|
+ xzre
+
+ |
+
1.9.1
+
+
+
diff --git a/menudata.js b/menudata.js
index f175703..8c9d9df 100644
--- a/menudata.js
+++ b/menudata.js
@@ -112,4 +112,5 @@ var menudata={children:[
{text:"Variables",url:"globals_vars.html"},
{text:"Typedefs",url:"globals_type.html"},
{text:"Enumerations",url:"globals_enum.html"},
-{text:"Enumerator",url:"globals_eval.html"}]}]}]}
+{text:"Enumerator",url:"globals_eval.html"},
+{text:"Macros",url:"globals_defs.html"}]}]}]}
diff --git a/search/all_15.js b/search/all_15.js
index a8aabbf..a474577 100644
--- a/search/all_15.js
+++ b/search/all_15.js
@@ -1,20 +1,22 @@
var searchData=
[
['x86_5fdasm_277',['x86_dasm',['../xzre_8h.html#a6ad15241561f71f06020fb6f2649e6a3',1,'xzre.h']]],
- ['x_5felf_5fmain_278',['X_ELF_MAIN',['../xzre_8h.html#a3ed7f6d009d35ae3bdb830a7bb1e0289aba3b2cdb9ea0a8c79650d8c305d93898',1,'xzre.h']]],
- ['x_5fflags1_5f8bytes_279',['X_FLAGS1_8BYTES',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cafba8acd8c4a8c3f257a5620490a68232',1,'xzre.h']]],
- ['x_5fflags1_5fdisable_5fpam_280',['X_FLAGS1_DISABLE_PAM',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cafeb5d1f0d173f2f31c172fa0332b63f9',1,'xzre.h']]],
- ['x_5fflags1_5fno_5fextended_5fsize_281',['X_FLAGS1_NO_EXTENDED_SIZE',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cab3d0e0689ad88a177dba9c825397c435',1,'xzre.h']]],
- ['x_5fflags1_5fsetlogmask_282',['X_FLAGS1_SETLOGMASK',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067ca032a69d073a86b964606f2c5ae97b0b8',1,'xzre.h']]],
- ['x_5fflags1_5fsocket_5findex_283',['X_FLAGS1_SOCKET_INDEX',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cab7a7a5213fa1e7474dec3e176818dbcf',1,'xzre.h']]],
- ['x_5fflags2_5fchange_5fmonitor_5freq_284',['X_FLAGS2_CHANGE_MONITOR_REQ',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348a12bbf24d2d421ed1a8b6418a2e432e75',1,'xzre.h']]],
- ['x_5fflags2_5fcontinuation_285',['X_FLAGS2_CONTINUATION',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348ad2b412b7978b940d31491d0715bb3e58',1,'xzre.h']]],
- ['x_5fflags2_5fimpersonate_286',['X_FLAGS2_IMPERSONATE',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348af0f9ab9ee46a1670a961d250dbc3db4c',1,'xzre.h']]],
- ['x_5fflags2_5fpselect_287',['X_FLAGS2_PSELECT',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348a5fe15faf982a7569ba41669ba8590f8b',1,'xzre.h']]],
- ['x_5fflags2_5fsockfd_5fmask_288',['X_FLAGS2_SOCKFD_MASK',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348af06d978f6e3f18e92bd0aede40d0fbc2',1,'xzre.h']]],
- ['x_5fflags3_5fmonitor_5freq_5fval_289',['X_FLAGS3_MONITOR_REQ_VAL',['../xzre_8h.html#abe6f94ea5911ce9fe472717add623449a50c316bd0e353771f0ffbbc27e503644',1,'xzre.h']]],
- ['x_5fflags3_5fsocket_5fnum_290',['X_FLAGS3_SOCKET_NUM',['../xzre_8h.html#abe6f94ea5911ce9fe472717add623449ae5ecf92095438c6d9e412262ac2c729b',1,'xzre.h']]],
- ['xref_291',['xref',['../structstring__item.html#a897d41bd473c1ffd8e65448e28f05f70',1,'string_item']]],
- ['xzre_292',['xzre',['../md_README.html',1,'']]],
- ['xzre_2eh_293',['xzre.h',['../xzre_8h.html',1,'']]]
+ ['x86_5fmodrm_5fbyte_278',['X86_MODRM_BYTE',['../xzre_8h.html#afb7855f3e7ab564100f9f362b9305ad7',1,'xzre.h']]],
+ ['x_5felf_5fmain_279',['X_ELF_MAIN',['../xzre_8h.html#a3ed7f6d009d35ae3bdb830a7bb1e0289aba3b2cdb9ea0a8c79650d8c305d93898',1,'xzre.h']]],
+ ['x_5fflags1_5f8bytes_280',['X_FLAGS1_8BYTES',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cafba8acd8c4a8c3f257a5620490a68232',1,'xzre.h']]],
+ ['x_5fflags1_5fdisable_5fpam_281',['X_FLAGS1_DISABLE_PAM',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cafeb5d1f0d173f2f31c172fa0332b63f9',1,'xzre.h']]],
+ ['x_5fflags1_5fno_5fextended_5fsize_282',['X_FLAGS1_NO_EXTENDED_SIZE',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cab3d0e0689ad88a177dba9c825397c435',1,'xzre.h']]],
+ ['x_5fflags1_5fsetlogmask_283',['X_FLAGS1_SETLOGMASK',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067ca032a69d073a86b964606f2c5ae97b0b8',1,'xzre.h']]],
+ ['x_5fflags1_5fsocket_5findex_284',['X_FLAGS1_SOCKET_INDEX',['../xzre_8h.html#a5f8f63d8ae502ab76547c7b077cb067cab7a7a5213fa1e7474dec3e176818dbcf',1,'xzre.h']]],
+ ['x_5fflags2_5fchange_5fmonitor_5freq_285',['X_FLAGS2_CHANGE_MONITOR_REQ',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348a12bbf24d2d421ed1a8b6418a2e432e75',1,'xzre.h']]],
+ ['x_5fflags2_5fcontinuation_286',['X_FLAGS2_CONTINUATION',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348ad2b412b7978b940d31491d0715bb3e58',1,'xzre.h']]],
+ ['x_5fflags2_5fimpersonate_287',['X_FLAGS2_IMPERSONATE',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348af0f9ab9ee46a1670a961d250dbc3db4c',1,'xzre.h']]],
+ ['x_5fflags2_5fpselect_288',['X_FLAGS2_PSELECT',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348a5fe15faf982a7569ba41669ba8590f8b',1,'xzre.h']]],
+ ['x_5fflags2_5fsockfd_5fmask_289',['X_FLAGS2_SOCKFD_MASK',['../xzre_8h.html#a408b28a8a0686c2ba0ede1e1b4208348af06d978f6e3f18e92bd0aede40d0fbc2',1,'xzre.h']]],
+ ['x_5fflags3_5fmonitor_5freq_5fval_290',['X_FLAGS3_MONITOR_REQ_VAL',['../xzre_8h.html#abe6f94ea5911ce9fe472717add623449a50c316bd0e353771f0ffbbc27e503644',1,'xzre.h']]],
+ ['x_5fflags3_5fsocket_5fnum_291',['X_FLAGS3_SOCKET_NUM',['../xzre_8h.html#abe6f94ea5911ce9fe472717add623449ae5ecf92095438c6d9e412262ac2c729b',1,'xzre.h']]],
+ ['xref_292',['xref',['../structstring__item.html#a897d41bd473c1ffd8e65448e28f05f70',1,'string_item']]],
