From 73dfa5d5dc375e9b6d3363ddae58088a06b6a29a Mon Sep 17 00:00:00 2001 From: smx-smx Date: Sat, 6 Apr 2024 19:02:26 +0000 Subject: [PATCH] =?UTF-8?q?Deploying=20to=20gh-pages=20from=20@=20smx-smx/?= =?UTF-8?q?xzre@2280a4962ceb0586b7b5809425d30214c75d388d=20=F0=9F=9A=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- annotated.html | 24 +- classes.html | 2 +- globals.html | 38 +- globals_func.html | 38 +- menudata.js | 20 +- search/all_0.js | 12 +- search/all_1.js | 12 +- search/all_2.js | 6 +- search/all_3.js | 34 +- search/all_4.js | 20 +- search/all_5.js | 18 +- search/all_6.js | 8 +- search/all_7.js | 10 +- search/all_8.js | 10 +- search/all_9.js | 6 +- search/all_a.js | 22 +- search/all_b.js | 4 +- search/all_c.js | 6 +- search/classes_0.js | 8 +- search/classes_1.js | 2 +- search/classes_2.js | 6 +- search/classes_3.js | 2 +- search/classes_4.js | 2 +- search/classes_5.js | 2 +- search/classes_6.js | 4 +- search/files_0.js | 2 +- search/functions_0.js | 2 +- search/functions_1.js | 24 +- search/functions_2.js | 18 +- search/functions_3.js | 2 +- search/functions_4.js | 4 +- search/functions_5.js | 2 +- search/functions_6.js | 8 +- search/functions_7.js | 2 +- search/pages_0.js | 2 +- search/variables_0.js | 6 +- search/variables_1.js | 12 +- search/variables_2.js | 4 +- search/variables_3.js | 4 +- search/variables_4.js | 2 +- search/variables_5.js | 14 +- search/variables_6.js | 6 +- search/variables_7.js | 10 +- search/variables_8.js | 6 +- search/variables_9.js | 4 +- search/variables_a.js | 10 +- search/variables_b.js | 4 +- structbackdoor__libraries__t.html | 105 +++ ...tbackdoor__shared__libraries__data__t.html | 108 +++ structimported__funcs__t.html | 18 +- xzre_8h.html | 123 +++- xzre_8h_source.html | 663 ++++++++++-------- 52 files changed, 976 insertions(+), 505 deletions(-) create mode 100644 structbackdoor__libraries__t.html create mode 100644 structbackdoor__shared__libraries__data__t.html diff --git a/annotated.html b/annotated.html index 56629af..aa9ae8a 100644 --- a/annotated.html +++ b/annotated.html @@ -68,17 +68,19 @@
Here are the data structures with brief descriptions:
- - - - - - - - - - - + + + + + + + + + + + + +
 Cbackdoor_data_tThis structure is used to hold most of the backdoor information. it's used as a local variable in function backdoor_setup
 Cbackdoor_setup_params_t
 Cbackdoor_shared_globals_t
 Cdasm_ctx_t
 Celf_entry_ctx_t
 Celf_info
 Celf_lib_info_t
 Cglobal_context_t
 Cimported_funcs_t
 Clibc_imports
 Csecret_data_shift_cursorShift register, which will shift a '1' into the secret data array. the low 3 bits represent the bit index, while the rest represents the byte index this is convenient, since a simple increment will increment the buffer position correctly
 Csystem_imports_t
 Cbackdoor_libraries_t
 Cbackdoor_setup_params_t
 Cbackdoor_shared_globals_t
 Cbackdoor_shared_libraries_data_t
 Cdasm_ctx_t
 Celf_entry_ctx_t
 Celf_info
 Celf_lib_info_t
 Cglobal_context_t
 Cimported_funcs_t
 Clibc_imports
 Csecret_data_shift_cursorShift register, which will shift a '1' into the secret data array. the low 3 bits represent the bit index, while the rest represents the byte index this is convenient, since a simple increment will increment the buffer position correctly
 Csystem_imports_t
diff --git a/classes.html b/classes.html index a886df2..532bd61 100644 --- a/classes.html +++ b/classes.html @@ -69,7 +69,7 @@
B
-
backdoor_data_t
backdoor_setup_params_t
backdoor_shared_globals_t
+
backdoor_data_t
backdoor_libraries_t
backdoor_setup_params_t
backdoor_shared_globals_t
backdoor_shared_libraries_data_t
D
dasm_ctx_t
diff --git a/globals.html b/globals.html index 2767029..1f96d69 100644 --- a/globals.html +++ b/globals.html @@ -61,10 +61,16 @@
-
Here is a list of all documented functions, variables, defines, enums, and typedefs with links to the documentation:
- 
+ +

scans loaded libraries to identify interesting libraries

+
Parameters
+ + +
datainput data for the function (will be duplicated, internally)
+
+
+
Returns
BOOL TRUE if successful, FALSE otherwise
+ +
+ + +

◆ process_shared_libraries_map()

+ +
+
+ + + + + + + + + + + + + + + + + + +
BOOL process_shared_libraries_map (struct link_map * r_map,
backdoor_shared_libraries_data_t * data 
)
+
+ +

scans loaded libraries to identify interesting libraries and populate related data

+
Parameters
+ + + +
r_mapthe linked list of loaded libraries obtained from r_debug
