ReturnsBOOL TRUE if the socket was found, FALSE otherwise
-
-
-
-◆ sshd_kex_sshbuf_get()
-
-
-
-
-
- | BOOL sshd_kex_sshbuf_get |
- ( |
- void * |
- kex, |
-
-
- |
- |
- global_context_t * |
- ctx, |
-
-
- |
- |
- void ** |
- pOutputData, |
-
-
- |
- |
- size_t * |
- pOutputSize |
-
-
- |
- ) |
- | |
-
-
-
-
-
locates an sshbuf within struct kex (FIXME: which?)
-
- Parameters
-
-
- | kex | pointer to struct kex to search in |
- | ctx | the global context |
- | pOutputData | output variable that will receive the address of the sshbuf data |
- | pOutputSize | output variable that will receive the size of the sshbuf data |
-
-
-
-
- Returns
- BOOL TRUE if the sshbuf was found, FALSE otherwise
-
561 PAYLOAD_STATE_INVALID = -1
+ 561 PAYLOAD_STATE_INITIAL = -1
@@ -589,1858 +589,1871 @@
571 #define EXPAND(x, y) CONCAT(x, y)
572 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
-
-
-
- 578 #define PERMIT_NOT_SET -1
-
- 580 #define PERMIT_FORCED_ONLY 1
- 581 #define PERMIT_NO_PASSWD 2
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+ 585 static_assert(
sizeof(
struct sshbuf) == 64);
+
+
+
+
+ 590 #define PERMIT_NOT_SET -1
+
+ 592 #define PERMIT_FORCED_ONLY 1
+ 593 #define PERMIT_NO_PASSWD 2
+
-
- 600 struct sshkey **host_keys;
- 601 struct sshkey **host_pubkeys;
- 602 struct sshkey **host_certificates;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 632 struct sshbuf *sk_key_handle;
- 633 struct sshbuf *sk_reserved;
-
- 635 struct sshkey_cert *cert;
-
- 637 u8 *shielded_private;
-
-
- 640 size_t shield_prekey_len;
-
-
- 643 typedef struct __attribute__((packed))
got_ctx {
-
-
-
-
-
-
-
- 667 assert_offset(
got_ctx_t, return_address, 0x8);
- 668 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
- 669 assert_offset(
got_ctx_t, got_offset, 0x18);
- 670 static_assert(
sizeof(
got_ctx_t) == 0x20);
-
-
-
-
-
-
-
-
-
-
-
- 692 #define X86_MODRM_BYTE(mod, reg, rm) \
-
- 694 | (u8)(((mod) & 3) << 6) \
- 695 | (u8)(((reg) & 7) << 3) \
-
-
-
- 699 #define X86_REX_BYTE(w,r,x,b) \
-
- 701 | (u8)(((w) & 1) << 3) \
- 702 | (u8)(((r) & 1) << 2) \
- 703 | (u8)(((x) & 1) << 1) \
- 704 | (u8)(((b) & 1) << 0) \
-
-
- 707 #define X86_REX_W X86_REX_BYTE(1,0,0,0)
-
- 712 #define XZDASM_MODRM_MAKE(mod, reg, rm) \
-
- 714 | (u32)(((rm) & 0xFF)<< 24) \
- 715 | (u32)(((reg) & 0xFF) << 16) \
- 716 | (u32)(((mod) & 0xFF) << 8) \
- 717 | X86_MODRM_BYTE(mod, reg, rm) \
-
-
- 720 enum dasm_modrm_mask {
- 721 XZ_MODRM_RM = 0xFF000000,
- 722 XZ_MODRM_REG = 0x00FF0000,
- 723 XZ_MODRM_MOD = 0x0000FF00,
- 724 XZ_MODRM_RAW = 0x000000FF
-
-
-
-
- 729 u64 instruction_size;
-
- 731 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 749 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
- 760 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 772 struct __attribute__((packed)) {
-
- 774 struct __attribute__((packed)) {
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+ 612 struct sshkey **host_keys;
+ 613 struct sshkey **host_pubkeys;
+ 614 struct sshkey **host_certificates;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 644 struct sshbuf *sk_key_handle;
+ 645 struct sshbuf *sk_reserved;
+
+ 647 struct sshkey_cert *cert;
+
+ 649 u8 *shielded_private;
+
+
+ 652 size_t shield_prekey_len;
+
+
+ 655 typedef struct __attribute__((packed))
got_ctx {
+
+
+
+
+
+
+
+ 679 assert_offset(
got_ctx_t, return_address, 0x8);
+ 680 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
+ 681 assert_offset(
got_ctx_t, got_offset, 0x18);
+ 682 static_assert(
sizeof(
got_ctx_t) == 0x20);
+
+
+
+
+
+
+
+
+
+
+
+ 704 #define X86_MODRM_BYTE(mod, reg, rm) \
+
+ 706 | (u8)(((mod) & 3) << 6) \
+ 707 | (u8)(((reg) & 7) << 3) \
+
+
+
+ 711 #define X86_REX_BYTE(w,r,x,b) \
+
+ 713 | (u8)(((w) & 1) << 3) \
+ 714 | (u8)(((r) & 1) << 2) \
+ 715 | (u8)(((x) & 1) << 1) \
+ 716 | (u8)(((b) & 1) << 0) \
+
+
+ 719 #define X86_REX_W X86_REX_BYTE(1,0,0,0)
+
+ 724 #define XZDASM_MODRM_MAKE(mod, reg, rm) \
+
+ 726 | (u32)(((rm) & 0xFF)<< 24) \
+ 727 | (u32)(((reg) & 0xFF) << 16) \
+ 728 | (u32)(((mod) & 0xFF) << 8) \
+ 729 | X86_MODRM_BYTE(mod, reg, rm) \
+
+
+ 732 enum dasm_modrm_mask {
+ 733 XZ_MODRM_RM = 0xFF000000,
+ 734 XZ_MODRM_REG = 0x00FF0000,
+ 735 XZ_MODRM_MOD = 0x0000FF00,
+ 736 XZ_MODRM_RAW = 0x000000FF
+
+
+
+
+ 741 u64 instruction_size;
+
+ 743 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 761 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+ 772 struct __attribute__((packed)) {
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
- 789 u64 operand_zeroextended;
-
-
-
-
-
-
- 796 assert_offset(
dasm_ctx_t, instruction_size, 8);
-
-
- 799 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 819 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
- 820 assert_offset(
dasm_ctx_t, operand_size, 0x48);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 887 Elf64_Versym *versym;
- 888 Elf64_Rela *rela_relocs;
-
-
- 891 Elf64_Relr *relr_relocs;
-
-
-
-
-
- 905 u64 rodata_segment_start;
- 906 u64 rodata_segment_size;
- 907 u64 data_segment_start;
- 908 u64 data_segment_size;
- 909 u64 data_segment_alignment;
-
-
-
-
-
- 921 u32 gnu_hash_bloom_shift;
-
-
- 924 u32 *gnu_hash_buckets;
-
-
-
-
-
-
-
-
- 933 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
-
-
-
- 937 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
- 938 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
- 939 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
- 940 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
-
-
-
-
- 945 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
-
- 947 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
- 948 assert_offset(
elf_info_t, code_segment_start, 0x98);
- 949 assert_offset(
elf_info_t, code_segment_size, 0xA0);
- 950 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
- 951 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
- 952 assert_offset(
elf_info_t, data_segment_start, 0xB8);
- 953 assert_offset(
elf_info_t, data_segment_size, 0xC0);
- 954 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
-
- 956 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
- 957 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
- 958 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
- 959 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
- 960 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
- 961 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
-
-
-
- 965 u32 resolved_imports_count;
-
- 967 size_t (*malloc_usable_size)(
void *ptr);
- 968 uid_t (*getuid)(void);
- 969 void (*exit)(
int status);
- 970 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
- 971 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
- 972 int (*system)(
const char *command);
- 973 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
-
- 975 int nfds, fd_set *readfds, fd_set *writefds,
- 976 fd_set *exceptfds,
const struct timespec *timeout,