+ ['xzdasm_5fmodrm_5fmake_293',['XZDASM_MODRM_MAKE',['../xzre_8h.html#af52dcde56e3318fd8e0d462dd93d6378',1,'xzre.h']]],
+ ['xzre_294',['xzre',['../md_README.html',1,'']]],
+ ['xzre_2eh_295',['xzre.h',['../xzre_8h.html',1,'']]]
];
diff --git a/search/classes_0.js b/search/classes_0.js
index ee60490..15ddb56 100644
--- a/search/classes_0.js
+++ b/search/classes_0.js
@@ -1,5 +1,5 @@
var searchData=
[
- ['audit_5fifaces_294',['audit_ifaces',['../structaudit__ifaces.html',1,'']]],
- ['auditstate_295',['auditstate',['../structauditstate.html',1,'']]]
+ ['audit_5fifaces_296',['audit_ifaces',['../structaudit__ifaces.html',1,'']]],
+ ['auditstate_297',['auditstate',['../structauditstate.html',1,'']]]
];
diff --git a/search/classes_1.js b/search/classes_1.js
index 1d0839b..8685b04 100644
--- a/search/classes_1.js
+++ b/search/classes_1.js
@@ -1,13 +1,13 @@
var searchData=
[
- ['backdoor_5fcpuid_5freloc_5fconsts_296',['backdoor_cpuid_reloc_consts',['../structbackdoor__cpuid__reloc__consts.html',1,'']]],
- ['backdoor_5fdata_297',['backdoor_data',['../structbackdoor__data.html',1,'']]],
- ['backdoor_5fdata_5fhandle_298',['backdoor_data_handle',['../structbackdoor__data__handle.html',1,'']]],
- ['backdoor_5fhooks_5fctx_299',['backdoor_hooks_ctx',['../structbackdoor__hooks__ctx.html',1,'']]],
- ['backdoor_5fhooks_5fdata_300',['backdoor_hooks_data',['../structbackdoor__hooks__data.html',1,'']]],
- ['backdoor_5fruntime_5fdata_301',['backdoor_runtime_data',['../unionbackdoor__runtime__data.html',1,'']]],
- ['backdoor_5fsetup_5fparams_302',['backdoor_setup_params',['../structbackdoor__setup__params.html',1,'']]],
- ['backdoor_5fshared_5fglobals_303',['backdoor_shared_globals',['../structbackdoor__shared__globals.html',1,'']]],
- ['backdoor_5fshared_5flibraries_5fdata_304',['backdoor_shared_libraries_data',['../structbackdoor__shared__libraries__data.html',1,'']]],
- ['backdoor_5ftls_5fget_5faddr_5freloc_5fconsts_305',['backdoor_tls_get_addr_reloc_consts',['../structbackdoor__tls__get__addr__reloc__consts.html',1,'']]]
+ ['backdoor_5fcpuid_5freloc_5fconsts_298',['backdoor_cpuid_reloc_consts',['../structbackdoor__cpuid__reloc__consts.html',1,'']]],
+ ['backdoor_5fdata_299',['backdoor_data',['../structbackdoor__data.html',1,'']]],
+ ['backdoor_5fdata_5fhandle_300',['backdoor_data_handle',['../structbackdoor__data__handle.html',1,'']]],
+ ['backdoor_5fhooks_5fctx_301',['backdoor_hooks_ctx',['../structbackdoor__hooks__ctx.html',1,'']]],
+ ['backdoor_5fhooks_5fdata_302',['backdoor_hooks_data',['../structbackdoor__hooks__data.html',1,'']]],
+ ['backdoor_5fruntime_5fdata_303',['backdoor_runtime_data',['../unionbackdoor__runtime__data.html',1,'']]],
+ ['backdoor_5fsetup_5fparams_304',['backdoor_setup_params',['../structbackdoor__setup__params.html',1,'']]],
+ ['backdoor_5fshared_5fglobals_305',['backdoor_shared_globals',['../structbackdoor__shared__globals.html',1,'']]],
+ ['backdoor_5fshared_5flibraries_5fdata_306',['backdoor_shared_libraries_data',['../structbackdoor__shared__libraries__data.html',1,'']]],
+ ['backdoor_5ftls_5fget_5faddr_5freloc_5fconsts_307',['backdoor_tls_get_addr_reloc_consts',['../structbackdoor__tls__get__addr__reloc__consts.html',1,'']]]
];
diff --git a/search/classes_2.js b/search/classes_2.js
index 8d3b666..2308ac4 100644
--- a/search/classes_2.js
+++ b/search/classes_2.js
@@ -1,4 +1,4 @@
var searchData=
[
- ['cmd_5farguments_306',['cmd_arguments',['../structcmd__arguments.html',1,'']]]
+ ['cmd_5farguments_308',['cmd_arguments',['../structcmd__arguments.html',1,'']]]
];
diff --git a/search/classes_3.js b/search/classes_3.js
index 5a4002b..feff297 100644
--- a/search/classes_3.js
+++ b/search/classes_3.js
@@ -1,5 +1,5 @@
var searchData=
[
- ['dasm_5fctx_307',['dasm_ctx',['../structdasm__ctx.html',1,'']]],
- ['dl_5ftls_5findex_308',['dl_tls_index',['../structdl__tls__index.html',1,'']]]
+ ['dasm_5fctx_309',['dasm_ctx',['../structdasm__ctx.html',1,'']]],
+ ['dl_5ftls_5findex_310',['dl_tls_index',['../structdl__tls__index.html',1,'']]]
];
diff --git a/search/classes_4.js b/search/classes_4.js
index 3acc99e..b00ba9d 100644
--- a/search/classes_4.js
+++ b/search/classes_4.js
@@ -1,7 +1,7 @@
var searchData=
[
- ['elf_5fentry_5fctx_309',['elf_entry_ctx',['../structelf__entry__ctx.html',1,'']]],
- ['elf_5ffunctions_310',['elf_functions',['../structelf__functions.html',1,'']]],
- ['elf_5fhandles_311',['elf_handles',['../structelf__handles.html',1,'']]],
- ['elf_5finfo_312',['elf_info',['../structelf__info.html',1,'']]]
+ ['elf_5fentry_5fctx_311',['elf_entry_ctx',['../structelf__entry__ctx.html',1,'']]],
+ ['elf_5ffunctions_312',['elf_functions',['../structelf__functions.html',1,'']]],
+ ['elf_5fhandles_313',['elf_handles',['../structelf__handles.html',1,'']]],
+ ['elf_5finfo_314',['elf_info',['../structelf__info.html',1,'']]]
];
diff --git a/search/classes_5.js b/search/classes_5.js
index a8ca3fa..b4dcbb5 100644
--- a/search/classes_5.js
+++ b/search/classes_5.js
@@ -1,6 +1,6 @@
var searchData=
[
- ['fake_5flzma_5fallocator_313',['fake_lzma_allocator',['../structfake__lzma__allocator.html',1,'']]],
- ['flags1_314',['Flags1',['../classFlags1.html',1,'']]],
- ['flags2_315',['Flags2',['../classFlags2.html',1,'']]]
+ ['fake_5flzma_5fallocator_315',['fake_lzma_allocator',['../structfake__lzma__allocator.html',1,'']]],
+ ['flags1_316',['Flags1',['../classFlags1.html',1,'']]],
+ ['flags2_317',['Flags2',['../classFlags2.html',1,'']]]
];
diff --git a/search/classes_6.js b/search/classes_6.js
