Returnsvoid* the address of the __tls_get_addr() GOT entry
+
+
+
+◆ verify_signature()
+
+
+
+
+
+ | BOOL verify_signature |
+ ( |
+ struct sshkey * |
+ sshkey, |
+
+
+ |
+ |
+ u8 * |
+ signed_data, |
+
+
+ |
+ |
+ u64 |
+ sshkey_digest_offset, |
+
+
+ |
+ |
+ u64 |
+ signed_data_size, |
+
+
+ |
+ |
+ u8 * |
+ signature, |
+
+
+ |
+ |
+ u8 * |
+ ed448_raw_key, |
+
+
+ |
+ |
+ global_context_t * |
+ global_ctx |
+
+
+ |
+ ) |
+ | |
+
+
+
+
+
Checks if signed_data is signed with ed448_raw_key.
+
in order to do this, the code will
+- compute a sha256 hash of the SSH host key in
sshkey (after serialization) and write it to signed_data at offset sshkey_digest_offset
+- load the ED448 key from
ed448_raw_key
+- use it to verify
signed_data (including the hashed SSH host key)
+
+
- Parameters
-
+
+ | sshkey | the SSH host key |
+ | signed_data | data to verify, including an empty space to hold the hashed SSH key |
+ | sshkey_digest_offset | offset to write the hashed SSH key to, in signed_data |
+ | signed_data_size | length of the signed_data buffer, including the space for the SSH key hash digest |
+ | signature | signature of the signed data to check |
+ | ed448_raw_key | the ED448 public key obtained from secret_data_get_decrypted |
+ | global_ctx | |
+
+
+
+
- Returns
- BOOL TRUE if the signature verification is successful, FALSE otherwise
+
23 typedef uintptr_t uptr;
- 26 typedef unsigned long int size_t;
- 27 typedef signed long int ssize_t;
-
-
+
+
+ 28 typedef uint32_t Elf32_Addr;
+ 29 typedef uint64_t Elf64_Addr;
- 31 Elf64_Ehdr, Elf64_Phdr, Elf64_Dyn, Elf64_Sym, Elf64_Rela, Elf64_Relr,
+ 31 Elf32_Sym, Elf64_Ehdr, Elf64_Phdr, Elf64_Dyn, Elf64_Sym, Elf64_Rela, Elf64_Relr,
32 Elf64_Verdef, Elf64_Versym, sigset_t, fd_set, EVP_PKEY, RSA, DSA,
33 BIGNUM, EC_POINT, EC_KEY, EC_GROUP, EVP_MD, point_conversion_form_t,
34 EVP_CIPHER, EVP_CIPHER_CTX, ENGINE, EVP_MD_CTX, EVP_PKEY_CTX, BN_CTX;
@@ -99,1590 +99,1661 @@
37 void (*free)(
void *opaque,
void *ptr);
-
-
-
-
- 44 #include <openssl/dsa.h>
- 45 #include <openssl/ec.h>
- 46 #include <openssl/evp.h>
- 47 #include <openssl/rsa.h>
-
-
- 50 typedef Elf64_Xword Elf64_Relr;
-
-
- 53 #define UPTR(x) ((uptr)(x))
- 54 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
- 55 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
-
-
-
-
-
-
-
- 63 #define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
- 64 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
- 65 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
- 66 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
-
-
-
-
-
- 72 unsigned int bindflags;
-
-
- 75 typedef struct link_map *lookup_t;
-
-
-
- 79 struct La_x86_64_regs;
- 80 struct La_x86_64_retval;
-
-
-
-
-
-
-
- 88 void (*activity) (uintptr_t *,
unsigned int);
- 89 char *(*objsearch) (
const char *, uintptr_t *,
unsigned int);
- 90 unsigned int (*objopen) (
struct link_map *, Lmid_t, uintptr_t *);
- 91 void (*preinit) (uintptr_t *);
-
-
- 94 uintptr_t (*symbind32) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 95 uintptr_t *,
unsigned int *,
const char *);
- 96 uintptr_t (*symbind64) (Elf64_Sym *,
unsigned int, uintptr_t *,
- 97 uintptr_t *,
unsigned int *,
const char *);
-
-
-
- 101 Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 102 uintptr_t *,
struct La_i86_regs *,
- 103 unsigned int *,
const char *name,
- 104 long int *framesizep);
- 105 Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *,
unsigned int,
-
- 107 uintptr_t *,
struct La_x86_64_regs *,
- 108 unsigned int *,
const char *name,
- 109 long int *framesizep);
- 110 Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 111 uintptr_t *,
struct La_x32_regs *,
- 112 unsigned int *,
const char *name,
- 113 long int *framesizep);
-
-
-
- 117 unsigned int (*i86_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 118 uintptr_t *,
const struct La_i86_regs *,
- 119 struct La_i86_retval *,
const char *);
- 120 unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *,
unsigned int,
-
-
- 123 const struct La_x86_64_regs *,
- 124 struct La_x86_64_retval *,
-
- 126 unsigned int (*x32_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
-
- 128 const struct La_x32_regs *,
- 129 struct La_x86_64_retval *,
-
-
- 132 unsigned int (*objclose) (uintptr_t *);
-
-
-
+
+ 41 typedef long int Lmid_t;
+ 42 #define ElfW(Sym) Elf64_Sym
+
+
+
+
+ 47 #include <openssl/dsa.h>
+ 48 #include <openssl/ec.h>
+ 49 #include <openssl/evp.h>
+ 50 #include <openssl/rsa.h>
+
+
+ 53 typedef Elf64_Xword Elf64_Relr;
+
+
+ 56 #define UPTR(x) ((uptr)(x))
+ 57 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
+ 58 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
+
+
+
+
+
+
+
+ 66 #define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
+ 67 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
+ 68 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+ 69 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
+
+
+
+
+
+ 75 unsigned int bindflags;
+
+
+ 78 typedef struct link_map *lookup_t;
+
+
+
+ 82 struct La_x86_64_regs;
+ 83 struct La_x86_64_retval;
+
+
+
+
+
+
+
+ 91 void (*activity) (uintptr_t *,
unsigned int);
+ 92 char *(*objsearch) (
const char *, uintptr_t *,
unsigned int);
+ 93 unsigned int (*objopen) (
struct link_map *, Lmid_t, uintptr_t *);
+ 94 void (*preinit) (uintptr_t *);
+
+
+ 97 uintptr_t (*symbind32) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 98 uintptr_t *,
unsigned int *,
const char *);
+ 99 uintptr_t (*symbind64) (Elf64_Sym *,
unsigned int, uintptr_t *,
+ 100 uintptr_t *,
unsigned int *,
const char *);
+
+
+
+ 104 Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 105 uintptr_t *,
struct La_i86_regs *,
+ 106 unsigned int *,
const char *name,
+ 107 long int *framesizep);
+ 108 Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *,
unsigned int,
+
+ 110 uintptr_t *,
struct La_x86_64_regs *,
+ 111 unsigned int *,
const char *name,
+ 112 long int *framesizep);
+ 113 Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 114 uintptr_t *,
struct La_x32_regs *,
+ 115 unsigned int *,
const char *name,
+ 116 long int *framesizep);
+
+
+
+ 120 unsigned int (*i86_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 121 uintptr_t *,
const struct La_i86_regs *,
+ 122 struct La_i86_retval *,
const char *);
+ 123 unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *,
unsigned int,
+
+
+ 126 const struct La_x86_64_regs *,
+ 127 struct La_x86_64_retval *,
+
+ 129 unsigned int (*x32_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
+
+ 131 const struct La_x32_regs *,
+ 132 struct La_x86_64_retval *,
+
+
+ 135 unsigned int (*objclose) (uintptr_t *);
-
- 138 #define XZDASM_OPC(op) (op - 0x80)
+
+
-
-
-
-
+
+ 141 #define XZDASM_OPC(op) (op - 0x80)
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 196 X_ELF_DYNAMIC_LINKER = 1,
