Returnsu8* the address of the first instruction that references the given string, or NULL if not found
+
+
+
+◆ elf_find_string_references()
+
+
+
+
+
parses the ELF rodata section, looking for strings and the instructions that reference them
+
- Parameters
-
+
+ | elf_info | the executable to find strings in |
+ | refs | structure that will be populated with the results |
+
+
+
+
- Returns
- BOOL
+
677 typedef struct __attribute__((packed)) {
-
-
-
-
-
- 683 typedef struct __attribute__((packed)) {
-
-
-
- 692 typedef struct __attribute__((packed)) {
-
-
-
-
- 697 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 726 typedef struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 739 typedef struct __attribute__((packed)) {
-
-
-
-
-
-
- 749 u8 decrypted_secret_data[57];
-
-
-
-
-
-
-
- 757 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
-
-
-
-
+ 672 typedef struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 686 typedef struct __attribute__((packed)) {
+
+
+
+
+
+
+ 698 typedef struct __attribute__((packed)) {
+
+
+
+
+
+ 704 typedef struct __attribute__((packed)) {
+
+
+
+ 713 typedef struct __attribute__((packed)) {
+
+
+
+
+ 718 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 747 typedef struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 760 typedef struct __attribute__((packed)) {
+
+
+
+
+
+
+ 770 u8 decrypted_secret_data[57];
+
+
+
+
+
+
+
+ 778 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
-
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 865 u32 encoded_string_id,
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 886 u32 encoded_string_id,
+
+
+
-
-
-
-
-
-
-
-
- 921 FuncFindType find_mode);
+
+
+
-
-
-
+
+
+
+
+
+
+ 942 FuncFindType find_mode);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1021 unsigned num_relocs,
- 1022 unsigned reloc_type,
- 1023 u32 encoded_string_id);
-
-
-
-
-
-
-
- 1057 u32 *stringId_inOut,
- 1058 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
- 1086 unsigned shift_count, BOOL start_from_call);
-
-
-
- 1100 unsigned operation_index,
- 1101 unsigned shift_count,
- 1102 int flags, u8 *code);
-
-
- 1147 u8 *call_site, u8 *code,
-
- 1149 unsigned shift_count,
unsigned operation_index);
-
-
-
- 1164 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
- 1188 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1051 unsigned num_relocs,
+ 1052 unsigned reloc_type,
+ 1053 u32 encoded_string_id);
+
+
+
+
+
+
+
+ 1087 u32 *stringId_inOut,
+ 1088 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+ 1116 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 1130 unsigned operation_index,
+ 1131 unsigned shift_count,
+ 1132 int flags, u8 *code);
+
+
+ 1177 u8 *call_site, u8 *code,
+
+ 1179 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 1194 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+ 1218 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
data passed to functions that access the backdoor data
Definition: xzre.h:571
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:584
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:616
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:122
u32 reg2reg_instructions_count
cumulative number of reg2reg instructions successfully validated by the data shifter
Definition: xzre.h:504
u64 code_range_end
the shifter will use this address as the maximum search address any instruction beyond this address w...
Definition: xzre.h:486
the payload header. also used as Chacha IV
Definition: xzre.h:677
the contents of the RSA 'n' field
Definition: xzre.h:692
the payload header. also used as Chacha IV
Definition: xzre.h:698
the contents of the RSA 'n' field
Definition: xzre.h:713
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:661
u32 index
Definition: xzre.h:663
u32 bit_index
Definition: xzre.h:666
u32 byte_index
Definition: xzre.h:668
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
char * elf_find_string(elf_info_t *elf_info, u32 *stringId_inOut, void *rodata_start_ptr)
Locates a string in the ELF .rodata section.
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags)
checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memor...
BOOL is_range_mapped(u8 *addr, u8 length, global_context_t *ctx)
verify if a memory range is mapped
void * elf_get_got_symbol(elf_info_t *elf_info, u32 encoded_string_id)
Gets the GOT symbol with name encoded_string_id from the parsed ELF file.
CommandFlags2
Definition: xzre.h:713
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:723
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:718
CommandFlags2
Definition: xzre.h:734
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:744
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:739
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
void * elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment)
Obtains the address and size of the last read-write segment in the given ELF file this is typically t...
int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end)
disassembles the given x64 code
void * elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize)
Obtains the address and size of the last readonly segment in the given ELF file this corresponds to t...
BOOL find_function_prologue_ex(u8 *code_start, u8 *func_start_0, u8 *func_start_1, u8 *search_base, u8 *code_end, FuncFindType find_mode)
locates the function prologue. it will try to backtrack and synchronize the code stream,...
CommandFlags1
Definition: xzre.h:702
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:710
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:706
CommandFlags1
Definition: xzre.h:723
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:731
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:727
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
BOOL main_elf_parse(main_elf_t *main_elf)
parses the main executable from the provided structure. as part of the process, argv0 will be retriev...
void elf_find_string_references(elf_info_t *elf_info, string_references_t *refs)
parses the ELF rodata section, looking for strings and the instructions that reference them
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
void * elf_get_plt_symbol(elf_info_t *elf_info, u32 encoded_string_id)
Gets the PLT symbol with name encoded_string_id from the parsed ELF file.