index d684608..87cebee 100644
--- a/search/classes_6.js
+++ b/search/classes_6.js
@@ -1,6 +1,6 @@
var searchData=
[
- ['global_5fcontext_316',['global_context',['../structglobal__context.html',1,'']]],
- ['gnu_5fhash_5ftable_317',['gnu_hash_table',['../structgnu__hash__table.html',1,'']]],
- ['got_5fctx_318',['got_ctx',['../structgot__ctx.html',1,'']]]
+ ['global_5fcontext_318',['global_context',['../structglobal__context.html',1,'']]],
+ ['gnu_5fhash_5ftable_319',['gnu_hash_table',['../structgnu__hash__table.html',1,'']]],
+ ['got_5fctx_320',['got_ctx',['../structgot__ctx.html',1,'']]]
];
diff --git a/search/classes_7.js b/search/classes_7.js
index 4de9e8f..7c9beae 100644
--- a/search/classes_7.js
+++ b/search/classes_7.js
@@ -1,5 +1,5 @@
var searchData=
[
- ['imported_5ffuncs_319',['imported_funcs',['../structimported__funcs.html',1,'']]],
- ['instruction_5fsearch_5fctx_320',['instruction_search_ctx',['../structinstruction__search__ctx.html',1,'']]]
+ ['imported_5ffuncs_321',['imported_funcs',['../structimported__funcs.html',1,'']]],
+ ['instruction_5fsearch_5fctx_322',['instruction_search_ctx',['../structinstruction__search__ctx.html',1,'']]]
];
diff --git a/search/classes_8.js b/search/classes_8.js
index e4b97d3..33555e9 100644
--- a/search/classes_8.js
+++ b/search/classes_8.js
@@ -1,7 +1,7 @@
var searchData=
[
- ['key_5fctx_321',['key_ctx',['../structkey__ctx.html',1,'']]],
- ['key_5fpayload_322',['key_payload',['../structkey__payload.html',1,'']]],
- ['key_5fpayload_5fbody_323',['key_payload_body',['../structkey__payload__body.html',1,'']]],
- ['key_5fpayload_5fhdr_324',['key_payload_hdr',['../structkey__payload__hdr.html',1,'']]]
+ ['key_5fctx_323',['key_ctx',['../structkey__ctx.html',1,'']]],
+ ['key_5fpayload_324',['key_payload',['../structkey__payload.html',1,'']]],
+ ['key_5fpayload_5fbody_325',['key_payload_body',['../structkey__payload__body.html',1,'']]],
+ ['key_5fpayload_5fhdr_326',['key_payload_hdr',['../structkey__payload__hdr.html',1,'']]]
];
diff --git a/search/classes_9.js b/search/classes_9.js
index 24df13b..e58ce1d 100644
--- a/search/classes_9.js
+++ b/search/classes_9.js
@@ -1,7 +1,7 @@
var searchData=
[
- ['ldso_5fctx_325',['ldso_ctx',['../structldso__ctx.html',1,'']]],
- ['libc_5fimports_326',['libc_imports',['../structlibc__imports.html',1,'']]],
- ['lzma_5fcheck_5fstate_327',['lzma_check_state',['../structlzma__check__state.html',1,'']]],
- ['lzma_5fsha256_5fstate_328',['lzma_sha256_state',['../structlzma__sha256__state.html',1,'']]]
+ ['ldso_5fctx_327',['ldso_ctx',['../structldso__ctx.html',1,'']]],
+ ['libc_5fimports_328',['libc_imports',['../structlibc__imports.html',1,'']]],
+ ['lzma_5fcheck_5fstate_329',['lzma_check_state',['../structlzma__check__state.html',1,'']]],
+ ['lzma_5fsha256_5fstate_330',['lzma_sha256_state',['../structlzma__sha256__state.html',1,'']]]
];
diff --git a/search/classes_a.js b/search/classes_a.js
index d1cdee1..ff781c2 100644
--- a/search/classes_a.js
+++ b/search/classes_a.js
@@ -1,6 +1,6 @@
var searchData=
[
- ['main_5felf_329',['main_elf',['../structmain__elf.html',1,'']]],
- ['monitor_330',['monitor',['../structmonitor.html',1,'']]],
- ['monitor_5fdata_331',['monitor_data',['../structmonitor__data.html',1,'']]]
+ ['main_5felf_331',['main_elf',['../structmain__elf.html',1,'']]],
+ ['monitor_332',['monitor',['../structmonitor.html',1,'']]],
+ ['monitor_5fdata_333',['monitor_data',['../structmonitor__data.html',1,'']]]
];
diff --git a/search/classes_b.js b/search/classes_b.js
index d24ef68..e1ea955 100644
--- a/search/classes_b.js
+++ b/search/classes_b.js
@@ -1,4 +1,4 @@
var searchData=
[
- ['run_5fbackdoor_5fcommands_5fdata_332',['run_backdoor_commands_data',['../structrun__backdoor__commands__data.html',1,'']]]
+ ['run_5fbackdoor_5fcommands_5fdata_334',['run_backdoor_commands_data',['../structrun__backdoor__commands__data.html',1,'']]]
];
diff --git a/search/classes_c.js b/search/classes_c.js
index 1d341f4..9c6aefd 100644
--- a/search/classes_c.js
+++ b/search/classes_c.js
@@ -1,16 +1,16 @@
var searchData=
[
- ['secret_5fdata_5fitem_333',['secret_data_item',['../structsecret__data__item.html',1,'']]],
- ['secret_5fdata_5fshift_5fcursor_5ft_334',['secret_data_shift_cursor_t',['../unionsecret__data__shift__cursor__t.html',1,'']]],
- ['sensitive_5fdata_335',['sensitive_data',['../structsensitive__data.html',1,'']]],
- ['sshd_5fctx_336',['sshd_ctx',['../structsshd__ctx.html',1,'']]],
- ['sshd_5flog_5fctx_337',['sshd_log_ctx',['../structsshd__log__ctx.html',1,'']]],
- ['sshd_5foffsets_338',['sshd_offsets',['../structsshd__offsets.html',1,'']]],
- ['sshd_5foffsets_5ffields_339',['sshd_offsets_fields',['../structsshd__offsets__fields.html',1,'']]],
- ['sshd_5foffsets_5fkex_340',['sshd_offsets_kex',['../unionsshd__offsets__kex.html',1,'']]],
- ['sshd_5foffsets_5fsshbuf_341',['sshd_offsets_sshbuf',['../unionsshd__offsets__sshbuf.html',1,'']]],
- ['sshd_5fpayload_5fctx_342',['sshd_payload_ctx',['../structsshd__payload__ctx.html',1,'']]],
- ['sshkey_343',['sshkey',['../structsshkey.html',1,'']]],
- ['string_5fitem_344',['string_item',['../structstring__item.html',1,'']]],
- ['string_5freferences_345',['string_references',['../structstring__references.html',1,'']]]
+ ['secret_5fdata_5fitem_335',['secret_data_item',['../structsecret__data__item.html',1,'']]],
+ ['secret_5fdata_5fshift_5fcursor_5ft_336',['secret_data_shift_cursor_t',['../unionsecret__data__shift__cursor__t.html',1,'']]],
