From 343a2ea00bc3af689167424b1794321535d6e653 Mon Sep 17 00:00:00 2001 From: smx-smx Date: Thu, 4 Apr 2024 23:04:41 +0000 Subject: [PATCH] =?UTF-8?q?Deploying=20to=20gh-pages=20from=20@=20smx-smx/?= =?UTF-8?q?xzre@5fcd7eaa093334e1ee2ffda7c519c98713819323=20=F0=9F=9A=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- xzre_8h.html | 36 ++ xzre_8h_source.html | 797 +++++++++++++++++++++++--------------------- 2 files changed, 450 insertions(+), 383 deletions(-) diff --git a/xzre_8h.html b/xzre_8h.html index d925cea..3487369 100644 --- a/xzre_8h.html +++ b/xzre_8h.html @@ -79,6 +79,9 @@ #include <stddef.h>
#include <stdint.h>
#include <lzma.h>
+#include <openssl/dsa.h>
+#include <openssl/ec.h>
+#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <elf.h>
#include "util.h"
@@ -311,6 +314,9 @@  assert_offset (system_imports_t, resolved_imports_count, 0)   + + assert_offset (system_imports_t, malloc_usable_size, 8) +   assert_offset (system_imports_t, getuid, 0x10)   @@ -341,6 +347,36 @@  assert_offset (imported_funcs_t, RSA_public_decrypt, 0)   + + assert_offset (imported_funcs_t, EVP_PKEY_set1_RSA_null, 8) +  + + assert_offset (imported_funcs_t, RSA_get0_key_null, 0x10) +  + + assert_offset (imported_funcs_t, RSA_public_decrypt_hook_ptr, 0x18) +  + + assert_offset (imported_funcs_t, EVP_PKEY_set1_RSA_hook_ptr_null, 0x20) +  + + assert_offset (imported_funcs_t, RSA_get0_key_hook_ptr_null, 0x28) +  + + assert_offset (imported_funcs_t, DSA_get0_pqg, 0x30) +  + + assert_offset (imported_funcs_t, DSA_get0_pub_key, 0x38) +  + + assert_offset (imported_funcs_t, EC_POINT_point2oct, 0x40) +  + + assert_offset (imported_funcs_t, EC_KEY_get0_public_key, 0x48) +  + + assert_offset (imported_funcs_t, EC_KEY_get0_group, 0x50) +   assert_offset (imported_funcs_t, EVP_sha256, 0x58)   diff --git a/xzre_8h_source.html b/xzre_8h_source.html index c64cb42..0c2e1f4 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -80,391 +80,422 @@
18 typedef uintptr_t uptr;
19 
20 #include <lzma.h>
-
21 #include <openssl/rsa.h>
-
22 #include <elf.h>
-
23 
-
24 #define UPTR(x) ((uptr)(x))
-
25 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
-
26 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
-
27 
-
28 // opcode is always +0x80 for the sake of it (yet another obfuscation)
-
29 #define XZDASM_OPC(op) (op - 0x80)
+
21 #include <openssl/dsa.h>
+
22 #include <openssl/ec.h>
+
23 #include <openssl/evp.h>
+
24 #include <openssl/rsa.h>
+
25 #include <elf.h>
+
26 
+
27 #define UPTR(x) ((uptr)(x))
+
28 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
+
29 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
30 
-
31 typedef int BOOL;
-
32 
-
33 typedef enum {
-
34  // has lock prefix
-
35  DF_LOCK = 1,
-
36  // has es-segment override
-
37  DF_ESEG = 2,
-
38  // has operand size override
-
39  DF_OSIZE = 4,
-
40  // has address size override
-
41  DF_ASIZE = 8,
-
42  // has rex
-
43  DF_REX = 0x20
-
44 } DasmFlags;
-
45 
-
46 typedef enum {
-
47  // ELF has JMPREL relocs
-
48  X_ELF_PLTREL = 0x1,
-
49  // ELF has RELA relocs
-
50  X_ELF_RELA = 0x2,
-
51  // ELF has RELR relocs
-
52  X_ELF_RELR = 0x4,
-
53  // ELF has DT_VERSYM
-
54  X_ELF_VERSYM = 0x10,
-
55  // ELF has DF_1_NOW
-
56  X_ELF_NOW = 0x20
-
57 } ElfFlags;
-
58 
-
59 typedef enum {
-
60  // register-indirect addressing or no displacement
-
61  MRM_I_REG, // 00
-
62  // indirect with one byte displacement
-
63  MRM_I_DISP1, // 01
-
64  // indirect with four byte displacement
-
65  MRM_I_DISP4, // 10
-
66  // direct-register addressing
-
67  MRM_D_REG // 11
-
68 } ModRm_Mod;
-
69 
-
70 typedef enum {
-
71  // find function beginning by looking for endbr64
-
72  FIND_ENDBR64,
-
73  // find function beginning by looking for padding,
-
74  // then getting the instruction after it
-
75  FIND_NOP
-
76 } FuncFindType;
-
77 
-
78 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
79 
-
80 #define CONCAT(x, y) x ## y
-
81 #define EXPAND(x, y) CONCAT(x, y)
-
82 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
83 
-
84 typedef struct __attribute__((packed)) {
-
85  u8* first_instruction;
-
86  u64 instruction_size;
