| enum | InstructionFlags {
diff --git a/xzre_8h_source.html b/xzre_8h_source.html
index be061a3..120f1a6 100644
--- a/xzre_8h_source.html
+++ b/xzre_8h_source.html
@@ -324,2011 +324,2012 @@
302 #define XZDASM_OPC(op) (op - 0x80)
- 305 X86_OPCODE_LEA = 0x8D
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 338 DF2_MEM_SEG_OFFS = 0x4,
-
-
- 341 DF2_FLAGS_MEM = DF2_MEM_DISP | DF2_MEM_DISP8 | DF2_MEM_SEG_OFFS,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 389 X_ELF_DYNAMIC_LINKER = 1,
-
-
-
-
-
- 395 XREF_xcalloc_zero_size = 0,
- 396 XREF_Could_not_chdir_to_home_directory_s_s = 1,
- 397 XREF_list_hostkey_types = 2,
- 398 XREF_demote_sensitive_data = 3,
- 399 XREF_mm_terminate = 4,
- 400 XREF_mm_pty_allocate = 5,
- 401 XREF_mm_do_pam_account = 6,
- 402 XREF_mm_session_pty_cleanup2 = 7,
- 403 XREF_mm_getpwnamallow = 8,
- 404 XREF_mm_sshpam_init_ctx = 9,
- 405 XREF_mm_sshpam_query = 10,
- 406 XREF_mm_sshpam_respond = 11,
- 407 XREF_mm_sshpam_free_ctx = 12,
- 408 XREF_mm_choose_dh = 13,
- 409 XREF_sshpam_respond = 14,
- 410 XREF_sshpam_auth_passwd = 15,
- 411 XREF_sshpam_query = 16,
-
- 413 XREF_mm_request_send = 18,
- 414 XREF_mm_log_handler = 19,
- 415 XREF_Could_not_get_agent_socket = 20,
- 416 XREF_auth_root_allowed = 21,
- 417 XREF_mm_answer_authpassword = 22,
- 418 XREF_mm_answer_keyallowed = 23,
- 419 XREF_mm_answer_keyverify = 24,
- 420 XREF_48s_48s_d_pid_ld_ = 25,
- 421 XREF_Unrecognized_internal_syslog_level_code_d = 26
-
-
-
-
-
- 427 STR_48s_48s_d_pid_ld_ = 0xd8,
-
- 429 STR_usr_sbin_sshd = 0x108,
- 430 STR_Accepted_password_for = 0x870,
- 431 STR_Accepted_publickey_for = 0x1a0,
- 432 STR_BN_bin2bn = 0xc40,
- 433 STR_BN_bn2bin = 0x6d0,
-
-
- 436 STR_BN_num_bits = 0x4e0,
- 437 STR_Connection_closed_by = 0x790,
- 438 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
- 439 STR_Could_not_get_agent_socket = 0xb0,
-
- 441 STR_DSA_get0_pqg = 0x9d0,
- 442 STR_DSA_get0_pub_key = 0x468,
- 443 STR_EC_KEY_get0_group = 0x7e8,
- 444 STR_EC_KEY_get0_public_key = 0x268,
- 445 STR_EC_POINT_point2oct = 0x6e0,
- 446 STR_EVP_CIPHER_CTX_free = 0xb28,
- 447 STR_EVP_CIPHER_CTX_new = 0x838,
- 448 STR_EVP_DecryptFinal_ex = 0x2a8,
- 449 STR_EVP_DecryptInit_ex = 0xc08,
- 450 STR_EVP_DecryptUpdate = 0x3f0,
- 451 STR_EVP_Digest = 0xf8,
- 452 STR_EVP_DigestVerify = 0x408,
- 453 STR_EVP_DigestVerifyInit = 0x118,
- 454 STR_EVP_MD_CTX_free = 0xd10,
- 455 STR_EVP_MD_CTX_new = 0xaf8,
- 456 STR_EVP_PKEY_free = 0x6f8,
- 457 STR_EVP_PKEY_new_raw_public_key = 0x758,
- 458 STR_EVP_PKEY_set1_RSA = 0x510,
- 459 STR_EVP_chacha20 = 0xc28,
- 460 STR_EVP_sha256 = 0xc60,
-
- 462 STR_GLIBC_2_2_5 = 0x8c0,
- 463 STR_GLRO_dl_naudit_naudit = 0x6a8,
- 464 STR_KRB5CCNAME = 0x1e0,
- 465 STR_LD_AUDIT = 0xcf0,
- 466 STR_LD_BIND_NOT = 0xbc0,
- 467 STR_LD_DEBUG = 0xa90,
- 468 STR_LD_PROFILE = 0xb98,
- 469 STR_LD_USE_LOAD_BIAS = 0x3e0,
-
- 471 STR_RSA_free = 0xac0,
- 472 STR_RSA_get0_key = 0x798,
-
- 474 STR_RSA_public_decrypt = 0x1d0,
- 475 STR_RSA_set0_key = 0x540,
- 476 STR_RSA_sign = 0x8f8,
-
-
- 479 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
- 480 STR_WAYLAND_DISPLAY = 0x158,
- 481 STR_errno_location = 0x878,
- 482 STR_libc_stack_end = 0x2b0,
- 483 STR_libc_start_main = 0x228,
- 484 STR_dl_audit_preinit = 0xa60,
- 485 STR_dl_audit_symbind_alt = 0x9c8,
-
-
- 488 STR_rtld_global = 0x5b8,
- 489 STR_rtld_global_ro = 0xa98,
- 490 STR_auth_root_allowed = 0xb8,
- 491 STR_authenticating = 0x1d8,
- 492 STR_demote_sensitive_data = 0x28,
-
- 494 STR_ld_linux_x86_64_so = 0xa48,
-
- 496 STR_libcrypto_so = 0x7c0,
- 497 STR_liblzma_so = 0x590,
- 498 STR_libsystemd_so = 0x938,
- 499 STR_list_hostkey_types = 0x20,
- 500 STR_malloc_usable_size = 0x440,
- 501 STR_mm_answer_authpassword = 0xc0,
- 502 STR_mm_answer_keyallowed = 0xc8,
- 503 STR_mm_answer_keyverify = 0xd0,
- 504 STR_mm_answer_pam_start = 0x948,
- 505 STR_mm_choose_dh = 0x78,
- 506 STR_mm_do_pam_account = 0x40,
- 507 STR_mm_getpwnamallow = 0x50,
- 508 STR_mm_log_handler = 0xa8,
- 509 STR_mm_pty_allocate = 0x38,
- 510 STR_mm_request_send = 0xa0,
- 511 STR_mm_session_pty_cleanup2 = 0x48,
- 512 STR_mm_sshpam_free_ctx = 0x70,
- 513 STR_mm_sshpam_init_ctx = 0x58,
- 514 STR_mm_sshpam_query = 0x60,
- 515 STR_mm_sshpam_respond = 0x68,
- 516 STR_mm_terminate = 0x30,
- 517 STR_parse_PAM = 0xc58,
- 518 STR_password = 0x400,
-
-
- 521 STR_publickey = 0x7b8,
-
- 523 STR_rsa_sha2_256 = 0x710,
- 524 STR_setlogmask = 0x428,
- 525 STR_setresgid = 0x5f0,
- 526 STR_setresuid = 0xab8,
