init_elf_entry_ctx()
+the symbol is used by init_elf_entry_ctx()
diff --git a/xzre_8h_source.html b/xzre_8h_source.html
index 3ea1170..7483707 100644
--- a/xzre_8h_source.html
+++ b/xzre_8h_source.html
@@ -907,1274 +907,1323 @@
1001 void (*RSA_free)(RSA *rsa);
1002 void (*BN_free)(BIGNUM *a);
- 1004 u64 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1049 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
-
-
- 1052 BOOL have_mm_answer_keyallowed;
- 1053 BOOL have_mm_answer_authpassword;
- 1054 BOOL have_mm_answer_keyverify;
-
-
- 1057 void *mm_answer_keyallowed;
- 1058 void *mm_answer_keyverify;
- 1059 void *mm_answer_authpassword_start;
- 1060 void *mm_answer_authpassword_end;
- 1061 sshd_monitor_func_t *mm_answer_authpassword_ptr;
- 1062 int monitor_reqtype_authpassword;
-
- 1064 void *mm_answer_keyallowed_start;
- 1065 void *mm_answer_keyallowed_end;
- 1066 void *mm_answer_keyallowed_ptr;
- 1067 u32 mm_answer_keyallowed_reqtype;
-
- 1069 void *mm_answer_keyverify_start;
- 1070 void *mm_answer_keyverify_end;
- 1071 void *mm_answer_keyverify_ptr;
-
-
-
-
-
+ 1004 u32 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1050 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
+
+
+ 1053 BOOL have_mm_answer_keyallowed;
+ 1054 BOOL have_mm_answer_authpassword;
+ 1055 BOOL have_mm_answer_keyverify;
+
+
+ 1058 void *mm_answer_keyallowed;
+ 1059 void *mm_answer_keyverify;
+ 1060 void *mm_answer_authpassword_start;
+ 1061 void *mm_answer_authpassword_end;
+ 1062 sshd_monitor_func_t *mm_answer_authpassword_ptr;
+ 1063 int monitor_reqtype_authpassword;
+
+ 1065 void *mm_answer_keyallowed_start;
+ 1066 void *mm_answer_keyallowed_end;
+ 1067 void *mm_answer_keyallowed_ptr;
+ 1068 u32 mm_answer_keyallowed_reqtype;
+
+ 1070 void *mm_answer_keyverify_start;
+ 1071 void *mm_answer_keyverify_end;
+ 1072 void *mm_answer_keyverify_ptr;
+
+
+
+
- 1078 char *STR_unknown_ptr;
- 1079 void *mm_request_send_start;
- 1080 void *mm_request_send_end;
- 1081 PADDING(
sizeof(u32));
+
+ 1079 char *STR_unknown_ptr;
+ 1080 void *mm_request_send_start;
+ 1081 void *mm_request_send_end;
1082 PADDING(
sizeof(u32));
-
- 1084 int *permit_root_login_ptr;
- 1085 char *STR_without_password;
- 1086 char *STR_publickey;
-
-
- 1089 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
- 1090 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
- 1091 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
-
- 1093 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
- 1094 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
- 1095 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 1096 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 1097 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
- 1098 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
- 1099 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 1100 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 1101 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
- 1102 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
- 1103 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 1104 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 1105 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
- 1106 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
-
- 1108 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
- 1109 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
- 1110 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
- 1111 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
- 1112 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 1113 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
- 1114 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
- 1118 BOOL unkbool_log_handler;
- 1119 BOOL syslog_disabled;
-
- 1121 char *STR_percent_s;
- 1122 char *STR_Connection_closed_by;
-
- 1124 char *STR_authenticating;
-
-
-
-
-
-
- 1131 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1145 struct __attribute__((packed)) {
-
-
-
-
-
-
-
- 1153 struct __attribute__((packed)) {
- 1154 u8 sshbuf_data_qword_index;
- 1155 u8 sshbuf_size_qword_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ 1083 PADDING(
sizeof(u32));
+
+ 1085 int *permit_root_login_ptr;
+ 1086 char *STR_without_password;
+ 1087 char *STR_publickey;
+
+
+ 1090 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+ 1091 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+ 1092 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+
+ 1094 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
+ 1095 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
+ 1096 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 1097 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 1098 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
+ 1099 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
+ 1100 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 1101 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 1102 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
+ 1103 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
+ 1104 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 1105 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 1106 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
+ 1107 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
+
+ 1109 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