-
87  u8 flags;
-
88  u8 flags2;
-
89  PADDING(2);
-
90  u8 lock_byte;
-
91  u8 _unk1;
-
92  u8 last_prefix;
-
93  PADDING(4);
-
94  u8 rex_byte;
-
95  u8 modrm;
-
96  u8 modrm_mod;
-
97  u8 modrm_reg;
-
98  u8 modrm_rm;
-
99  PADDING(4);
-
100  u8 byte_24;
-
101  PADDING(3);
-
102  u32 opcode;
-
103  PADDING(4);
-
104  u64 mem_disp;
-
105  // e.g. in CALL
-
106  u64 operand;
-
107  PADDING(16);
-
108  u8 insn_offset;
-
109  PADDING(47);
-
110 } dasm_ctx_t;
-
111 
-
112 assert_offset(dasm_ctx_t, first_instruction, 0);
-
113 assert_offset(dasm_ctx_t, instruction_size, 8);
-
114 assert_offset(dasm_ctx_t, flags, 0x10);
-
115 assert_offset(dasm_ctx_t, flags2, 0x11);
-
116 assert_offset(dasm_ctx_t, lock_byte, 0x14);
-
117 assert_offset(dasm_ctx_t, last_prefix, 0x16);
-
118 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
-
119 assert_offset(dasm_ctx_t, modrm, 0x1C);
-
120 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
-
121 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
-
122 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
-
123 assert_offset(dasm_ctx_t, opcode, 0x28);
-
124 assert_offset(dasm_ctx_t, mem_disp, 0x30);
-
125 assert_offset(dasm_ctx_t, operand, 0x38);
-
126 assert_offset(dasm_ctx_t, insn_offset, 0x50);
-
127 static_assert(sizeof(dasm_ctx_t) == 128);
-
128 
-
129 typedef struct __attribute__((packed)) {
-
133  Elf64_Ehdr *elfbase;
-
137  u64 first_vaddr;
-
141  Elf64_Phdr *phdrs;
-
145  u64 e_phnum;
-
149  Elf64_Dyn *dyn;
-
153  u64 dyn_num_entries;
-
157  char *strtab;
-
161  Elf64_Sym *symtab;
-
165  Elf64_Rela *plt_relocs;
-
169  u32 plt_relocs_num;
-
175  BOOL gnurelro_found;
-
179  u64 gnurelro_vaddr;
-
183  u64 gnurelro_memsize;
-
187  Elf64_Verdef *verdef;
-
191  u64 verdef_num;
-
192  Elf64_Versym *versym;
-
193  Elf64_Rela *rela_relocs;
-
194  u32 rela_relocs_num;
-
195  u32 _unused0;
-
196  Elf64_Relr *relr_relocs;
-
197  u32 relr_relocs_num;
-
198  PADDING(4);
-
203  u64 code_segment_start;
-
208  u64 code_segment_size;
-
209  PADDING(0x28);
-
210  u8 flags;
-
211  PADDING(7);
-
215  u32 gnu_hash_nbuckets;
-
219  u32 gnu_hash_last_bloom;
-
220  u32 gnu_hash_bloom_shift;
-
221  PADDING(4);
-
222  u64 *gnu_hash_bloom;
-
223  u32 *gnu_hash_buckets;
-
224  u32 *gnu_hash_chain;
-
225 } elf_info_t;
-
226 
-
227 assert_offset(elf_info_t, elfbase, 0x0);
-
228 assert_offset(elf_info_t, first_vaddr, 0x8);
-
229 assert_offset(elf_info_t, phdrs, 0x10);
-
230 assert_offset(elf_info_t, e_phnum, 0x18);
-
231 assert_offset(elf_info_t, dyn, 0x20);
-
232 assert_offset(elf_info_t, dyn_num_entries, 0x28);
-
233 assert_offset(elf_info_t, strtab, 0x30);
-
234 assert_offset(elf_info_t, symtab, 0x38);
-
235 assert_offset(elf_info_t, plt_relocs, 0x40);
-
236 assert_offset(elf_info_t, plt_relocs_num, 0x48);
-
237 assert_offset(elf_info_t, gnurelro_found, 0x4C);
-
238 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
-
239 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
-
240 assert_offset(elf_info_t, verdef, 0x60);
-
241 assert_offset(elf_info_t, verdef_num, 0x68);
-
242 assert_offset(elf_info_t, versym, 0x70);
-
243 assert_offset(elf_info_t, rela_relocs, 0x78);
-
244 assert_offset(elf_info_t, rela_relocs_num, 0x80);
-
245 assert_offset(elf_info_t, relr_relocs, 0x88);
-
246 assert_offset(elf_info_t, relr_relocs_num, 0x90);
-
247 assert_offset(elf_info_t, code_segment_start, 0x98);
-
248 assert_offset(elf_info_t, code_segment_size, 0xA0);
-
249 assert_offset(elf_info_t, flags, 0xD0);
-
250 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
-
251 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
-
252 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
-
253 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
-
254 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
-
255 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
-
256 
-
257 typedef struct __attribute__((packed)) {
-
258  u32 resolved_imports_count;
-
259  PADDING(12);
-
260  uid_t (*getuid)(void);
-
261  void (*exit)(int status);
-
262  int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
-
263  int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