- 527 STR_shutdown = 0x760,
-
- 529 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
- 530 STR_sshpam_auth_passwd = 0x88,
- 531 STR_sshpam_query = 0x90,
- 532 STR_sshpam_respond = 0x80,
- 533 STR_start_pam = 0x98,
-
-
-
-
- 538 STR_xcalloc_zero_size = 0x10,
- 539 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
-
-
-
-
- 544 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
- 546 #define assert_offset(t, f, o)
-
-
- 549 #define CONCAT(x, y) x ## y
- 550 #define EXPAND(x, y) CONCAT(x, y)
- 551 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
-
-
-
-
- 557 #define PERMIT_NOT_SET -1
-
- 559 #define PERMIT_FORCED_ONLY 1
- 560 #define PERMIT_NO_PASSWD 2
-
-
-
-
-
-
-
-
-
-
-
-
- 579 struct sshkey **host_keys;
- 580 struct sshkey **host_pubkeys;
- 581 struct sshkey **host_certificates;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 611 struct sshbuf *sk_key_handle;
- 612 struct sshbuf *sk_reserved;
-
- 614 struct sshkey_cert *cert;
-
- 616 u8 *shielded_private;
-
-
- 619 size_t shield_prekey_len;
-
-
- 622 typedef struct __attribute__((packed)) got_ctx {
-
-
-
-
-
-
-
- 646 assert_offset( got_ctx_t, return_address, 0x8);
- 647 assert_offset( got_ctx_t, cpuid_fn, 0x10);
- 648 assert_offset( got_ctx_t, got_offset, 0x18);
- 649 static_assert( sizeof( got_ctx_t) == 0x20);
-
-
-
-
-
-
-
-
-
-
-
-
-
- 670 u64 instruction_size;
-
- 672 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 691 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 703 struct __attribute__((packed)) {
-
- 705 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 720 u64 operand_zeroextended;
-
-
-
-
-
-
- 727 assert_offset( dasm_ctx_t, instruction_size, 8);
-
-
- 730 assert_offset( dasm_ctx_t, lock_rep_byte, 0x14);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 750 assert_offset( dasm_ctx_t, operand_zeroextended, 0x40);
- 751 assert_offset( dasm_ctx_t, operand_size, 0x48);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 818 Elf64_Versym *versym;
- 819 Elf64_Rela *rela_relocs;
-
-
- 822 Elf64_Relr *relr_relocs;
-
-
-
-
-
- 836 u64 rodata_segment_start;
- 837 u64 rodata_segment_size;
- 838 u64 data_segment_start;
- 839 u64 data_segment_size;
- 840 u64 data_segment_alignment;
-
-
-
-
-
- 852 u32 gnu_hash_bloom_shift;
-
-
- 855 u32 *gnu_hash_buckets;
-
-
-
-
-
-
-
-
- 864 assert_offset( elf_info_t, dyn_num_entries, 0x28);
-
-
-
- 868 assert_offset( elf_info_t, plt_relocs_num, 0x48);
- 869 assert_offset( elf_info_t, gnurelro_found, 0x4C);
- 870 assert_offset( elf_info_t, gnurelro_vaddr, 0x50);
- 871 assert_offset( elf_info_t, gnurelro_memsize, 0x58);
-
-
-
-
- 876 assert_offset( elf_info_t, rela_relocs_num, 0x80);
-
- 878 assert_offset( elf_info_t, relr_relocs_num, 0x90);
- 879 assert_offset( elf_info_t, code_segment_start, 0x98);
- 880 assert_offset( elf_info_t, code_segment_size, 0xA0);
- 881 assert_offset( elf_info_t, rodata_segment_start, 0xA8);
- 882 assert_offset( elf_info_t, rodata_segment_size, 0xB0);
- 883 assert_offset( elf_info_t, data_segment_start, 0xB8);
- 884 assert_offset( elf_info_t, data_segment_size, 0xC0);
- 885 assert_offset( elf_info_t, data_segment_alignment, 0xC8);
-
- 887 assert_offset( elf_info_t, gnu_hash_nbuckets, 0xd8);
- 888 assert_offset( elf_info_t, gnu_hash_last_bloom, 0xdc);
- 889 assert_offset( elf_info_t, gnu_hash_bloom_shift, 0xe0);
- 890 assert_offset( elf_info_t, gnu_hash_bloom, 0xe8);
- 891 assert_offset( elf_info_t, gnu_hash_buckets, 0xf0);
- 892 assert_offset( elf_info_t, gnu_hash_chain, 0xf8);
-
-
-
- 896 u32 resolved_imports_count;
-
- 898 size_t (*malloc_usable_size)( void *ptr);
- 899 uid_t (*getuid)(void);
- 900 void (*exit)( int status);
- 901 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
- 902 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
- 903 int (*system)( const char *command);
- 904 ssize_t (*write)( int fd, const void *buf, size_t count);
-
- 906 int nfds, fd_set *readfds, fd_set *writefds,
- 907 fd_set *exceptfds, const struct timespec *timeout,
- 908 const sigset_t *sigmask);
- 909 ssize_t (*read)( int fd, void *buf, size_t count);
- 910 int *(*__errno_location)(void);
- 911 int (*setlogmask)( int mask);
- 912 int (*shutdown)( int sockfd, int how);
- 913 void *__libc_stack_end;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 932 typedef int (*pfn_RSA_public_decrypt_t)(
- 933 int flen, unsigned char *from, unsigned char *to,
- 934 RSA *rsa, int padding);
- 935 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
