ReturnsBOOL
+
+
+
+◆ sshd_find_monitor_struct()
+
+
+
+
+
finds the pointer to struct monitor, and updates the global context in ctx with its location
+
- Parameters
-
+
+ | elf | sshd elf context |
+ | refs | sshd string references |
+ | ctx | global context |
+
+
+
+
- Returns
- BOOL TRUE if the pointer has been found, FALSE otherwise
+
380 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
-
- 388 struct sshkey **host_keys;
- 389 struct sshkey **host_pubkeys;
- 390 struct sshkey **host_certificates;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 420 struct sshbuf *sk_key_handle;
- 421 struct sshbuf *sk_reserved;
-
- 423 struct sshkey_cert *cert;
-
- 425 u8 *shielded_private;
-
-
- 428 size_t shield_prekey_len;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 472 u64 instruction_size;
-
- 474 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 487 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 499 struct __attribute__((packed)) {
-
- 501 struct __attribute__((packed)) {
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+ 401 struct sshkey **host_keys;
+ 402 struct sshkey **host_pubkeys;
+ 403 struct sshkey **host_certificates;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 433 struct sshbuf *sk_key_handle;
+ 434 struct sshbuf *sk_reserved;
+
+ 436 struct sshkey_cert *cert;
+
+ 438 u8 *shielded_private;
+
+
+ 441 size_t shield_prekey_len;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 485 u64 instruction_size;
+
+ 487 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 500 struct __attribute__((packed)) {
+
+
+
+
+
+
+
-
-
-
-
-
-
-
- 516 u64 operand_zeroextended;
-
-
-
-
-
-
- 523 assert_offset(
dasm_ctx_t, instruction_size, 8);
-
-
- 526 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 545 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
- 546 assert_offset(
dasm_ctx_t, operand_size, 0x48);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 613 Elf64_Versym *versym;
- 614 Elf64_Rela *rela_relocs;
-
-
- 617 Elf64_Relr *relr_relocs;
-
-
-
-
-
- 631 u64 rodata_segment_start;
- 632 u64 rodata_segment_size;
- 633 u64 data_segment_start;
- 634 u64 data_segment_size;
- 635 u64 data_segment_alignment;
-
-
-
-
-
- 647 u32 gnu_hash_bloom_shift;
-
-
- 650 u32 *gnu_hash_buckets;
-
-
-
-
-
-
-
-
- 659 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
-
-
-
- 663 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
- 664 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
- 665 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
- 666 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
-
-
-
-
- 671 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
-
- 673 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
- 674 assert_offset(
elf_info_t, code_segment_start, 0x98);
- 675 assert_offset(
elf_info_t, code_segment_size, 0xA0);
- 676 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
- 677 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
- 678 assert_offset(
elf_info_t, data_segment_start, 0xB8);
- 679 assert_offset(
elf_info_t, data_segment_size, 0xC0);
- 680 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
-
- 682 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
- 683 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
- 684 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
- 685 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
- 686 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
- 687 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
-
-
-
- 691 u32 resolved_imports_count;
-
- 693 size_t (*malloc_usable_size)(
void *ptr);
- 694 uid_t (*getuid)(void);
- 695 void (*exit)(
int status);
- 696 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
- 697 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
- 698 int (*system)(
const char *command);
- 699 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
-
- 701 int nfds, fd_set *readfds, fd_set *writefds,
- 702 fd_set *exceptfds,
const struct timespec *timeout,
- 703 const sigset_t *sigmask);
- 704 ssize_t (*read)(
int fd,
void *buf,
size_t count);
- 705 int *(*__errno_location)(void);
- 706 int (*setlogmask)(
int mask);
- 707 int (*shutdown)(
int sockfd,
int how);
- 708 void *__libc_stack_end;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 726 typedef int (*pfn_RSA_public_decrypt_t)(
- 727 int flen,
unsigned char *from,
unsigned char *to,
- 728 RSA *rsa,
int padding);
- 729 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
- 730 typedef void (*pfn_RSA_get0_key_t)(
-
- 732 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
-
-
- 735 pfn_RSA_public_decrypt_t RSA_public_decrypt;
- 736 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
- 738 void (*RSA_get0_key_null)(
- 739 const RSA *r,
const BIGNUM **n,
- 740 const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 756 void (*DSA_get0_pqg)(
- 757 const DSA *d,
const BIGNUM **p,
- 758 const BIGNUM **q,
const BIGNUM **g);
- 759 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
- 760 size_t (*EC_POINT_point2oct)(
- 761 const EC_GROUP *group,
const EC_POINT *p,
- 762 point_conversion_form_t form,
unsigned char *buf,
- 763 size_t len, BN_CTX *ctx);
- 764 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
- 765 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
- 766 EVP_MD *(*EVP_sha256)(void);
- 767 pfn_RSA_get0_key_t RSA_get0_key;
- 768 int (*BN_num_bits)(
const BIGNUM *a);
- 769 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
- 771 const unsigned char *key,
size_t keylen);
- 772 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
- 773 int (*EVP_DigestVerifyInit)(
- 774 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
- 775 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