-
264  int (*system)(const char *command);
-
265  ssize_t (*write)(int fd, const void *buf, size_t count);
-
266  int (*pselect)(
-
267  int nfds, fd_set *readfds, fd_set *writefds,
-
268  fd_set *exceptfds, const struct timespec *timeout,
-
269  const sigset_t *sigmask);
-
270  PADDING(0x10);
-
271  int (*setlogmask)(int mask);
-
272  int (*shutdown)(int sockfd, int how);
-
273 } system_imports_t;
-
274 
-
275 assert_offset(system_imports_t, resolved_imports_count, 0);
-
276 assert_offset(system_imports_t, getuid, 0x10);
-
277 assert_offset(system_imports_t, exit, 0x18);
-
278 assert_offset(system_imports_t, setresgid, 0x20);
-
279 assert_offset(system_imports_t, setresuid, 0x28);
-
280 assert_offset(system_imports_t, system, 0x30);
-
281 assert_offset(system_imports_t, write, 0x38);
-
282 assert_offset(system_imports_t, pselect, 0x40);
-
283 assert_offset(system_imports_t, setlogmask, 0x58);
-
284 assert_offset(system_imports_t, shutdown, 0x60);
-
285 
-
286 typedef struct __attribute__((packed)) {
-
287  int (*RSA_public_decrypt)(
-
288  int flen, unsigned char *from,
-
289  unsigned char *to, RSA *rsa, int padding);
-
290  PADDING(0x50);
-
291  EVP_MD *(*EVP_sha256)(void);
-
292  void (*RSA_get0_key)(
-
293  const RSA *r,
-
294  const BIGNUM **n,
-
295  const BIGNUM **e,
-
296  const BIGNUM **d);
-
297  int (*BN_num_bits)(const BIGNUM *a);
-
298  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
299  int type, ENGINE *e,
-
300  const unsigned char *key, size_t keylen);
-
301  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
-
302  int (*EVP_DigestVerifyInit)(
-
303  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
-
304  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
-
305  PADDING(0x8);
-
306  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
-
307  void (*EVP_PKEY_free)(EVP_PKEY *key);
-
308  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
-
309  int (*EVP_DecryptInit_ex)(
-
310  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
-
311  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
-
312  int (*EVP_DecryptUpdate)(
-
313  EVP_CIPHER_CTX *ctx, unsigned char *out,
-
314  int *outl, const unsigned char *in, int inl);
-
315  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
-
316  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
-
317  EVP_CIPHER *(*EVP_chacha20)(void);
-
318  RSA *(*RSA_new)(void);
-
319  BIGNUM *(*BN_dup)(const BIGNUM *from);
-
320  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
-
321  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
322  PADDING(8);
-
323  int (*RSA_sign)(
-
324  int type,
-
325  const unsigned char *m, unsigned int m_len,
-
326  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
-
327  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
-
328  void (*RSA_free)(RSA *rsa);
-
329  void (*BN_free)(BIGNUM *a);
-
330  system_imports_t *system;
-
331  u32 resolved_imports_count;
-
332 } imported_funcs_t;
-
333 
-
334 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
-
335 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
-
336 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
-
337 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
-
338 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
-
339 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
-
340 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
-
341 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
-
342 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
-
343 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
-
344 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
-
345 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
-
346 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
-
347 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
-
348 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
-
349 assert_offset(imported_funcs_t, RSA_new, 0xD0);
-
350 assert_offset(imported_funcs_t, BN_dup, 0xD8);
-
351 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
-
352 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
