diff --git a/xzre_8h.html b/xzre_8h.html index 895700c..15a773a 100644 --- a/xzre_8h.html +++ b/xzre_8h.html @@ -108,6 +108,15 @@ #define assert_offset(t, f, o)   static_assert(offsetof(t, f) == o)   + +#define CONCAT(x, y)   x ## y +  + +#define EXPAND(x, y)   CONCAT(x, y) +  + +#define PADDING(size)   u8 EXPAND(_unknown, __LINE__)[size] +  diff --git a/xzre_8h_source.html b/xzre_8h_source.html index 76faf80..21aeeaa 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -133,166 +133,170 @@
71 
72 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
73 
-
74 typedef struct __attribute__((packed)) {
-
75  u8* first_instruction;
-
76  u64 instruction_size;
-
77  u8 flags;
-
78  u8 flags2;
-
79  u8 _unk0[2]; // likely padding
-
80  u8 lock_byte;
-
81  u8 _unk1;
-
82  u8 last_prefix;
-
83  u8 _unk2[4];
-
84  u8 rex_byte;
-
85  u8 modrm;
-
86  u8 modrm_mod;
-
87  u8 modrm_reg;
-
88  u8 modrm_rm;
-
89  u8 _unk3[4];
-
90  u8 byte_24;
-
91  u8 _unk4[3];
-
92  u32 opcode;
-
93  u8 _unk5[4];
-
94  u64 mem_disp;
-
95  // e.g. in CALL
-
96  u64 operand;
-
97  u64 _unk6[2];
-
98  u8 insn_offset;
-
99  u8 _unk8[47];
-
100 } dasm_ctx_t;
-
101 
-
102 assert_offset(dasm_ctx_t, first_instruction, 0);
-
103 assert_offset(dasm_ctx_t, instruction_size, 8);
-
104 assert_offset(dasm_ctx_t, flags, 0x10);
-
105 assert_offset(dasm_ctx_t, flags2, 0x11);
-
106 assert_offset(dasm_ctx_t, lock_byte, 0x14);
-
107 assert_offset(dasm_ctx_t, last_prefix, 0x16);
-
108 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
-
109 assert_offset(dasm_ctx_t, modrm, 0x1C);
-
110 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
-
111 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
-
112 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
-
113 assert_offset(dasm_ctx_t, opcode, 0x28);
-
114 assert_offset(dasm_ctx_t, mem_disp, 0x30);
-
115 assert_offset(dasm_ctx_t, operand, 0x38);
-
116 assert_offset(dasm_ctx_t, insn_offset, 0x50);
-
117 static_assert(sizeof(dasm_ctx_t) == 128);
-
118 
-
119 typedef struct __attribute__((packed)) {
-
120  Elf64_Ehdr *elfbase;
-
121  u64 first_vaddr;
-
122  Elf64_Phdr *phdrs;
-
123  u64 e_phnum;
-
124  Elf64_Dyn *dyn;
-
125  u64 dyn_num_entries;
-
126  char *strtab;
-
127  Elf64_Sym *symtab;
-
128  Elf64_Rela *plt_relocs;
-
129  u32 plt_relocs_num;
-
130  BOOL gnurelro_found;
-
131  u64 gnurelro_vaddr;
-
132  u64 gnurelro_memsize;
-
133  Elf64_Verdef *verdef;
-
134  u64 verdef_num;
-
135  Elf64_Versym *versym;
-
136  Elf64_Rela *rela_relocs;
-
137  u32 rela_relocs_num;
-
138  u32 _unused0;
-
139  Elf64_Relr *relr_relocs;
-
140  u32 relr_relocs_num;
-
141  u8 _unknown0[60];
-
142  u8 flags;
-
143  u8 _unknown1[7];
-
144  u32 gnu_hash_nbuckets;
-
145  u32 gnu_hash_last_bloom;
-
146  u32 gnu_hash_bloom_shift;
-
147  u8 _unused1[4];
-
148  u64 *gnu_hash_bloom;
-
149  u32 *gnu_hash_buckets;
-
150  u32 *gnu_hash_chain;
-
151 } elf_info_t;
-
152 
-
153 assert_offset(elf_info_t, elfbase, 0x0);
-
154 assert_offset(elf_info_t, first_vaddr, 0x8);
-
155 assert_offset(elf_info_t, phdrs, 0x10);
-
156 assert_offset(elf_info_t, e_phnum, 0x18);
-
157 assert_offset(elf_info_t, dyn, 0x20);
-
158 assert_offset(elf_info_t, dyn_num_entries, 0x28);
-
159 assert_offset(elf_info_t, strtab, 0x30);
-
160 assert_offset(elf_info_t, symtab, 0x38);
-
161 assert_offset(elf_info_t, plt_relocs, 0x40);
-
162 assert_offset(elf_info_t, plt_relocs_num, 0x48);
-
163 assert_offset(elf_info_t, gnurelro_found, 0x4C);
-
164 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
-
165 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
-
166 assert_offset(elf_info_t, verdef, 0x60);
-
167 assert_offset(elf_info_t, verdef_num, 0x68);
-
168 assert_offset(elf_info_t, versym, 0x70);
-
169 assert_offset(elf_info_t, rela_relocs, 0x78);
-
170 assert_offset(elf_info_t, rela_relocs_num, 0x80);
-
171 assert_offset(elf_info_t, relr_relocs, 0x88);
-
172 assert_offset(elf_info_t, relr_relocs_num, 0x90);
-
173 assert_offset(elf_info_t, flags, 0xD0);
-
174 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
-
175 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
-