- 936 typedef void (*pfn_RSA_get0_key_t)(
-
- 938 const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
-
-
-
- 942 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
- 944 void (*RSA_get0_key_null)(
- 945 const RSA *r, const BIGNUM **n,
- 946 const BIGNUM **e, const BIGNUM **d);
-
-
-
- 962 void (*DSA_get0_pqg)(
- 963 const DSA *d, const BIGNUM **p,
- 964 const BIGNUM **q, const BIGNUM **g);
- 965 const BIGNUM *(*DSA_get0_pub_key)( const DSA *d);
- 966 size_t (*EC_POINT_point2oct)(
- 967 const EC_GROUP *group, const EC_POINT *p,
- 968 point_conversion_form_t form, unsigned char *buf,
- 969 size_t len, BN_CTX *ctx);
- 970 EC_POINT *(*EC_KEY_get0_public_key)( const EC_KEY *key);
- 971 const EC_GROUP *(*EC_KEY_get0_group)( const EC_KEY *key);
- 972 EVP_MD *(*EVP_sha256)(void);
- 973 pfn_RSA_get0_key_t RSA_get0_key;
- 974 int (*BN_num_bits)( const BIGNUM *a);
- 975 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
- 977 const unsigned char *key, size_t keylen);
- 978 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
- 979 int (*EVP_DigestVerifyInit)(
- 980 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
- 981 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
- 982 int (*EVP_DigestVerify)(
- 983 EVP_MD_CTX *ctx, const unsigned char *sig,
- 984 size_t siglen, const unsigned char *tbs, size_t tbslen);
- 985 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
- 986 void (*EVP_PKEY_free)(EVP_PKEY *key);
- 987 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
- 988 int (*EVP_DecryptInit_ex)(
- 989 EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
- 990 ENGINE *impl, const unsigned char *key, const unsigned char *iv);
- 991 int (*EVP_DecryptUpdate)(
- 992 EVP_CIPHER_CTX *ctx, unsigned char *out,
- 993 int *outl, const unsigned char *in, int inl);
- 994 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
- 995 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
- 996 const EVP_CIPHER *(*EVP_chacha20)(void);
- 997 RSA *(*RSA_new)(void);
- 998 BIGNUM *(*BN_dup)( const BIGNUM *from);
- 999 BIGNUM *(*BN_bin2bn)( const unsigned char *s, int len, BIGNUM *ret);
- 1000 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
- 1002 const void *data, size_t count, unsigned char *md,
- 1003 unsigned int *size, const EVP_MD *type, ENGINE *impl);
-
-
- 1006 const unsigned char *m, unsigned int m_len,
- 1007 unsigned char *sigret, unsigned int *siglen, RSA *rsa);
- 1008 int (*BN_bn2bin)( const BIGNUM *a, unsigned char *to);
- 1009 void (*RSA_free)(RSA *rsa);
- 1010 void (*BN_free)(BIGNUM *a);
-
- 1012 u32 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1058 typedef int (*sshd_monitor_func_t)( struct ssh *ssh, int sock, struct sshbuf *m);
-
-
- 1061 BOOL have_mm_answer_keyallowed;
- 1062 BOOL have_mm_answer_authpassword;
- 1063 BOOL have_mm_answer_keyverify;
-
-
- 1066 void *mm_answer_keyallowed;
- 1067 void *mm_answer_keyverify;
- 1068 void *mm_answer_authpassword_start;
- 1069 void *mm_answer_authpassword_end;
- 1070 sshd_monitor_func_t *mm_answer_authpassword_ptr;
- 1071 int monitor_reqtype_authpassword;
-
- 1073 void *mm_answer_keyallowed_start;
- 1074 void *mm_answer_keyallowed_end;
- 1075 void *mm_answer_keyallowed_ptr;
- 1076 u32 mm_answer_keyallowed_reqtype;
-
- 1078 void *mm_answer_keyverify_start;
- 1079 void *mm_answer_keyverify_end;
- 1080 void *mm_answer_keyverify_ptr;
-
-
-
-
-
+ 305 X86_OPCODE_LEA = 0x8D,
+ 306 X86_OPCODE_CALL = 0xE8
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 339 DF2_MEM_SEG_OFFS = 0x4,
+
+
+ 342 DF2_FLAGS_MEM = DF2_MEM_DISP | DF2_MEM_DISP8 | DF2_MEM_SEG_OFFS,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 390 X_ELF_DYNAMIC_LINKER = 1,
+
+
+
+
+
+ 396 XREF_xcalloc_zero_size = 0,
+ 397 XREF_Could_not_chdir_to_home_directory_s_s = 1,
+ 398 XREF_list_hostkey_types = 2,
+ 399 XREF_demote_sensitive_data = 3,
+ 400 XREF_mm_terminate = 4,
+ 401 XREF_mm_pty_allocate = 5,
+ 402 XREF_mm_do_pam_account = 6,
+ 403 XREF_mm_session_pty_cleanup2 = 7,
+ 404 XREF_mm_getpwnamallow = 8,
+ 405 XREF_mm_sshpam_init_ctx = 9,
+ 406 XREF_mm_sshpam_query = 10,
+ 407 XREF_mm_sshpam_respond = 11,
+ 408 XREF_mm_sshpam_free_ctx = 12,
+ 409 XREF_mm_choose_dh = 13,
+ 410 XREF_sshpam_respond = 14,
+ 411 XREF_sshpam_auth_passwd = 15,
+ 412 XREF_sshpam_query = 16,
+
+ 414 XREF_mm_request_send = 18,
+ 415 XREF_mm_log_handler = 19,
+ 416 XREF_Could_not_get_agent_socket = 20,
+ 417 XREF_auth_root_allowed = 21,
+ 418 XREF_mm_answer_authpassword = 22,
