From 9e4f5c77f667b00a337e6d5edfe8d8b9a387b9c3 Mon Sep 17 00:00:00 2001 From: smx-smx Date: Thu, 4 Apr 2024 19:30:29 +0000 Subject: [PATCH] =?UTF-8?q?Deploying=20to=20gh-pages=20from=20@=20smx-smx/?= =?UTF-8?q?xzre@42f3f0b1b980425bb640b36d44f75081b9ad8b75=20=F0=9F=9A=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- globals.html | 4 +- globals_func.html | 4 +- search/all_2.js | 2 +- search/functions_1.js | 2 +- xzre_8h.html | 34 ++--- xzre_8h_source.html | 284 +++++++++++++++++++++--------------------- 6 files changed, 168 insertions(+), 162 deletions(-) diff --git a/globals.html b/globals.html index 60acd76..fd071cc 100644 --- a/globals.html +++ b/globals.html @@ -65,8 +65,8 @@
  • __attribute__() : xzre.h
    • -
  • elf_contains_segment() -: xzre.h +
  • elf_contains_vaddr() +: xzre.h
  • elf_get_code_segment() : xzre.h diff --git a/globals_func.html b/globals_func.html index c85c0d6..c61cba8 100644 --- a/globals_func.html +++ b/globals_func.html @@ -65,8 +65,8 @@
  • __attribute__() : xzre.h
    • -
  • elf_contains_segment() -: xzre.h +
  • elf_contains_vaddr() +: xzre.h
  • elf_get_code_segment() : xzre.h diff --git a/search/all_2.js b/search/all_2.js index 467f898..604c780 100644 --- a/search/all_2.js +++ b/search/all_2.js @@ -1,6 +1,6 @@ var searchData= [ - ['elf_5fcontains_5fsegment_3',['elf_contains_segment',['../xzre_8h.html#a484c7f2d91a4774ef5c9de803c9fcfa5',1,'xzre.h']]], + ['elf_5fcontains_5fvaddr_3',['elf_contains_vaddr',['../xzre_8h.html#a2a09d15b1c506e0f29ee9433771ad8db',1,'xzre.h']]], ['elf_5fget_5fcode_5fsegment_4',['elf_get_code_segment',['../xzre_8h.html#af3f0d23e5fece210bdf4945c65e3a10a',1,'xzre.h']]], ['elf_5fparse_5',['elf_parse',['../xzre_8h.html#a049328971f4e99ce954d5e0346fee6d7',1,'xzre.h']]], ['elf_5fsymbol_5fget_6',['elf_symbol_get',['../xzre_8h.html#ac0a43ada7f303cb88b9c4b48a17b5154',1,'xzre.h']]], diff --git a/search/functions_1.js b/search/functions_1.js index ae4f854..80d464c 100644 --- a/search/functions_1.js +++ b/search/functions_1.js @@ -1,6 +1,6 @@ var searchData= [ - ['elf_5fcontains_5fsegment_24',['elf_contains_segment',['../xzre_8h.html#a484c7f2d91a4774ef5c9de803c9fcfa5',1,'xzre.h']]], + ['elf_5fcontains_5fvaddr_24',['elf_contains_vaddr',['../xzre_8h.html#a2a09d15b1c506e0f29ee9433771ad8db',1,'xzre.h']]], ['elf_5fget_5fcode_5fsegment_25',['elf_get_code_segment',['../xzre_8h.html#af3f0d23e5fece210bdf4945c65e3a10a',1,'xzre.h']]], ['elf_5fparse_26',['elf_parse',['../xzre_8h.html#a049328971f4e99ce954d5e0346fee6d7',1,'xzre.h']]], ['elf_5fsymbol_5fget_27',['elf_symbol_get',['../xzre_8h.html#ac0a43ada7f303cb88b9c4b48a17b5154',1,'xzre.h']]], diff --git a/xzre_8h.html b/xzre_8h.html index e75c72d..32eb0e8 100644 --- a/xzre_8h.html +++ b/xzre_8h.html @@ -335,6 +335,9 @@  assert_offset (imported_funcs_t, RSA_public_decrypt, 0)   + + assert_offset (imported_funcs_t, EVP_sha256, 0x58) +   assert_offset (imported_funcs_t, RSA_get0_key, 0x60)   @@ -434,9 +437,9 @@ BOOL find_function_prologue_ex (u8 *code_start, u8 *func_start_0, u8 *func_start_1, u8 *search_base, u8 *code_end, FuncFindType find_mode)  locates the function prologue. it will try to backtrack and synchronize the code stream, calling find_function_prologue for each iteration More...
      -BOOL elf_contains_segment (elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags) - checks if given ELF file contains an elf segment with the given parameters More...
    -  +BOOL elf_contains_vaddr (elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags) + checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memory protection flags More...
    +  BOOL elf_parse (Elf64_Ehdr *ehdr, elf_info_t *elf_info)  Parses the given in-memory ELF file into elf_info. More...
      @@ -450,7 +453,7 @@  Obtains the address and size of the first executable page in the given ELF file. More...
      lzma_allocator * get_lzma_allocator () - gets the fake LZMA allocator, used for imports resolution More...
    + gets the fake LZMA allocator, used for imports resolution the "opaque" field of the structure holds a pointer to More...
      BOOL secret_data_append_if_flags (secret_data_shift_cursor shift_cursor, unsigned operation_index, unsigned reg2reg_instruction_count, int flags, u8 *code)  Calls secret_data_append_singleton, if flags are non-zero. More...
    @@ -524,14 +527,14 @@