-
-
-
-
-
- 202 XREF_xcalloc_zero_size = 0,
- 203 XREF_Could_not_chdir_to_home_directory_s_s = 1,
- 204 XREF_list_hostkey_types = 2,
- 205 XREF_demote_sensitive_data = 3,
- 206 XREF_mm_terminate = 4,
- 207 XREF_mm_pty_allocate = 5,
- 208 XREF_mm_do_pam_account = 6,
- 209 XREF_mm_session_pty_cleanup2 = 7,
- 210 XREF_mm_getpwnamallow = 8,
- 211 XREF_mm_sshpam_init_ctx = 9,
- 212 XREF_mm_sshpam_query = 10,
- 213 XREF_mm_sshpam_respond = 11,
- 214 XREF_mm_sshpam_free_ctx = 12,
- 215 XREF_mm_choose_dh = 13,
- 216 XREF_sshpam_respond = 14,
- 217 XREF_sshpam_auth_passwd = 15,
- 218 XREF_sshpam_query = 16,
-
- 220 XREF_mm_request_send = 18,
- 221 XREF_mm_log_handler = 19,
- 222 XREF_Could_not_get_agent_socket = 20,
- 223 XREF_auth_root_allowed = 21,
- 224 XREF_mm_answer_authpassword = 22,
- 225 XREF_mm_answer_keyallowed = 23,
- 226 XREF_mm_answer_keyverify = 24,
- 227 XREF_48s_48s_d_pid_ld_ = 25,
- 228 XREF_Unrecognized_internal_syslog_level_code_d = 26
-
-
-
-
-
- 234 STR_48s_48s_d_pid_ld_ = 0xd8,
-
- 236 STR_usr_sbin_sshd = 0x108,
- 237 STR_Accepted_password_for = 0x870,
- 238 STR_Accepted_publickey_for = 0x1a0,
- 239 STR_BN_bin2bn = 0xc40,
- 240 STR_BN_bn2bin = 0x6d0,
-
-
- 243 STR_BN_num_bits = 0x4e0,
- 244 STR_Connection_closed_by = 0x790,
- 245 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
- 246 STR_Could_not_get_agent_socket = 0xb0,
-
- 248 STR_DSA_get0_pqg = 0x9d0,
- 249 STR_DSA_get0_pub_key = 0x468,
- 250 STR_EC_KEY_get0_group = 0x7e8,
- 251 STR_EC_KEY_get0_public_key = 0x268,
- 252 STR_EC_POINT_point2oct = 0x6e0,
- 253 STR_EVP_CIPHER_CTX_free = 0xb28,
- 254 STR_EVP_CIPHER_CTX_new = 0x838,
- 255 STR_EVP_DecryptFinal_ex = 0x2a8,
- 256 STR_EVP_DecryptInit_ex = 0xc08,
- 257 STR_EVP_DecryptUpdate = 0x3f0,
- 258 STR_EVP_Digest = 0xf8,
- 259 STR_EVP_DigestVerify = 0x408,
- 260 STR_EVP_DigestVerifyInit = 0x118,
- 261 STR_EVP_MD_CTX_free = 0xd10,
- 262 STR_EVP_MD_CTX_new = 0xaf8,
- 263 STR_EVP_PKEY_free = 0x6f8,
- 264 STR_EVP_PKEY_new_raw_public_key = 0x758,
- 265 STR_EVP_PKEY_set1_RSA = 0x510,
- 266 STR_EVP_chacha20 = 0xc28,
- 267 STR_EVP_sha256 = 0xc60,
-
- 269 STR_GLIBC_2_2_5 = 0x8c0,
- 270 STR_GLRO_dl_naudit_naudit = 0x6a8,
- 271 STR_KRB5CCNAME = 0x1e0,
- 272 STR_LD_AUDIT = 0xcf0,
- 273 STR_LD_BIND_NOT = 0xbc0,
- 274 STR_LD_DEBUG = 0xa90,
- 275 STR_LD_PROFILE = 0xb98,
- 276 STR_LD_USE_LOAD_BIAS = 0x3e0,
-
- 278 STR_RSA_free = 0xac0,
- 279 STR_RSA_get0_key = 0x798,
-
- 281 STR_RSA_public_decrypt = 0x1d0,
- 282 STR_RSA_set0_key = 0x540,
- 283 STR_RSA_sign = 0x8f8,
-
-
- 286 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
- 287 STR_WAYLAND_DISPLAY = 0x158,
- 288 STR_errno_location = 0x878,
- 289 STR_libc_stack_end = 0x2b0,
- 290 STR_libc_start_main = 0x228,
- 291 STR_dl_audit_preinit = 0xa60,
- 292 STR_dl_audit_symbind_alt = 0x9c8,
-
-
- 295 STR_rtld_global = 0x5b8,
- 296 STR_rtld_global_ro = 0xa98,
- 297 STR_auth_root_allowed = 0xb8,
- 298 STR_authenticating = 0x1d8,
- 299 STR_demote_sensitive_data = 0x28,
-
- 301 STR_ld_linux_x86_64_so = 0xa48,
-
- 303 STR_libcrypto_so = 0x7c0,
- 304 STR_liblzma_so = 0x590,
- 305 STR_libsystemd_so = 0x938,
- 306 STR_list_hostkey_types = 0x20,
- 307 STR_malloc_usable_size = 0x440,
- 308 STR_mm_answer_authpassword = 0xc0,
- 309 STR_mm_answer_keyallowed = 0xc8,
- 310 STR_mm_answer_keyverify = 0xd0,
- 311 STR_mm_answer_pam_start = 0x948,
- 312 STR_mm_choose_dh = 0x78,
- 313 STR_mm_do_pam_account = 0x40,
- 314 STR_mm_getpwnamallow = 0x50,
- 315 STR_mm_log_handler = 0xa8,
- 316 STR_mm_pty_allocate = 0x38,
- 317 STR_mm_request_send = 0xa0,
- 318 STR_mm_session_pty_cleanup2 = 0x48,
- 319 STR_mm_sshpam_free_ctx = 0x70,
- 320 STR_mm_sshpam_init_ctx = 0x58,
- 321 STR_mm_sshpam_query = 0x60,
- 322 STR_mm_sshpam_respond = 0x68,
- 323 STR_mm_terminate = 0x30,
- 324 STR_parse_PAM = 0xc58,
- 325 STR_password = 0x400,
-
-
- 328 STR_publickey = 0x7b8,
-
- 330 STR_rsa_sha2_256 = 0x710,
- 331 STR_setlogmask = 0x428,
- 332 STR_setresgid = 0x5f0,
- 333 STR_setresuid = 0xab8,
- 334 STR_shutdown = 0x760,
-
- 336 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
- 337 STR_sshpam_auth_passwd = 0x88,
- 338 STR_sshpam_query = 0x90,
- 339 STR_sshpam_respond = 0x80,
- 340 STR_start_pam = 0x98,
-
-
-
-
- 345 STR_xcalloc_zero_size = 0x10,
- 346 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
-
-
-
-
- 351 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
- 353 #define assert_offset(t, f, o)
-
-
- 356 #define CONCAT(x, y) x ## y
- 357 #define EXPAND(x, y) CONCAT(x, y)
- 358 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
-
-
-
- 366 struct sshkey **host_keys;
- 367 struct sshkey **host_pubkeys;
- 368 struct sshkey **host_certificates;
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 173 DF_MEM_SEG_OFFS = 0x4,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 218 X_ELF_DYNAMIC_LINKER = 1,
+
+
+
+
+
+ 224 XREF_xcalloc_zero_size = 0,
+ 225 XREF_Could_not_chdir_to_home_directory_s_s = 1,
+ 226 XREF_list_hostkey_types = 2,
+ 227 XREF_demote_sensitive_data = 3,
+ 228 XREF_mm_terminate = 4,
+ 229 XREF_mm_pty_allocate = 5,
+ 230 XREF_mm_do_pam_account = 6,
+ 231 XREF_mm_session_pty_cleanup2 = 7,
+ 232 XREF_mm_getpwnamallow = 8,
+ 233 XREF_mm_sshpam_init_ctx = 9,
+ 234 XREF_mm_sshpam_query = 10,
+ 235 XREF_mm_sshpam_respond = 11,
+ 236 XREF_mm_sshpam_free_ctx = 12,
+ 237 XREF_mm_choose_dh = 13,
+ 238 XREF_sshpam_respond = 14,
+ 239 XREF_sshpam_auth_passwd = 15,
+ 240 XREF_sshpam_query = 16,
+
+ 242 XREF_mm_request_send = 18,
+ 243 XREF_mm_log_handler = 19,
+ 244 XREF_Could_not_get_agent_socket = 20,
+ 245 XREF_auth_root_allowed = 21,
+ 246 XREF_mm_answer_authpassword = 22,
+ 247 XREF_mm_answer_keyallowed = 23,
+ 248 XREF_mm_answer_keyverify = 24,
+ 249 XREF_48s_48s_d_pid_ld_ = 25,
+ 250 XREF_Unrecognized_internal_syslog_level_code_d = 26
+
+
+
+
+
+ 256 STR_48s_48s_d_pid_ld_ = 0xd8,
+
+ 258 STR_usr_sbin_sshd = 0x108,
+ 259 STR_Accepted_password_for = 0x870,
+ 260 STR_Accepted_publickey_for = 0x1a0,
+ 261 STR_BN_bin2bn = 0xc40,
+ 262 STR_BN_bn2bin = 0x6d0,
+
+
+ 265 STR_BN_num_bits = 0x4e0,
+ 266 STR_Connection_closed_by = 0x790,
+ 267 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
+ 268 STR_Could_not_get_agent_socket = 0xb0,
+
+ 270 STR_DSA_get0_pqg = 0x9d0,
+ 271 STR_DSA_get0_pub_key = 0x468,
+ 272 STR_EC_KEY_get0_group = 0x7e8,
+ 273 STR_EC_KEY_get0_public_key = 0x268,
+ 274 STR_EC_POINT_point2oct = 0x6e0,
+ 275 STR_EVP_CIPHER_CTX_free = 0xb28,
+ 276 STR_EVP_CIPHER_CTX_new = 0x838,
+ 277 STR_EVP_DecryptFinal_ex = 0x2a8,
+ 278 STR_EVP_DecryptInit_ex = 0xc08,
+ 279 STR_EVP_DecryptUpdate = 0x3f0,
+ 280 STR_EVP_Digest = 0xf8,
+ 281 STR_EVP_DigestVerify = 0x408,
+ 282 STR_EVP_DigestVerifyInit = 0x118,
+ 283 STR_EVP_MD_CTX_free = 0xd10,
+ 284 STR_EVP_MD_CTX_new = 0xaf8,