datapointer to data that will be populated by the function
+
+
+
Returns
BOOL TRUE if successful, FALSE otherwise
+
diff --git a/xzre_8h_source.html b/xzre_8h_source.html index a66b2cd..c0372b4 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -337,310 +337,351 @@
359 assert_offset(system_imports_t, setlogmask, 0x58);
360 assert_offset(system_imports_t, shutdown, 0x60);
361 
-
362 typedef struct __attribute__((packed)) {
-
363  int (*RSA_public_decrypt)(
-
364  int flen, unsigned char *from,
-
365  unsigned char *to, RSA *rsa, int padding);
-
366  int (*EVP_PKEY_set1_RSA_null)(EVP_PKEY *pkey, struct rsa_st *key);
-
367  void (*RSA_get0_key_null)(
-
368  const RSA *r, const BIGNUM **n,
-
369  const BIGNUM **e, const BIGNUM **d);
-
370  void *RSA_public_decrypt_hook_ptr;
-
371  void *EVP_PKEY_set1_RSA_hook_ptr_null;
-
372  void *RSA_get0_key_hook_ptr_null;
-
373  void (*DSA_get0_pqg)(
-
374  const DSA *d, const BIGNUM **p,
-
375  const BIGNUM **q, const BIGNUM **g);
-
376  const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
-
377  size_t (*EC_POINT_point2oct)(
-
378  const EC_GROUP *group, const EC_POINT *p,
-
379  point_conversion_form_t form, unsigned char *buf,
-
380  size_t len, BN_CTX *ctx);
-
381  EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
-
382  const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
-
383  EVP_MD *(*EVP_sha256)(void);
-
384  void (*RSA_get0_key)(
-
385  const RSA *r,
-
386  const BIGNUM **n,
-
387  const BIGNUM **e,
-
388  const BIGNUM **d);
-
389  int (*BN_num_bits)(const BIGNUM *a);
-
390  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
391  int type, ENGINE *e,
-
392  const unsigned char *key, size_t keylen);
-
393  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
-
394  int (*EVP_DigestVerifyInit)(
-
395  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
-
396  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
-
397  int (*EVP_DigestVerify)(
-
398  EVP_MD_CTX *ctx, const unsigned char *sig,
-
399  size_t siglen, const unsigned char *tbs, size_t tbslen);
-
400  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
-
401  void (*EVP_PKEY_free)(EVP_PKEY *key);
-
402  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
-
403  int (*EVP_DecryptInit_ex)(
-
404  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
-
405  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
-
406  int (*EVP_DecryptUpdate)(
-
407  EVP_CIPHER_CTX *ctx, unsigned char *out,
-
408  int *outl, const unsigned char *in, int inl);
-
409  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
-
410  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
-
411  EVP_CIPHER *(*EVP_chacha20)(void);
-
412  RSA *(*RSA_new)(void);
-
413  BIGNUM *(*BN_dup)(const BIGNUM *from);
-
414  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
-
415  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
416  PADDING(8);
-
417  int (*RSA_sign)(
-
418  int type,
-
419  const unsigned char *m, unsigned int m_len,
-
420  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
-
421  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
-
422  void (*RSA_free)(RSA *rsa);
-
423  void (*BN_free)(BIGNUM *a);
-
424  system_imports_t *system;
-
425  u32 resolved_imports_count;
-
426 } imported_funcs_t;
-
427 
-
428 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
-
429 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_null, 8);
-
430 assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
-
431 assert_offset(imported_funcs_t, RSA_public_decrypt_hook_ptr, 0x18);
-
432 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_hook_ptr_null, 0x20);
-
433 assert_offset(imported_funcs_t, RSA_get0_key_hook_ptr_null, 0x28);
-
434 assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
-
435 assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
-
436 assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
-
437 assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
-
438 assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
-
439 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
-
440 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
-
441 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
-
442 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
-
443 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
-
444 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
-
