get_got_offset() and get_cpuid_got_index()
+used by call_backdoor_init_stage2(), update_got_offset() and get_cpuid_got_index()
diff --git a/xzre_8h_source.html b/xzre_8h_source.html
index 7483707..53f74ab 100644
--- a/xzre_8h_source.html
+++ b/xzre_8h_source.html
@@ -1854,335 +1854,335 @@
-
-
-
-
-
-
-
- 2911 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2988 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 3029 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 3042 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3130 uptr *refcook, uptr *defcook,
-
- 3132 const char *symname);
-
-
-
-
-
- 3163 ptrdiff_t *libname_offset,
-
-
-
-
-
- 3191 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 3238 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3281 void **sensitive_data_out);
-
-
-
-
-
-
- 3302 void **sensitive_data_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3372 u8 *buffer, u64 bufferSize,
-
-
-
+
+
+
+
+
+
+
+ 2910 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2987 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 3028 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 3041 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3129 uptr *refcook, uptr *defcook,
+
+ 3131 const char *symname);
+
+
+
+
+
+ 3162 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 3190 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 3237 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3280 void **sensitive_data_out);
+
+
+
+
+
+
+ 3301 void **sensitive_data_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3371 u8 *buffer, u64 bufferSize,
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3453 u64 sshkey_digest_offset,
- 3454 u64 signed_data_size,
-
-
-
-
-
-
- 3472 BOOL skip_root_patch,
-
- 3474 BOOL replace_monitor_reqtype,
- 3475 int monitor_reqtype,
-
-
-
-
-
-
-
-
-
-
- 3503 u8 **code_start_out,
-
-
-
-
-
-
-
-
-
-
- 3541 void **monitor_field_ptr_out,
-
-
-
-
-
-
- 3559 void *mem_range_start,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3627 enum SocketMode socket_direction
-
-
-
-
-
-
-
-
-
-
-
- 3673 size_t *pOutPayloadSize,
-
-
-
-
- 3686 size_t payload_size,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3781 unsigned int num_pointers
-
-
-
-
-
-
-
-
-
-
-
-
- 3816 LogLevel level,
const char *fmt, ...);
-
-
-
-
-
-
-
-
-
-
-
-
- 3846 static_assert(
sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3452 u64 sshkey_digest_offset,
+ 3453 u64 signed_data_size,
+
+
+
+
+
+
+ 3471 BOOL skip_root_patch,
+
+ 3473 BOOL replace_monitor_reqtype,
+ 3474 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+ 3502 u8 **code_start_out,
+
+
+
+
+
+
+
+
+
+
+ 3540 void **monitor_field_ptr_out,
+
+
+
+
+
+
+ 3558 void *mem_range_start,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3626 enum SocketMode socket_direction
+
+
+
+
+
+
+
+
+
+
+
+ 3672 size_t *pOutPayloadSize,
+
+
+
+
+ 3685 size_t payload_size,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3780 unsigned int num_pointers
+
+
+
+
+
+
+
+
+
+
+
+
+ 3815 LogLevel level,
const char *fmt, ...);
+
+
+
+
+
+
+
+
+
+
+
+
+ 3845 static_assert(
sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding)
Definition: ssh_patch.c:37
u8 flags2
see InstructionFlags2
Definition: xzre.h:672
u8 flags
see InstructionFlags
Definition: xzre.h:668
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:648
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:653
BOOL is_payload_message(u8 *sshbuf_data, size_t sshbuf_size, size_t *pOutPayloadSize, global_context_t *ctx)
checks if the given sshbuf buffer contains a backdoor payload message
void * dummy_tls_get_addr(tls_index *ti)
a dummy function that calls __tls_get_addr, to make sure its GOT slot doesn't get removed by compiler...
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
void update_got_offset(elf_entry_ctx_t *ctx)
updates the offset to the GOT
struct gnu_hash_table gnu_hash_table_t
BOOL find_link_map_l_name(backdoor_data_handle_t *data_handle, ptrdiff_t *libname_offset, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find struct link_map offsets required to modify ld.so's private struct auditstate state.
BOOL find_dl_naudit(elf_info_t *dynamic_linker_elf, elf_info_t *libcrypto_elf, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find __rtld_global_ro offsets required to modify ld.so's private struct audit_ifaces state.
int mm_answer_authpassword_hook(struct ssh *ssh, int sock, struct sshbuf *m)
used to bypass password authentication by replying with a successful MONITOR_ANS_AUTHPASSWORD
BOOL secret_data_append_from_call_site(secret_data_shift_cursor_t shift_cursor, unsigned shift_count, unsigned operation_index, BOOL bypass)
Shifts data in the secret data store, after validation of the call site, i.e. the caller of this func...
BOOL sshd_find_monitor_struct(elf_info_t *elf, string_references_t *refs, global_context_t *ctx)
finds the pointer to struct monitor, and updates the global context in ctx with its location
ptrdiff_t get_got_offset(elf_entry_ctx_t *ctx)
get the offset to the GOT
void * update_got_address(elf_entry_ctx_t *entry_ctx)
finds the __tls_get_addr() GOT entry
BOOL secret_data_append_from_code(void *code_start, void *code_end, secret_data_shift_cursor_t shift_cursor, unsigned shift_count, BOOL start_from_call)
Pushes secret data by validating the given code block.
char * elf_find_string(elf_info_t *elf_info, EncodedStringId *stringId_inOut, void *rodata_start_ptr)
Locates a string in the ELF .rodata section.