176 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
-
177 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
-
178 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
-
179 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
-
180 
-
187 typedef union {
-
188  struct {
-
190  u32 bit_index : 3;
-
192  u32 byte_index : 29;
-
193  };
-
195  u32 index;
-
196 } secret_data_shift_cursor;
-
197 
-
206 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
-
207 
-
217 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
-
218 
-
227 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
-
228 
-
248 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
-
249 
-
259 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
-
260 
-
274 extern BOOL find_function_prologue_ex(
-
275  u8 *code_start,
-
276  u8 *func_start_0,
-
277  u8 *func_start_1,
-
278  u8 *search_base,
-
279  u8 *code_end,
-
280  FuncFindType find_mode);
-
281 
-
291 extern BOOL elf_contains_segment(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
-
292 
-
300 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
-
301 
-
310 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
-
311 
-
319 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
-
320 
-
326 extern lzma_allocator *get_lzma_allocator();
-
327 
-
338 extern BOOL secret_data_append_if_flags(
-
339  secret_data_shift_cursor shift_cursor,
-
340  unsigned operation_index,
-
341  unsigned reg2reg_instruction_count,
-
342  int flags, u8 *code);
-
343 
-
382 extern BOOL secret_data_append_singleton(
-
383  u8 *call_site, u8 *code,
-
384  secret_data_shift_cursor shift_cursor,
-
385  unsigned reg2reg_instruction_count, unsigned operation_index);
-
386 
-
387 #include "util.h"
-
388 #endif
-
secret_data_shift_cursor
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:187
-
secret_data_shift_cursor::index
u32 index
Definition: xzre.h:195
-
secret_data_shift_cursor::bit_index
u32 bit_index
Definition: xzre.h:190
-
secret_data_shift_cursor::byte_index
u32 byte_index
Definition: xzre.h:192
+
74 #define CONCAT(x, y) x ## y
+
75 #define EXPAND(x, y) CONCAT(x, y)
+
76 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
77 
+
78 typedef struct __attribute__((packed)) {
+
79  u8* first_instruction;
+
80  u64 instruction_size;
+
81  u8 flags;
+
82  u8 flags2;
+
83  PADDING(2);
+
84  u8 lock_byte;
+
85  u8 _unk1;
+
86  u8 last_prefix;
+
87  PADDING(4);
+
88  u8 rex_byte;
+
89  u8 modrm;
+
90  u8 modrm_mod;
+
91  u8 modrm_reg;
+
92  u8 modrm_rm;
+
93  PADDING(4);
+
94  u8 byte_24;
+
95  PADDING(3);
+
96  u32 opcode;
+
97  PADDING(4);
+
98  u64 mem_disp;
+
99  // e.g. in CALL
+
100  u64 operand;
+
101  PADDING(16);
+
102  u8 insn_offset;
+
103  PADDING(47);
+
104 } dasm_ctx_t;
+
105 
+
106 assert_offset(dasm_ctx_t, first_instruction, 0);
+
107 assert_offset(dasm_ctx_t, instruction_size, 8);
+
108 assert_offset(dasm_ctx_t, flags, 0x10);
+
109 assert_offset(dasm_ctx_t, flags2, 0x11);
+
110 assert_offset(dasm_ctx_t, lock_byte, 0x14);
+
111 assert_offset(dasm_ctx_t, last_prefix, 0x16);
+
112 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
+
113 assert_offset(dasm_ctx_t, modrm, 0x1C);
+
114 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
+
115 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
+
116 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
+
117 assert_offset(dasm_ctx_t, opcode, 0x28);
+
118 assert_offset(dasm_ctx_t, mem_disp, 0x30);
+
119 assert_offset(dasm_ctx_t, operand, 0x38);
+
120 assert_offset(dasm_ctx_t, insn_offset, 0x50);
+
121 static_assert(sizeof(dasm_ctx_t) == 128);
+
122 
+
123 typedef struct __attribute__((packed)) {
+
124  Elf64_Ehdr *elfbase;
+
125  u64 first_vaddr;
+
126  Elf64_Phdr *phdrs;
+
127  u64 e_phnum;
+
128  Elf64_Dyn *dyn;
+
129  u64 dyn_num_entries;
+
130  char *strtab;
+
131  Elf64_Sym *symtab;
+
132  Elf64_Rela *plt_relocs;
+
133  u32 plt_relocs_num;
+
134  BOOL gnurelro_found;
+
135  u64 gnurelro_vaddr;
+
136  u64 gnurelro_memsize;
+
137  Elf64_Verdef *verdef;
+
138  u64 verdef_num;
+
139  Elf64_Versym *versym;
+
140  Elf64_Rela *rela_relocs;
+
141  u32 rela_relocs_num;
+
142  u32 _unused0;
+