445 assert_offset(imported_funcs_t, EVP_DigestVerify, 0x88);
-
446 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
-
447 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
-
448 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
-
449 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
-
450 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
-
451 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
-
452 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
-
453 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
-
454 assert_offset(imported_funcs_t, RSA_new, 0xD0);
-
455 assert_offset(imported_funcs_t, BN_dup, 0xD8);
-
456 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
-
457 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
-
458 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
-
459 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
-
460 assert_offset(imported_funcs_t, RSA_free, 0x108);
-
461 assert_offset(imported_funcs_t, BN_free, 0x110);
-
462 assert_offset(imported_funcs_t, system, 0x118);
-
463 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
-
464 
-
465 typedef struct __attribute__((packed)) {
-
466  PADDING(8);
-
471  imported_funcs_t *imported_funcs;
-
472  PADDING(0x70);
-
478  u64 code_range_start;
-
484  u64 code_range_end;
-
485  PADDING(0x78);
-
490  u8 secret_data[57];
-
496  u8 shift_operations[31];
-
502  u32 reg2reg_instructions_count;
-
503  PADDING(4);
-
504 } global_context_t;
-
505 
-
506 assert_offset(global_context_t, imported_funcs, 8);
-
507 assert_offset(global_context_t, code_range_start, 0x80);
-
508 assert_offset(global_context_t, code_range_end, 0x88);
-
509 assert_offset(global_context_t, secret_data, 0x108);
-
510 assert_offset(global_context_t, shift_operations, 0x141);
-
511 assert_offset(global_context_t, reg2reg_instructions_count, 0x160);
-
512 static_assert(sizeof(global_context_t) == 0x168);
-
513 
-
514 typedef struct __attribute__((packed)) {
-
515  elf_info_t *lib_elf_info;
-
516  elf_info_t *elf_info;
-
517 } elf_lib_info_t;
-
518 
-
519 assert_offset(elf_lib_info_t, lib_elf_info, 0);
-
520 assert_offset(elf_lib_info_t, elf_info, 8);
+
362 typedef int (*pfn_RSA_public_decrypt_t)(
+
363  int flen, unsigned char *from, unsigned char *to,
+
364  RSA *rsa, int padding);
+
365 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
+
366 typedef void (*pfn_RSA_get0_key_t)(
+
367  const RSA *r,
+
368  const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
+
369 
+
370 typedef struct __attribute__((packed)) {
+
371  pfn_RSA_public_decrypt_t RSA_public_decrypt;
+
372  pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
373  // ???
+
374  void (*RSA_get0_key_null)(
+
375  const RSA *r, const BIGNUM **n,
+
376  const BIGNUM **e, const BIGNUM **d);
+
377  void *RSA_public_decrypt_hook_ptr;
+
378  void *EVP_PKEY_set1_RSA_hook_ptr_null;
+
379  void *RSA_get0_key_hook_ptr_null;
+
380  void (*DSA_get0_pqg)(
+
381  const DSA *d, const BIGNUM **p,
+
382  const BIGNUM **q, const BIGNUM **g);
+
383  const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
+
384  size_t (*EC_POINT_point2oct)(
+
385  const EC_GROUP *group, const EC_POINT *p,
+
386  point_conversion_form_t form, unsigned char *buf,
+
387  size_t len, BN_CTX *ctx);
+
388  EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
+
389  const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
+
390  EVP_MD *(*EVP_sha256)(void);
+
391  pfn_RSA_get0_key_t RSA_get0_key;
+
392  int (*BN_num_bits)(const BIGNUM *a);
+
393  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
394  int type, ENGINE *e,
+
395  const unsigned char *key, size_t keylen);
+
396  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+
397  int (*EVP_DigestVerifyInit)(
+
398  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+
399  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+
400  int (*EVP_DigestVerify)(
+
401  EVP_MD_CTX *ctx, const unsigned char *sig,
+
402  size_t siglen, const unsigned char *tbs, size_t tbslen);
+
403  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+
404  void (*EVP_PKEY_free)(EVP_PKEY *key);
+
405  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+
406  int (*EVP_DecryptInit_ex)(
+
407  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+
408  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
+
409  int (*EVP_DecryptUpdate)(
+
410  EVP_CIPHER_CTX *ctx, unsigned char *out,
+