- 977 const sigset_t *sigmask);
- 978 ssize_t (*read)(
int fd,
void *buf,
size_t count);
- 979 int *(*__errno_location)(void);
- 980 int (*setlogmask)(
int mask);
- 981 int (*shutdown)(
int sockfd,
int how);
- 982 void *__libc_stack_end;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1001 typedef int (*pfn_RSA_public_decrypt_t)(
- 1002 int flen,
unsigned char *from,
unsigned char *to,
- 1003 RSA *rsa,
int padding);
- 1004 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
- 1005 typedef void (*pfn_RSA_get0_key_t)(
-
- 1007 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 1011 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
- 1013 void (*RSA_get0_key_null)(
- 1014 const RSA *r,
const BIGNUM **n,
- 1015 const BIGNUM **e,
const BIGNUM **d);
- 1020 pfn_RSA_public_decrypt_t *RSA_public_decrypt_plt;
- 1025 pfn_EVP_PKEY_set1_RSA_t *EVP_PKEY_set1_RSA_plt;
- 1030 pfn_RSA_get0_key_t *RSA_get0_key_plt;
- 1031 void (*DSA_get0_pqg)(
- 1032 const DSA *d,
const BIGNUM **p,
- 1033 const BIGNUM **q,
const BIGNUM **g);
- 1034 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
- 1035 size_t (*EC_POINT_point2oct)(
- 1036 const EC_GROUP *group,
const EC_POINT *p,
- 1037 point_conversion_form_t form,
unsigned char *buf,
- 1038 size_t len, BN_CTX *ctx);
- 1039 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
- 1040 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
- 1041 EVP_MD *(*EVP_sha256)(void);
- 1042 pfn_RSA_get0_key_t RSA_get0_key;
- 1043 int (*BN_num_bits)(
const BIGNUM *a);
- 1044 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
- 1045 int type, ENGINE *e,
- 1046 const unsigned char *key,
size_t keylen);
- 1047 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
- 1048 int (*EVP_DigestVerifyInit)(
- 1049 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
- 1050 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
- 1051 int (*EVP_DigestVerify)(
- 1052 EVP_MD_CTX *ctx,
const unsigned char *sig,
- 1053 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
- 1054 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
- 1055 void (*EVP_PKEY_free)(EVP_PKEY *key);
- 1056 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
- 1057 int (*EVP_DecryptInit_ex)(
- 1058 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
- 1059 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
- 1060 int (*EVP_DecryptUpdate)(
- 1061 EVP_CIPHER_CTX *ctx,
unsigned char *out,
- 1062 int *outl,
const unsigned char *in,
int inl);
- 1063 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
- 1064 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
- 1065 const EVP_CIPHER *(*EVP_chacha20)(void);
- 1066 RSA *(*RSA_new)(void);
- 1067 BIGNUM *(*BN_dup)(
const BIGNUM *from);
- 1068 BIGNUM *(*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
- 1069 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
- 1071 const void *data,
size_t count,
unsigned char *md,
- 1072 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
-
-
- 1075 const unsigned char *m,
unsigned int m_len,
- 1076 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
- 1077 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
- 1078 void (*RSA_free)(RSA *rsa);
- 1079 void (*BN_free)(BIGNUM *a);
-
- 1081 u32 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1127 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
-
-
- 1130 BOOL have_mm_answer_keyallowed;
- 1131 BOOL have_mm_answer_authpassword;
- 1132 BOOL have_mm_answer_keyverify;
-
-
- 1135 void *mm_answer_keyallowed;
- 1136 void *mm_answer_keyverify;
- 1137 void *mm_answer_authpassword_start;
- 1138 void *mm_answer_authpassword_end;
- 1139 sshd_monitor_func_t *mm_answer_authpassword_ptr;
- 1140 int monitor_reqtype_authpassword;
-
- 1142 void *mm_answer_keyallowed_start;
- 1143 void *mm_answer_keyallowed_end;
- 1144 void *mm_answer_keyallowed_ptr;
- 1145 u32 mm_answer_keyallowed_reqtype;
-
- 1147 void *mm_answer_keyverify_start;
- 1148 void *mm_answer_keyverify_end;
- 1149 void *mm_answer_keyverify_ptr;
-
-
-
-
-
-
- 1156 char *STR_unknown_ptr;
- 1157 void *mm_request_send_start;
- 1158 void *mm_request_send_end;
- 1159 PADDING(
sizeof(u32));
- 1160 PADDING(
sizeof(u32));
-
- 1162 int *permit_root_login_ptr;
- 1163 char *STR_without_password;
- 1164 char *STR_publickey;
-
-
- 1167 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
- 1168 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
- 1169 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
-
- 1171 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
- 1172 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
- 1173 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 1174 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 1175 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
- 1176 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
- 1177 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 1178 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 1179 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
- 1180 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
- 1181 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 1182 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 1183 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
- 1184 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
-
- 1186 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
- 1187 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
- 1188 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
- 1189 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
- 1190 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 1191 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
- 1192 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
-
-
-
- 1199 SYSLOG_LEVEL_VERBOSE,
- 1200 SYSLOG_LEVEL_DEBUG1,
- 1201 SYSLOG_LEVEL_DEBUG2,
- 1202 SYSLOG_LEVEL_DEBUG3,
- 1203 SYSLOG_LEVEL_NOT_SET = -1
-
+
+
+
+
+ 784 struct __attribute__((packed)) {
+
+ 786 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 801 u64 operand_zeroextended;
+
+
+
+
+
+
+ 808 assert_offset(
dasm_ctx_t, instruction_size, 8);
+
+
+ 811 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 831 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
+ 832 assert_offset(
dasm_ctx_t, operand_size, 0x48);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 899 Elf64_Versym *versym;
+ 900 Elf64_Rela *rela_relocs;
+
+
+ 903 Elf64_Relr *relr_relocs;
+
+
+
+
+
+ 917 u64 rodata_segment_start;
+ 918 u64 rodata_segment_size;
+ 919 u64 data_segment_start;
+ 920 u64 data_segment_size;
+ 921 u64 data_segment_alignment;
+
+
+
+
+
+ 933 u32 gnu_hash_bloom_shift;
+
+
+ 936 u32 *gnu_hash_buckets;
+
+
+
+
+
+
+
+
+ 945 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
+
+
+
+ 949 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
+ 950 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