-
353 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
-
354 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
-
355 assert_offset(imported_funcs_t, RSA_free, 0x108);
-
356 assert_offset(imported_funcs_t, BN_free, 0x110);
-
357 assert_offset(imported_funcs_t, system, 0x118);
-
358 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
-
359 
-
360 typedef struct __attribute__((packed)) {
-
361  PADDING(8);
-
366  imported_funcs_t *imported_funcs;
-
367  PADDING(0x70);
-
373  u64 code_range_start;
-
379  u64 code_range_end;
-
380  PADDING(0x78);
-
385  u8 secret_data[57];
-
391  u8 shift_operations[31];
-
397  u32 reg2reg_instructions_count;
-
398 } global_context_t;
-
399 
-
400 assert_offset(global_context_t, imported_funcs, 8);
-
401 assert_offset(global_context_t, code_range_start, 0x80);
-
402 assert_offset(global_context_t, code_range_end, 0x88);
-
403 assert_offset(global_context_t, secret_data, 0x108);
-
404 assert_offset(global_context_t, shift_operations, 0x141);
-
405 assert_offset(global_context_t, reg2reg_instructions_count, 0x160);
-
406 
-
413 typedef union {
-
414  struct {
-
416  u32 bit_index : 3;
-
418  u32 byte_index : 29;
-
419  };
-
421  u32 index;
-
422 } secret_data_shift_cursor;
-
423 
-
432 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
-
433 
-
443 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
-
444 
-
453 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
+
31 // opcode is always +0x80 for the sake of it (yet another obfuscation)
+
32 #define XZDASM_OPC(op) (op - 0x80)
+
33 
+
34 typedef int BOOL;
+
35 
+
36 typedef enum {
+
37  // has lock prefix
+
38  DF_LOCK = 1,
+
39  // has es-segment override
+
40  DF_ESEG = 2,
+
41  // has operand size override
+
42  DF_OSIZE = 4,
+
43  // has address size override
+
44  DF_ASIZE = 8,
+
45  // has rex
+
46  DF_REX = 0x20
+
47 } DasmFlags;
+
48 
+
49 typedef enum {
+
50  // ELF has JMPREL relocs
+
51  X_ELF_PLTREL = 0x1,
+
52  // ELF has RELA relocs
+
53  X_ELF_RELA = 0x2,
+
54  // ELF has RELR relocs
+
55  X_ELF_RELR = 0x4,
+
56  // ELF has DT_VERSYM
+
57  X_ELF_VERSYM = 0x10,
+
58  // ELF has DF_1_NOW
+
59  X_ELF_NOW = 0x20
+
60 } ElfFlags;
+
61 
+
62 typedef enum {
+
63  // register-indirect addressing or no displacement
+
64  MRM_I_REG, // 00
+
65  // indirect with one byte displacement
+
66  MRM_I_DISP1, // 01
+
67  // indirect with four byte displacement
+
68  MRM_I_DISP4, // 10
+
69  // direct-register addressing
+
70  MRM_D_REG // 11
+
71 } ModRm_Mod;
+
72 
+
73 typedef enum {
+
74  // find function beginning by looking for endbr64
+
75  FIND_ENDBR64,
+
76  // find function beginning by looking for padding,
+
77  // then getting the instruction after it
+
78  FIND_NOP
+
79 } FuncFindType;
+
80 
+
81 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
82 
+
83 #define CONCAT(x, y) x ## y
+
84 #define EXPAND(x, y) CONCAT(x, y)
+
85 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
86 
+
87 typedef struct __attribute__((packed)) {
+
88  u8* first_instruction;
+
89  u64 instruction_size;
+
90  u8 flags;
+
91  u8 flags2;
+
92  PADDING(2);
+
93  u8 lock_byte;
+
94  u8 _unk1;
+
95  u8 last_prefix;
+
96  PADDING(4);
+
97  u8 rex_byte;
+
98  u8 modrm;
+
99  u8 modrm_mod;
+
100  u8 modrm_reg;
+
101  u8 modrm_rm;
+
102  PADDING(4);
+
103  u8 byte_24;
+
104  PADDING(3);
+
105  u32 opcode;
+
106  PADDING(4);
+
107  u64 mem_disp;
+
108  // e.g. in CALL
+
109  u64 operand;
+
110  PADDING(16);
+
111  u8 insn_offset;
+
112  PADDING(47);
+
113 } dasm_ctx_t;
+
114 
+
115 assert_offset(dasm_ctx_t, first_instruction, 0);
+
116 assert_offset(dasm_ctx_t, instruction_size, 8);
+
117 assert_offset(dasm_ctx_t, flags, 0x10);
+
118 assert_offset(dasm_ctx_t, flags2, 0x11);
+
119 assert_offset(dasm_ctx_t, lock_byte, 0x14);
+
120 assert_offset(dasm_ctx_t, last_prefix, 0x16);
+
121 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
+
122 assert_offset(dasm_ctx_t, modrm, 0x1C);
+
123 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
+
124 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
+
125 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
+