- 776 int (*EVP_DigestVerify)(
- 777 EVP_MD_CTX *ctx,
const unsigned char *sig,
- 778 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
- 779 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
- 780 void (*EVP_PKEY_free)(EVP_PKEY *key);
- 781 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
- 782 int (*EVP_DecryptInit_ex)(
- 783 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
- 784 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
- 785 int (*EVP_DecryptUpdate)(
- 786 EVP_CIPHER_CTX *ctx,
unsigned char *out,
- 787 int *outl,
const unsigned char *in,
int inl);
- 788 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
- 789 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
- 790 const EVP_CIPHER *(*EVP_chacha20)(void);
- 791 RSA *(*RSA_new)(void);
- 792 BIGNUM *(*BN_dup)(
const BIGNUM *from);
- 793 BIGNUM (*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
- 794 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
- 796 const void *data,
size_t count,
unsigned char *md,
- 797 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
-
-
- 800 const unsigned char *m,
unsigned int m_len,
- 801 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
- 802 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
- 803 void (*RSA_free)(RSA *rsa);
- 804 void (*BN_free)(BIGNUM *a);
-
- 806 u64 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 852 BOOL have_mm_answer_keyallowed;
- 853 BOOL have_mm_answer_authpassword;
- 854 BOOL have_mm_answer_keyverify;
-
- 856 int (*monitor_req_fn)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
-
- 858 PADDING(
sizeof(
void *));
- 859 void *mm_answer_authpassword_start;
- 860 void *mm_answer_authpassword_end;
- 861 void *monitor_req_authpassword;
- 862 PADDING(
sizeof(
void *));
- 863 void *mm_answer_keyallowed_start;
- 864 void *mm_answer_keyallowed_end;
- 865 void *monitor_req_keyallowed_ptr;
- 866 PADDING(
sizeof(
void *));
- 867 void *mm_answer_keyverify_start;
- 868 void *mm_answer_keyverify_end;
- 869 void *monitor_req_keyverify_ptr;
-
-
-
-
-
-
- 876 PADDING(
sizeof(
void *));
- 877 void *mm_request_send_start;
- 878 void *mm_request_send_end;
- 879 PADDING(
sizeof(u32));
- 880 PADDING(
sizeof(u32));
-
- 882 int *permit_root_login_ptr;
-
-
-
-
- 887 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
- 888 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
- 889 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
- 890 assert_offset(
sshd_ctx_t, monitor_req_fn, 0x10);
- 891 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 892 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 893 assert_offset(
sshd_ctx_t, monitor_req_authpassword, 0x38);
- 894 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 895 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 896 assert_offset(
sshd_ctx_t, monitor_req_keyallowed_ptr, 0x58);
- 897 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 898 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 899 assert_offset(
sshd_ctx_t, monitor_req_keyverify_ptr, 0x78);
- 900 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
-
- 902 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
- 903 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
-
- 905 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 906 assert_offset(
sshd_ctx_t, STR_password, 0xD0);
- 907 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
-
-
- 913 char *STR_Connection_closed_by;
-
- 915 char *STR_authenticating;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1004 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1031 PADDING(
sizeof(
void*));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1135 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
- 1145 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1151 pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
- 1156 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1158 u64 hooks_installed;
-
-
- 1161 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1162 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1163 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1164 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1165 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1166 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1167 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1168 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1169 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1171 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1172 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1173 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
- 1174 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
- 1175 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1176 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1178 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+ 512 struct __attribute__((packed)) {
+
+ 514 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 529 u64 operand_zeroextended;
+
+
+
+
+
+
+ 536 assert_offset(
dasm_ctx_t, instruction_size, 8);
+
+
+ 539 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 558 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
+ 559 assert_offset(
dasm_ctx_t, operand_size, 0x48);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 626 Elf64_Versym *versym;
+ 627 Elf64_Rela *rela_relocs;
+
+
+ 630 Elf64_Relr *relr_relocs;
+
+
+
+
+
+ 644 u64 rodata_segment_start;
+ 645 u64 rodata_segment_size;
+ 646 u64 data_segment_start;
+ 647 u64 data_segment_size;
+ 648 u64 data_segment_alignment;
+
+
+
+
+
+ 660 u32 gnu_hash_bloom_shift;
+
+
+ 663 u32 *gnu_hash_buckets;
+
+
+
+
+
+
+
+
+ 672 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
+
+
+