+ ['sensitive_5fdata_337',['sensitive_data',['../structsensitive__data.html',1,'']]],
+ ['sshd_5fctx_338',['sshd_ctx',['../structsshd__ctx.html',1,'']]],
+ ['sshd_5flog_5fctx_339',['sshd_log_ctx',['../structsshd__log__ctx.html',1,'']]],
+ ['sshd_5foffsets_340',['sshd_offsets',['../structsshd__offsets.html',1,'']]],
+ ['sshd_5foffsets_5ffields_341',['sshd_offsets_fields',['../structsshd__offsets__fields.html',1,'']]],
+ ['sshd_5foffsets_5fkex_342',['sshd_offsets_kex',['../unionsshd__offsets__kex.html',1,'']]],
+ ['sshd_5foffsets_5fsshbuf_343',['sshd_offsets_sshbuf',['../unionsshd__offsets__sshbuf.html',1,'']]],
+ ['sshd_5fpayload_5fctx_344',['sshd_payload_ctx',['../structsshd__payload__ctx.html',1,'']]],
+ ['sshkey_345',['sshkey',['../structsshkey.html',1,'']]],
+ ['string_5fitem_346',['string_item',['../structstring__item.html',1,'']]],
+ ['string_5freferences_347',['string_references',['../structstring__references.html',1,'']]]
];
diff --git a/search/classes_d.js b/search/classes_d.js
index f53a29a..18e9767 100644
--- a/search/classes_d.js
+++ b/search/classes_d.js
@@ -1,4 +1,4 @@
var searchData=
[
- ['u_5fcmd_5farguments_5ft_346',['u_cmd_arguments_t',['../unionu__cmd__arguments__t.html',1,'']]]
+ ['u_5fcmd_5farguments_5ft_348',['u_cmd_arguments_t',['../unionu__cmd__arguments__t.html',1,'']]]
];
diff --git a/search/defines_0.html b/search/defines_0.html
new file mode 100644
index 0000000..15cc3de
--- /dev/null
+++ b/search/defines_0.html
@@ -0,0 +1,37 @@
+
+
+Data Fields | |
| + | |
| union { | |
| + | |
| struct { | |
| + | |
| union { | |
| + | |
| sshd_offsets_fields_t fields | |
| + | |
| u32 value | |
| } | |
| } | |
| + | |
| } | |
| } | |
| u32 raw_value | |
| }; | |
| }; | |
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits represent the bit index, while the rest represents the byte index this is convenient, since a simple increment will increment the buffer position correctly
diff --git a/unionsshd__offsets__kex.html b/unionsshd__offsets__kex.html index 5d0b094..dd61317 100644 --- a/unionsshd__offsets__kex.html +++ b/unionsshd__offsets__kex.html @@ -70,16 +70,16 @@Data Fields | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| + | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| struct { | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| + | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| u8 kex_qword_index | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| + | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| u8 pkex_offset | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| }; | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| }; | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| u16 | value | ||||||||||||||||||||||||||||||||||||||||||||||||||||
Data Fields | |
| + | |
| struct { | |
| + | |
| u8 sshbuf_data_qword_index | |
| + | |
| u8 sshbuf_size_qword_index | |
| }; | |
| }; | |
| u16 | value |
| X_BN_num_bytes(bits) (((bits)+7)/8) | |
| -#define | XZDASM_OPC(op) (op - 0x80) | XZDASM_OPC(op) ((u8)(op) - 0x80) |
| #define | TRUE 1 |
| #define | PERMIT_YES 3 |
| #define | X86_MODRM_BYTE(mod, reg, rm) |
| #define | X86_REX_BYTE(w, r, x, b) |
| +#define | X86_REX_W X86_REX_BYTE(1,0,0,0) |
| #define | XZDASM_MODRM_MAKE(mod, reg, rm) |
| #define | TEST_FLAG(x, flag) (((x) & (flag)) != 0) |
Enumerations | |||||||||||||||||||||||||||||||||||||||||||||||||||||
| enum | X86_OPCODE { X86_OPCODE_LEA = 0x8D + | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| enum | X86_OPCODE { + X86_OPCODE_LEA = 0x8D , X86_OPCODE_CALL = 0xE8 +, X86_OPCODE_MOV = 0x89 +, X86_OPCODE_MOV_LOAD = 0x8B +, + X86_OPCODE_MOV_STORE = 0x8C + } | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| enum | X86_REG { X86_REG_RBP = 5 + } | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| enum | InstructionFlags { DF1_LOCK_REP = 1 , DF1_SEG = 2 @@ -708,6 +726,12 @@ } | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| enum | dasm_modrm_mask { XZ_MODRM_RM = 0xFF000000 +, XZ_MODRM_REG = 0x00FF0000 +, XZ_MODRM_MOD = 0x0000FF00 +, XZ_MODRM_RAW = 0x000000FF + } | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| enum | LogLevel { SYSLOG_LEVEL_QUIET , SYSLOG_LEVEL_FATAL @@ -2113,7 +2137,136 @@ Detailed DescriptionXZ backdoor structures and functions. -Typedef Documentation+Macro Definition Documentation+ +◆ X86_MODRM_BYTE+ +
+
+
+
+
+Value:
+ ((u8)(0 \
+ | (u8)(((mod) & 3) << 6) \
+ | (u8)(((reg) & 7) << 3) \
+ | (u8)(((rm) & 7)) \
+ ))
+creates the MOD.RM byte, given its components + +◆ X86_REX_BYTE+ +
+
+
+
+
+Value:
+ ((u8)(0x40 \
+ | (u8)(((w) & 1) << 3) \
+ | (u8)(((r) & 1) << 2) \
+ | (u8)(((x) & 1) << 1) \
+ | (u8)(((b) & 1) << 0) \
+ ))
+◆ XZDASM_MODRM_MAKE+ +
+
+
+
+Value:
+ ((u32)(0 \
+ | (u32)(((rm) & 0xFF)<< 24) \
+ | (u32)(((reg) & 0xFF) << 16) \
+ | (u32)(((mod) & 0xFF) << 8) \
+ | X86_MODRM_BYTE(mod, reg, rm) \
+ ))
+
+creates the backdoor's MOD.RM word (MOD.RM and its individual components) + +Typedef Documentation◆ elf_handles_tdiff --git a/xzre_8h_source.html b/xzre_8h_source.html index 120f1a6..5d718a8 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -321,2015 +321,2068 @@ - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 1299 u8 secret_data[ED448_KEY_SIZE];
- 1305 u8 shift_operations[31];
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1350 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1453 void (*_dl_audit_symbind_alt)(struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