+ 951 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
+ 952 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
+
+
+
+
+ 957 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
+
+ 959 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
+ 960 assert_offset(
elf_info_t, code_segment_start, 0x98);
+ 961 assert_offset(
elf_info_t, code_segment_size, 0xA0);
+ 962 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
+ 963 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
+ 964 assert_offset(
elf_info_t, data_segment_start, 0xB8);
+ 965 assert_offset(
elf_info_t, data_segment_size, 0xC0);
+ 966 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
+
+ 968 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
+ 969 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
+ 970 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
+ 971 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
+ 972 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
+ 973 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
+
+
+
+ 977 u32 resolved_imports_count;
+
+ 979 size_t (*malloc_usable_size)(
void *ptr);
+ 980 uid_t (*getuid)(void);
+ 981 void (*exit)(
int status);
+ 982 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+ 983 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+ 984 int (*system)(
const char *command);
+ 985 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
+
+ 987 int nfds, fd_set *readfds, fd_set *writefds,
+ 988 fd_set *exceptfds,
const struct timespec *timeout,
+ 989 const sigset_t *sigmask);
+ 990 ssize_t (*read)(
int fd,
void *buf,
size_t count);
+ 991 int *(*__errno_location)(void);
+ 992 int (*setlogmask)(
int mask);
+ 993 int (*shutdown)(
int sockfd,
int how);
+ 994 void *__libc_stack_end;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1013 typedef int (*pfn_RSA_public_decrypt_t)(
+ 1014 int flen,
unsigned char *from,
unsigned char *to,
+ 1015 RSA *rsa,
int padding);
+ 1016 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
+ 1017 typedef void (*pfn_RSA_get0_key_t)(
+
+ 1019 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 1023 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
+ 1025 void (*RSA_get0_key_null)(
+ 1026 const RSA *r,
const BIGNUM **n,
+ 1027 const BIGNUM **e,
const BIGNUM **d);
+ 1032 pfn_RSA_public_decrypt_t *RSA_public_decrypt_plt;
+ 1037 pfn_EVP_PKEY_set1_RSA_t *EVP_PKEY_set1_RSA_plt;
+ 1042 pfn_RSA_get0_key_t *RSA_get0_key_plt;
+ 1043 void (*DSA_get0_pqg)(
+ 1044 const DSA *d,
const BIGNUM **p,
+ 1045 const BIGNUM **q,
const BIGNUM **g);
+ 1046 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
+ 1047 size_t (*EC_POINT_point2oct)(
+ 1048 const EC_GROUP *group,
const EC_POINT *p,
+ 1049 point_conversion_form_t form,
unsigned char *buf,
+ 1050 size_t len, BN_CTX *ctx);
+ 1051 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
+ 1052 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
+ 1053 EVP_MD *(*EVP_sha256)(void);
+ 1054 pfn_RSA_get0_key_t RSA_get0_key;
+ 1055 int (*BN_num_bits)(
const BIGNUM *a);
+ 1056 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+ 1057 int type, ENGINE *e,
+ 1058 const unsigned char *key,
size_t keylen);
+ 1059 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+ 1060 int (*EVP_DigestVerifyInit)(
+ 1061 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+ 1062 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+ 1063 int (*EVP_DigestVerify)(
+ 1064 EVP_MD_CTX *ctx,
const unsigned char *sig,
+ 1065 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
+ 1066 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+ 1067 void (*EVP_PKEY_free)(EVP_PKEY *key);
+ 1068 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+ 1069 int (*EVP_DecryptInit_ex)(
+ 1070 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
+ 1071 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
+ 1072 int (*EVP_DecryptUpdate)(
+ 1073 EVP_CIPHER_CTX *ctx,
unsigned char *out,
+ 1074 int *outl,
const unsigned char *in,
int inl);
+ 1075 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
+ 1076 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+ 1077 const EVP_CIPHER *(*EVP_chacha20)(void);
+ 1078 RSA *(*RSA_new)(void);
+ 1079 BIGNUM *(*BN_dup)(
const BIGNUM *from);
+ 1080 BIGNUM *(*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
+ 1081 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+ 1083 const void *data,
size_t count,
unsigned char *md,
+ 1084 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
+
+
+ 1087 const unsigned char *m,
unsigned int m_len,
+ 1088 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
+ 1089 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
+ 1090 void (*RSA_free)(RSA *rsa);
+ 1091 void (*BN_free)(BIGNUM *a);
+
+ 1093 u32 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1139 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
+
+
+ 1142 BOOL have_mm_answer_keyallowed;
+ 1143 BOOL have_mm_answer_authpassword;
+ 1144 BOOL have_mm_answer_keyverify;
+
+
+ 1147 void *mm_answer_keyallowed;
+ 1148 void *mm_answer_keyverify;
+ 1149 void *mm_answer_authpassword_start;
+ 1150 void *mm_answer_authpassword_end;
+ 1151 sshd_monitor_func_t *mm_answer_authpassword_ptr;
+ 1152 int monitor_reqtype_authpassword;
+
+ 1154 sshd_monitor_func_t *mm_answer_keyallowed_start;
+ 1155 void *mm_answer_keyallowed_end;
+ 1156 void *mm_answer_keyallowed_ptr;
+ 1157 u32 mm_answer_keyallowed_reqtype;
+
+ 1159 void *mm_answer_keyverify_start;
+ 1160 void *mm_answer_keyverify_end;
+ 1161 void *mm_answer_keyverify_ptr;
+
+
+
+
+
+
+ 1168 char *STR_unknown_ptr;
+ 1169 void *mm_request_send_start;
+ 1170 void *mm_request_send_end;
+ 1171 PADDING(
sizeof(u32));
+ 1172 PADDING(
sizeof(u32));
+
+ 1174 int *permit_root_login_ptr;
+ 1175 char *STR_without_password;
+ 1176 char *STR_publickey;
+
+
+ 1179 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+ 1180 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+ 1181 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+
+ 1183 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
+ 1184 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
+ 1185 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 1186 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 1187 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
+ 1188 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
+ 1189 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 1190 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 1191 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
+ 1192 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
+ 1193 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 1194 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 1195 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
+ 1196 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
+
+ 1198 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