+ 676 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
+ 677 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
+ 678 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
+ 679 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
+
+
+
+
+ 684 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
+
+ 686 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
+ 687 assert_offset(
elf_info_t, code_segment_start, 0x98);
+ 688 assert_offset(
elf_info_t, code_segment_size, 0xA0);
+ 689 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
+ 690 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
+ 691 assert_offset(
elf_info_t, data_segment_start, 0xB8);
+ 692 assert_offset(
elf_info_t, data_segment_size, 0xC0);
+ 693 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
+
+ 695 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
+ 696 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
+ 697 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
+ 698 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
+ 699 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
+ 700 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
+
+
+
+ 704 u32 resolved_imports_count;
+
+ 706 size_t (*malloc_usable_size)(
void *ptr);
+ 707 uid_t (*getuid)(void);
+ 708 void (*exit)(
int status);
+ 709 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+ 710 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+ 711 int (*system)(
const char *command);
+ 712 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
+
+ 714 int nfds, fd_set *readfds, fd_set *writefds,
+ 715 fd_set *exceptfds,
const struct timespec *timeout,
+ 716 const sigset_t *sigmask);
+ 717 ssize_t (*read)(
int fd,
void *buf,
size_t count);
+ 718 int *(*__errno_location)(void);
+ 719 int (*setlogmask)(
int mask);
+ 720 int (*shutdown)(
int sockfd,
int how);
+ 721 void *__libc_stack_end;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 739 typedef int (*pfn_RSA_public_decrypt_t)(
+ 740 int flen,
unsigned char *from,
unsigned char *to,
+ 741 RSA *rsa,
int padding);
+ 742 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
+ 743 typedef void (*pfn_RSA_get0_key_t)(
+
+ 745 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
+
+
+ 748 pfn_RSA_public_decrypt_t RSA_public_decrypt;
+ 749 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
+ 751 void (*RSA_get0_key_null)(
+ 752 const RSA *r,
const BIGNUM **n,
+ 753 const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 769 void (*DSA_get0_pqg)(
+ 770 const DSA *d,
const BIGNUM **p,
+ 771 const BIGNUM **q,
const BIGNUM **g);
+ 772 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
+ 773 size_t (*EC_POINT_point2oct)(
+ 774 const EC_GROUP *group,
const EC_POINT *p,
+ 775 point_conversion_form_t form,
unsigned char *buf,
+ 776 size_t len, BN_CTX *ctx);
+ 777 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
+ 778 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
+ 779 EVP_MD *(*EVP_sha256)(void);
+ 780 pfn_RSA_get0_key_t RSA_get0_key;
+ 781 int (*BN_num_bits)(
const BIGNUM *a);
+ 782 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
+ 784 const unsigned char *key,
size_t keylen);
+ 785 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+ 786 int (*EVP_DigestVerifyInit)(
+ 787 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+ 788 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+ 789 int (*EVP_DigestVerify)(
+ 790 EVP_MD_CTX *ctx,
const unsigned char *sig,
+ 791 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
+ 792 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+ 793 void (*EVP_PKEY_free)(EVP_PKEY *key);
+ 794 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+ 795 int (*EVP_DecryptInit_ex)(
+ 796 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
+ 797 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
+ 798 int (*EVP_DecryptUpdate)(
+ 799 EVP_CIPHER_CTX *ctx,
unsigned char *out,
+ 800 int *outl,
const unsigned char *in,
int inl);
+ 801 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
+ 802 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+ 803 const EVP_CIPHER *(*EVP_chacha20)(void);
+ 804 RSA *(*RSA_new)(void);
+ 805 BIGNUM *(*BN_dup)(
const BIGNUM *from);
+ 806 BIGNUM (*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
+ 807 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+ 809 const void *data,
size_t count,
unsigned char *md,
+ 810 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
+
+
+ 813 const unsigned char *m,
unsigned int m_len,
+ 814 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
+ 815 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
+ 816 void (*RSA_free)(RSA *rsa);
+ 817 void (*BN_free)(BIGNUM *a);
+
+ 819 u64 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 865 BOOL have_mm_answer_keyallowed;
+ 866 BOOL have_mm_answer_authpassword;
+ 867 BOOL have_mm_answer_keyverify;
+
+ 869 int (*monitor_req_fn)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
+
+ 871 PADDING(
sizeof(
void *));
+ 872 void *mm_answer_authpassword_start;
+ 873 void *mm_answer_authpassword_end;
+ 874 void *monitor_req_authpassword;
+ 875 PADDING(
sizeof(
void *));
+ 876 void *mm_answer_keyallowed_start;
+ 877 void *mm_answer_keyallowed_end;
+ 878 void *monitor_req_keyallowed_ptr;
+ 879 PADDING(
sizeof(
void *));
+ 880 void *mm_answer_keyverify_start;
+ 881 void *mm_answer_keyverify_end;
+ 882 void *monitor_req_keyverify_ptr;
+
+
+
+
+
+
+ 889 PADDING(
sizeof(
void *));
+ 890 void *mm_request_send_start;
+ 891 void *mm_request_send_end;
+ 892 PADDING(
sizeof(u32));
+ 893 PADDING(
sizeof(u32));
+
+ 895 int *permit_root_login_ptr;
+
+
+
+
+ 900 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+ 901 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+ 902 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+ 903 assert_offset(