411  int *outl, const unsigned char *in, int inl);
+
412  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
+
413  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+
414  EVP_CIPHER *(*EVP_chacha20)(void);
+
415  RSA *(*RSA_new)(void);
+
416  BIGNUM *(*BN_dup)(const BIGNUM *from);
+
417  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
+
418  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
419  PADDING(8);
+
420  int (*RSA_sign)(
+
421  int type,
+
422  const unsigned char *m, unsigned int m_len,
+
423  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
424  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
+
425  void (*RSA_free)(RSA *rsa);
+
426  void (*BN_free)(BIGNUM *a);
+
427  system_imports_t *system;
+
428  u32 resolved_imports_count;
+
429 } imported_funcs_t;
+
430 
+
431 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
+
432 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA, 8);
+
433 assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
+
434 assert_offset(imported_funcs_t, RSA_public_decrypt_hook_ptr, 0x18);
+
435 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_hook_ptr_null, 0x20);
+
436 assert_offset(imported_funcs_t, RSA_get0_key_hook_ptr_null, 0x28);
+
437 assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
+
438 assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
+
439 assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
+
440 assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
+
441 assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
+
442 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
+
443 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
+
444 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
+
445 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
+
446 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
+
447 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
+
448 assert_offset(imported_funcs_t, EVP_DigestVerify, 0x88);
+
449 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
+
450 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
+
451 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
+
452 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
+
453 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
+
454 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
+
455 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
+
456 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
+
457 assert_offset(imported_funcs_t, RSA_new, 0xD0);
+
458 assert_offset(imported_funcs_t, BN_dup, 0xD8);
+
459 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
+
460 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
+
461 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
+
462 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
+
463 assert_offset(imported_funcs_t, RSA_free, 0x108);
+
464 assert_offset(imported_funcs_t, BN_free, 0x110);
+
465 assert_offset(imported_funcs_t, system, 0x118);
+
466 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
+
467 
+
468 typedef struct __attribute__((packed)) {
+
469  PADDING(8);
+
474  imported_funcs_t *imported_funcs;
+
475  PADDING(0x70);
+
481  u64 code_range_start;
+
487  u64 code_range_end;
+
488  PADDING(0x78);
+
493  u8 secret_data[57];
+
499  u8 shift_operations[31];
+
505  u32 reg2reg_instructions_count;
+
506  PADDING(4);
+
507 } global_context_t;
+
508 
+
509 assert_offset(global_context_t, imported_funcs, 8);
+
510 assert_offset(global_context_t, code_range_start, 0x80);
+
511 assert_offset(global_context_t, code_range_end, 0x88);
+
512 assert_offset(global_context_t, secret_data, 0x108);
+
513 assert_offset(global_context_t, shift_operations, 0x141);
+
514 assert_offset(global_context_t, reg2reg_instructions_count, 0x160);
+
515 static_assert(sizeof(global_context_t) == 0x168);
+
516 
+
517 typedef struct __attribute__((packed)) {
+
518  elf_info_t *lib_elf_info;
+
519  elf_info_t *elf_info;
+
520 } elf_lib_info_t;
521 
-
526 typedef struct __attribute__((packed)) {
-
527  PADDING(0x30);
-
528  PADDING(sizeof(elf_lib_info_t));
-
529 
-
533  elf_info_t *libc;
-
534  PADDING(sizeof(elf_info_t *));
-
538  elf_info_t *libcrypto;
-
539 
-
543  struct backdoor_data *backdoor_data;
-
544  PADDING(sizeof(elf_lib_info_t *));
-
545 
-
547  PADDING(sizeof(elf_info_t));
-
548  PADDING(sizeof(elf_info_t));
-
552  elf_info_t libc_info;
-
553  PADDING(sizeof(elf_info_t));
-