+ 285 STR_EVP_PKEY_free = 0x6f8,
+ 286 STR_EVP_PKEY_new_raw_public_key = 0x758,
+ 287 STR_EVP_PKEY_set1_RSA = 0x510,
+ 288 STR_EVP_chacha20 = 0xc28,
+ 289 STR_EVP_sha256 = 0xc60,
+
+ 291 STR_GLIBC_2_2_5 = 0x8c0,
+ 292 STR_GLRO_dl_naudit_naudit = 0x6a8,
+ 293 STR_KRB5CCNAME = 0x1e0,
+ 294 STR_LD_AUDIT = 0xcf0,
+ 295 STR_LD_BIND_NOT = 0xbc0,
+ 296 STR_LD_DEBUG = 0xa90,
+ 297 STR_LD_PROFILE = 0xb98,
+ 298 STR_LD_USE_LOAD_BIAS = 0x3e0,
+
+ 300 STR_RSA_free = 0xac0,
+ 301 STR_RSA_get0_key = 0x798,
+
+ 303 STR_RSA_public_decrypt = 0x1d0,
+ 304 STR_RSA_set0_key = 0x540,
+ 305 STR_RSA_sign = 0x8f8,
+
+
+ 308 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
+ 309 STR_WAYLAND_DISPLAY = 0x158,
+ 310 STR_errno_location = 0x878,
+ 311 STR_libc_stack_end = 0x2b0,
+ 312 STR_libc_start_main = 0x228,
+ 313 STR_dl_audit_preinit = 0xa60,
+ 314 STR_dl_audit_symbind_alt = 0x9c8,
+
+
+ 317 STR_rtld_global = 0x5b8,
+ 318 STR_rtld_global_ro = 0xa98,
+ 319 STR_auth_root_allowed = 0xb8,
+ 320 STR_authenticating = 0x1d8,
+ 321 STR_demote_sensitive_data = 0x28,
+
+ 323 STR_ld_linux_x86_64_so = 0xa48,
+
+ 325 STR_libcrypto_so = 0x7c0,
+ 326 STR_liblzma_so = 0x590,
+ 327 STR_libsystemd_so = 0x938,
+ 328 STR_list_hostkey_types = 0x20,
+ 329 STR_malloc_usable_size = 0x440,
+ 330 STR_mm_answer_authpassword = 0xc0,
+ 331 STR_mm_answer_keyallowed = 0xc8,
+ 332 STR_mm_answer_keyverify = 0xd0,
+ 333 STR_mm_answer_pam_start = 0x948,
+ 334 STR_mm_choose_dh = 0x78,
+ 335 STR_mm_do_pam_account = 0x40,
+ 336 STR_mm_getpwnamallow = 0x50,
+ 337 STR_mm_log_handler = 0xa8,
+ 338 STR_mm_pty_allocate = 0x38,
+ 339 STR_mm_request_send = 0xa0,
+ 340 STR_mm_session_pty_cleanup2 = 0x48,
+ 341 STR_mm_sshpam_free_ctx = 0x70,
+ 342 STR_mm_sshpam_init_ctx = 0x58,
+ 343 STR_mm_sshpam_query = 0x60,
+ 344 STR_mm_sshpam_respond = 0x68,
+ 345 STR_mm_terminate = 0x30,
+ 346 STR_parse_PAM = 0xc58,
+ 347 STR_password = 0x400,
+
+
+ 350 STR_publickey = 0x7b8,
+
+ 352 STR_rsa_sha2_256 = 0x710,
+ 353 STR_setlogmask = 0x428,
+ 354 STR_setresgid = 0x5f0,
+ 355 STR_setresuid = 0xab8,
+ 356 STR_shutdown = 0x760,
+
+ 358 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
+ 359 STR_sshpam_auth_passwd = 0x88,
+ 360 STR_sshpam_query = 0x90,
+ 361 STR_sshpam_respond = 0x80,
+ 362 STR_start_pam = 0x98,
+
+
+
+
+ 367 STR_xcalloc_zero_size = 0x10,
+ 368 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 398 struct sshbuf *sk_key_handle;
- 399 struct sshbuf *sk_reserved;
-
- 401 struct sshkey_cert *cert;
-
- 403 u8 *shielded_private;
-
-
- 406 size_t shield_prekey_len;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 450 u64 instruction_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 477 assert_offset(
dasm_ctx_t, instruction_size, 8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 556 Elf64_Versym *versym;
- 557 Elf64_Rela *rela_relocs;
-
-
- 560 Elf64_Relr *relr_relocs;
-
-
-
-
-
- 574 u64 rodata_segment_start;
- 575 u64 rodata_segment_size;
- 576 u64 data_segment_start;
- 577 u64 data_segment_size;
- 578 u64 data_segment_alignment;
-
-
-
-
-
- 590 u32 gnu_hash_bloom_shift;
-
-
- 593 u32 *gnu_hash_buckets;
-
-
-
-
-
-
-
-
- 602 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
-
-
-
- 606 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
- 607 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
- 608 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
- 609 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
-
-
-
-
- 614 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
-
- 616 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
- 617 assert_offset(
elf_info_t, code_segment_start, 0x98);
- 618 assert_offset(
elf_info_t, code_segment_size, 0xA0);
- 619 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
- 620 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
- 621 assert_offset(
elf_info_t, data_segment_start, 0xB8);
- 622 assert_offset(
elf_info_t, data_segment_size, 0xC0);
- 623 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
-
- 625 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
- 626 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
- 627 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
- 628 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
- 629 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
- 630 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
-
-
-
- 634 u32 resolved_imports_count;
-
- 636 size_t (*malloc_usable_size)(
void *ptr);
- 637 uid_t (*getuid)(void);
- 638 void (*exit)(
int status);
- 639 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
- 640 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
- 641 int (*system)(
const char *command);
- 642 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
-
- 644 int nfds, fd_set *readfds, fd_set *writefds,
- 645 fd_set *exceptfds,
const struct timespec *timeout,
- 646 const sigset_t *sigmask);
- 647 ssize_t (*read)(
int fd,
void *buf,
size_t count);
- 648 int *(*__errno_location)(void);
- 649 int (*setlogmask)(
int mask);
- 650 int (*shutdown)(
int sockfd,
int how);
- 651 void *__libc_stack_end;
-
+
+ 373 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
+ 375 #define assert_offset(t, f, o)
+
+
+ 378 #define CONCAT(x, y) x ## y
+ 379 #define EXPAND(x, y) CONCAT(x, y)
+ 380 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
+
+
+
+ 388 struct sshkey **host_keys;
+ 389 struct sshkey **host_pubkeys;
+ 390 struct sshkey **host_certificates;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 420 struct sshbuf *sk_key_handle;
+ 421 struct sshbuf *sk_reserved;
+
+ 423 struct sshkey_cert *cert;
+
+ 425 u8 *shielded_private;
+
+
+ 428 size_t shield_prekey_len;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 472 u64 instruction_size;
+
+ 474 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 487 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 499 struct __attribute__((packed)) {
+
+ 501 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 516 u64 operand_zeroextended;
+
+
+
+
+
+
+ 523 assert_offset(
dasm_ctx_t, instruction_size, 8);
+
+
+ 526 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 545 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
+ 546 assert_offset(
dasm_ctx_t, operand_size, 0x48);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 613 Elf64_Versym *versym;
+ 614 Elf64_Rela *rela_relocs;
+
+
+ 617 Elf64_Relr *relr_relocs;
+
+
+
+
+
+ 631 u64 rodata_segment_start;
+ 632 u64 rodata_segment_size;
+ 633 u64 data_segment_start;
+ 634 u64 data_segment_size;
+ 635 u64 data_segment_alignment;
+
+
+
+
+
+ 647 u32 gnu_hash_bloom_shift;
+
+
+ 650 u32 *gnu_hash_buckets;
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 669 typedef int (*pfn_RSA_public_decrypt_t)(
- 670 int flen,
unsigned char *from,
unsigned char *to,