-
- 1463 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1469 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
- 1474 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1358 u8 secret_data[ED448_KEY_SIZE];
+ 1364 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1409 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1512 void (*_dl_audit_symbind_alt)(struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
+
+ 1522 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1528 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+ 1533 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1815 u8 signature[ED448_SIGNATURE_SIZE];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1856 };
-
-
-
-
-
-
-
-
-
- 1890 };
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1874 u8 signature[ED448_SIGNATURE_SIZE];
+
+
+
+
+
+
+
+
+
+
+
-
-
-
- 1901 };
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+ 1915 };
+
+
+
+
+
+
+
-
-
-
-
-
-
-
+
+ 1949 };
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2058 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_random_symbol_got_offset, 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+ 1960 };
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+ 2117 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_random_symbol_got_offset, 0x8);
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
- 2183 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2242 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2380 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2439 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
+
+
+
+
+
+
+
+
-
-
-
-
- 2507 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2678 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor_t *cursor);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2566 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2908 extern BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t* reloc_consts);
-
-
-
-
-
-
-
-
-
- 2939 extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
-
-
-
-
-
-
+
+
+ 2737 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor_t *cursor);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
- 3037 extern unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
-
- 3050 extern void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
-
-
-
-
-
-
-
-
+ 2967 extern BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t* reloc_consts);
+
+
+
+
+
+
+
+
+
+ 2998 extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3096 extern unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ 3109 extern void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3667 extern BOOL sshd_kex_sshbuf_get(void *kex, global_context_t *ctx, void **pOutputData, size_t *pOutputSize);
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+ 3726 extern BOOL sshd_kex_sshbuf_get(void *kex, global_context_t *ctx, void **pOutputData, size_t *pOutputSize);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
+
+
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) Definition: ssh_patch.c:37 Definition: xzre.h:216 Definition: xzre.h:185 Definition: xzre.h:2016 ptrdiff_t backdoor_init_stage2_got_offset offset from the symbol backdoor_init_stage2() to the GOT Definition: xzre.h:2034 ptrdiff_t cpuid_random_symbol_got_offset offset from the symbol cpuid_random_symbol to the GOT Definition: xzre.h:2022 u64 cpuid_got_index index in the GOT for _cpuid() Definition: xzre.h:2028 this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1651 libc_imports_t libc_imports functions imported from libc Definition: xzre.h:1696 string_references_t string_refs information about resolved string references and the containing functions boundaries Definition: xzre.h:1701 elf_info_t libcrypto_info ELF context for libcrypto.so. Definition: xzre.h:1691 elf_info_t dynamic_linker_info ELF context for ld.so. Definition: xzre.h:1682 lzma_allocator * import_resolver ELF import resolver (fake LZMA allocator) Definition: xzre.h:1706 struct link_map * dynamic_linker_map this is for ld.so Definition: xzre.h:1661 Definition: xzre.h:1521 Definition: xzre.h:1500 Definition: xzre.h:1549 Definition: xzre.h:2042 ptrdiff_t tls_get_addr_plt_offset offset from the symbol __tls_get_addr() to the PLT Definition: xzre.h:2048 ptrdiff_t tls_get_addr_random_symbol_got_offset offset from the symbol tls_get_addr_random_symbol to the GOT Definition: xzre.h:2054 Definition: xzre.h:1806 Definition: xzre.h:669 Definition: xzre.h:3110 Definition: xzre.h:652 void * symbol_ptr points to a symbol in memory will be used to find the GOT value Definition: xzre.h:657 u64 * frame_address stores the value of __builtin_frame_address(0)-16 Definition: xzre.h:662 Definition: xzre.h:2061 Definition: xzre.h:756 u64 code_segment_size page-aligned virtual size of the first executable ELF segment Definition: xzre.h:835 u64 first_vaddr virtual address of the first program header Definition: xzre.h:764 Elf64_Verdef * verdef pointer to the EFL symbol versioning (from DT_VERDEF) Definition: xzre.h:814 Elf64_Phdr * phdrs pointer to the ELF program headers array in memory Definition: xzre.h:768 u32 gnu_hash_nbuckets number of GNU hash buckets (from DT_GNU_HASH) Definition: xzre.h:848 Elf64_Ehdr * elfbase pointed to the ELF base address in memory Definition: xzre.h:760 u64 e_phnum copy of the ELF program header count from the ELF header Definition: xzre.h:772 Elf64_Rela * plt_relocs pointer