557  elf_info_t libcrypto_info;
-
558 
-
562  libc_imports_t libc_imports;
-
563 
-
564  PADDING(0x390);
-
568  lzma_allocator *import_resolver;
-
569 } backdoor_data_t;
-
570 
-
571 assert_offset(backdoor_data_t, libc, 0x40);
-
572 assert_offset(backdoor_data_t, libcrypto, 0x50);
-
573 assert_offset(backdoor_data_t, libc_info, 0x268);
-
574 assert_offset(backdoor_data_t, libcrypto_info, 0x468);
-
575 assert_offset(backdoor_data_t, libc_imports, 0x568);
-
576 assert_offset(backdoor_data_t, import_resolver, 0x950);
-
577 static_assert(sizeof(backdoor_data_t) == 0x958);
-
578 
-
585 typedef union {
-
587  u32 index;
-
588  struct {
-
590  u32 bit_index : 3;
-
592  u32 byte_index : 29;
-
593  };
-
594 } secret_data_shift_cursor;
-
595 
-
604 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
-
605 
-
615 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
-
616 
-
625 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
-
626 
-
636 extern BOOL find_instruction_with_mem_operand(
-
637  u8 *code_start,
-
638  u8 *code_end,
-
639  dasm_ctx_t *dctx,
-
640  void *mem_address
-
641 );
-
642 
-
652 extern BOOL find_lea_instruction_with_mem_operand(
-
653  u8 *code_start,
-
654  u8 *code_end,
-
655  dasm_ctx_t *dctx,
-
656  void *mem_address
-
657 );
-
658 
-
669 extern BOOL find_instruction_with_mem_operand_ex(
-
670  u8 *code_start,
-
671  u8 *code_end,
-
672  dasm_ctx_t *dctx,
-
673  int opcode,
-
674  void *mem_address
-
675 );
-
676 
-
685 extern u8 *find_string_reference(
-
686  u8 *code_start,
-
687  u8 *code_end,
-
688  const char *str
-
689 );
-
690 
-
700 extern u8 *elf_find_string_reference(
-
701  elf_info_t *elf_info,
-
702  u32 encoded_string_id,
-
703  u8 *code_start,
-
704  u8 *code_end
-
705 );
-
706 
-
726 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
-
727 
-
737 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
-
738 
-
752 extern BOOL find_function_prologue_ex(
-
753  u8 *code_start,
-
754  u8 *func_start_0,
-
755  u8 *func_start_1,
-
756  u8 *search_base,
-
757  u8 *code_end,
-
758  FuncFindType find_mode);
-
759 
-
770 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
-
771 
-
779 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
-
780 
-
789 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
-
790 
-
798 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
-
799 
-
807 extern void *elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
-
808 
-
817 extern void *elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize);
-
818 
-
832 extern void *elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment);
-
833 
-
845 extern void *elf_get_reloc_symbol(
-
846  elf_info_t *elf_info,
-
847  Elf64_Rela *relocs,
-
848  unsigned num_relocs,
-
849  unsigned reloc_type,
-
850  u32 encoded_string_id);
-
851 
-
859 extern void *elf_get_plt_symbol(elf_info_t *elf_info, u32 encoded_string_id);
-
860 
-
868 extern void *elf_get_got_symbol(elf_info_t *elf_info, u32 encoded_string_id);
-
869 
-
882 extern char *elf_find_string(
-
883  elf_info_t *elf_info,
-
884  u32 *stringId_inOut,
-
885  void *rodata_start_ptr);
+
522 assert_offset(elf_lib_info_t, lib_elf_info, 0);
+
523 assert_offset(elf_lib_info_t, elf_info, 8);
+
524 
+
529 typedef struct __attribute__((packed)) {
+
530  PADDING(0x30);
+
531  PADDING(sizeof(elf_lib_info_t));
+
532 
+
536  elf_info_t *libc;
+
537  PADDING(sizeof(elf_info_t *));
+
541  elf_info_t *libcrypto;
+
542 
+
546  struct backdoor_data *backdoor_data;
+
547  PADDING(sizeof(elf_lib_info_t *));
+
548 
+
550  PADDING(sizeof(elf_info_t));
+
551  PADDING(sizeof(elf_info_t));
+
555  elf_info_t libc_info;
+
556  PADDING(sizeof(elf_info_t));
+
560  elf_info_t libcrypto_info;
+
561 
+
565  libc_imports_t libc_imports;
+
566 
+
567  PADDING(0x390);
+
571  lzma_allocator *import_resolver;
+
572 } backdoor_data_t;
+
573 
+
574 assert_offset(backdoor_data_t, libc, 0x40);
+
575 assert_offset(backdoor_data_t, libcrypto, 0x50);
+
576 assert_offset(backdoor_data_t, libc_info, 0x268);
+
577 assert_offset(backdoor_data_t, libcrypto_info, 0x468);
+
578 assert_offset(backdoor_data_t, libc_imports, 0x568);
+
579 assert_offset(backdoor_data_t, import_resolver, 0x950);
+
580 static_assert(sizeof(backdoor_data_t) == 0x958);
+
581 
+
582 typedef struct __attribute__((packed)) {
+
583  PADDING(sizeof(struct link_map *));
+
584  struct link_map *dynamic_linker;
+
585  struct link_map *liblzma;
+