- 671 RSA *rsa,
int padding);
- 672 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
- 673 typedef void (*pfn_RSA_get0_key_t)(
-
- 675 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
-
-
- 678 pfn_RSA_public_decrypt_t RSA_public_decrypt;
- 679 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
- 681 void (*RSA_get0_key_null)(
- 682 const RSA *r,
const BIGNUM **n,
- 683 const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 699 void (*DSA_get0_pqg)(
- 700 const DSA *d,
const BIGNUM **p,
- 701 const BIGNUM **q,
const BIGNUM **g);
- 702 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
- 703 size_t (*EC_POINT_point2oct)(
- 704 const EC_GROUP *group,
const EC_POINT *p,
- 705 point_conversion_form_t form,
unsigned char *buf,
- 706 size_t len, BN_CTX *ctx);
- 707 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
- 708 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
- 709 EVP_MD *(*EVP_sha256)(void);
- 710 pfn_RSA_get0_key_t RSA_get0_key;
- 711 int (*BN_num_bits)(
const BIGNUM *a);
- 712 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
- 714 const unsigned char *key,
size_t keylen);
- 715 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
- 716 int (*EVP_DigestVerifyInit)(
- 717 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
- 718 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
- 719 int (*EVP_DigestVerify)(
- 720 EVP_MD_CTX *ctx,
const unsigned char *sig,
- 721 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
- 722 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
- 723 void (*EVP_PKEY_free)(EVP_PKEY *key);
- 724 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
- 725 int (*EVP_DecryptInit_ex)(
- 726 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
- 727 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
- 728 int (*EVP_DecryptUpdate)(
- 729 EVP_CIPHER_CTX *ctx,
unsigned char *out,
- 730 int *outl,
const unsigned char *in,
int inl);
- 731 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
- 732 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
- 733 const EVP_CIPHER *(*EVP_chacha20)(void);
- 734 RSA *(*RSA_new)(void);
- 735 BIGNUM *(*BN_dup)(
const BIGNUM *from);
- 736 BIGNUM (*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
- 737 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
- 739 const void *data,
size_t count,
unsigned char *md,
- 740 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
-
-
- 743 const unsigned char *m,
unsigned int m_len,
- 744 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
- 745 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
- 746 void (*RSA_free)(RSA *rsa);
- 747 void (*BN_free)(BIGNUM *a);
-
- 749 u64 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 793 PADDING(
sizeof(
void *));
- 794 void *mm_answer_authpassword_start;
- 795 void *mm_answer_authpassword_end;
- 796 void *monitor_req_authpassword;
- 797 PADDING(
sizeof(
void *));
- 798 void *mm_answer_keyallowed_start;
- 799 void *mm_answer_keyallowed_end;
- 800 void *monitor_req_keyallowed_ptr;
- 801 PADDING(
sizeof(
void *));
- 802 void *mm_answer_keyverify_start;
- 803 void *mm_answer_keyverify_end;
- 804 void *monitor_req_keyverify_ptr;
-
-
-
-
-
-
- 811 PADDING(
sizeof(
void *));
- 812 void *mm_request_send_start;
- 813 void *mm_request_send_end;
- 814 PADDING(
sizeof(u32));
- 815 PADDING(
sizeof(u32));
-
- 817 int *permit_root_login_ptr;
-
-
-
-
- 822 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 823 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 824 assert_offset(
sshd_ctx_t, monitor_req_authpassword, 0x38);
- 825 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 826 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 827 assert_offset(
sshd_ctx_t, monitor_req_keyallowed_ptr, 0x58);
- 828 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 829 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 830 assert_offset(
sshd_ctx_t, monitor_req_keyverify_ptr, 0x78);
- 831 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
-
- 833 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
- 834 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
-
- 836 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 837 assert_offset(
sshd_ctx_t, STR_password, 0xD0);
- 838 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
-
-
- 844 char *STR_Connection_closed_by;
-
- 846 char *STR_authenticating;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+ 659 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
+
+
+
+ 663 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
+ 664 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
+ 665 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
+ 666 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
+
+
+
+
+ 671 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
+
+ 673 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
+ 674 assert_offset(
elf_info_t, code_segment_start, 0x98);
+ 675 assert_offset(
elf_info_t, code_segment_size, 0xA0);
+ 676 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
+ 677 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
+ 678 assert_offset(
elf_info_t, data_segment_start, 0xB8);
+ 679 assert_offset(
elf_info_t, data_segment_size, 0xC0);
+ 680 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
+
+ 682 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
+ 683 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
+ 684 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
+ 685 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
+ 686 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
+ 687 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
+
+
+
+ 691 u32 resolved_imports_count;
+
+ 693 size_t (*malloc_usable_size)(
void *ptr);
+ 694 uid_t (*getuid)(void);
+ 695 void (*exit)(
int status);
+ 696 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+ 697 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+ 698 int (*system)(
const char *command);
+ 699 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
+
+ 701 int nfds, fd_set *readfds, fd_set *writefds,
+ 702 fd_set *exceptfds,
const struct timespec *timeout,
+ 703 const sigset_t *sigmask);
+ 704 ssize_t (*read)(
int fd,
void *buf,
size_t count);
+ 705 int *(*__errno_location)(void);
+ 706 int (*setlogmask)(
int mask);
+ 707 int (*shutdown)(
int sockfd,
int how);
+ 708 void *__libc_stack_end;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 726 typedef int (*pfn_RSA_public_decrypt_t)(
+ 727 int flen,
unsigned char *from,
unsigned char *to,
+ 728 RSA *rsa,
int padding);
+ 729 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
+ 730 typedef void (*pfn_RSA_get0_key_t)(
+
+ 732 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
+
+
+ 735 pfn_RSA_public_decrypt_t RSA_public_decrypt;