+ 1110 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
+ 1111 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
+ 1112 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
+ 1113 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 1114 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
+ 1115 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
+
+
+
+
+
+
+ 1122 SYSLOG_LEVEL_VERBOSE,
+ 1123 SYSLOG_LEVEL_DEBUG1,
+ 1124 SYSLOG_LEVEL_DEBUG2,
+ 1125 SYSLOG_LEVEL_DEBUG3,
+ 1126 SYSLOG_LEVEL_NOT_SET = -1
+
+
+ 1129 typedef void (*log_handler_fn)(
+
+
+
+
+
+
+ 1136 BOOL logging_disabled;
+ 1137 BOOL log_hooking_possible;
+ 1138 BOOL syslog_disabled;
+
+ 1140 char *STR_percent_s;
+ 1141 char *STR_Connection_closed_by;
+
+ 1143 char *STR_authenticating;
+
+
+
+ 1147 void *log_handler_ptr;
+ 1148 void *log_handler_ctx_ptr;
+ 1149 log_handler_fn orig_log_handler;
+ 1150 void *orig_log_handler_ctx;
+
+ 1152 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1173 struct __attribute__((packed)) {
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
- 1213 struct monitor **struct_monitor_ptr_address;
-
-
-
-
-
-
-
-
-
-
-
-
- 1250 u64 sock_read_buf_size;
- 1251 u8 sock_read_buf[64];
- 1252 u64 payload_data_size;
-
-
-
-
- 1257 u32 sshd_host_pubkey_idx;
-
- 1262 u8 secret_data[ED448_KEY_SIZE];
- 1268 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1313 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1416 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
- 1426 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1432 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
- 1437 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1439 u64 hooks_installed;
-
-
- 1442 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1443 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1444 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1445 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1446 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1447 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1448 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1449 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1450 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1452 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1453 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1454 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
- 1455 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
- 1456 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1457 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1459 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
- 1470 u64 signed_data_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1489 SYSLOG_LEVEL_VERBOSE,
- 1490 SYSLOG_LEVEL_DEBUG1,
- 1491 SYSLOG_LEVEL_DEBUG2,
- 1492 SYSLOG_LEVEL_DEBUG3,
- 1493 SYSLOG_LEVEL_NOT_SET = -1
-
- 1495 typedef void (*log_handler_fn)(
-
-
-
-
-
-
-
-
-
- 1505 uintptr_t (*symbind64)(
- 1506 Elf64_Sym *sym,
unsigned int ndx,
- 1507 uptr *refcook, uptr *defcook,
- 1508 unsigned int flags,
const char *symname);
- 1509 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1510 pfn_RSA_get0_key_t hook_RSA_get0_key;
- 1511 log_handler_fn mm_log_handler;
- 1512 PADDING(
sizeof(
void *));
- 1513 PADDING(
sizeof(
void *));
- 1514 sshd_monitor_func_t mm_answer_keyallowed;
- 1515 sshd_monitor_func_t mm_answer_keyverify;
- 1516 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1572 Elf64_Ehdr *dynamic_linker_ehdr;
- 1573 void **__libc_stack_end;
-
-
-
- 1577 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
- 1578 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
-
+
+ 1181 struct __attribute__((packed)) {
+ 1182 u8 sshbuf_data_qword_index;
+ 1183 u8 sshbuf_size_qword_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1241 struct monitor **struct_monitor_ptr_address;
+
+
+
+
+
+
+
+
+
+
+
+
+ 1278 u64 sock_read_buf_size;
+ 1279 u8 sock_read_buf[64];
+ 1280 u64 payload_data_size;
+
+
+
+
+ 1285 u32 sshd_host_pubkey_idx;
+
+ 1290 u8 secret_data[ED448_KEY_SIZE];
+ 1296 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1341 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1444 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+ 1454 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1460 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+ 1465 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1467 u64 hooks_installed;
+
+
+ 1470 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1471 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1472 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1473 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1474 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1475 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1476 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1477 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1478 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1480 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1481 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1482 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+ 1483 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+ 1484 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1485 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1487 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