+ 1199 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
+ 1200 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
+ 1201 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
+ 1202 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 1203 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
+ 1204 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
- 1206 typedef void (*log_handler_fn)(
-
-
-
-
-
-
- 1213 BOOL logging_disabled;
- 1214 BOOL log_hooking_possible;
- 1215 BOOL syslog_disabled;
-
- 1217 char *STR_percent_s;
- 1218 char *STR_Connection_closed_by;
-
- 1220 char *STR_authenticating;
-
-
-
- 1224 void *log_handler_ptr;
- 1225 void *log_handler_ctx_ptr;
- 1226 log_handler_fn orig_log_handler;
- 1227 void *orig_log_handler_ctx;
-
- 1229 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1250 struct __attribute__((packed)) {
-
-
-
-
-
-
-
- 1258 struct __attribute__((packed)) {
- 1259 u8 sshbuf_data_qword_index;
- 1260 u8 sshbuf_size_qword_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+ 1211 SYSLOG_LEVEL_VERBOSE,
+ 1212 SYSLOG_LEVEL_DEBUG1,
+ 1213 SYSLOG_LEVEL_DEBUG2,
+ 1214 SYSLOG_LEVEL_DEBUG3,
+ 1215 SYSLOG_LEVEL_NOT_SET = -1
+
+
+ 1218 typedef void (*log_handler_fn)(
+
+
+
+
+
+
+ 1225 BOOL logging_disabled;
+ 1226 BOOL log_hooking_possible;
+ 1227 BOOL syslog_disabled;
+
+ 1229 char *STR_percent_s;
+ 1230 char *STR_Connection_closed_by;
+
+ 1232 char *STR_authenticating;
+
+
+
+ 1236 void *log_handler_ptr;
+ 1237 void *log_handler_ctx_ptr;
+ 1238 log_handler_fn orig_log_handler;
+ 1239 void *orig_log_handler_ctx;
+
+ 1241 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1262 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+ 1270 struct __attribute__((packed)) {
+ 1271 u8 sshbuf_data_qword_index;
+ 1272 u8 sshbuf_size_qword_index;
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1318 struct monitor **struct_monitor_ptr_address;
-
-
-
-
-
-
-
-
-
-
-
-
- 1355 u64 sock_read_buf_size;
- 1356 u8 sock_read_buf[64];
- 1357 u64 payload_data_size;
-
-
-
-
- 1366 u32 sshd_host_pubkey_idx;
-
- 1371 u8 secret_data[ED448_KEY_SIZE];
- 1377 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1422 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1525 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
-
- 1541 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
- 1546 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1548 u64 hooks_installed;
-
-
- 1551 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1552 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1553 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1554 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1555 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1556 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1557 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1558 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1559 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1561 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1562 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1563 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
-
- 1565 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1566 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1568 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
- 1579 u64 signed_data_size;
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1330 struct monitor **struct_monitor_ptr_address;
+
+
+
+
+
+
+
+
+
+
+
+
+ 1367 u64 sock_read_buf_size;
+ 1368 u8 sock_read_buf[64];
+ 1369 u64 payload_data_size;
+
+
+
+
+ 1378 u32 sshd_host_pubkey_idx;
+
+ 1383 u8 secret_data[ED448_KEY_SIZE];
+ 1389 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1434 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1537 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+
+ 1553 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+ 1558 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1560 u64 hooks_installed;
+
+
+ 1563 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1564 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1565 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1566 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1567 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1568 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1569 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1570 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1571 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1573 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1574 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1575 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+
+ 1577 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1578 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1580 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1597 uintptr_t (*symbind64)(
- 1598 Elf64_Sym *sym,
unsigned int ndx,
- 1599 uptr *refcook, uptr *defcook,
- 1600 unsigned int flags,
const char *symname);
-
- 1602 pfn_RSA_get0_key_t hook_RSA_get0_key;
- 1603 log_handler_fn mm_log_handler;
- 1604 PADDING(
sizeof(
void *));
- 1605 PADDING(
sizeof(
void *));
- 1606 sshd_monitor_func_t mm_answer_keyallowed;
- 1607 sshd_monitor_func_t mm_answer_keyverify;
- 1608 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1664 Elf64_Ehdr *dynamic_linker_ehdr;
- 1665 void **__libc_stack_end;
-
-
-
- 1669 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
- 1670 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1734 struct link_map *liblzma_map;
- 1735 struct link_map *libcrypto_map;
- 1736 struct link_map *libsystemd_map;
- 1737 struct link_map *libc_map;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1774 lzma_allocator fake_allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1850 u32 operation_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1870 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
- 1879 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+ 1591 u64 signed_data_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1609 uintptr_t (*symbind64)(
+ 1610 Elf64_Sym *sym,
unsigned int ndx,
+ 1611 uptr *refcook, uptr *defcook,
+ 1612 unsigned int flags,
const char *symname);
+
+ 1614 pfn_RSA_get0_key_t hook_RSA_get0_key;
+ 1615 log_handler_fn mm_log_handler;
+ 1616 PADDING(
sizeof(
void *));
+ 1617 PADDING(
sizeof(
void *));
+ 1618 sshd_monitor_func_t mm_answer_keyallowed;
+ 1619 sshd_monitor_func_t mm_answer_keyverify;
+ 1620 PADDING(
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1676 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1677 void **__libc_stack_end;
+
+
+
+ 1681 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+ 1682 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1746 struct link_map *liblzma_map;
+ 1747 struct link_map *libcrypto_map;
+ 1748 struct link_map *libsystemd_map;