+ 736 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
+ 738 void (*RSA_get0_key_null)(
+ 739 const RSA *r,
const BIGNUM **n,
+ 740 const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 756 void (*DSA_get0_pqg)(
+ 757 const DSA *d,
const BIGNUM **p,
+ 758 const BIGNUM **q,
const BIGNUM **g);
+ 759 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
+ 760 size_t (*EC_POINT_point2oct)(
+ 761 const EC_GROUP *group,
const EC_POINT *p,
+ 762 point_conversion_form_t form,
unsigned char *buf,
+ 763 size_t len, BN_CTX *ctx);
+ 764 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
+ 765 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
+ 766 EVP_MD *(*EVP_sha256)(void);
+ 767 pfn_RSA_get0_key_t RSA_get0_key;
+ 768 int (*BN_num_bits)(
const BIGNUM *a);
+ 769 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
+ 771 const unsigned char *key,
size_t keylen);
+ 772 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+ 773 int (*EVP_DigestVerifyInit)(
+ 774 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+ 775 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+ 776 int (*EVP_DigestVerify)(
+ 777 EVP_MD_CTX *ctx,
const unsigned char *sig,
+ 778 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
+ 779 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+ 780 void (*EVP_PKEY_free)(EVP_PKEY *key);
+ 781 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+ 782 int (*EVP_DecryptInit_ex)(
+ 783 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
+ 784 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
+ 785 int (*EVP_DecryptUpdate)(
+ 786 EVP_CIPHER_CTX *ctx,
unsigned char *out,
+ 787 int *outl,
const unsigned char *in,
int inl);
+ 788 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
+ 789 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+ 790 const EVP_CIPHER *(*EVP_chacha20)(void);
+ 791 RSA *(*RSA_new)(void);
+ 792 BIGNUM *(*BN_dup)(
const BIGNUM *from);
+ 793 BIGNUM (*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
+ 794 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+ 796 const void *data,
size_t count,
unsigned char *md,
+ 797 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
+
+
+ 800 const unsigned char *m,
unsigned int m_len,
+ 801 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
+ 802 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
+ 803 void (*RSA_free)(RSA *rsa);
+ 804 void (*BN_free)(BIGNUM *a);
+
+ 806 u64 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 849 BOOL have_mm_answer_keyallowed;
+ 850 BOOL have_mm_answer_authpassword;
+ 851 BOOL have_mm_answer_keyverify;
+
+ 853 PADDING(
sizeof(
void *));
+ 854 void *mm_answer_authpassword_start;
+ 855 void *mm_answer_authpassword_end;
+ 856 void *monitor_req_authpassword;
+ 857 PADDING(
sizeof(
void *));
+ 858 void *mm_answer_keyallowed_start;
+ 859 void *mm_answer_keyallowed_end;
+ 860 void *monitor_req_keyallowed_ptr;
+ 861 PADDING(
sizeof(
void *));
+ 862 void *mm_answer_keyverify_start;
+ 863 void *mm_answer_keyverify_end;
+ 864 void *monitor_req_keyverify_ptr;
+
+
+
+
+
+
+ 871 PADDING(
sizeof(
void *));
+ 872 void *mm_request_send_start;
+ 873 void *mm_request_send_end;
+ 874 PADDING(
sizeof(u32));
+ 875 PADDING(
sizeof(u32));
+
+ 877 int *permit_root_login_ptr;
+
+
+
+
+ 882 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 883 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 884 assert_offset(
sshd_ctx_t, monitor_req_authpassword, 0x38);
+ 885 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 886 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 887 assert_offset(
sshd_ctx_t, monitor_req_keyallowed_ptr, 0x58);
+ 888 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 889 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 890 assert_offset(
sshd_ctx_t, monitor_req_keyverify_ptr, 0x78);
+ 891 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
+
+ 893 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
+ 894 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
+
+ 896 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 897 assert_offset(
sshd_ctx_t, STR_password, 0xD0);
+ 898 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
+
+
+
+
+
+ 904 char *STR_Connection_closed_by;
+
+ 906 char *STR_authenticating;
+
+
-
-
-
-
- 934 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 960 PADDING(
sizeof(
void*));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1064 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
- 1074 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1080 pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
- 1085 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1087 u64 hooks_installed;
-
-
- 1090 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1091 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1092 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1093 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1094 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1095 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1096 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1097 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1098 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1100 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1101 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1102 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
- 1103 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
- 1104 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1105 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1107 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1130 uintptr_t (*symbind64)(
- 1131 Elf64_Sym *sym,
unsigned int ndx,
- 1132 uptr *refcook, uptr *defcook,
- 1133 unsigned int flags,
const char *symname);
- 1134 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1135 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1140 PADDING(
sizeof(
void *));
- 1141 PADDING(
sizeof(
void *));
-
-
- 1150 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1203 Elf64_Ehdr *dynamic_linker_ehdr;
- 1204 void **__libc_stack_end;
-
-
-
- 1208 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 994 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1020 PADDING(
sizeof(
void*));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1124 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+ 1134 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1140 pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
+ 1145 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1147 u64 hooks_installed;
+
+