+
+
+
+
+
+
+
+
+
+ 1498 u64 signed_data_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1516 uintptr_t (*symbind64)(
+ 1517 Elf64_Sym *sym,
unsigned int ndx,
+ 1518 uptr *refcook, uptr *defcook,
+ 1519 unsigned int flags,
const char *symname);
+ 1520 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1521 pfn_RSA_get0_key_t hook_RSA_get0_key;
+ 1522 log_handler_fn mm_log_handler;
+ 1523 PADDING(
sizeof(
void *));
+ 1524 PADDING(
sizeof(
void *));
+ 1525 sshd_monitor_func_t mm_answer_keyallowed;
+ 1526 sshd_monitor_func_t mm_answer_keyverify;
+ 1527 PADDING(
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
+
+
+ 1583 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1584 void **__libc_stack_end;
+
+
+
+ 1588 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+ 1589 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1642 struct link_map *liblzma_map;
- 1643 struct link_map *libcrypto_map;
- 1644 struct link_map *libsystemd_map;
- 1645 struct link_map *libc_map;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1682 lzma_allocator fake_allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1758 u32 operation_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1653 struct link_map *liblzma_map;
+ 1654 struct link_map *libcrypto_map;
+ 1655 struct link_map *libsystemd_map;
+ 1656 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1693 lzma_allocator fake_allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1769 u32 operation_index;
+
+
+
+
+
+
+
+
+
+
- 1781 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 1795 u8 signature[ED448_SIGNATURE_SIZE];
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+ 1792 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 1806 u8 signature[ED448_SIGNATURE_SIZE];
+
+
+
+
+
- 1813 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
-
-
-
-
-
-
-
-
-
-
-
-
- 1852 CMDF_AUTH_BYPASS = 0x4,
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+ 1824 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
+
+
+
+
+
+
+
+
+
+
+
+
+ 1863 X_FLAGS2_AUTH_BYPASS = 0x4,
+
+
+
+
+
-
-
-
-
-
-
-
- 1890 const BIGNUM *rsa_n;
- 1891 const BIGNUM *rsa_e;
-
-
- 1894 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
- 1895 u8 ivec[CHACHA20_IV_SIZE];
- 1896 u8 ed448_key[ED448_KEY_SIZE];
-
-
+
+
+
+
+
+
+
+
+
+
-
-
-
- 1903 assert_offset(
key_ctx_t, payload, 0x15);
-
- 1905 assert_offset(
key_ctx_t, ed448_key, 0x27D);
-
-
-
-
-
- 1915 const BIGNUM *rsa_n;
- 1916 const BIGNUM *rsa_e;
-
- 1918 u16 payload_body_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1937 struct timespec timespec;
-
-
-
-
-
-
-
-
-
-
- 1952 u64 hostkey_hash_offset;
-
- 1954 u8 *payload_data_ptr;
-
-
-
-
-
-
-
-
- 1963 struct __attribute__((packed)) {
-
-
-
-
- 1968 struct __attribute__((packed)) {
-
- 1970 u64 num_host_pubkeys;
- 1971 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2042 PADDING(
sizeof(u64));
-
- 2049 PADDING(
sizeof(u64));
- 2050 PADDING(
sizeof(u64));
-
- 2057 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
-
-
- 2072 PADDING(
sizeof(u64));
- 2073 lzma_allocator allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2103 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+ 1901 const BIGNUM *rsa_n;
+ 1902 const BIGNUM *rsa_e;
+
+
+ 1905 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
+ 1906 u8 ivec[CHACHA20_IV_SIZE];
+ 1907 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+ 1914 assert_offset(
key_ctx_t, payload, 0x15);
+
+ 1916 assert_offset(
key_ctx_t, ed448_key, 0x27D);
+
+
+
+
+
+ 1926 const BIGNUM *rsa_n;
+ 1927 const BIGNUM *rsa_e;
+
+ 1929 u16 payload_body_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1948 struct timespec timespec;
+
+
+
+
+
+
+
+
+
+
+ 1963 u64 hostkey_hash_offset;
+
+ 1965 u8 *payload_data_ptr;
+
+
+
+
+
+
+
+
+ 1974 struct __attribute__((packed)) {
+
+
+
+
+ 1979 struct __attribute__((packed)) {
+
+ 1981 u64 num_host_pubkeys;
+ 1982 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2053 PADDING(
sizeof(u64));
+
+ 2060 PADDING(
sizeof(u64));
+ 2061 PADDING(
sizeof(u64));
+
+ 2068 PADDING(
sizeof(u64));
+
+
+
+
+
+
+
+
+
+ 2083 PADDING(
sizeof(u64));
+ 2084 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2114 u8 *output_register;
+
+
+
+
+
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2236 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 2259 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2325 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2247 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 2270 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2336 EncodedStringId encoded_string_id,
+
+
+
+
+
-
-
-
-
-
-
- 2379 FuncFindType find_mode);
-
-
-
-
-
-
-
-
-
-
-
- 2438 extern char *check_argument(
char arg_first_char,
char* arg_name);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2551 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2585 StringXrefId xref_id,
- 2586 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
-
-
-
-
- 2605 EncodedStringId *stringId_inOut,
- 2606 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2676 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2690 unsigned operation_index,
- 2691 unsigned shift_count,
- 2692 int index, u8 *code);
-
-
-
-
-
-
-
-
-
- 2720 unsigned shift_count,
unsigned operation_index);
-
-
