|
|
return ft_put_error("Corrupted file");
|
|
|
|
char *Sshstrtab = (char *)secure_jump(woody->file, woody->file_size, Shdr[woody->Ehdr->e_shstrndx].sh_offset, 0);
|
|
if (Sshstrtab == NULL)
|
|
return ft_put_error("Corrupted file");
|
|
|
|
for (int i = 0; i < woody->Ehdr->e_shnum; i++) {
|
|
char *section_name = Sshstrtab + Shdr[i].sh_name;
|
|
printf("%s : Offset: %lx | Size: %lx | Virtual adress: %lx\n", section_name, Shdr[i].sh_offset, Shdr[i].sh_size, Shdr[i].sh_addr);
|
|
}
|
|
|
|
// useless for now
|
|
Elf64_Shdr *strtab_header = (Elf64_Shdr *)secure_jump(woody->file, woody->file_size, woody->Ehdr->e_shoff + (symbols_table->sh_link * woody->Ehdr->e_shentsize), sizeof(Elf64_Shdr));
|
|
if (!strtab_header)
|
|
return ft_put_error("Corrupted file");
|
|
|
|
char *strtab = secure_jump(woody->file, woody->file_size, strtab_header->sh_offset, 0);
|
|
if (strtab == NULL)
|
|
return ft_put_error("Corrupted file");
|
|
Elf64_Sym *symbols = (Elf64_Sym *)secure_jump(woody->file, woody->file_size, symbols_table->sh_offset, sizeof(Elf64_Sym));
|
|
if (symbols == NULL)
|
|
return ft_put_error("Corrupted file");
|
|
// end useless woody->Ehdr->e_entry =
|
|
|
|
find_cave(woody);
|
|
|
|
char *woody_file = malloc(woody->file_size);
|
|
|
|
ft_memcpy(woody_file, woody->file, woody->file_size);
|
|
|
|
// encrypt_zone(woody_file, strtab_header->sh_offset , strtab_header->sh_size);
|
|
munmap(woody_file, woody->file_size);
|
|
return save_elf("woody", woody_file, woody->file_size);
|
|
} |