586  struct link_map *libcrypto;
+
587  struct link_map *libsystemd;
+
588  struct link_map *libc;
+
589 } backdoor_libraries_t;
+
590 
+
591 assert_offset(backdoor_libraries_t, dynamic_linker, 0x8);
+
592 assert_offset(backdoor_libraries_t, liblzma, 0x10);
+
593 assert_offset(backdoor_libraries_t, libcrypto, 0x18);
+
594 assert_offset(backdoor_libraries_t, libsystemd, 0x20);
+
595 assert_offset(backdoor_libraries_t, libc, 0x28);
+
596 
+
597 typedef struct __attribute__((packed)) {
+
598  backdoor_libraries_t *libs;
+
599  elf_lib_info_t *elf;
+
600  pfn_RSA_public_decrypt_t RSA_public_decrypt;
+
601  pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
602  pfn_RSA_get0_key_t RSA_get0_key;
+
603  PADDING(sizeof(void *));
+
604  libc_imports_t *libc_imports;
+
605 } backdoor_shared_libraries_data_t;
+
606 
+
607 assert_offset(backdoor_shared_libraries_data_t, libs, 0x0);
+
608 assert_offset(backdoor_shared_libraries_data_t, elf, 0x8);
+
609 assert_offset(backdoor_shared_libraries_data_t, RSA_public_decrypt, 0x10);
+
610 assert_offset(backdoor_shared_libraries_data_t, EVP_PKEY_set1_RSA, 0x18);
+
611 assert_offset(backdoor_shared_libraries_data_t, RSA_get0_key, 0x20);
+
612 assert_offset(backdoor_shared_libraries_data_t, libc_imports, 0x30);
+
613 
+
620 typedef union {
+
622  u32 index;
+
623  struct {
+
625  u32 bit_index : 3;
+
627  u32 byte_index : 29;
+
628  };
+
629 } secret_data_shift_cursor;
+
630 
+
639 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
+
640 
+
650 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
+
651 
+
660 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
+
661 
+
671 extern BOOL find_instruction_with_mem_operand(
+
672  u8 *code_start,
+
673  u8 *code_end,
+
674  dasm_ctx_t *dctx,
+
675  void *mem_address
+
676 );
+
677 
+
687 extern BOOL find_lea_instruction_with_mem_operand(
+
688  u8 *code_start,
+
689  u8 *code_end,
+
690  dasm_ctx_t *dctx,
+
691  void *mem_address
+
692 );
+
693 
+
704 extern BOOL find_instruction_with_mem_operand_ex(
+
705  u8 *code_start,
+
706  u8 *code_end,
+
707  dasm_ctx_t *dctx,
+
708  int opcode,
+
709  void *mem_address
+
710 );
+
711 
+
720 extern u8 *find_string_reference(
+
721  u8 *code_start,
+
722  u8 *code_end,
+
723  const char *str
+
724 );
+
725 
+
735 extern u8 *elf_find_string_reference(
+
736  elf_info_t *elf_info,
+
737  u32 encoded_string_id,
+
738  u8 *code_start,
+
739  u8 *code_end
+
740 );
+
741 
+
761 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
+
762 
+
772 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
+
773 
+
787 extern BOOL find_function_prologue_ex(
+
788  u8 *code_start,
+
789  u8 *func_start_0,
+
790  u8 *func_start_1,
+
791  u8 *search_base,
+
792  u8 *code_end,
+
793  FuncFindType find_mode);
+
794 
+
805 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
+
806 
+
814 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
+
815 
+
824 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
+
825 
+
833 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
+
834 
+
842 extern void *elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
+
843 
+
852 extern void *elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize);
+
853 
+
867 extern void *elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment);
+
868 
+
880 extern void *elf_get_reloc_symbol(
+
881  elf_info_t *elf_info,
+
882  Elf64_Rela *relocs,
+
883  unsigned num_relocs,
+
884  unsigned reloc_type,
+
885  u32 encoded_string_id);
886 
-
893 extern lzma_allocator *get_lzma_allocator();
-
894 
-
895 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor *cursor);
-
896 
-
909 extern BOOL secret_data_append_from_code(
-
910  void *code_start,
-
911  void *code_end,
-
912  secret_data_shift_cursor shift_cursor,
-
913  unsigned shift_count, BOOL start_from_call);
-
914 
-
925 extern BOOL secret_data_append_if_flags(
-
926  secret_data_shift_cursor shift_cursor,
-
927  unsigned operation_index,
-
928  unsigned shift_count,
-
929  int flags, u8 *code);
-
930 
-
973 extern BOOL secret_data_append_singleton(
-
974  u8 *call_site, u8 *code,
-
975  secret_data_shift_cursor shift_cursor,
-
976  unsigned shift_count, unsigned operation_index);
-
977 
-
989 extern BOOL secret_data_append_from_call_site(
-
990  secret_data_shift_cursor shift_cursor,
-
991  unsigned shift_count, unsigned operation_index,
-
992  BOOL bypass
-
993 );
-
994 
-