+ 419 XREF_mm_answer_keyallowed = 23,
+ 420 XREF_mm_answer_keyverify = 24,
+ 421 XREF_48s_48s_d_pid_ld_ = 25,
+ 422 XREF_Unrecognized_internal_syslog_level_code_d = 26
+
+
+
+
+
+ 428 STR_48s_48s_d_pid_ld_ = 0xd8,
+
+ 430 STR_usr_sbin_sshd = 0x108,
+ 431 STR_Accepted_password_for = 0x870,
+ 432 STR_Accepted_publickey_for = 0x1a0,
+ 433 STR_BN_bin2bn = 0xc40,
+ 434 STR_BN_bn2bin = 0x6d0,
+
+
+ 437 STR_BN_num_bits = 0x4e0,
+ 438 STR_Connection_closed_by = 0x790,
+ 439 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
+ 440 STR_Could_not_get_agent_socket = 0xb0,
+
+ 442 STR_DSA_get0_pqg = 0x9d0,
+ 443 STR_DSA_get0_pub_key = 0x468,
+ 444 STR_EC_KEY_get0_group = 0x7e8,
+ 445 STR_EC_KEY_get0_public_key = 0x268,
+ 446 STR_EC_POINT_point2oct = 0x6e0,
+ 447 STR_EVP_CIPHER_CTX_free = 0xb28,
+ 448 STR_EVP_CIPHER_CTX_new = 0x838,
+ 449 STR_EVP_DecryptFinal_ex = 0x2a8,
+ 450 STR_EVP_DecryptInit_ex = 0xc08,
+ 451 STR_EVP_DecryptUpdate = 0x3f0,
+ 452 STR_EVP_Digest = 0xf8,
+ 453 STR_EVP_DigestVerify = 0x408,
+ 454 STR_EVP_DigestVerifyInit = 0x118,
+ 455 STR_EVP_MD_CTX_free = 0xd10,
+ 456 STR_EVP_MD_CTX_new = 0xaf8,
+ 457 STR_EVP_PKEY_free = 0x6f8,
+ 458 STR_EVP_PKEY_new_raw_public_key = 0x758,
+ 459 STR_EVP_PKEY_set1_RSA = 0x510,
+ 460 STR_EVP_chacha20 = 0xc28,
+ 461 STR_EVP_sha256 = 0xc60,
+
+ 463 STR_GLIBC_2_2_5 = 0x8c0,
+ 464 STR_GLRO_dl_naudit_naudit = 0x6a8,
+ 465 STR_KRB5CCNAME = 0x1e0,
+ 466 STR_LD_AUDIT = 0xcf0,
+ 467 STR_LD_BIND_NOT = 0xbc0,
+ 468 STR_LD_DEBUG = 0xa90,
+ 469 STR_LD_PROFILE = 0xb98,
+ 470 STR_LD_USE_LOAD_BIAS = 0x3e0,
+
+ 472 STR_RSA_free = 0xac0,
+ 473 STR_RSA_get0_key = 0x798,
+
+ 475 STR_RSA_public_decrypt = 0x1d0,
+ 476 STR_RSA_set0_key = 0x540,
+ 477 STR_RSA_sign = 0x8f8,
+
+
+ 480 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
+ 481 STR_WAYLAND_DISPLAY = 0x158,
+ 482 STR_errno_location = 0x878,
+ 483 STR_libc_stack_end = 0x2b0,
+ 484 STR_libc_start_main = 0x228,
+ 485 STR_dl_audit_preinit = 0xa60,
+ 486 STR_dl_audit_symbind_alt = 0x9c8,
+
+
+ 489 STR_rtld_global = 0x5b8,
+ 490 STR_rtld_global_ro = 0xa98,
+ 491 STR_auth_root_allowed = 0xb8,
+ 492 STR_authenticating = 0x1d8,
+ 493 STR_demote_sensitive_data = 0x28,
+
+ 495 STR_ld_linux_x86_64_so = 0xa48,
+
+ 497 STR_libcrypto_so = 0x7c0,
+ 498 STR_liblzma_so = 0x590,
+ 499 STR_libsystemd_so = 0x938,
+ 500 STR_list_hostkey_types = 0x20,
+ 501 STR_malloc_usable_size = 0x440,
+ 502 STR_mm_answer_authpassword = 0xc0,
+ 503 STR_mm_answer_keyallowed = 0xc8,
+ 504 STR_mm_answer_keyverify = 0xd0,
+ 505 STR_mm_answer_pam_start = 0x948,
+ 506 STR_mm_choose_dh = 0x78,
+ 507 STR_mm_do_pam_account = 0x40,
+ 508 STR_mm_getpwnamallow = 0x50,
+ 509 STR_mm_log_handler = 0xa8,
+ 510 STR_mm_pty_allocate = 0x38,
+ 511 STR_mm_request_send = 0xa0,
+ 512 STR_mm_session_pty_cleanup2 = 0x48,
+ 513 STR_mm_sshpam_free_ctx = 0x70,
+ 514 STR_mm_sshpam_init_ctx = 0x58,
+ 515 STR_mm_sshpam_query = 0x60,
+ 516 STR_mm_sshpam_respond = 0x68,
+ 517 STR_mm_terminate = 0x30,
+ 518 STR_parse_PAM = 0xc58,
+ 519 STR_password = 0x400,
+
+
+ 522 STR_publickey = 0x7b8,
+
+ 524 STR_rsa_sha2_256 = 0x710,
+ 525 STR_setlogmask = 0x428,
+ 526 STR_setresgid = 0x5f0,
+ 527 STR_setresuid = 0xab8,
+ 528 STR_shutdown = 0x760,
+
+ 530 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
+ 531 STR_sshpam_auth_passwd = 0x88,
+ 532 STR_sshpam_query = 0x90,
+ 533 STR_sshpam_respond = 0x80,
+ 534 STR_start_pam = 0x98,
+
+
+
+
+ 539 STR_xcalloc_zero_size = 0x10,
+ 540 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
+
+
+
+
+ 545 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
+ 547 #define assert_offset(t, f, o)
+
+
+ 550 #define CONCAT(x, y) x ## y
+ 551 #define EXPAND(x, y) CONCAT(x, y)
+ 552 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
+
+
+
+
+ 558 #define PERMIT_NOT_SET -1
+
+ 560 #define PERMIT_FORCED_ONLY 1
+ 561 #define PERMIT_NO_PASSWD 2
+
+
+
+
+
+
+
+
+
+
+
+
+ 580 struct sshkey **host_keys;
+ 581 struct sshkey **host_pubkeys;
+ 582 struct sshkey **host_certificates;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 612 struct sshbuf *sk_key_handle;
+ 613 struct sshbuf *sk_reserved;
+
+ 615 struct sshkey_cert *cert;
+
+ 617 u8 *shielded_private;
+
+
+ 620 size_t shield_prekey_len;
+
+
+ 623 typedef struct __attribute__((packed)) got_ctx {
+
+
+
+
+
+
+
+ 647 assert_offset( got_ctx_t, return_address, 0x8);
+ 648 assert_offset( got_ctx_t, cpuid_fn, 0x10);
+ 649 assert_offset( got_ctx_t, got_offset, 0x18);
+ 650 static_assert( sizeof( got_ctx_t) == 0x20);