- 2765 u8 *call_site, u8 *code,
-
- 2767 unsigned shift_count,
unsigned operation_index);
-
-
-
- 2782 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+ 2390 FuncFindType find_mode);
+
+
+
+
+
+
+
+
+
+
+
+ 2449 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2562 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2596 StringXrefId xref_id,
+ 2597 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+
+
+
+
+ 2616 EncodedStringId *stringId_inOut,
+ 2617 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2687 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2701 unsigned operation_index,
+ 2702 unsigned shift_count,
+ 2703 int index, u8 *code);
+
+
+
+
+
+
+
+
+
+ 2731 unsigned shift_count,
unsigned operation_index);
+
+
+ 2776 u8 *call_site, u8 *code,
+
+ 2778 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2793 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
- 2901 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+ 2911 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
- 2978 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 3019 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 3032 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
+
+
+
+
+ 2988 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 3029 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 3042 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
-
-
-
- 3104 uptr *refcook, uptr *defcook,
-
- 3106 const char *symname);
-
-
-
-
-
- 3137 ptrdiff_t *libname_offset,
-
-
-
-
-
- 3165 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 3212 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3255 void **sensitive_data_out);
-
-
-
-
-
-
- 3276 void **sensitive_data_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3346 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3427 u64 sshkey_digest_offset,
- 3428 u64 signed_data_size,
-
-
-
-
-
-
- 3446 BOOL skip_root_patch,
-
- 3448 BOOL replace_monitor_reqtype,
- 3449 int monitor_reqtype,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3488 enum SocketMode socket_direction
-
-
-
-
-
-
-
-
-
-
-
- 3534 size_t *pOutPayloadSize,
-
-
-
-
- 3547 size_t payload_size,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3642 unsigned int num_pointers
-
-
-
-
-
-
-
-
-
-
- 3669 LogLevel level,
const char *fmt, ...);
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3130 uptr *refcook, uptr *defcook,
+
+ 3132 const char *symname);
+
+
+
+
+
+ 3163 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 3191 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 3238 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3281 void **sensitive_data_out);
+
+
+
+
+
+
+ 3302 void **sensitive_data_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3372 u8 *buffer, u64 bufferSize,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3453 u64 sshkey_digest_offset,
+ 3454 u64 signed_data_size,
+
+
+
+
+
+
+ 3472 BOOL skip_root_patch,
+
+ 3474 BOOL replace_monitor_reqtype,
+ 3475 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+ 3503 u8 **code_start_out,
+
+
+
+
+
+
+
+
+
+
+ 3541 void **monitor_field_ptr_out,
+
+
+
+
+
+
+ 3559 void *mem_range_start,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3627 enum SocketMode socket_direction
+
+
+
+
+
+
+
+
+
+
+
+ 3673 size_t *pOutPayloadSize,
+
+
+
+
+ 3686 size_t payload_size,
-
-
-
-
- 3699 static_assert(
sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3781 unsigned int num_pointers
+
+
+
+
+
+
+
+
+
+
+
+
+ 3816 LogLevel level,
const char *fmt, ...);
+
+
+
+
+
+
+
+
+
+
+
+
+ 3846 static_assert(
sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding)
Definition: ssh_patch.c:37
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2014
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2002
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2008
data passed to functions that access the backdoor data
Definition: xzre.h:1586
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1631
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1676
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1681
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1636
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1666
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1671
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1662
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1656
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1686
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1641
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1720
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1725
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1715
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2028
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2034
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2025
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2013
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2019
data passed to functions that access the backdoor data
Definition: xzre.h:1597
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1642
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1687
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1692
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1647
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1677