126 assert_offset(dasm_ctx_t, opcode, 0x28);
+
127 assert_offset(dasm_ctx_t, mem_disp, 0x30);
+
128 assert_offset(dasm_ctx_t, operand, 0x38);
+
129 assert_offset(dasm_ctx_t, insn_offset, 0x50);
+
130 static_assert(sizeof(dasm_ctx_t) == 128);
+
131 
+
132 typedef struct __attribute__((packed)) {
+
136  Elf64_Ehdr *elfbase;
+
140  u64 first_vaddr;
+
144  Elf64_Phdr *phdrs;
+
148  u64 e_phnum;
+
152  Elf64_Dyn *dyn;
+
156  u64 dyn_num_entries;
+
160  char *strtab;
+
164  Elf64_Sym *symtab;
+
168  Elf64_Rela *plt_relocs;
+
172  u32 plt_relocs_num;
+
178  BOOL gnurelro_found;
+
182  u64 gnurelro_vaddr;
+
186  u64 gnurelro_memsize;
+
190  Elf64_Verdef *verdef;
+
194  u64 verdef_num;
+
195  Elf64_Versym *versym;
+
196  Elf64_Rela *rela_relocs;
+
197  u32 rela_relocs_num;
+
198  u32 _unused0;
+
199  Elf64_Relr *relr_relocs;
+
200  u32 relr_relocs_num;
+
201  PADDING(4);
+
206  u64 code_segment_start;
+
211  u64 code_segment_size;
+
212  PADDING(0x28);
+
213  u8 flags;
+
214  PADDING(7);
+
218  u32 gnu_hash_nbuckets;
+
222  u32 gnu_hash_last_bloom;
+
223  u32 gnu_hash_bloom_shift;
+
224  PADDING(4);
+
225  u64 *gnu_hash_bloom;
+
226  u32 *gnu_hash_buckets;
+
227  u32 *gnu_hash_chain;
+
228 } elf_info_t;
+
229 
+
230 assert_offset(elf_info_t, elfbase, 0x0);
+
231 assert_offset(elf_info_t, first_vaddr, 0x8);
+
232 assert_offset(elf_info_t, phdrs, 0x10);
+
233 assert_offset(elf_info_t, e_phnum, 0x18);
+
234 assert_offset(elf_info_t, dyn, 0x20);
+
235 assert_offset(elf_info_t, dyn_num_entries, 0x28);
+
236 assert_offset(elf_info_t, strtab, 0x30);
+
237 assert_offset(elf_info_t, symtab, 0x38);
+
238 assert_offset(elf_info_t, plt_relocs, 0x40);
+
239 assert_offset(elf_info_t, plt_relocs_num, 0x48);
+
240 assert_offset(elf_info_t, gnurelro_found, 0x4C);
+
241 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
+
242 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
+
243 assert_offset(elf_info_t, verdef, 0x60);
+
244 assert_offset(elf_info_t, verdef_num, 0x68);
+
245 assert_offset(elf_info_t, versym, 0x70);
+
246 assert_offset(elf_info_t, rela_relocs, 0x78);
+
247 assert_offset(elf_info_t, rela_relocs_num, 0x80);
+
248 assert_offset(elf_info_t, relr_relocs, 0x88);
+
249 assert_offset(elf_info_t, relr_relocs_num, 0x90);
+
250 assert_offset(elf_info_t, code_segment_start, 0x98);
+
251 assert_offset(elf_info_t, code_segment_size, 0xA0);
+
252 assert_offset(elf_info_t, flags, 0xD0);
+
253 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
+
254 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
+
255 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
+
256 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
+
257 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
+
258 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
+
259 
+
260 typedef struct __attribute__((packed)) {
+
261  u32 resolved_imports_count;
+
262  PADDING(4);
+
263  size_t (*malloc_usable_size)(void *ptr);
+
264  uid_t (*getuid)(void);
+
265  void (*exit)(int status);
+
266  int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+
267  int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+
268  int (*system)(const char *command);
+
269  ssize_t (*write)(int fd, const void *buf, size_t count);
+
270  int (*pselect)(
+
271  int nfds, fd_set *readfds, fd_set *writefds,
+
272  fd_set *exceptfds, const struct timespec *timeout,
+
273  const sigset_t *sigmask);
+
274  PADDING(0x10);
+
275  int (*setlogmask)(int mask);
+
276  int (*shutdown)(int sockfd, int how);
+
277 } system_imports_t;
+
278 
+
279 assert_offset(system_imports_t, resolved_imports_count, 0);
+
280 assert_offset(system_imports_t, malloc_usable_size, 8);
+
281 assert_offset(system_imports_t, getuid, 0x10);
+
282 assert_offset(system_imports_t, exit, 0x18);
+
283 assert_offset(system_imports_t, setresgid, 0x20);
+
284 assert_offset(system_imports_t, setresuid, 0x28);
+
285 assert_offset(system_imports_t, system, 0x30);
+
286 assert_offset(system_imports_t, write, 0x38);
+
287 assert_offset(system_imports_t, pselect, 0x40);
+
288 assert_offset(system_imports_t, setlogmask, 0x58);
+
289 assert_offset(system_imports_t, shutdown, 0x60);