+ 1150 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1151 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1152 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1153 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1154 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1155 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1156 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1157 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1158 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1160 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1161 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1162 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+ 1163 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+ 1164 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1165 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1167 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1190 uintptr_t (*symbind64)(
+ 1191 Elf64_Sym *sym,
unsigned int ndx,
+ 1192 uptr *refcook, uptr *defcook,
+ 1193 unsigned int flags,
const char *symname);
+ 1194 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1195 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1200 PADDING(
sizeof(
void *));
+ 1201 PADDING(
sizeof(
void *));
+
+
+ 1210 PADDING(
sizeof(
void *));
+
-
-
-
-
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
- 1272 struct link_map *liblzma_map;
- 1273 struct link_map *libcrypto_map;
- 1274 struct link_map *libsystemd_map;
- 1275 struct link_map *libc_map;
-
-
-
-
+
+
+
+
+
+
+
+
+ 1263 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1264 void **__libc_stack_end;
+
+
+
+ 1268 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1408 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1332 struct link_map *liblzma_map;
+ 1333 struct link_map *libcrypto_map;
+ 1334 struct link_map *libsystemd_map;
+ 1335 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
- 1478 u8 decrypted_secret_data[57];
-
-
-
-
-
-
- 1485 assert_offset(
key_ctx_t, payload, 0x15);
- 1486 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1534 PADDING(
sizeof(u64));
-
- 1541 PADDING(
sizeof(u64));
- 1542 PADDING(
sizeof(u64));
-
- 1549 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
-
-
- 1564 PADDING(
sizeof(u64));
- 1565 lzma_allocator allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1595 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1692 BOOL is_64bit_operand,
-
-
-
+ 1468 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1538 u8 decrypted_secret_data[57];
+
+
+
+
+
+
+ 1545 assert_offset(
key_ctx_t, payload, 0x15);
+ 1546 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1594 PADDING(
sizeof(u64));
+
+ 1601 PADDING(
sizeof(u64));
+ 1602 PADDING(
sizeof(u64));
+
+ 1609 PADDING(
sizeof(u64));
+
+
+
+
+
+
+
+
+
+ 1624 PADDING(
sizeof(u64));
+ 1625 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1655 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
- 1715 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1781 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1835 FuncFindType find_mode);
-
-
-
-
-
-
-
- 1873 extern char *check_argument(
char arg_first_char,
char* arg_name);
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1752 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 1775 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1841 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1895 FuncFindType find_mode);
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
- 1986 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2020 StringXrefId xref_id,
- 2021 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
- 2024 BOOL *pCheckPrologue);
-
-
-
- 2040 EncodedStringId *stringId_inOut,
- 2041 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2111 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2125 unsigned operation_index,
- 2126 unsigned shift_count,
- 2127 int flags, u8 *code);
-
-
-
-
- 2142 unsigned shift_count,
unsigned operation_index);
-
-
- 2187 u8 *call_site, u8 *code,
-
- 2189 unsigned shift_count,
unsigned operation_index);
-
-
-
- 2204 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2316 struct link_map *libc,
-
-
-
+ 1933 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2046 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2080 StringXrefId xref_id,
+ 2081 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+ 2084 BOOL *pCheckPrologue);
+
+
+
+ 2100 EncodedStringId *stringId_inOut,
+ 2101 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2171 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2185 unsigned operation_index,
+ 2186 unsigned shift_count,
+ 2187 int flags, u8 *code);
+
+
+
+
+ 2202 unsigned shift_count,
unsigned operation_index);
+
+
+ 2247 u8 *call_site, u8 *code,
+
+ 2249 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2264 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2393 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 2434 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 2447 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
- 2504 uptr *refcook, uptr *defcook,
-
- 2506 const char *symname);
-
-
-
-
-
- 2537 ptrdiff_t *libname_offset,
-
-
-
-
-
- 2565 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 2612 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2655 void **host_keys_out);
-
-
-
-
-
-
- 2676 void **host_keys_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2746 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+ 2376 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2453 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 2494 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 2507 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+ 2564 uptr *refcook, uptr *defcook,
+
+ 2566 const char *symname);
+
+
+
+
+
+ 2597 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 2625 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 2672 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2715 void **host_keys_out);
+
+
+
+
+
+
+ 2736 void **host_keys_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
- 2808 static_assert(
sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1506
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1494
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1500
data passed to functions that access the backdoor data
Definition: xzre.h:1216
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1261
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1306
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1311
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1266
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1296
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1301
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1292
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1286
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1316
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1271