1001 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
-
1002 
-
1011 extern BOOL resolve_libc_imports(
-
1012  struct link_map *libc,
-
1013  elf_info_t *libc_info,
-
1014  libc_imports_t *imports
-
1015 );
-
1016 
-
1017 extern global_context_t *global_ctx;
-
1018 
-
1019 #include "util.h"
-
1020 #endif
-
backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:526
-
backdoor_data_t::libcrypto_info
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:557
-
backdoor_data_t::libc
elf_info_t * libc
points to libc_info
Definition: xzre.h:533
-
backdoor_data_t::import_resolver
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:568
-
backdoor_data_t::libc_imports
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:562
-
backdoor_data_t::libcrypto
elf_info_t * libcrypto
points to libcrypto_info
Definition: xzre.h:538
-
backdoor_data_t::backdoor_data
struct backdoor_data * backdoor_data
points to the beginning of this struct
Definition: xzre.h:543
-
backdoor_data_t::libc_info
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:552
+
894 extern void *elf_get_plt_symbol(elf_info_t *elf_info, u32 encoded_string_id);
+
895 
+
903 extern void *elf_get_got_symbol(elf_info_t *elf_info, u32 encoded_string_id);
+
904 
+
917 extern char *elf_find_string(
+
918  elf_info_t *elf_info,
+
919  u32 *stringId_inOut,
+
920  void *rodata_start_ptr);
+
921 
+
928 extern lzma_allocator *get_lzma_allocator();
+
929 
+
930 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor *cursor);
+
931 
+
944 extern BOOL secret_data_append_from_code(
+
945  void *code_start,
+
946  void *code_end,
+
947  secret_data_shift_cursor shift_cursor,
+
948  unsigned shift_count, BOOL start_from_call);
+
949 
+
960 extern BOOL secret_data_append_if_flags(
+
961  secret_data_shift_cursor shift_cursor,
+
962  unsigned operation_index,
+
963  unsigned shift_count,
+
964  int flags, u8 *code);
+
965 
+
1008 extern BOOL secret_data_append_singleton(
+
1009  u8 *call_site, u8 *code,
+
1010  secret_data_shift_cursor shift_cursor,
+
1011  unsigned shift_count, unsigned operation_index);
+
1012 
+
1024 extern BOOL secret_data_append_from_call_site(
+
1025  secret_data_shift_cursor shift_cursor,
+
1026  unsigned shift_count, unsigned operation_index,
+
1027  BOOL bypass
+
1028 );
+
1029 
+
1036 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
+
1037 
+
1046 extern BOOL resolve_libc_imports(
+
1047  struct link_map *libc,
+
1048  elf_info_t *libc_info,
+
1049  libc_imports_t *imports
+
1050 );
+
1051 
+
1058 extern BOOL process_shared_libraries(backdoor_shared_libraries_data_t *data);
+
1059 
+
1067 extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
+
1068 
+
1069 extern global_context_t *global_ctx;
+
1070 
+
1071 #include "util.h"
+
1072 #endif
+
backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:529
+
backdoor_data_t::libcrypto_info
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:560
+
backdoor_data_t::libc
elf_info_t * libc
points to libc_info
Definition: xzre.h:536
+
backdoor_data_t::import_resolver
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:571
+
backdoor_data_t::libc_imports
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:565
+
backdoor_data_t::libcrypto
elf_info_t * libcrypto
points to libcrypto_info
Definition: xzre.h:541
+
backdoor_data_t::backdoor_data
struct backdoor_data * backdoor_data
points to the beginning of this struct
Definition: xzre.h:546
+
backdoor_data_t::libc_info
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:555
backdoor_data_t::PADDING
PADDING(sizeof(elf_info_t))
+
backdoor_libraries_t
Definition: xzre.h:582
backdoor_setup_params_t
Definition: xzre.h:134
backdoor_shared_globals_t
Definition: xzre.h:127
+
backdoor_shared_libraries_data_t
Definition: xzre.h:597
dasm_ctx_t
Definition: xzre.h:145
elf_entry_ctx_t
Definition: xzre.h:88
elf_entry_ctx_t::return_address
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:104
@@ -669,24 +710,26 @@
elf_info::symtab
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:222
elf_info::dyn_num_entries
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:214
elf_info::plt_relocs_num
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:230
-
elf_lib_info_t
Definition: xzre.h:514
-
global_context_t
Definition: xzre.h:465
-
global_context_t::code_range_start
u64 code_range_start
the shifter will use this address as the minimum search address any instruction below this address wi...