sshd_ctx_t, monitor_req_fn, 0x10);
+ 904 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 905 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 906 assert_offset(
sshd_ctx_t, monitor_req_authpassword, 0x38);
+ 907 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 908 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 909 assert_offset(
sshd_ctx_t, monitor_req_keyallowed_ptr, 0x58);
+ 910 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 911 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 912 assert_offset(
sshd_ctx_t, monitor_req_keyverify_ptr, 0x78);
+ 913 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
+
+ 915 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
+ 916 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
+
+ 918 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 919 assert_offset(
sshd_ctx_t, STR_password, 0xD0);
+ 920 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
+
+
+
+
+
+ 926 char *STR_Connection_closed_by;
+
+ 928 char *STR_authenticating;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 975 struct monitor **struct_monitor_ptr_address;
+
+
+
+
+
+
+
+
+
+
+ 1018 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1046 PADDING(
sizeof(
void*));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1150 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+ 1160 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1166 pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
+ 1171 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1173 u64 hooks_installed;
+
+
+ 1176 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1177 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1178 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1179 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1180 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1181 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1182 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1183 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1184 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1186 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1187 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1188 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+ 1189 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+ 1190 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1191 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1193 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
+
-
-
-
-
- 1201 uintptr_t (*symbind64)(
- 1202 Elf64_Sym *sym,
unsigned int ndx,
- 1203 uptr *refcook, uptr *defcook,
- 1204 unsigned int flags,
const char *symname);
- 1205 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1206 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1211 PADDING(
sizeof(
void *));
- 1212 PADDING(
sizeof(
void *));
-
-
- 1221 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1274 Elf64_Ehdr *dynamic_linker_ehdr;
- 1275 void **__libc_stack_end;
-
-
-
- 1279 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1343 struct link_map *liblzma_map;
- 1344 struct link_map *libcrypto_map;
- 1345 struct link_map *libsystemd_map;
- 1346 struct link_map *libc_map;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1216 uintptr_t (*symbind64)(
+ 1217 Elf64_Sym *sym,
unsigned int ndx,
+ 1218 uptr *refcook, uptr *defcook,
+ 1219 unsigned int flags,
const char *symname);
+ 1220 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1221 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1226 PADDING(
sizeof(
void *));
+ 1227 PADDING(
sizeof(
void *));
+
+
+ 1236 PADDING(
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1289 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1290 void **__libc_stack_end;
+
+
+
+ 1294 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1358 struct link_map *liblzma_map;
+ 1359 struct link_map *libcrypto_map;
+ 1360 struct link_map *libsystemd_map;
+ 1361 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
- 1479 typedef union __attribute__((packed)) {
-
-
-
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1549 u8 decrypted_secret_data[57];
-
-
-
-
-
-
- 1556 assert_offset(
key_ctx_t, payload, 0x15);
- 1557 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+ 1494 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1564 u8 decrypted_secret_data[57];
+
+
+
+
+
+
+ 1571 assert_offset(
key_ctx_t, payload, 0x15);
+ 1572 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
- 1605 PADDING(
sizeof(u64));
-
- 1612 PADDING(
sizeof(u64));
- 1613 PADDING(
sizeof(u64));
-
+
+
+
+
+
+
+
+
+
+
1620 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
-
-
+
+ 1627 PADDING(
sizeof(u64));
+ 1628 PADDING(
sizeof(u64));
+
1635 PADDING(
sizeof(u64));
- 1636 lzma_allocator allocator;
-
-
-
-
-
-
+
+
-
-
-
-
-
-
- 1666 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1763 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 1786 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1852 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1906 FuncFindType find_mode);
-
-
-
-
-
-
+
+
+
+
+
+
+ 1650 PADDING(
sizeof(u64));
+ 1651 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1681 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1778 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 1801 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1867 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1921 FuncFindType find_mode);
+
+
+
+
- 1944 extern char *check_argument(
char arg_first_char,
char* arg_name);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2057 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2091 StringXrefId xref_id,