    -

    ◆ elf_contains_segment()

    + +

    ◆ elf_contains_vaddr()

    - + @@ -562,13 +565,13 @@

    -

    checks if given ELF file contains an elf segment with the given parameters

    +

    checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memory protection flags

    Parameters

    BOOL elf_contains_segment BOOL elf_contains_vaddr ( elf_info_t *  elf_info,
    - - - + + +
    elf_infoelf context
    vaddrthe starting virtual address of the segment
    sizethe size of the segment
    p_flagsthe segment protection flags (PF_*)
    vaddrstarting memory address
    sizememory size
    p_flagsthe expected segment protection flags (PF_*)
    @@ -1018,7 +1021,8 @@

    -

    gets the fake LZMA allocator, used for imports resolution

    +

    gets the fake LZMA allocator, used for imports resolution the "opaque" field of the structure holds a pointer to

    +
    See also
    elf_info_t
    Returns
    lzma_allocator*

    @@ -1129,8 +1133,8 @@

    -
  • for each instruction, shift a '1' in the data register, and increment the shift cursor to the next bit index if, at any given point, a non reg2reg instruction is encountered, the whole loop will stop.
    • +
  • search for reg2reg_instruction_count number of "reg2reg" instructions (explained below)
    • +
  • for each instruction, shift a '1' in the data register, and increment the shift cursor to the next bit index if, at any given point, a non reg2reg instruction is encountered, the whole loop will stop and FALSE will be returned.

    • a reg2reg instruction is an x64 instruction with one of the following characteristics:

    diff --git a/xzre_8h_source.html b/xzre_8h_source.html index 70b8b3e..6f3b651 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -282,155 +282,157 @@
    281  int (*RSA_public_decrypt)(
    282  int flen, unsigned char *from,
    283  unsigned char *to, RSA *rsa, int padding);
    -
    284  PADDING(0x58);
    -
    285  void (*RSA_get0_key)(
    -
    286  const RSA *r,
    -
    287  const BIGNUM **n,
    -
    288  const BIGNUM **e,
    -
    289  const BIGNUM **d);
    -
    290  int (*BN_num_bits)(const BIGNUM *a);
    -
    291  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
    -
    292  int type, ENGINE *e,
    -
    293  const unsigned char *key, size_t keylen);
    -
    294  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
    -
    295  int (*EVP_DigestVerifyInit)(
    -
    296  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
    -
    297  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
    -
    298  PADDING(0x8);
    -
    299  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
    -
    300  void (*EVP_PKEY_free)(EVP_PKEY *key);
    -
    301  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
    -
    302  int (*EVP_DecryptInit_ex)(
    -
    303  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
    -
    304  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
    -
    305  int (*EVP_DecryptUpdate)(
    -
    306  EVP_CIPHER_CTX *ctx, unsigned char *out,
    -
    307  int *outl, const unsigned char *in, int inl);
    -
    308  PADDING(8);
    -
    309  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
    -
    310  EVP_CIPHER *(*EVP_chacha20)(void);
    -
    311  RSA *(*RSA_new)(void);
    -
    312  BIGNUM *(*BN_dup)(const BIGNUM *from);
    -
    313  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
    -
    314  PADDING(16);
    -
    315  int (*RSA_sign)(
    -
    316  int type,
    -
    317  const unsigned char *m, unsigned int m_len,
    -
    318  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
    -
    319  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
    -
    320  void (*RSA_free)(RSA *rsa);
    -
    321  void (*BN_free)(BIGNUM *a);
    -
    322  system_imports_t *system;
    -
    323  u32 resolved_imports_count;
    -
    324 } imported_funcs_t;
    -
    325 
    -
    326 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
    -
    327 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
    -
    328 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
    -
    329 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
    -
    330 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
    -
    331 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
    -
    332 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
    -
    333 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
    -
    334 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
    -
    335 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
    -
    336 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
    -
    337 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
    -
    338 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
    -
    339 assert_offset(imported_funcs_t, RSA_new, 0xD0);
    -
    340 assert_offset(imported_funcs_t, BN_dup, 0xD8);
    -
    341 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
    -
    342 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
    -
    343 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
    -
    344 assert_offset(imported_funcs_t, RSA_free, 0x108);
    -
    345 assert_offset(imported_funcs_t, BN_free, 0x110);
    -
    346 assert_offset(imported_funcs_t, system, 0x118);
    -
    347 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
    -
    348 
    -
    349 typedef struct __attribute__((packed)) {
    -
    350  PADDING(8);
    -
    355  imported_funcs_t *imported_funcs;
    -
    356  PADDING(0x70);
    -
    362  u64 code_range_start;
    -
    368  u64 code_range_end;
    -
    369  PADDING(0x78);
    -
    374  u8 secret_data[57];
    -
    380  u8 shift_operations[31];
    -
    386  u32 reg2reg_instructions_count;
    -
    387 } global_context_t;
    -
    388 
    -
    389 assert_offset(global_context_t, imported_funcs, 8);
    -
    390 assert_offset(global_context_t, code_range_start, 0x80);
    -
    391 assert_offset(global_context_t, code_range_end, 0x88);
    -
    392 assert_offset(global_context_t, secret_data, 0x108);
    -
    393 assert_offset(global_context_t, shift_operations, 0x141);
    -
    394 assert_offset(global_context_t, reg2reg_instructions_count, 0x160);
    -
    395 
    -
    402 typedef union {
    -
    403  struct {
    -
    405  u32 bit_index : 3;
    -
    407  u32 byte_index : 29;
    -
    408  };
    -
    410  u32 index;
    -
    411 } secret_data_shift_cursor;
    -
    412 
    -
    421 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
    -
    422 
    -
    432 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
    -
    433 
    -
    442 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
    -
    443 
    -
    463 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
    -
    464 
    -
    474 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
    -
    475 
    -
    489 extern BOOL find_function_prologue_ex(
    -
    490  u8 *code_start,
    -
    491  u8 *func_start_0,
    -
    492  u8 *func_start_1,
    -
    493  u8 *search_base,
    -
    494  u8 *code_end,