2806 u8 *buffer, u64 bufferSize,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2878 u64 sshkey_digest_offset,
+ 2879 u64 signed_data_size,
+
+
+
+
+
+
+
+
+
+ 2895 static_assert(
sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1566
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1554
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1560
data passed to functions that access the backdoor data
Definition: xzre.h:1276
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1321
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1366
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1371
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1326
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1356
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1361
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1352
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1346
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1376
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1331
PADDING(sizeof(void *))
set to addess of symbol .Llzma12_mode_map_part_1
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1348
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1353
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1343
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1520
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1526
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:414
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:418
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:425
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:434
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:429
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:438
array of ELF handles
Definition: xzre.h:1178
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1189
elf_info_t * main
this is for sshd
Definition: xzre.h:1183
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:572
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:501
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:547
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:551
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:589
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:513
char * strtab
pointer to the ELF string table
Definition: xzre.h:521
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:505
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:585
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:497
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:509
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:529
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:539
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:567
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:555
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:543
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:525
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:517
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:533
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:923
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:871
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:879
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:891
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:867
void * sshd_data_start
sshd data segment end
Definition: xzre.h:904
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:887
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:938
void * sshd_code_start
sshd code segment start
Definition: xzre.h:896
void * sshd_data_end
sshd data segment start
Definition: xzre.h:908
void * sshd_code_end
sshd code segment end
Definition: xzre.h:900
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:916
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:688
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:698
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:693
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1600
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1589
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1579
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1584
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1594
the payload header. also used as Chacha IV
Definition: xzre.h:1388
the contents of the RSA 'n' field
Definition: xzre.h:1403
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1000
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:989
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:984
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1021
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1040
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1005
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1057
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1069
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1031
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1014
struct sensitive_data from openssh-portable
Definition: xzre.h:365
struct sshkey from openssh-portable
Definition: xzre.h:376
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1233
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1228
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1241
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1237
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1372
u32 index
Definition: xzre.h:1374
u32 byte_index
Definition: xzre.h:1379
u32 bit_index
Definition: xzre.h:1377
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1408
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1413
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1403
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1580
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1586
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:436
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:440
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:447
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:456
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:451
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:460
array of ELF handles
Definition: xzre.h:1238
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1249
elf_info_t * main
this is for sshd
Definition: xzre.h:1243
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:629
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:558
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:604
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:608
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:646
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:570
char * strtab
pointer to the ELF string table
Definition: xzre.h:578
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:562
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:642