- 2092 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
-
-
-
-
- 2111 EncodedStringId *stringId_inOut,
- 2112 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2182 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2196 unsigned operation_index,
- 2197 unsigned shift_count,
- 2198 int flags, u8 *code);
-
-
-
-
- 2213 unsigned shift_count,
unsigned operation_index);
+
+
+ 1959 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2072 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2106 StringXrefId xref_id,
+ 2107 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+
+
+
+
+ 2126 EncodedStringId *stringId_inOut,
+ 2127 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2197 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2211 unsigned operation_index,
+ 2212 unsigned shift_count,
+ 2213 int flags, u8 *code);
-
- 2258 u8 *call_site, u8 *code,
-
- 2260 unsigned shift_count,
unsigned operation_index);
-
-
+
+
+
+ 2228 unsigned shift_count,
unsigned operation_index);
+
+
+ 2273 u8 *call_site, u8 *code,
- 2275 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2387 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2464 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 2505 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 2518 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
- 2575 uptr *refcook, uptr *defcook,
-
- 2577 const char *symname);
-
-
-
-
-
- 2608 ptrdiff_t *libname_offset,
-
-
-
-
-
- 2636 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 2683 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2726 void **host_keys_out);
-
-
-
-
-
-
- 2747 void **host_keys_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2817 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
+ 2275 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2290 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2402 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2479 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 2520 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 2533 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+ 2590 uptr *refcook, uptr *defcook,
+
+ 2592 const char *symname);
+
+
+
+
+
+ 2623 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 2651 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 2698 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2741 void **host_keys_out);
+
+
+
+
+
+
+ 2762 void **host_keys_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2832 u8 *buffer, u64 bufferSize,
+
+
-
-
+
+
-
-
-
-
-
-
-
-
-
-
- 2889 u64 sshkey_digest_offset,
- 2890 u64 signed_data_size,
-
-
-
-
-
-
- 2908 BOOL skip_root_patch,
-
- 2910 BOOL replace_monitor_reqtype,
- 2911 int monitor_reqtype,
-
-
-
-
-
-
-
- 2925 static_assert(
sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2904 u64 sshkey_digest_offset,
+ 2905 u64 signed_data_size,
+
+
+
+
+
+
+ 2923 BOOL skip_root_patch,
+
+ 2925 BOOL replace_monitor_reqtype,
+ 2926 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2954 static_assert(
sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1577
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1565
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1571
data passed to functions that access the backdoor data
Definition: xzre.h:1287
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1332
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1377
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1382
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1337
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1367
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1372
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1363
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1357
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1387
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1342
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1592
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1580
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1586
data passed to functions that access the backdoor data
Definition: xzre.h:1302
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1347
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1392
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1397
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1352
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1382
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1387
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1378
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1372
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1402
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1357
PADDING(sizeof(void *))
set to addess of symbol .Llzma12_mode_map_part_1
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1419
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1424
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1414
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1591
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1597
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:436
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:440
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:447
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:456
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:451
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:460
array of ELF handles
Definition: xzre.h:1249
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1260
elf_info_t * main
this is for sshd
Definition: xzre.h:1254
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:629
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:558
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:604