143  Elf64_Relr *relr_relocs;
+
144  u32 relr_relocs_num;
+
145  PADDING(60);
+
146  u8 flags;
+
147  PADDING(7);
+
148  u32 gnu_hash_nbuckets;
+
149  u32 gnu_hash_last_bloom;
+
150  u32 gnu_hash_bloom_shift;
+
151  PADDING(4);
+
152  u64 *gnu_hash_bloom;
+
153  u32 *gnu_hash_buckets;
+
154  u32 *gnu_hash_chain;
+
155 } elf_info_t;
+
156 
+
157 assert_offset(elf_info_t, elfbase, 0x0);
+
158 assert_offset(elf_info_t, first_vaddr, 0x8);
+
159 assert_offset(elf_info_t, phdrs, 0x10);
+
160 assert_offset(elf_info_t, e_phnum, 0x18);
+
161 assert_offset(elf_info_t, dyn, 0x20);
+
162 assert_offset(elf_info_t, dyn_num_entries, 0x28);
+
163 assert_offset(elf_info_t, strtab, 0x30);
+
164 assert_offset(elf_info_t, symtab, 0x38);
+
165 assert_offset(elf_info_t, plt_relocs, 0x40);
+
166 assert_offset(elf_info_t, plt_relocs_num, 0x48);
+
167 assert_offset(elf_info_t, gnurelro_found, 0x4C);
+
168 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
+
169 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
+
170 assert_offset(elf_info_t, verdef, 0x60);
+
171 assert_offset(elf_info_t, verdef_num, 0x68);
+
172 assert_offset(elf_info_t, versym, 0x70);
+
173 assert_offset(elf_info_t, rela_relocs, 0x78);
+
174 assert_offset(elf_info_t, rela_relocs_num, 0x80);
+
175 assert_offset(elf_info_t, relr_relocs, 0x88);
+
176 assert_offset(elf_info_t, relr_relocs_num, 0x90);
+
177 assert_offset(elf_info_t, flags, 0xD0);
+
178 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
+
179 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
+
180 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
+
181 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
+
182 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
+
183 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
+
184 
+
191 typedef union {
+
192  struct {
+
194  u32 bit_index : 3;
+
196  u32 byte_index : 29;
+
197  };
+
199  u32 index;
+
200 } secret_data_shift_cursor;
+
201 
+
210 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
+
211 
+
221 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
+
222 
+
231 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
+
232 
+
252 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
+
253 
+
263 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
+
264 
+
278 extern BOOL find_function_prologue_ex(
+
279  u8 *code_start,
+
280  u8 *func_start_0,
+
281  u8 *func_start_1,
+
282  u8 *search_base,
+
283  u8 *code_end,
+
284  FuncFindType find_mode);
+
285 
+
295 extern BOOL elf_contains_segment(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
+
296 
+
304 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
+
305 
+
314 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
+
315 
+
323 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
+
324 
+
330 extern lzma_allocator *get_lzma_allocator();
+
331 
+
342 extern BOOL secret_data_append_if_flags(
+
343  secret_data_shift_cursor shift_cursor,
+
344  unsigned operation_index,
+
345  unsigned reg2reg_instruction_count,
+
346  int flags, u8 *code);
+
347 
+
386 extern BOOL secret_data_append_singleton(
+
387  u8 *call_site, u8 *code,
+
388  secret_data_shift_cursor shift_cursor,
+
389  unsigned reg2reg_instruction_count, unsigned operation_index);
+
390 
+
391 #include "util.h"
+
392 #endif
+
secret_data_shift_cursor
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:191
+
secret_data_shift_cursor::index
u32 index
Definition: xzre.h:199
+
secret_data_shift_cursor::bit_index
u32 bit_index
Definition: xzre.h:194
+
secret_data_shift_cursor::byte_index
u32 byte_index
Definition: xzre.h:196
elf_parse
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
elf_symbol_get_addr
void * elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id)
Looks up an ELF symbol from a parsed ELF, and returns its memory address.
secret_data_append_singleton
BOOL secret_data_append_singleton(u8 *call_site, u8 *code, secret_data_shift_cursor shift_cursor, unsigned reg2reg_instruction_count, unsigned operation_index)
Shifts data in the secret data store, after validation of code. this function is intended to be invok...

Typedefs