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 671 u64 instruction_size;
+
+ 673 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 692 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 704 struct __attribute__((packed)) {
+
+ 706 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 721 u64 operand_zeroextended;
+
+
+
+
+
+
+ 728 assert_offset( dasm_ctx_t, instruction_size, 8);
+
+
+ 731 assert_offset( dasm_ctx_t, lock_rep_byte, 0x14);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 751 assert_offset( dasm_ctx_t, operand_zeroextended, 0x40);
+ 752 assert_offset( dasm_ctx_t, operand_size, 0x48);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 819 Elf64_Versym *versym;
+ 820 Elf64_Rela *rela_relocs;
+
+
+ 823 Elf64_Relr *relr_relocs;
+
+
+
+
+
+ 837 u64 rodata_segment_start;
+ 838 u64 rodata_segment_size;
+ 839 u64 data_segment_start;
+ 840 u64 data_segment_size;
+ 841 u64 data_segment_alignment;
+
+
+
+
+
+ 853 u32 gnu_hash_bloom_shift;
+
+
+ 856 u32 *gnu_hash_buckets;
+
+
+
+
+
+
+
+
+ 865 assert_offset( elf_info_t, dyn_num_entries, 0x28);
+
+
+
+ 869 assert_offset( elf_info_t, plt_relocs_num, 0x48);
+ 870 assert_offset( elf_info_t, gnurelro_found, 0x4C);
+ 871 assert_offset( elf_info_t, gnurelro_vaddr, 0x50);
+ 872 assert_offset( elf_info_t, gnurelro_memsize, 0x58);
+
+
+
+
+ 877 assert_offset( elf_info_t, rela_relocs_num, 0x80);
+
+ 879 assert_offset( elf_info_t, relr_relocs_num, 0x90);
+ 880 assert_offset( elf_info_t, code_segment_start, 0x98);
+ 881 assert_offset( elf_info_t, code_segment_size, 0xA0);
+ 882 assert_offset( elf_info_t, rodata_segment_start, 0xA8);
+ 883 assert_offset( elf_info_t, rodata_segment_size, 0xB0);
+ 884 assert_offset( elf_info_t, data_segment_start, 0xB8);
+ 885 assert_offset( elf_info_t, data_segment_size, 0xC0);
+ 886 assert_offset( elf_info_t, data_segment_alignment, 0xC8);
+
+ 888 assert_offset( elf_info_t, gnu_hash_nbuckets, 0xd8);
+ 889 assert_offset( elf_info_t, gnu_hash_last_bloom, 0xdc);
+ 890 assert_offset( elf_info_t, gnu_hash_bloom_shift, 0xe0);
+ 891 assert_offset( elf_info_t, gnu_hash_bloom, 0xe8);
+ 892 assert_offset( elf_info_t, gnu_hash_buckets, 0xf0);
+ 893 assert_offset( elf_info_t, gnu_hash_chain, 0xf8);
+
+
+
+ 897 u32 resolved_imports_count;
+
+ 899 size_t (*malloc_usable_size)( void *ptr);
+ 900 uid_t (*getuid)(void);
+ 901 void (*exit)( int status);
+ 902 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+ 903 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+ 904 int (*system)( const char *command);
+ 905 ssize_t (*write)( int fd, const void *buf, size_t count);
+
+ 907 int nfds, fd_set *readfds, fd_set *writefds,
+ 908 fd_set *exceptfds, const struct timespec *timeout,
+ 909 const sigset_t *sigmask);
+ 910 ssize_t (*read)( int fd, void *buf, size_t count);
+ 911 int *(*__errno_location)(void);
+ 912 int (*setlogmask)( int mask);
+ 913 int (*shutdown)( int sockfd, int how);
+ 914 void *__libc_stack_end;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 933 typedef int (*pfn_RSA_public_decrypt_t)(
+ 934 int flen, unsigned char *from, unsigned char *to,
+ 935 RSA *rsa, int padding);
+ 936 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
+ 937 typedef void (*pfn_RSA_get0_key_t)(
+
+ 939 const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
+
+
+
+ 943 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
+ 945 void (*RSA_get0_key_null)(
+ 946 const RSA *r, const BIGNUM **n,
+ 947 const BIGNUM **e, const BIGNUM **d);
+
+
+
+ 963 void (*DSA_get0_pqg)(
+ 964 const DSA *d, const BIGNUM **p,
+ 965 const BIGNUM **q, const BIGNUM **g);
+ 966 const BIGNUM *(*DSA_get0_pub_key)( const DSA *d);
+ 967 size_t (*EC_POINT_point2oct)(
+ 968 const EC_GROUP *group, const EC_POINT *p,
+ 969 point_conversion_form_t form, unsigned char *buf,
+ 970 size_t len, BN_CTX *ctx);
+ 971 EC_POINT *(*EC_KEY_get0_public_key)( const EC_KEY *key);
+ 972 const EC_GROUP *(*EC_KEY_get0_group)( const EC_KEY *key);
+ 973 EVP_MD *(*EVP_sha256)(void);
+ 974 pfn_RSA_get0_key_t RSA_get0_key;
+ 975 int (*BN_num_bits)( const BIGNUM *a);
+ 976 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
+ 978 const unsigned char *key, size_t keylen);
+ 979 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+ 980 int (*EVP_DigestVerifyInit)(
+ 981 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+ 982 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+ 983 int (*EVP_DigestVerify)(
+ 984 EVP_MD_CTX *ctx, const unsigned char *sig,