+ 1749 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1786 lzma_allocator fake_allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1862 u32 operation_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1882 struct __attribute__((packed)) {
+
+
+
+
+
+
+
-
- 1893 u8 signature[ED448_SIGNATURE_SIZE];
-
-
-
-
-
-
-
-
-
- 1908 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 1921 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
- 1932 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
-
-
-
-
-
-
-
-
-
-
-
-
- 1971 X_FLAGS2_AUTH_BYPASS = 0x4,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2009 const BIGNUM *rsa_n;
- 2010 const BIGNUM *rsa_e;
-
-
- 2013 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
- 2014 u8 ivec[CHACHA20_IV_SIZE];
- 2015 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
- 2022 assert_offset(
key_ctx_t, payload, 0x15);
-
- 2024 assert_offset(
key_ctx_t, ed448_key, 0x27D);
-
-
-
-
-
- 2034 const BIGNUM *rsa_n;
- 2035 const BIGNUM *rsa_e;
-
- 2037 u16 payload_body_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2056 struct timespec timespec;
-
-
-
-
-
-
-
-
-
-
- 2071 u64 hostkey_hash_offset;
-
- 2073 u8 *payload_data_ptr;
-
-
-
-
-
-
-
-
- 2082 struct __attribute__((packed)) {
-
-
-
-
- 2087 struct __attribute__((packed)) {
-
- 2089 u64 num_host_pubkeys;
- 2090 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2161 PADDING(
sizeof(u64));
-
- 2168 PADDING(
sizeof(u64));
- 2169 PADDING(
sizeof(u64));
-
- 2176 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
-
-
- 2191 PADDING(
sizeof(u64));
- 2192 lzma_allocator allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2222 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2355 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 2378 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2444 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2498 FuncFindType find_mode);
-
-
+ 1891 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 1905 u8 signature[ED448_SIGNATURE_SIZE];
+
+
+
+
+
+
+
+
+
+ 1920 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 1933 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+ 1944 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
+
+
+
+
+
+
+
+
+
+
+
+
+ 1983 X_FLAGS2_AUTH_BYPASS = 0x4,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2021 const BIGNUM *rsa_n;
+ 2022 const BIGNUM *rsa_e;
+
+
+ 2025 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
+ 2026 u8 ivec[CHACHA20_IV_SIZE];
+ 2027 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+ 2034 assert_offset(
key_ctx_t, payload, 0x15);
+
+ 2036 assert_offset(
key_ctx_t, ed448_key, 0x27D);
+
+
+
+
+
+ 2046 const BIGNUM *rsa_n;
+ 2047 const BIGNUM *rsa_e;
+
+ 2049 u16 payload_body_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2068 struct timespec timespec;
+
+
+
+
+
+
+
+
+
+
+ 2083 u64 hostkey_hash_offset;
+
+ 2085 u8 *payload_data_ptr;
+
+
+
+
+
+
+
+
+ 2094 struct __attribute__((packed)) {
+
+
+
+
+ 2099 struct __attribute__((packed)) {
+
+ 2101 u64 num_host_pubkeys;
+ 2102 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2173 PADDING(
sizeof(u64));
+
+ 2180 PADDING(
sizeof(u64));
+ 2181 PADDING(
sizeof(u64));
+
+ 2188 PADDING(
sizeof(u64));
+
+
+
+
+
+
+
+
+
+ 2203 PADDING(
sizeof(u64));
+ 2204 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2234 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2367 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 2390 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2456 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2510 FuncFindType find_mode);
-
+
-
-
-
-
-
-
- 2557 extern char *check_argument(
char arg_first_char,
char* arg_name);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2670 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2704 StringXrefId xref_id,
- 2705 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
-
-
-
-
- 2724 EncodedStringId *stringId_inOut,
- 2725 void *rodata_start_ptr);
-
-
-
-
+
+
+
+
+
+
+
+
+ 2569 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2682 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2716 StringXrefId xref_id,
+ 2717 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+
+
+
+
+ 2736 EncodedStringId *stringId_inOut,
+ 2737 void *rodata_start_ptr);
+
+
-
-
-
-
-
-
-
+
+
+
+
+
-
-
-
-
- 2795 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2809 unsigned operation_index,
- 2810 unsigned shift_count,
- 2811 int index, u8 *code);
-
-
-
-
-
-
-
-
-
- 2839 unsigned shift_count,
unsigned operation_index);
-
-
- 2884 u8 *call_site, u8 *code,
-
- 2886 unsigned shift_count,
unsigned operation_index);
-
-
-
- 2901 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+ 2807 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2821 unsigned operation_index,
+ 2822 unsigned shift_count,
+ 2823 int index, u8 *code);
+
+
+
+
+
+
+
+
+
+ 2851 unsigned shift_count,
unsigned operation_index);
+
+
+ 2896 u8 *call_site, u8 *code,
+
+ 2898 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2913 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
- 3018 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3095 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 3136 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 3149 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3237 uptr *refcook, uptr *defcook,
-
- 3239 const char *symname);
-
-
-
-
-
- 3270 ptrdiff_t *libname_offset,
-
-
-
-
-
- 3298 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 3345 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3388 void **sensitive_data_out);
-
-
-
-
-
-
- 3409 void **sensitive_data_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3479 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3560 u64 sshkey_digest_offset,
- 3561 u64 signed_data_size,
-
-
-
-
-
-
- 3579 BOOL skip_root_patch,
-
- 3581 BOOL replace_monitor_reqtype,
- 3582 int monitor_reqtype,
-
-
-
-
-
-
-
-
-
-
- 3610 u8 **code_start_out,
-
-
-
-
-
-
-
-
-
-
- 3648 void **monitor_field_ptr_out,
-
-
-
-
-
-
- 3666 void *mem_range_start,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3734 enum SocketMode socket_direction
-
-
-
-
-
-
-
-
-
-
-
- 3780 size_t *pOutPayloadSize,
-
-
-
-
- 3793 size_t payload_size,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+ 3030 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3107 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 3148 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 3161 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3249 uptr *refcook, uptr *defcook,
+
+ 3251 const char *symname);
+
+
+
+
+
+ 3282 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 3310 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 3357 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3400 void **sensitive_data_out);
+
+
+
+
+
+