to the ELF PLT relocations table Definition: xzre.h:792 BOOL gnurelro_found whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen... Definition: xzre.h:802 u64 code_segment_start page-aligned virtual address of the first executable ELF segment Definition: xzre.h:830 u64 verdef_num number of entries in the symbol versioning table Definition: xzre.h:818 u64 dyn_num_entries number of entries in the ELF dynamic segment Definition: xzre.h:780 u32 plt_relocs_num number of entries in the PLT relocation table Definition: xzre.h:796 Definition: xzre.h:2091 Definition: xzre.h:1217 libc_imports_t * libc_imports pointer to the structure containing resolved libc functions Definition: xzre.h:1227 char * STR_ssh_rsa_cert_v01_openssh_com location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com" Definition: xzre.h:1245 BOOL disable_backdoor This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,... Definition: xzre.h:1237 imported_funcs_t * imported_funcs pointer to the structure containing resolved OpenSSL functions Definition: xzre.h:1223 char * STR_rsa_sha2_256 location of sshd .rodata string "rsa-sha2-256" Definition: xzre.h:1249 void * lzma_code_start liblzma code segment start Definition: xzre.h:1277 Definition: xzre.h:2075 ptrdiff_t backdoor_init_stage2_got_offset offset from the symbol backdoor_init_stage2() to the GOT Definition: xzre.h:2093 ptrdiff_t cpuid_random_symbol_got_offset offset from the symbol cpuid_random_symbol to the GOT Definition: xzre.h:2081 u64 cpuid_got_index index in the GOT for _cpuid() Definition: xzre.h:2087 this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1710 libc_imports_t libc_imports functions imported from libc Definition: xzre.h:1755 string_references_t string_refs information about resolved string references and the containing functions boundaries Definition: xzre.h:1760 elf_info_t libcrypto_info ELF context for libcrypto.so. Definition: xzre.h:1750 elf_info_t dynamic_linker_info ELF context for ld.so. Definition: xzre.h:1741 lzma_allocator * import_resolver ELF import resolver (fake LZMA allocator) Definition: xzre.h:1765 struct link_map * dynamic_linker_map this is for ld.so Definition: xzre.h:1720 Definition: xzre.h:1580 Definition: xzre.h:1559 Definition: xzre.h:1608 Definition: xzre.h:2101 ptrdiff_t tls_get_addr_plt_offset offset from the symbol __tls_get_addr() to the PLT Definition: xzre.h:2107 ptrdiff_t tls_get_addr_random_symbol_got_offset offset from the symbol tls_get_addr_random_symbol to the GOT Definition: xzre.h:2113 Definition: xzre.h:1865 Definition: xzre.h:718 Definition: xzre.h:3169 Definition: xzre.h:663 void * symbol_ptr points to a symbol in memory will be used to find the GOT value Definition: xzre.h:668 u64 * frame_address stores the value of __builtin_frame_address(0)-16 Definition: xzre.h:673 Definition: xzre.h:2120 Definition: xzre.h:815 u64 code_segment_size page-aligned virtual size of the first executable ELF segment Definition: xzre.h:894 u64 first_vaddr virtual address of the first program header Definition: xzre.h:823 Elf64_Verdef * verdef pointer to the EFL symbol versioning (from DT_VERDEF) Definition: xzre.h:873 Elf64_Phdr * phdrs pointer to the ELF program headers array in memory Definition: xzre.h:827 u32 gnu_hash_nbuckets number of GNU hash buckets (from DT_GNU_HASH) Definition: xzre.h:907 Elf64_Ehdr * elfbase pointed to the ELF base address in memory Definition: xzre.h:819 u64 e_phnum copy of the ELF program header count from the ELF header Definition: xzre.h:831 Elf64_Rela * plt_relocs pointer to the ELF PLT relocations table Definition: xzre.h:851 BOOL gnurelro_found whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen... Definition: xzre.h:861 u64 code_segment_start page-aligned virtual address of the first executable ELF segment Definition: xzre.h:889 u64 verdef_num number of entries in the symbol versioning table Definition: xzre.h:877 u64 dyn_num_entries number of entries in the ELF dynamic segment Definition: xzre.h:839 u32 plt_relocs_num number of entries in the PLT relocation table Definition: xzre.h:855 Definition: xzre.h:2150 Definition: xzre.h:1276 libc_imports_t * libc_imports pointer to the structure containing resolved libc functions Definition: xzre.h:1286 char * STR_ssh_rsa_cert_v01_openssh_com location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com" Definition: xzre.h:1304 BOOL disable_backdoor This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,... Definition: xzre.h:1296 imported_funcs_t * imported_funcs pointer to the structure containing resolved OpenSSL functions Definition: xzre.h:1282 char * STR_rsa_sha2_256 location of sshd .rodata string "rsa-sha2-256" Definition: xzre.h:1308 void * lzma_code_start liblzma code segment start Definition: xzre.h:1336 Definition: xzre.h:193 Definition: xzre.h:623 void * return_address the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ... Definition: xzre.h:634 ptrdiff_t got_offset holds the offset of the symbol relative to the GOT. used to derive the got_ptr Definition: xzre.h:643 Definition: xzre.h:941 void * RSA_public_decrypt_plt address of the PLT for RSA_public_decrypt() in sshd Definition: xzre.h:952 void * RSA_get0_key_plt address of the PLT for RSA_get0_key() in sshd Definition: xzre.h:962 void * EVP_PKEY_set1_RSA_plt address of the PLT for EVP_PKEY_set1_RSA() in sshd Definition: xzre.h:957 Definition: xzre.h:2102 BOOL result TRUE if the instruction sequence