+ 985 size_t siglen, const unsigned char *tbs, size_t tbslen);
+ 986 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+ 987 void (*EVP_PKEY_free)(EVP_PKEY *key);
+ 988 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+ 989 int (*EVP_DecryptInit_ex)(
+ 990 EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
+ 991 ENGINE *impl, const unsigned char *key, const unsigned char *iv);
+ 992 int (*EVP_DecryptUpdate)(
+ 993 EVP_CIPHER_CTX *ctx, unsigned char *out,
+ 994 int *outl, const unsigned char *in, int inl);
+ 995 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
+ 996 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+ 997 const EVP_CIPHER *(*EVP_chacha20)(void);
+ 998 RSA *(*RSA_new)(void);
+ 999 BIGNUM *(*BN_dup)( const BIGNUM *from);
+ 1000 BIGNUM *(*BN_bin2bn)( const unsigned char *s, int len, BIGNUM *ret);
+ 1001 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+ 1003 const void *data, size_t count, unsigned char *md,
+ 1004 unsigned int *size, const EVP_MD *type, ENGINE *impl);
+
+
+ 1007 const unsigned char *m, unsigned int m_len,
+ 1008 unsigned char *sigret, unsigned int *siglen, RSA *rsa);
+ 1009 int (*BN_bn2bin)( const BIGNUM *a, unsigned char *to);
+ 1010 void (*RSA_free)(RSA *rsa);
+ 1011 void (*BN_free)(BIGNUM *a);
+
+ 1013 u32 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1059 typedef int (*sshd_monitor_func_t)( struct ssh *ssh, int sock, struct sshbuf *m);
+
+
+ 1062 BOOL have_mm_answer_keyallowed;
+ 1063 BOOL have_mm_answer_authpassword;
+ 1064 BOOL have_mm_answer_keyverify;
+
+
+ 1067 void *mm_answer_keyallowed;
+ 1068 void *mm_answer_keyverify;
+ 1069 void *mm_answer_authpassword_start;
+ 1070 void *mm_answer_authpassword_end;
+ 1071 sshd_monitor_func_t *mm_answer_authpassword_ptr;
+ 1072 int monitor_reqtype_authpassword;
+
+ 1074 void *mm_answer_keyallowed_start;
+ 1075 void *mm_answer_keyallowed_end;
+ 1076 void *mm_answer_keyallowed_ptr;
+ 1077 u32 mm_answer_keyallowed_reqtype;
+
+ 1079 void *mm_answer_keyverify_start;
+ 1080 void *mm_answer_keyverify_end;
+ 1081 void *mm_answer_keyverify_ptr;
+
+
+
+
- 1087 char *STR_unknown_ptr;
- 1088 void *mm_request_send_start;
- 1089 void *mm_request_send_end;
- 1090 PADDING( sizeof(u32));
+
+ 1088 char *STR_unknown_ptr;
+ 1089 void *mm_request_send_start;
+ 1090 void *mm_request_send_end;
1091 PADDING( sizeof(u32));
-
- 1093 int *permit_root_login_ptr;
- 1094 char *STR_without_password;
- 1095 char *STR_publickey;
-
-
- 1098 assert_offset( sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
- 1099 assert_offset( sshd_ctx_t, have_mm_answer_authpassword, 0x4);
- 1100 assert_offset( sshd_ctx_t, have_mm_answer_keyverify, 0x8);
-
- 1102 assert_offset( sshd_ctx_t, mm_answer_keyallowed, 0x18);
- 1103 assert_offset( sshd_ctx_t, mm_answer_keyverify, 0x20);
- 1104 assert_offset( sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 1105 assert_offset( sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 1106 assert_offset( sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
- 1107 assert_offset( sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
- 1108 assert_offset( sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 1109 assert_offset( sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 1110 assert_offset( sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
- 1111 assert_offset( sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
- 1112 assert_offset( sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 1113 assert_offset( sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 1114 assert_offset( sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
- 1115 assert_offset( sshd_ctx_t, writebuf_size, 0x84);
-
- 1117 assert_offset( sshd_ctx_t, STR_unknown_ptr, 0xA0);
- 1118 assert_offset( sshd_ctx_t, mm_request_send_start, 0xA8);
- 1119 assert_offset( sshd_ctx_t, mm_request_send_end, 0xB0);
- 1120 assert_offset( sshd_ctx_t, use_pam_ptr, 0xC0);
- 1121 assert_offset( sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 1122 assert_offset( sshd_ctx_t, STR_without_password, 0xD0);
- 1123 assert_offset( sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
-
-
-
- 1130 SYSLOG_LEVEL_VERBOSE,
- 1131 SYSLOG_LEVEL_DEBUG1,
- 1132 SYSLOG_LEVEL_DEBUG2,
- 1133 SYSLOG_LEVEL_DEBUG3,
- 1134 SYSLOG_LEVEL_NOT_SET = -1
-
-
- 1137 typedef void (*log_handler_fn)(
-
-
-
-
-
-
- 1144 BOOL logging_disabled;
- 1145 BOOL log_hooking_possible;
- 1146 BOOL syslog_disabled;
-
- 1148 char *STR_percent_s;