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1682
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1673
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1667
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1697
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1652
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1731
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1736
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1726
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2039
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2045
u8 flags2
see InstructionFlags2
Definition: xzre.h:672
u8 flags
see InstructionFlags
Definition: xzre.h:668
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:648
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:653
array of ELF handles
Definition: xzre.h:1546
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1557
elf_info_t * main
this is for sshd
Definition: xzre.h:1551
array of ELF handles
Definition: xzre.h:1557
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1568
elf_info_t * main
this is for sshd
Definition: xzre.h:1562
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:826
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:755
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:779
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:771
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:787
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1247
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1190
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1208
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1200
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1186
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1228
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1272
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1220
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1232
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1212
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1224
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1240
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1275
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1218
char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1236
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1228
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1214
void * sshd_data_start
sshd data segment end
Definition: xzre.h:1256
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1300
void * sshd_code_start
sshd code segment start
Definition: xzre.h:1248
void * sshd_data_end
sshd data segment start
Definition: xzre.h:1260
char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1240
void * sshd_code_end
sshd code segment end
Definition: xzre.h:1252
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1268
void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:625
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:943
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:953
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:948
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2108
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2097
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2087
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2092
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2102
the payload header. also used as Chacha IV
Definition: xzre.h:1775
the contents of the RSA 'n' field
Definition: xzre.h:1807
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1373
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1392
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1351
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1409
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1421
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1339
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1383
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1366
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1334
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1356
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2119
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2108
u8 * start_addr
start of the code address range to search
Definition: xzre.h:2098
u8 * end_addr
start of the code address range to search
Definition: xzre.h:2103
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2113
the payload header. also used as Chacha IV
Definition: xzre.h:1786
the contents of the RSA 'n' field
Definition: xzre.h:1818
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1401
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1420
u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1379
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1437
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1449
u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1367
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1411
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1394
u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1362
u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1384
Structure to hold internal state of the check being calculated.
Definition: xzre.h:280
State for the internal SHA-256 implementation.
Definition: xzre.h:268
uint64_t size
Size of the message excluding padding.