    -
    495  FuncFindType find_mode);
    -
    496 
    -
    506 extern BOOL elf_contains_segment(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
    -
    507 
    -
    515 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
    -
    516 
    -
    525 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
    -
    526 
    -
    534 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
    -
    535 
    -
    543 extern u64 elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
    -
    544 
    -
    550 extern lzma_allocator *get_lzma_allocator();
    -
    551 
    -
    562 extern BOOL secret_data_append_if_flags(
    -
    563  secret_data_shift_cursor shift_cursor,
    -
    564  unsigned operation_index,
    -
    565  unsigned reg2reg_instruction_count,
    -
    566  int flags, u8 *code);
    -
    567 
    -
    606 extern BOOL secret_data_append_singleton(
    -
    607  u8 *call_site, u8 *code,
    -
    608  secret_data_shift_cursor shift_cursor,
    -
    609  unsigned reg2reg_instruction_count, unsigned operation_index);
    -
    610 
    -
    611 #include "util.h"
    -
    612 #endif
    -
    secret_data_shift_cursor
    represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
    Definition: xzre.h:402
    -
    secret_data_shift_cursor::index
    u32 index
    Definition: xzre.h:410
    -
    secret_data_shift_cursor::bit_index
    u32 bit_index
    Definition: xzre.h:405
    -
    secret_data_shift_cursor::byte_index
    u32 byte_index
    Definition: xzre.h:407
    +
    284  PADDING(0x50);
    +
    285  EVP_MD *(*EVP_sha256)(void);
    +
    286  void (*RSA_get0_key)(
    +
    287  const RSA *r,
    +
    288  const BIGNUM **n,
    +
    289  const BIGNUM **e,
    +
    290  const BIGNUM **d);
    +
    291  int (*BN_num_bits)(const BIGNUM *a);
    +
    292  EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
    +
    293  int type, ENGINE *e,
    +
    294  const unsigned char *key, size_t keylen);
    +
    295  EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
    +
    296  int (*EVP_DigestVerifyInit)(
    +
    297  EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
    +
    298  const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
    +
    299  PADDING(0x8);
    +
    300  void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
    +
    301  void (*EVP_PKEY_free)(EVP_PKEY *key);
    +
    302  EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
    +
    303  int (*EVP_DecryptInit_ex)(
    +
    304  EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
    +
    305  ENGINE *impl, const unsigned char *key, const unsigned char *iv);
    +
    306  int (*EVP_DecryptUpdate)(
    +
    307  EVP_CIPHER_CTX *ctx, unsigned char *out,
    +
    308  int *outl, const unsigned char *in, int inl);
    +
    309  PADDING(8);
    +
    310  void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
    +
    311  EVP_CIPHER *(*EVP_chacha20)(void);
    +
    312  RSA *(*RSA_new)(void);
    +
    313  BIGNUM *(*BN_dup)(const BIGNUM *from);
    +
    314  BIGNUM (*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
    +
    315  PADDING(16);
    +
    316  int (*RSA_sign)(
    +
    317  int type,
    +
    318  const unsigned char *m, unsigned int m_len,
    +
    319  unsigned char *sigret, unsigned int *siglen, RSA *rsa);
    +
    320  int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
    +
    321  void (*RSA_free)(RSA *rsa);
    +
    322  void (*BN_free)(BIGNUM *a);
    +
    323  system_imports_t *system;
    +
    324  u32 resolved_imports_count;
    +
    325 } imported_funcs_t;
    +
    326 
    +
    327 assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
    +
    328 assert_offset(imported_funcs_t, EVP_sha256, 0x58);
    +
    329 assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
    +
    330 assert_offset(imported_funcs_t, BN_num_bits, 0x68);
    +
    331 assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
    +
    332 assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
    +
    333 assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
    +
    334 assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
    +
    335 assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
    +
    336 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
    +
    337 assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
    +
    338 assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
    +
    339 assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
    +
    340 assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
    +
    341 assert_offset(imported_funcs_t, RSA_new, 0xD0);
    +
    342 assert_offset(imported_funcs_t, BN_dup, 0xD8);
    +
    343 assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
    +
    344 assert_offset(imported_funcs_t, RSA_sign, 0xF8);
    +
    345 assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
    +
    346 assert_offset(imported_funcs_t, RSA_free, 0x108);
    +
    347 assert_offset(imported_funcs_t, BN_free, 0x110);
    +
    348 assert_offset(imported_funcs_t, system, 0x118);
    +
    349 assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
    +
    350 
    +
    351 typedef struct __attribute__((packed)) {
    +
    352  PADDING(8);
    +
    357  imported_funcs_t *imported_funcs;
    +
    358  PADDING(0x70);
    +
    364  u64 code_range_start;
    +
    370  u64 code_range_end;
    +
    371  PADDING(0x78);
    +
    376  u8 secret_data[57];