+ 3421 void **sensitive_data_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3491 u8 *buffer, u64 bufferSize,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3572 u64 sshkey_digest_offset,
+ 3573 u64 signed_data_size,
+
+
+
+
+
+
+ 3591 BOOL skip_root_patch,
+
+ 3593 BOOL replace_monitor_reqtype,
+ 3594 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+ 3622 u8 **code_start_out,
+
+
+
+
+
+
+
+
+
+
+ 3660 void **monitor_field_ptr_out,
+
+
+
+
+
+
+ 3678 void *mem_range_start,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3746 enum SocketMode socket_direction
+
+
+
+
+
+
+
+
+
+ 3792 struct sshbuf *sshbuf_data,
+
+ 3794 size_t *out_payload_size,
+
+
+
+
+ 3807 size_t payload_size,
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3888 unsigned int num_pointers
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3902 unsigned int num_pointers
-
-
-
- 3917 int flen,
unsigned char *from,
- 3918 unsigned char *to, RSA *rsa,
int padding);
-
-
-
- 3930 LogLevel level,
const char *fmt, ...);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3996 static_assert(
sizeof(global_ctx) ==
sizeof(
void *));
-
-
- 3999 static_assert(
sizeof(hooks_data) ==
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+ 3931 int flen,
unsigned char *from,
+ 3932 unsigned char *to, RSA *rsa,
int padding);
+
+
+
+ 3944 LogLevel level,
const char *fmt, ...);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 4010 static_assert(
sizeof(global_ctx) ==
sizeof(
void *));
+
+
+ 4013 static_assert(
sizeof(hooks_data) ==
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding)
Definition: ssh_patch.c:37
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2133
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2121
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2127
data passed to functions that access the backdoor data
Definition: xzre.h:1678
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1723
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1768
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1773
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1728
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1758
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1763
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1754
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1748
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1778
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1733
the contents of the RSA 'n' field
Definition: xzre.h:1905
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1812
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1817
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1807
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2147
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2153
u8 flags2
see InstructionFlags2
Definition: xzre.h:739
u8 flags
see InstructionFlags
Definition: xzre.h:735
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:677
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:682
array of ELF handles
Definition: xzre.h:1638
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1649
elf_info_t * main
this is for sshd
Definition: xzre.h:1643
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:903
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:832
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:878
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:882
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:920
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:844
char * strtab
pointer to the ELF string table
Definition: xzre.h:852
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:836
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:916
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:828
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:840
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:860
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:870
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:898
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:886
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:874
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:856
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:848
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:864
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1352
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1295
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1313
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1305
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1291
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1333
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1381
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1325
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1337
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1317
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1329
u64 current_data_size
number of body bytes copied to payload_data. will point to the digest at the end
Definition: xzre.h:1362
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1345
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2145
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2133
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2139
data passed to functions that access the backdoor data
Definition: xzre.h:1690
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1735
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1780
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1785
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1740
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1770
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1775
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1766
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1760
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1790
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1745
the contents of the RSA 'n' field
Definition: xzre.h:1917
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1824
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1829
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1819
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2159
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2165
u8 flags2
see InstructionFlags2
Definition: xzre.h:751
u8 flags
see InstructionFlags
Definition: xzre.h:747
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:689
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:694
array of ELF handles
Definition: xzre.h:1650
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1661
elf_info_t * main
this is for sshd
Definition: xzre.h:1655
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:915
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:844
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:890
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:894