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:608
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:646
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:570
char * strtab
pointer to the ELF string table
Definition: xzre.h:578
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:562
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:642
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:554
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:566
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:586
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:596
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:624
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:612
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:600
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:582
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:574
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:590
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:993
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:941
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:949
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:961
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:937
void * sshd_data_start
sshd data segment end
Definition: xzre.h:974
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:957
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1008
void * sshd_code_start
sshd code segment start
Definition: xzre.h:966
void * sshd_data_end
sshd data segment start
Definition: xzre.h:978
void * sshd_code_end
sshd code segment end
Definition: xzre.h:970
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:986
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:745
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:755
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:750
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1671
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1660
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1650
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1655
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1665
the payload header. also used as Chacha IV
Definition: xzre.h:1459
the contents of the RSA 'n' field
Definition: xzre.h:1474
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1071
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1060
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1055
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1092
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1111
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1076
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1128
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1140
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1102
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1085
struct sensitive_data from openssh-portable
Definition: xzre.h:387
struct sshkey from openssh-portable
Definition: xzre.h:398
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1304
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1299
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1312
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1308
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1443
u32 index
Definition: xzre.h:1445
u32 byte_index
Definition: xzre.h:1450
u32 bit_index
Definition: xzre.h:1448
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1434
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1439
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1429
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1606
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1612
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:449
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:453
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:460
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:469
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:464
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:473
array of ELF handles
Definition: xzre.h:1264
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1275
elf_info_t * main
this is for sshd
Definition: xzre.h:1269
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:642
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:571
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:617
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:621
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:659
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:583
char * strtab
pointer to the ELF string table
Definition: xzre.h:591
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:575
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:655
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:567
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:579
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:599
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:609
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:637
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:625
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:613
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:595
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:587
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:603
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1007
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:954
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:962
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:974
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:950
void * sshd_data_start
sshd data segment end
Definition: xzre.h:988
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:970