- 1149 char *STR_Connection_closed_by;
-
- 1151 char *STR_authenticating;
-
-
-
- 1155 void *log_handler_ptr;
- 1156 void *log_handler_ctx_ptr;
- 1157 log_handler_fn orig_log_handler;
- 1158 void *orig_log_handler_ctx;
-
- 1160 void (*mm_log_handler)( int level, int forced, const char *msg, void *ctx);
-
-
-
-
-
+ 1092 PADDING( sizeof(u32));
+
+ 1094 int *permit_root_login_ptr;
+ 1095 char *STR_without_password;
+ 1096 char *STR_publickey;
+
+
+ 1099 assert_offset( sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+ 1100 assert_offset( sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+ 1101 assert_offset( sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+
+ 1103 assert_offset( sshd_ctx_t, mm_answer_keyallowed, 0x18);
+ 1104 assert_offset( sshd_ctx_t, mm_answer_keyverify, 0x20);
+ 1105 assert_offset( sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 1106 assert_offset( sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 1107 assert_offset( sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
+ 1108 assert_offset( sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
+ 1109 assert_offset( sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 1110 assert_offset( sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 1111 assert_offset( sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
+ 1112 assert_offset( sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
+ 1113 assert_offset( sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 1114 assert_offset( sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 1115 assert_offset( sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
+ 1116 assert_offset( sshd_ctx_t, writebuf_size, 0x84);
+
+ 1118 assert_offset( sshd_ctx_t, STR_unknown_ptr, 0xA0);
+ 1119 assert_offset( sshd_ctx_t, mm_request_send_start, 0xA8);
+ 1120 assert_offset( sshd_ctx_t, mm_request_send_end, 0xB0);
+ 1121 assert_offset( sshd_ctx_t, use_pam_ptr, 0xC0);
+ 1122 assert_offset( sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 1123 assert_offset( sshd_ctx_t, STR_without_password, 0xD0);
+ 1124 assert_offset( sshd_ctx_t, STR_publickey, 0xD8);
+
+
+
+
+
+
+ 1131 SYSLOG_LEVEL_VERBOSE,
+ 1132 SYSLOG_LEVEL_DEBUG1,
+ 1133 SYSLOG_LEVEL_DEBUG2,
+ 1134 SYSLOG_LEVEL_DEBUG3,
+ 1135 SYSLOG_LEVEL_NOT_SET = -1
+
+
+ 1138 typedef void (*log_handler_fn)(
+
+
+
+
+
+
+ 1145 BOOL logging_disabled;
+ 1146 BOOL log_hooking_possible;
+ 1147 BOOL syslog_disabled;
+
+ 1149 char *STR_percent_s;
+ 1150 char *STR_Connection_closed_by;
+
+ 1152 char *STR_authenticating;
+
+
+
+ 1156 void *log_handler_ptr;
+ 1157 void *log_handler_ctx_ptr;
+ 1158 log_handler_fn orig_log_handler;
+ 1159 void *orig_log_handler_ctx;
+
+ 1161 void (*mm_log_handler)( int level, int forced, const char *msg, void *ctx);
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1181 struct __attribute__((packed)) {
-
-
-
-
-
-
-
- 1189 struct __attribute__((packed)) {
- 1190 u8 sshbuf_data_qword_index;
- 1191 u8 sshbuf_size_qword_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1249 struct monitor **struct_monitor_ptr_address;
-
-
-
-
-
-
-
-
-
-
-
-
- 1286 u64 sock_read_buf_size;
- 1287 u8 sock_read_buf[64];
- 1288 u64 payload_data_size;
-
-
-
-
- 1293 u32 sshd_host_pubkey_idx;
-
- 1298 u8 secret_data[ED448_KEY_SIZE];
- 1304 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1349 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1452 void (*_dl_audit_symbind_alt)( struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
-
- 1462 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1468 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
- 1473 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1475 u64 hooks_installed;
-
-
- 1478 assert_offset( ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1479 assert_offset( ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1480 assert_offset( ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1481 assert_offset( ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1482 assert_offset( ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1483 assert_offset( ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1484 assert_offset( ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1485 assert_offset( ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1486 assert_offset( ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1488 assert_offset( ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1489 assert_offset( ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1490 assert_offset( ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