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:932
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:856
char * strtab
pointer to the ELF string table
Definition: xzre.h:864
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:848
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:928
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:840
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:852
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:872
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:882
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:910
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:898
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:886
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:868
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:860
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:876
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1364
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1307
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1325
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1317
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1303
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1345
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1393
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1337
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1349
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1329
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1341
u64 current_data_size
number of body bytes copied to payload_data. will point to the digest at the end
Definition: xzre.h:1374
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1357
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:654
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:658
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:647
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:663
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2227
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2216
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2206
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2211
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2221
the payload header. also used as Chacha IV
Definition: xzre.h:1867
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1482
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1501
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1460
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1518
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1530
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1448
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1492
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1475
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1443
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1465
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:666
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:670
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:659
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:675
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2239
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2228
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2218
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2223
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2233
the payload header. also used as Chacha IV
Definition: xzre.h:1879
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1494
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1513
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1472
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1530
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1542
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1460
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1504
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1487
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1455
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1477
Structure to hold internal state of the check being calculated.
Definition: xzre.h:280
State for the internal SHA-256 implementation.
Definition: xzre.h:268
uint64_t size
Size of the message excluding padding.
Definition: xzre.h:273
data used within sshd_proxy_elevate
Definition: xzre.h:2030
struct monitor from openssh-portable
Definition: xzre.h:587
stack frame layout for run_backdoor_commands
Definition: xzre.h:2067
struct sensitive_data from openssh-portable
Definition: xzre.h:599
struct sshkey from openssh-portable
Definition: xzre.h:610
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1695
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1690
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1703
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1699
union used within run_backdoor_commands
Definition: xzre.h:2054
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1836
u32 index
Definition: xzre.h:1838
u32 byte_index
Definition: xzre.h:1843
u32 bit_index
Definition: xzre.h:1841
data used within sshd_proxy_elevate
Definition: xzre.h:2042
struct monitor from openssh-portable
Definition: xzre.h:599
stack frame layout for run_backdoor_commands
Definition: xzre.h:2079
struct sensitive_data from openssh-portable
Definition: xzre.h:611
struct sshkey from openssh-portable
Definition: xzre.h:622
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1707
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1702
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1715
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1711
union used within run_backdoor_commands
Definition: xzre.h:2066
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1848
u32 index
Definition: xzre.h:1850
u32 byte_index
Definition: xzre.h:1855
u32 bit_index
Definition: xzre.h:1853
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
fake_lzma_allocator_t * get_lzma_allocator_address(void)
gets the address of the fake LZMA allocator
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
void init_elf_entry_ctx(elf_entry_ctx_t *ctx)
initialises the elf_entry_ctx_t
BOOL verify_signature(struct sshkey *sshkey, u8 *signed_data, u64 sshkey_digest_offset, u64 signed_data_size, u8 *signature, u8 *ed448_raw_key, global_context_t *global_ctx)
Checks if signed_data is signed with ed448_raw_key.
BOOL validate_log_handler_pointers(void *addr1, void *addr2, void *search_base, u8 *code_end, string_references_t *refs, global_context_t *global)
Validate that the two addresses are the expected/correct ones.
BOOL is_payload_message(u8 *sshbuf_data, size_t sshbuf_size, size_t *pOutPayloadSize, global_context_t *ctx)
checks if the given sshbuf buffer contains a backdoor payload message
void * dummy_tls_get_addr(tls_index *ti)
a dummy function that calls __tls_get_addr, to make sure its GOT slot doesn't get removed by compiler...