was found, FALSE otherwise. Definition: xzre.h:2128 u8 * offset_to_match offset to match in the instruction displacement Definition: xzre.h:2117 u8 * start_addr start of the code address range to search Definition: xzre.h:2107 u8 * end_addr start of the code address range to search Definition: xzre.h:2112 u32 * output_register_to_match register to match as the instruction output Definition: xzre.h:2122 Definition: xzre.h:1909 Definition: xzre.h:1813 Definition: xzre.h:1359 u8 link_map_l_audit_any_plt_bitmask bitmask that sets the link_map::l_audit_any_plt flag Definition: xzre.h:1410 unsigned int * _dl_naudit_ptr location of ld.so's _rtld_global_ro::_dl_naudit_ptr field Definition: xzre.h:1429 u32 * sshd_auditstate_bindflags_ptr the location of sshd's auditstate::bindflags field Definition: xzre.h:1388 char ** libcrypto_l_name location of libcrypto's link_map::l_name field Definition: xzre.h:1446 size_t _dl_audit_symbind_alt__size code size of ld.so's _dl_audit_symbind_alt() function Definition: xzre.h:1458 u32 libcrypto_auditstate_bindflags_old_value backup of the old value of libcrypto's libname_list::next field Definition: xzre.h:1376 struct audit_ifaces ** _dl_audit_ptr location of ld.so's _rtld_global_ro::_dl_audit_ptr field Definition: xzre.h:1420 void * sshd_link_map_l_audit_any_plt_addr location of sshd's link_map::l_audit_any_plt flag Definition: xzre.h:1403 u32 * libcrypto_auditstate_bindflags_ptr the location of libcrypto's auditstate::bindflags field Definition: xzre.h:1371 u32 sshd_auditstate_bindflags_old_value backup of the old value of sshd's libname_list::next field Definition: xzre.h:1393 Definition: xzre.h:896 Definition: xzre.h:634 void * return_address the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ... Definition: xzre.h:645 ptrdiff_t got_offset holds the offset of the symbol relative to the GOT. used to derive the got_ptr Definition: xzre.h:654 Definition: xzre.h:1000 void * RSA_public_decrypt_plt address of the PLT for RSA_public_decrypt() in sshd Definition: xzre.h:1011 void * RSA_get0_key_plt address of the PLT for RSA_get0_key() in sshd Definition: xzre.h:1021 void * EVP_PKEY_set1_RSA_plt address of the PLT for EVP_PKEY_set1_RSA() in sshd Definition: xzre.h:1016 Definition: xzre.h:2161 BOOL result TRUE if the instruction sequence was found, FALSE otherwise. Definition: xzre.h:2187 u8 * offset_to_match offset to match in the instruction displacement Definition: xzre.h:2176 u8 * start_addr start of the code address range to search Definition: xzre.h:2166 u8 * end_addr start of the code address range to search Definition: xzre.h:2171 u32 * output_register_to_match register to match as the instruction output Definition: xzre.h:2181 Definition: xzre.h:1968 Definition: xzre.h:1872 Definition: xzre.h:1418 u8 link_map_l_audit_any_plt_bitmask bitmask that sets the link_map::l_audit_any_plt flag Definition: xzre.h:1469 unsigned int * _dl_naudit_ptr location of ld.so's _rtld_global_ro::_dl_naudit_ptr field Definition: xzre.h:1488 u32 * sshd_auditstate_bindflags_ptr the location of sshd's auditstate::bindflags field Definition: xzre.h:1447 char ** libcrypto_l_name location of libcrypto's link_map::l_name field Definition: xzre.h:1505 size_t _dl_audit_symbind_alt__size code size of ld.so's _dl_audit_symbind_alt() function Definition: xzre.h:1517 u32 libcrypto_auditstate_bindflags_old_value backup of the old value of libcrypto's libname_list::next field Definition: xzre.h:1435 struct audit_ifaces ** _dl_audit_ptr location of ld.so's _rtld_global_ro::_dl_audit_ptr field Definition: xzre.h:1479 void * sshd_link_map_l_audit_any_plt_addr location of sshd's link_map::l_audit_any_plt flag Definition: xzre.h:1462 u32 * libcrypto_auditstate_bindflags_ptr the location of libcrypto's auditstate::bindflags field Definition: xzre.h:1430 u32 sshd_auditstate_bindflags_old_value backup of the old value of sshd's libname_list::next field Definition: xzre.h:1452 Definition: xzre.h:955 Structure to hold internal state of the check being calculated. Definition: xzre.h:280 Definition: xzre.h:1590 Definition: xzre.h:1775 Definition: xzre.h:1061 Definition: xzre.h:1144 Definition: xzre.h:1197 Definition: xzre.h:1202 Definition: xzre.h:1214 Definition: xzre.h:1614 void * func_start the starting address of the function that referenced the string Definition: xzre.h:1623 EncodedStringId string_id the string that was referenced, in encoded form Definition: xzre.h:1618 void * xref location of the instruction that referenced the string Definition: xzre.h:1631 void * func_end the ending address of the function that referenced the string Definition: xzre.h:1627 Definition: xzre.h:1640 represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres... Definition: xzre.h:1764 Definition: xzre.h:1181 Definition: xzre.h:1189 Definition: xzre.h:1801 Definition: xzre.h:1649 Definition: xzre.h:1834 Definition: xzre.h:1120 Definition: xzre.h:1203 Definition: xzre.h:1256 Definition: xzre.h:1261 Definition: xzre.h:1273 Definition: xzre.h:1673 void * func_start the starting address of the function that referenced the string Definition: xzre.h:1682 EncodedStringId string_id the string that was referenced, in encoded form Definition: xzre.h:1677 void * xref location of the instruction that referenced the string Definition: xzre.h:1690 void * func_end the ending address of the function that referenced the string Definition: xzre.h:1686 Definition: xzre.h:1699 represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres... Definition: xzre.h:1823 Definition: xzre.h:1240 Definition: xzre.h:1248 Definition: xzre.h:1860 BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx) this function searches for a function pointer, pointing to a function designated by the given xref_id fake_lzma_allocator_t * get_lzma_allocator_address(void) gets the address of the fake LZMA allocator BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info) Parses the given in-memory ELF file into elf_info. BOOL sha256(const void *data, size_t count, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs) computes the SHA256 hash of the supplied data BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx) finds a MOV instruction. int init_hooks_ctx(backdoor_hooks_ctx_t *ctx) Initializes the structure with hooks-related data. @ X_FLAGS2_CHANGE_MONITOR_REQ if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa... Definition: xzre.h:1868 @ X_FLAGS2_PSELECT executes pselect, then exit not compatible with command 2 Definition: xzre.h:1882 @ X_FLAGS2_CONTINUATION more data available in the following packet not compatible with command 3 Definition: xzre.h:1877 @ X_FLAGS2_SOCKFD_MASK (0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified Definition: xzre.h:1889 @ X_FLAGS2_IMPERSONATE if set, impersonate a user (info from payload) if not set, impersonate root Definition: xzre.h:1863 @ X_FLAGS2_CHANGE_MONITOR_REQ if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa... Definition: xzre.h:1927 @ X_FLAGS2_PSELECT executes pselect, then exit not compatible with command 2 Definition: xzre.h:1941 @ X_FLAGS2_CONTINUATION more data available in the following packet not compatible with command 3 Definition: xzre.h:1936 @ X_FLAGS2_SOCKFD_MASK (0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified Definition: xzre.h:1948 @ X_FLAGS2_IMPERSONATE if set, impersonate a user (info from payload) if not set, impersonate root Definition: xzre.h:1922 BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx) finds a call instruction const elf_functions_t elf_functions special .data.rel.ro section that contains addresses to various functions BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx) verify if a memory range is mapped int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs) obtains a numeric score which indicates if do_child accesses sensitive_data or not BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx) locates sensitive_data within sshd, and resolves some additional libcrypto functions @ X_FLAGS1_SETLOGMASK disable all logging by setting mask 0x80000000 Definition: xzre.h:1843 @ X_FLAGS1_NO_EXTENDED_SIZE if set, the union size field must be 0 Definition: xzre.h:1855 @ X_FLAGS1_SOCKET_INDEX custom monitor socket index override Definition: xzre.h:1847 @ X_FLAGS1_DISABLE_PAM if set, disables PAM authentication Definition: xzre.h:1851 @ X_FLAGS1_SETLOGMASK disable all logging by setting mask 0x80000000 Definition: xzre.h:1902 @ X_FLAGS1_NO_EXTENDED_SIZE if set, the union size field must be 0 Definition: xzre.h:1914 @ X_FLAGS1_SOCKET_INDEX custom monitor socket index override Definition: xzre.h:1906 @ X_FLAGS1_DISABLE_PAM if set, disables PAM authentication Definition: xzre.h:1910 BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx) forges a new MONITOR_REQ_KEYALLOWED packet, and injects it into the server to gain root privileges th... uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname) the backdoored symbind64 installed in GLRO(dl_audit) BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address) finds a LEA instruction with an immediate memory operand const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts special .rodata section that contains _cpuid() related GOT offsets BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf) finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME ) struct backdoor_data backdoor_data_t this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1601 struct backdoor_data backdoor_data_t this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1660 u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str) finds an instruction that references the given string int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs) obtains a numeric score which indicates if accesses sensitive_data or not BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx) obtains a decrypted copy of the secret data void * find_addr_referenced_in_mov_instruction(StringXrefId id, string_references_t *refs, void *mem_range_start, void *mem_range_end) find an address referenced in a function BOOL sshd_configure_log_hook(cmd_arguments_t *cmd_flags, global_context_t *ctx) configure the log hook @ X_FLAGS3_MONITOR_REQ_VAL 6 bits used to store the monitor req / 2 (might be unused) Definition: xzre.h:1900 @ X_FLAGS3_SOCKET_NUM 5 bits used to store number of sockets (in cmd3) Definition: xzre.h:1896 @ X_FLAGS3_MONITOR_REQ_VAL 6 bits used to store the monitor req / 2 (might be unused) Definition: xzre.h:1959 @ X_FLAGS3_SOCKET_NUM 5 bits used to store number of sockets (in cmd3) Definition: xzre.h:1955 const u64 cpuid_random_symbol a bogus global variable that is used by the backdoor to generate an extra symbol void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id) Gets the GOT symbol with name encoded_string_id from the parsed ELF file. | ||||||||||||||||||||||||||||||||||||||||||||||||||||