Definition: xzre.h:478
-
global_context_t::imported_funcs
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL and system functions
Definition: xzre.h:471
-
global_context_t::reg2reg_instructions_count
u32 reg2reg_instructions_count
cumulative number of reg2reg instructions successfully validated by the data shifter
Definition: xzre.h:502
-
global_context_t::code_range_end
u64 code_range_end
the shifter will use this address as the maximum search address any instruction beyond this address w...
Definition: xzre.h:484
-
imported_funcs_t
Definition: xzre.h:362
+
elf_lib_info_t
Definition: xzre.h:517
+
global_context_t
Definition: xzre.h:468
+
global_context_t::code_range_start
u64 code_range_start
the shifter will use this address as the minimum search address any instruction below this address wi...
Definition: xzre.h:481
+
global_context_t::imported_funcs
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL and system functions
Definition: xzre.h:474
+
global_context_t::reg2reg_instructions_count
u32 reg2reg_instructions_count
cumulative number of reg2reg instructions successfully validated by the data shifter
Definition: xzre.h:505
+
global_context_t::code_range_end
u64 code_range_end
the shifter will use this address as the maximum search address any instruction beyond this address w...
Definition: xzre.h:487
+
imported_funcs_t
Definition: xzre.h:370
libc_imports
Definition: xzre.h:324
system_imports_t
Definition: xzre.h:331
-
secret_data_shift_cursor
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:585
-
secret_data_shift_cursor::index
u32 index
Definition: xzre.h:587
-
secret_data_shift_cursor::bit_index
u32 bit_index
Definition: xzre.h:590
-
secret_data_shift_cursor::byte_index
u32 byte_index
Definition: xzre.h:592
+
secret_data_shift_cursor
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:620
+
secret_data_shift_cursor::index
u32 index
Definition: xzre.h:622
+
secret_data_shift_cursor::bit_index
u32 bit_index
Definition: xzre.h:625
+
secret_data_shift_cursor::byte_index
u32 byte_index
Definition: xzre.h:627
elf_parse
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
elf_find_string
char * elf_find_string(elf_info_t *elf_info, u32 *stringId_inOut, void *rodata_start_ptr)
Locates a string in the ELF .rodata section.
resolve_libc_imports
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
elf_get_code_segment
void * elf_get_code_segment(elf_info_t *elf_info, u64 *pSize)
Obtains the address and size of the first executable segment in the given ELF file.
find_instruction_with_mem_operand_ex
BOOL find_instruction_with_mem_operand_ex(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, int opcode, void *mem_address)
finds an instruction with an immediate memory operand
+
process_shared_libraries
BOOL process_shared_libraries(backdoor_shared_libraries_data_t *data)
scans loaded libraries to identify interesting libraries
+
process_shared_libraries_map
BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data)
scans loaded libraries to identify interesting libraries and populate related data
elf_symbol_get_addr
void * elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id)
Looks up an ELF symbol from a parsed ELF, and returns its memory address.
backdoor_setup
BOOL backdoor_setup(backdoor_setup_params_t *params)
the backdoor main method
elf_contains_vaddr
BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags)
checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memor...