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
struct key_payload_hdr backdoor_payload_hdr_t
the payload header. also used as Chacha IV
ElfId
Definition: xzre.h:400
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:405
int init_hooks_ctx(backdoor_hooks_ctx_t *ctx)
Initializes the structure with hooks-related data.
CommandFlags2
Definition: xzre.h:1957
@ X_FLAGS2_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1967
@ X_FLAGS2_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1981
@ X_FLAGS2_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1976
@ X_FLAGS2_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1988
@ X_FLAGS2_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1962
CommandFlags2
Definition: xzre.h:1969
@ X_FLAGS2_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1979
@ X_FLAGS2_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1993
@ X_FLAGS2_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1988
@ X_FLAGS2_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:2000
@ X_FLAGS2_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1974
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
const elf_functions_t elf_functions
special .data.rel.ro section that contains addresses to various functions
ssize_t fd_read(int fd, void *buffer, size_t count, libc_imports_t *funcs)
reads data from the specified file descriptor
BOOL secret_data_append_singleton(u8 *call_site, u8 *code, secret_data_shift_cursor_t shift_cursor, unsigned shift_count, unsigned operation_index)
Shifts data in the secret data store, after validation of code. this function is intended to be invok...
BOOL contains_null_pointers(void **pointers, unsigned int num_pointers)
checks if the given array of pointers contains any NULL pointer
void * elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment)
Obtains the address and size of the last read-write segment in the given ELF file this is typically t...
BOOL extract_payload_message(struct sshbuf *sshbuf_data, size_t sshbuf_size, size_t *out_payload_size, global_context_t *ctx)
locates the RSA modulus from the given sshbuf. if found, the given sshbuf_data will be updated to poi...
const u32 string_action_data[1304]
contains action data for the encoded string radix tree
BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part)
Checks if the code between code_start and code_end is an endbr64 instruction.
void fake_lzma_free(void *opaque, void *ptr)
a fake free function called by lzma_free()
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if do_child accesses sensitive_data or not
BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx)
locates sensitive_data within sshd, and resolves some additional libcrypto functions
CommandFlags1
Definition: xzre.h:1934
@ X_FLAGS1_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1942
@ X_FLAGS1_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1954
@ X_FLAGS1_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1946
@ X_FLAGS1_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1938
@ X_FLAGS1_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1950
CommandFlags1
Definition: xzre.h:1946
@ X_FLAGS1_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1954
@ X_FLAGS1_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1966
@ X_FLAGS1_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1958
@ X_FLAGS1_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1950
@ X_FLAGS1_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1962
void update_cpuid_got_index(elf_entry_ctx_t *ctx)
get the cpuid() GOT index
BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx)
forges a new MONITOR_REQ_KEYALLOWED packet, and injects it into the server to gain root privileges th...
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
BOOL rsa_key_hash(const RSA *rsa, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs)
obtains a SHA256 hash of the supplied RSA key
BOOL main_elf_parse(main_elf_t *main_elf)
Parses the main executable from the provided structure. As part of the process the arguments and envi...
fake_lzma_allocator_t fake_lzma_allocator
special .data.rel.ro section that contains a fake lzma_allocator
BOOL sshd_kex_sshbuf_get(void *kex, global_context_t *ctx, void **pOutputData, size_t *pOutputSize)
locates an sshbuf within struct kex (FIXME: which?)
struct elf_handles elf_handles_t
array of ELF handles
BOOL find_add_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds an ADD instruction with an immediate memory operand
u8 * elf_find_string_reference(elf_info_t *elf_info, EncodedStringId encoded_string_id, u8 *code_start, u8 *code_end)
finds an instruction that references the given string
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
BOOL decrypt_payload_message(key_payload_t *payload, size_t payload_size, global_context_t *ctx)
decrypts the given backdoor payload
BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf)
finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME )
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1673
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1685
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if accesses sensitive_data or not
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
const u64 string_mask_data[238]
contains mask data for the encoded string radix tree
int mm_answer_keyallowed_hook(struct ssh *ssh, int sock, struct sshbuf *m)
runs the payload received from sshd_proxy_elevate, and then runs the original mm_answer_keyallowed fu...
BOOL chacha_decrypt(u8 *in, int inl, u8 *key, u8 *iv, u8 *out, imported_funcs_t *funcs)
decrypts a buffer with chacha20
BOOL sshbuf_extract(struct sshbuf *buf, global_context_t *ctx, void **p_sshbuf_d, size_t *p_sshbuf_size)
checks if the provided buf is sane, then decomposes it into p_sshbuf_d and p_sshbuf_size
BOOL sshd_patch_variables(BOOL skip_root_patch, BOOL disable_pam, BOOL replace_monitor_reqtype, int monitor_reqtype, global_context_t *global_ctx)
Patches the sshd configuration.
void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d)
actually calls cpuid instruction
unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame)
the backdoor entrypoint function, called by the IFUNC resolver for liblzma crc32() and crc64()
void * find_addr_referenced_in_mov_instruction(StringXrefId id, string_references_t *refs, void *mem_range_start, void *mem_range_end)
find an address referenced in a function
u32 resolver_call_count
counts the number of times the IFUNC resolver is called
BOOL sshd_configure_log_hook(cmd_arguments_t *cmd_flags, global_context_t *ctx)
configure the log hook
CommandFlags3
Definition: xzre.h:1991
@ X_FLAGS3_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1999
@ X_FLAGS3_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1995
CommandFlags3
Definition: xzre.h:2003
@ X_FLAGS3_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:2011
@ X_FLAGS3_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:2007
struct monitor_data monitor_data_t
data used within sshd_proxy_elevate
const u64 cpuid_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Gets the GOT symbol with name encoded_string_id from the parsed ELF file.