Definition: xzre.h:273
data used within sshd_proxy_elevate
Definition: xzre.h:1911
data used within sshd_proxy_elevate
Definition: xzre.h:1922
struct monitor from openssh-portable
Definition: xzre.h:558
stack frame layout for run_backdoor_commands
Definition: xzre.h:1948
stack frame layout for run_backdoor_commands
Definition: xzre.h:1959
struct sensitive_data from openssh-portable
Definition: xzre.h:570
struct sshkey from openssh-portable
Definition: xzre.h:581
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1603
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1598
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1611
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1607
union used within run_backdoor_commands
Definition: xzre.h:1935
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1744
u32 index
Definition: xzre.h:1746
u32 byte_index
Definition: xzre.h:1751
u32 bit_index
Definition: xzre.h:1749
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1614
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1609
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1622
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1618
union used within run_backdoor_commands
Definition: xzre.h:1946
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1755
u32 index
Definition: xzre.h:1757
u32 byte_index
Definition: xzre.h:1762
u32 bit_index
Definition: xzre.h:1760
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
fake_lzma_allocator_t * get_lzma_allocator_address(void)
gets the address of the fake LZMA allocator
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
BOOL sshd_get_usable_socket(int *pSock, int socket_index, libc_imports_t *imports)
gets the first usable socket fd
void mm_log_handler_hook(LogLevel level, int forced, const char *msg, void *ctx)
void * elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Looks up an ELF symbol from a parsed ELF, and returns its memory address.
void init_elf_entry_ctx(elf_entry_ctx_t *ctx)
initialises the elf_entry_ctx_t
BOOL verify_signature(struct sshkey *sshkey, u8 *signed_data, u64 sshkey_digest_offset, u64 signed_data_size, u8 *signature, u8 *ed448_raw_key, global_context_t *global_ctx)
Checks if signed_data is signed with ed448_raw_key.
BOOL validate_log_handler_pointers(void *addr1, void *addr2, void *search_base, u8 *code_end, string_references_t *refs, global_context_t *global)
Validate that the two addresses are the expected/correct ones.
BOOL is_payload_message(u8 *sshbuf_data, size_t sshbuf_size, size_t *pOutPayloadSize, global_context_t *ctx)
checks if the given sshbuf buffer contains a backdoor payload message
void * dummy_tls_get_addr(tls_index *ti)
a dummy function that calls __tls_get_addr, to make sure its GOT slot doesn't get removed by compiler...
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
BOOL secret_data_append_item(secret_data_shift_cursor_t shift_cursor, unsigned operation_index, unsigned shift_count, int index, u8 *code)
Calls secret_data_append_singleton, if flags are non-zero.
const u64 tls_get_addr_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
void init_ldso_ctx(ldso_ctx_t *ldso_ctx)
initializes/resets ldso data
BOOL init_imported_funcs(imported_funcs_t *imported_funcs)
Initializes the imported_funcs structure.
backdoor_hooks_data_t * hooks_data_addr
location of backdoor_hooks_data_t
BOOL sha256(const void *data, size_t count, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs)
computes the SHA256 hash of the supplied data
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
ElfId
Definition: xzre.h:375
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:380
CommandFlags2
Definition: xzre.h:1838
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1848
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1862
@ CMDF_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1869
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1843
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1857
int init_hooks_ctx(backdoor_hooks_ctx_t *ctx)
Initializes the structure with hooks-related data.
CommandFlags2
Definition: xzre.h:1849
@ X_FLAGS2_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1859
@ X_FLAGS2_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1873
@ X_FLAGS2_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1868
@ X_FLAGS2_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1880
@ X_FLAGS2_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1854
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
const elf_functions_t elf_functions
special .data.rel.ro section that contains addresses to various functions
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if do_child accesses sensitive_data or not
BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx)
locates sensitive_data within sshd, and resolves some additional libcrypto functions
CommandFlags1
Definition: xzre.h:1815
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1823
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1835
@ CMDF_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1827
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1831
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1819
CommandFlags1
Definition: xzre.h:1826
@ X_FLAGS1_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1834
@ X_FLAGS1_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1846
@ X_FLAGS1_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1838
@ X_FLAGS1_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1830
@ X_FLAGS1_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1842
BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx)
forges a new MONITOR_REQ_KEYALLOWED packet, and injects it into the server to gain root privileges th...