+
290 
+
291 typedef struct __attribute__((packed)) {
+
292  int (*RSA_public_decrypt)(
+
293  int flen, unsigned char *from,
+
294  unsigned char *to, RSA *rsa, int padding);
+
295  int (*EVP_PKEY_set1_RSA_null)(EVP_PKEY *pkey, struct rsa_st *key);
+
296  void (*RSA_get0_key_null)(
+
297  const RSA *r, const BIGNUM **n,
+
298  const BIGNUM **e, const BIGNUM **d);
+
299  void *RSA_public_decrypt_hook_ptr;
+
300  void *EVP_PKEY_set1_RSA_hook_ptr_null;
+
301  void *RSA_get0_key_hook_ptr_null;
+
302  void (*DSA_get0_pqg)(
+
303  const DSA *d, const BIGNUM **p,
+
304  const BIGNUM **q, const BIGNUM **g);
+
305  const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
+
306  size_t (*EC_POINT_point2oct)(
+
307  const EC_GROUP *group, const EC_POINT *p,
+
308  point_conversion_form_t form, unsigned char *buf,
+
309  size_t len, BN_CTX *ctx);
+
310  EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
+
311  const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
+
312  EVP_MD *(*EVP_sha256)(void);
+
313  void (*RSA_get0_key)(
+
314  const RSA *r,
+
315  const BIGNUM **n,
+
316  const BIGNUM **e,
+
317  const BIGNUM **d);
+
318  int (*BN_num_bits)(const BIGNUM *a);
+
319  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
320  int type, ENGINE *e,
+
321  const unsigned char *key, size_t keylen);
+
322  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+
323  int (*EVP_DigestVerifyInit)(
+
324  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+
325  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+
326  PADDING(0x8);
+
327  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+
328  void (*EVP_PKEY_free)(EVP_PKEY *key);
+
329  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+
330  int (*EVP_DecryptInit_ex)(
+
331  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+
332  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
+
333  int (*EVP_DecryptUpdate)(
+
334  EVP_CIPHER_CTX *ctx, unsigned char *out,
+
335  int *outl, const unsigned char *in, int inl);
+
336  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
+
337  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+
338  EVP_CIPHER *(*EVP_chacha20)(void);
+
339  RSA *(*RSA_new)(void);
+
340  BIGNUM *(*BN_dup)(const BIGNUM *from);
+
341  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
+
342  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
343  PADDING(8);
+
344  int (*RSA_sign)(
+
345  int type,
+
346  const unsigned char *m, unsigned int m_len,
+
347  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
348  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
+
349  void (*RSA_free)(RSA *rsa);
+
350  void (*BN_free)(BIGNUM *a);
+
351  system_imports_t *system;
+
352  u32 resolved_imports_count;
+
353 } imported_funcs_t;
+
354 
+
355 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
+
356 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_null, 8);
+
357 assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
+
358 assert_offset(imported_funcs_t, RSA_public_decrypt_hook_ptr, 0x18);
+
359 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_hook_ptr_null, 0x20);
+
360 assert_offset(imported_funcs_t, RSA_get0_key_hook_ptr_null, 0x28);
+
361 assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
+
362 assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
+
363 assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
+
364 assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
+
365 assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
+
366 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
+
367 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
+
368 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
+
369 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
+
370 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
+
371 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
+
372 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
+
373 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
+
374 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
+
375 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