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1022
void * sshd_code_start
sshd code segment start
Definition: xzre.h:980
void * sshd_data_end
sshd data segment start
Definition: xzre.h:992
void * sshd_code_end
sshd code segment end
Definition: xzre.h:984
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1000
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:758
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:768
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:763
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1686
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1675
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1665
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1670
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1680
the payload header. also used as Chacha IV
Definition: xzre.h:1474
the contents of the RSA 'n' field
Definition: xzre.h:1489
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1086
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1075
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1070
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1107
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1126
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1091
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1143
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1155
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1117
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1100
struct monitor from openssh-portable
Definition: xzre.h:388
struct sensitive_data from openssh-portable
Definition: xzre.h:400
struct sshkey from openssh-portable
Definition: xzre.h:411
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1319
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1314
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1327
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1323
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1458
u32 index
Definition: xzre.h:1460
u32 byte_index
Definition: xzre.h:1465
u32 bit_index
Definition: xzre.h:1463
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
BOOL process_is_sshd(elf_info_t *elf, u8 *stack_end)
checks if the current process is sshd by inspecting argv and envp.
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
ElfId
Definition: xzre.h:212
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:217
CommandFlags2
Definition: xzre.h:1503
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1513
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1523
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1508
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1518
CommandFlags2
Definition: xzre.h:1518
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1528
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1538
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1523
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1533
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
BOOL sshd_get_host_keys_address_via_xcalloc(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, string_references_t *string_refs, void **host_keys_out)
finds the address of sensitive_data.host_keys in sshd by using XREF_xcalloc_zero_size in xcalloc
void fake_lzma_free(void *opaque, void *ptr)
a fake free function called by lzma_free()
void * elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize)
Obtains the address and size of the last readonly segment in the given ELF file this corresponds to t...
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
CommandFlags1
Definition: xzre.h:1484
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1492
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1500
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1496
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1488
CommandFlags1
Definition: xzre.h:1499
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1507
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1515
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1511
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1503
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
EncodedStringId get_string_id(const char *string_begin, const char *string_end)
Get the.
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
int sshd_get_host_keys_score_in_main(void *host_keys, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if main accesses host_keys or not
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1282
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1297
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode)
locates the function prologue
void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Gets the GOT symbol with name encoded_string_id from the parsed ELF file.
void * elf_get_plt_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Gets the PLT symbol with name encoded_string_id from the parsed ELF file.
BOOL secret_data_append_from_call_site(secret_data_shift_cursor_t shift_cursor, unsigned shift_count, unsigned operation_index, BOOL bypass)
Shifts data in the secret data store, after validation of the call site, i.e. the caller of this func...
BOOL sshd_find_monitor_struct(elf_info_t *elf, string_references_t *refs, global_context_t *ctx)
finds the pointer to struct monitor, and updates the global context in ctx with its location
ptrdiff_t get_got_offset(elf_entry_ctx_t *ctx)
get the offset to the GOT
void * update_got_address(elf_entry_ctx_t *entry_ctx)
finds the __tls_get_addr() GOT entry
BOOL secret_data_append_from_code(void *code_start, void *code_end, secret_data_shift_cursor_t shift_cursor, unsigned shift_count, BOOL start_from_call)
Pushes secret data by validating the given code block.