    +
    382  u8 shift_operations[31];
    +
    388  u32 reg2reg_instructions_count;
    +
    389 } global_context_t;
    +
    390 
    +
    391 assert_offset(global_context_t, imported_funcs, 8);
    +
    392 assert_offset(global_context_t, code_range_start, 0x80);
    +
    393 assert_offset(global_context_t, code_range_end, 0x88);
    +
    394 assert_offset(global_context_t, secret_data, 0x108);
    +
    395 assert_offset(global_context_t, shift_operations, 0x141);
    +
    396 assert_offset(global_context_t, reg2reg_instructions_count, 0x160);
    +
    397 
    +
    404 typedef union {
    +
    405  struct {
    +
    407  u32 bit_index : 3;
    +
    409  u32 byte_index : 29;
    +
    410  };
    +
    412  u32 index;
    +
    413 } secret_data_shift_cursor;
    +
    414 
    +
    423 extern int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
    +
    424 
    +
    434 extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
    +
    435 
    +
    444 extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
    +
    445 
    +
    465 extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
    +
    466 
    +
    476 extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
    +
    477 
    +
    491 extern BOOL find_function_prologue_ex(
    +
    492  u8 *code_start,
    +
    493  u8 *func_start_0,
    +
    494  u8 *func_start_1,
    +
    495  u8 *search_base,
    +
    496  u8 *code_end,
    +
    497  FuncFindType find_mode);
    +
    498 
    +
    509 extern BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
    +
    510 
    +
    518 extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
    +
    519 
    +
    528 extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version);
    +
    529 
    +
    537 extern void *elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id);
    +
    538 
    +
    546 extern u64 elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
    +
    547 
    +
    554 extern lzma_allocator *get_lzma_allocator();
    +
    555 
    +
    566 extern BOOL secret_data_append_if_flags(
    +
    567  secret_data_shift_cursor shift_cursor,
    +
    568  unsigned operation_index,
    +
    569  unsigned reg2reg_instruction_count,
    +
    570  int flags, u8 *code);
    +
    571 
    +
    610 extern BOOL secret_data_append_singleton(
    +
    611  u8 *call_site, u8 *code,
    +
    612  secret_data_shift_cursor shift_cursor,
    +
    613  unsigned reg2reg_instruction_count, unsigned operation_index);
    +
    614 
    +
    615 #include "util.h"
    +
    616 #endif
    +
    secret_data_shift_cursor
    represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
    Definition: xzre.h:404
    +
    secret_data_shift_cursor::index
    u32 index
    Definition: xzre.h:412
    +
    secret_data_shift_cursor::bit_index
    u32 bit_index
    Definition: xzre.h:407
    +
    secret_data_shift_cursor::byte_index
    u32 byte_index
    Definition: xzre.h:409
    elf_parse
    BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
    Parses the given in-memory ELF file into elf_info.
    elf_symbol_get_addr
    void * elf_symbol_get_addr(elf_info_t *elf_info, u32 encoded_string_id)
    Looks up an ELF symbol from a parsed ELF, and returns its memory address.
    +
    elf_contains_vaddr
    BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags)
    checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memor...
    secret_data_append_singleton
    BOOL secret_data_append_singleton(u8 *call_site, u8 *code, secret_data_shift_cursor shift_cursor, unsigned reg2reg_instruction_count, unsigned operation_index)
    Shifts data in the secret data store, after validation of code. this function is intended to be invok...
    find_call_instruction
    BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
    finds a call instruction
    -
    elf_contains_segment
    BOOL elf_contains_segment(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags)
    checks if given ELF file contains an elf segment with the given parameters
    x86_dasm
    int x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end)
    disassembles the given x64 code
    find_function_prologue_ex
    BOOL find_function_prologue_ex(u8 *code_start, u8 *func_start_0, u8 *func_start_1, u8 *search_base, u8 *code_end, FuncFindType find_mode)
    locates the function prologue. it will try to backtrack and synchronize the code stream,...
    find_function_prologue
    BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode)
    locates the function prologue
    __attribute__
    struct __attribute__((packed))
    Definition: xzre.h:78
    -
    get_lzma_allocator
    lzma_allocator * get_lzma_allocator()
    gets the fake LZMA allocator, used for imports resolution
    +
    get_lzma_allocator
    lzma_allocator * get_lzma_allocator()
    gets the fake LZMA allocator, used for imports resolution the "opaque" field of the structure holds a...
    elf_symbol_get
    Elf64_Sym * elf_symbol_get(elf_info_t *elf_info, u32 encoded_string_id, const char *sym_version)
    Looks up an ELF symbol from a parsed ELF.
    secret_data_append_if_flags
    BOOL secret_data_append_if_flags(secret_data_shift_cursor shift_cursor, unsigned operation_index, unsigned reg2reg_instruction_count, int flags, u8 *code)
    Calls secret_data_append_singleton, if flags are non-zero.
    find_lea_instruction
    BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement)
    finds a lea instruction