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:554
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:566
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:586
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:596
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:624
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:612
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:600
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:582
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:574
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:590
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:983
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:931
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:939
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:951
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:927
void * sshd_data_start
sshd data segment end
Definition: xzre.h:964
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:947
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:998
void * sshd_code_start
sshd code segment start
Definition: xzre.h:956
void * sshd_data_end
sshd data segment start
Definition: xzre.h:968
void * sshd_code_end
sshd code segment end
Definition: xzre.h:960
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:976
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:745
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:755
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:750
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1660
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1649
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1639
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1644
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1654
the payload header. also used as Chacha IV
Definition: xzre.h:1448
the contents of the RSA 'n' field
Definition: xzre.h:1463
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1060
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1049
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1044
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1081
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1100
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1065
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1117
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1129
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1091
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1074
struct sensitive_data from openssh-portable
Definition: xzre.h:387
struct sshkey from openssh-portable
Definition: xzre.h:398
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1293
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1288
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1301
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1297
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1432
u32 index
Definition: xzre.h:1434
u32 byte_index
Definition: xzre.h:1439
u32 bit_index
Definition: xzre.h:1437
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
BOOL process_is_sshd(elf_info_t *elf, u8 *stack_end)
checks if the current process is sshd by inspecting argv and envp.
void * elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Looks up an ELF symbol from a parsed ELF, and returns its memory address.
BOOL verify_signature(struct sshkey *sshkey, u8 *signed_data, u64 sshkey_digest_offset, u64 signed_data_size, u8 *signature, u8 *ed448_raw_key, global_context_t *global_ctx)
Checks if signed_data is signed with ed448_raw_key.
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
BOOL dsa_key_hash(const DSA *dsa, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs)
obtains a SHA256 hash of the supplied RSA key
BOOL find_link_map_l_name(backdoor_data_handle_t *data_handle, ptrdiff_t *libname_offset, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find struct link_map offsets required to modify ld.so's private struct auditstate state.
backdoor_hooks_data_t * hooks_data_addr
location of backdoor_hooks_data_t
BOOL sha256(const void *data, size_t count, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs)
computes the SHA256 hash of the supplied data
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
ElfId
Definition: xzre.h:190
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:195
CommandFlags2
Definition: xzre.h:1432
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1442
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1452
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1437
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1447
ElfId
Definition: xzre.h:212
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:217
CommandFlags2
Definition: xzre.h:1492
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1502
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1512
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1497
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1507
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
BOOL sshd_get_host_keys_address_via_xcalloc(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, string_references_t *string_refs, void **host_keys_out)
finds the address of sensitive_data.host_keys in sshd by using XREF_xcalloc_zero_size in xcalloc
BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part)
Checks if the code between code_start and code_end is an endbr64 instruction.
void fake_lzma_free(void *opaque, void *ptr)
a fake free function called by lzma_free()
void * elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize)
Obtains the address and size of the last readonly segment in the given ELF file this corresponds to t...
CommandFlags1
Definition: xzre.h:1413
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1421
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1429
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1425
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1417
CommandFlags1
Definition: xzre.h:1473
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1481
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1489
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1485
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1477
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
EncodedStringId get_string_id(const char *string_begin, const char *string_end)
Get the.
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
int sshd_get_host_keys_score_in_main(void *host_keys, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if main accesses host_keys or not
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1211
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1271
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode)
locates the function prologue