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
BOOL find_add_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds an ADD instruction with an immediate memory operand
u8 * elf_find_string_reference(elf_info_t *elf_info, EncodedStringId encoded_string_id, u8 *code_start, u8 *code_end)
finds an instruction that references the given string
BOOL x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end)
disassembles the given x64 code
BOOL sshd_find_main(u8 **code_start_out, elf_info_t *sshd, elf_info_t *libcrypto, imported_funcs_t *imported_funcs)
finds the sshd_main function
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf)
finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME )
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1581
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1592
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if accesses sensitive_data or not
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
unsigned int backdoor_entry(unsigned int cpuid_request, u64 *caller_frame)
calls backdoor_init while in the crc64() IFUNC resolver function
BOOL find_dl_audit_offsets(backdoor_data_handle_t *data, ptrdiff_t *libname_offset, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find the various offsets in ld.so that need modification to trigger _dl_audit_symbind_alt() to call b...
BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t *reloc_consts)
BOOL sshd_find_monitor_field_addr_in_function(u8 *code_start, u8 *code_end, u8 *data_start, u8 *data_end, void **monitor_field_ptr_out, global_context_t *ctx)
find a pointer to a field in struct monitor by examining code referencing it
const u64 string_mask_data[238]
contains mask data for the encoded string radix tree
int mm_answer_keyallowed_hook(struct ssh *ssh, int sock, struct sshbuf *m)
runs the payload received from sshd_proxy_elevate, and then runs the original mm_answer_keyallowed fu...
BOOL chacha_decrypt(u8 *in, int inl, u8 *key, u8 *iv, u8 *out, imported_funcs_t *funcs)
decrypts a buffer with chacha20
struct key_payload key_payload_t
the contents of the RSA 'n' field
const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts
special .rodata section that contains __tls_get_addr() related GOT offsets
BOOL is_gnu_relro(Elf64_Word p_type, u32 addend)
checks if the provided identifiers represent a PT_GNU_RELRO
void * find_addr_referenced_in_mov_instruction(StringXrefId id, string_references_t *refs, void *mem_range_start, void *mem_range_end)
find an address referenced in a function
u32 resolver_call_count
counts the number of times the IFUNC resolver is called
int init_hook_functions(backdoor_hooks_ctx_t *funcs)
Initializes the structure with hooks-related data.
CommandFlags3
Definition: xzre.h:1872
@ CMDF_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1876
@ CMDF_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1880
ptrdiff_t init_elf_entry_ctx(elf_entry_ctx_t *ctx)
initialises the elf_entry_ctx_t
BOOL sshd_configure_log_hook(cmd_arguments_t *cmd_flags, global_context_t *ctx)
configure the log hook
CommandFlags3
Definition: xzre.h:1883
@ X_FLAGS3_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1891
@ X_FLAGS3_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1887
struct monitor_data monitor_data_t
data used within sshd_proxy_elevate
const u64 cpuid_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Gets the GOT symbol with name encoded_string_id from the parsed ELF file.
BOOL sshd_get_sensitive_data_address_via_xcalloc(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, string_references_t *string_refs, void **sensitive_data_out)
finds the address of sensitive_data.host_keys in sshd by using XREF_xcalloc_zero_size in xcalloc
ptrdiff_t get_tls_get_addr_random_symbol_got_offset(elf_entry_ctx_t *ctx)
get the tls_get_addr_random_symbol GOT offset
BOOL sshbuf_bignum_is_negative(struct sshbuf *buf)
checks if the given serialized BIGNUM is negative
int init_shared_globals(backdoor_shared_globals_t *shared_globals)
Initializes the backdoor_shared_globals structure.
elf_functions_t * get_elf_functions_address(void)
gets the address of the elf_functions
BOOL find_mov_lea_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
like find_mov_instruction, but also considers LEA instructions
BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement)
finds a lea instruction