+
376 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
+
377 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
+
378 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
+
379 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
+
380 assert_offset(imported_funcs_t, RSA_new, 0xD0);
+
381 assert_offset(imported_funcs_t, BN_dup, 0xD8);
+
382 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
+
383 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
+
384 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
+
385 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
+
386 assert_offset(imported_funcs_t, RSA_free, 0x108);
+
387 assert_offset(imported_funcs_t, BN_free, 0x110);
+
388 assert_offset(imported_funcs_t, system, 0x118);
+
389 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
+
390 
+
391 typedef struct __attribute__((packed)) {
+
392  PADDING(8);
+
397  imported_funcs_t *imported_funcs;
+
398  PADDING(0x70);
+
404  u64 code_range_start;
+
410  u64 code_range_end;
+
411  PADDING(0x78);
+
416  u8 secret_data[57];
+
422  u8 shift_operations[31];
+
428  u32 reg2reg_instructions_count;
+
429 } global_context_t;
+
430 
+
431 assert_offset(global_context_t, imported_funcs, 8);
+
432 assert_offset(global_context_t, code_range_start, 0x80);
+
433 assert_offset(global_context_t, code_range_end, 0x88);
+
434 assert_offset(global_context_t, secret_data, 0x108);
+
435 assert_offset(global_context_t, shift_operations, 0x141);
+
436 assert_offset(global_context_t, reg2reg_instructions_count, 0x160);
+
437 
+
444 typedef union {
+
445  struct {
+
447  u32 bit_index : 3;
+
449  u32 byte_index : 29;
+
450  };
+
452  u32 index;
+
453 } secret_data_shift_cursor;
454 
-
464 extern BOOL find_instruction_with_mem_operand(
-
465  u8 *code_start,
-
466  u8 *code_end,
-
467  dasm_ctx_t *dctx,
-
468  u8 *mem_address
-
469 );
-
470 
-
480 extern BOOL find_lea_instruction_with_mem_operand(
-
481  u8 *code_start,
-
482  u8 *code_end,
-
483  dasm_ctx_t *dctx,
-
484  u8 *mem_address
-
485 );
-
486 
-
497 extern BOOL find_instruction_with_mem_operand_ex(
-
498  u8 *code_start,
-
499  u8 *code_end,
-
500  dasm_ctx_t *dctx,
-
501  int opcode,
-
502  u8 *mem_address
-
503 );
-
504 
-
524 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
-
525 
-
535 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
-
536 
-
550 extern BOOL find_function_prologue_ex(
-
551  u8 *code_start,
-
552  u8 *func_start_0,
-
553  u8 *func_start_1,
-
554  u8 *search_base,
-
555  u8 *code_end,
-
556  FuncFindType find_mode);
-
557 
-
568 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
-
569 
-
577 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
-
578 
-
587 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
+
463 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
+
464 
+
474 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
+
475 
+
484 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
+
485 
+
495 extern BOOL find_instruction_with_mem_operand(
+
496  u8 *code_start,
+
497  u8 *code_end,
+
498  dasm_ctx_t *dctx,
+
499  u8 *mem_address
+
500 );
+
501 
+
511 extern BOOL find_lea_instruction_with_mem_operand(
+
512  u8 *code_start,
+
513  u8 *code_end,
+
514  dasm_ctx_t *dctx,
+
515  u8 *mem_address
+
516 );
+
517 
+
528 extern BOOL find_instruction_with_mem_operand_ex(
+
529  u8 *code_start,
+
530  u8 *code_end,
+
531  dasm_ctx_t *dctx,
+
532  int opcode,
+
533  u8 *mem_address
+
534 );
+
535 
+
555 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
+
556 
+
566 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
+
567 
+
581 extern BOOL find_function_prologue_ex(
+
582  u8 *code_start,
+
583  u8 *func_start_0,
+
584  u8 *func_start_1,
+
585  u8 *search_base,
+
586  u8 *code_end,
+
587  FuncFindType find_mode);
588 
-
596 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
-
597 
-
605 extern u64 elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
-
606 
-
618 extern void *elf_get_reloc_symbol(
-
619  elf_info_t *elf_info,
-
620  Elf64_Rela *relocs,
-
621  unsigned num_relocs,
-
622  unsigned reloc_type,
-
623  u32 encoded_string_id);
-
624 
-
632 extern void *elf_get_plt_symbol(elf_info_t *elf_info, u32 encoded_string_id);
-
633 
-
641 extern void *elf_get_got_symbol(elf_info_t *elf_info, u32 encoded_string_id);
-
642 
-
649 extern lzma_allocator *get_lzma_allocator();
-
650 
-
661 extern BOOL secret_data_append_if_flags(
-
662  secret_data_shift_cursor shift_cursor,
-
663  unsigned operation_index,
-
664  unsigned reg2reg_instruction_count,
-
665  int flags, u8 *code);
-
666 
-
705 extern BOOL secret_data_append_singleton(
-
706  u8 *call_site, u8 *code,
-
707  secret_data_shift_cursor shift_cursor,
-
708  unsigned reg2reg_instruction_count, unsigned operation_index);
-
709 
-
710 #include "util.h"
-
711 #endif
-
secret_data_shift_cursor
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:413
-
secret_data_shift_cursor::index
u32 index
Definition: xzre.h:421
-
secret_data_shift_cursor::bit_index
u32 bit_index
Definition: xzre.h:416
-
secret_data_shift_cursor::byte_index
u32 byte_index
Definition: xzre.h:418
+
599 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
+
600 
+
608 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
+
609 
+
618 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
+
619 
+
627 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
+
628 
+
636 extern u64 elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
+
637 
+
649 extern void *elf_get_reloc_symbol(
+
650  elf_info_t *elf_info,
+
651  Elf64_Rela *relocs,
+
652  unsigned num_relocs,
+
653  unsigned reloc_type,
+
654  u32 encoded_string_id);
+
655 
+
663 extern void *elf_get_plt_symbol(elf_info_t *elf_info, u32 encoded_string_id);
+
664 
+
672 extern void *elf_get_got_symbol(elf_info_t *elf_info, u32 encoded_string_id);
+
673 
+
680 extern lzma_allocator *get_lzma_allocator();
+
681 
+
692 extern BOOL secret_data_append_if_flags(
+
693  secret_data_shift_cursor shift_cursor,
+
694  unsigned operation_index,
+
695  unsigned reg2reg_instruction_count,
+
696  int flags, u8 *code);
+
697 
+
736 extern BOOL secret_data_append_singleton(
+
737  u8 *call_site, u8 *code,
+
738  secret_data_shift_cursor shift_cursor,
+
739  unsigned reg2reg_instruction_count, unsigned operation_index);
+
740 
+
741 #include "util.h"
+
742 #endif
+
secret_data_shift_cursor
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:444
+
secret_data_shift_cursor::index
u32 index
Definition: xzre.h:452
+
secret_data_shift_cursor::bit_index
u32 bit_index
Definition: xzre.h:447
+
secret_data_shift_cursor::byte_index
u32 byte_index
Definition: xzre.h:449
elf_parse
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
find_instruction_with_mem_operand_ex
BOOL find_instruction_with_mem_operand_ex(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, int opcode, u8 *mem_address)
finds an instruction with an immediate memory operand
elf_symbol_get_addr
void * elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id)
Looks up an ELF symbol from a parsed ELF, and returns its memory address.
@@ -477,7 +508,7 @@
find_instruction_with_mem_operand
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, u8 *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
elf_get_plt_symbol
void * elf_get_plt_symbol(elf_info_t *elf_info, u32 encoded_string_id)
Gets the PLT symbol with name encoded_string_id from the parsed ELF file.
find_function_prologue
BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode)
locates the function prologue
-
__attribute__
struct __attribute__((packed))
Definition: xzre.h:84
+
__attribute__
struct __attribute__((packed))
Definition: xzre.h:87
get_lzma_allocator
lzma_allocator * get_lzma_allocator()
gets the fake LZMA allocator, used for imports resolution the "opaque" field of the structure holds a...
elf_symbol_get
Elf64_Sym * elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version)
Looks up an ELF symbol from a parsed ELF.
elf_get_reloc_symbol
void * elf_get_reloc_symbol(elf_info_t *elf_info, Elf64_Rela *relocs, unsigned num_relocs, unsigned reloc_type, u32 encoded_string_id)
Searches the ELF relocations for a symbol having name encoded_string id and relocation of type reloc_...