- 1491 assert_offset( ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
- 1492 assert_offset( ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1493 assert_offset( ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1495 assert_offset( ldso_ctx_t, hooks_installed, 0x130);
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1182 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+ 1190 struct __attribute__((packed)) {
+ 1191 u8 sshbuf_data_qword_index;
+ 1192 u8 sshbuf_size_qword_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1250 struct monitor **struct_monitor_ptr_address;
+
+
+
+
+
+
+
+
+
+
+
+
+ 1287 u64 sock_read_buf_size;
+ 1288 u8 sock_read_buf[64];
+ 1289 u64 payload_data_size;
+
+
+
+
+ 1294 u32 sshd_host_pubkey_idx;
+
+ 1299 u8 secret_data[ED448_KEY_SIZE];
+ 1305 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1350 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1453 void (*_dl_audit_symbind_alt)( struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
+
+ 1463 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1469 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+ 1474 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1476 u64 hooks_installed;
+
+
+ 1479 assert_offset( ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1480 assert_offset( ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1481 assert_offset( ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1482 assert_offset( ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1483 assert_offset( ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1484 assert_offset( ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1485 assert_offset( ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1486 assert_offset( ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1487 assert_offset( ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1489 assert_offset( ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1490 assert_offset( ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1491 assert_offset( ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+ 1492 assert_offset( ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+ 1493 assert_offset( ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1494 assert_offset( ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1496 assert_offset( ldso_ctx_t, hooks_installed, 0x130);
+
-
-
-
-
-
-
-
- 1506 u64 signed_data_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1524 uintptr_t (*symbind64)(
- 1525 Elf64_Sym *sym, unsigned int ndx,
- 1526 uptr *refcook, uptr *defcook,
- 1527 unsigned int flags, const char *symname);
- 1528 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1529 pfn_RSA_get0_key_t hook_RSA_get0_key;
- 1530 log_handler_fn mm_log_handler;
- 1531 PADDING( sizeof( void *));
+
+
+
+
+
+
+
+
+ 1507 u64 signed_data_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1525 uintptr_t (*symbind64)(
+ 1526 Elf64_Sym *sym, unsigned int ndx,
+ 1527 uptr *refcook, uptr *defcook,
+ 1528 unsigned int flags, const char *symname);
+ 1529 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1530 pfn_RSA_get0_key_t hook_RSA_get0_key;
+ 1531 log_handler_fn mm_log_handler;
1532 PADDING( sizeof( void *));
- 1533 sshd_monitor_func_t mm_answer_keyallowed;
- 1534 sshd_monitor_func_t mm_answer_keyverify;
- 1535 PADDING( sizeof( void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1591 Elf64_Ehdr *dynamic_linker_ehdr;
- 1592 void **__libc_stack_end;
-
-
-
- 1596 assert_offset( main_elf_t, dynamic_linker_ehdr, 0x8);
- 1597 assert_offset( main_elf_t, __libc_stack_end, 0x10);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1661 struct link_map *liblzma_map;
- 1662 struct link_map *libcrypto_map;
- 1663 struct link_map *libsystemd_map;
- 1664 struct link_map *libc_map;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1701 lzma_allocator fake_allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1777 u32 operation_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1800 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 1814 u8 signature[ED448_SIGNATURE_SIZE];
-
-
-
-
-
-
-
-
-
-
-
-
- 1832 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
-
-
-
-
-
-
-
-
-
-
-
-
- 1871 X_FLAGS2_AUTH_BYPASS = 0x4,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1909 const BIGNUM *rsa_n;
- 1910 const BIGNUM *rsa_e;
-
-
- 1913 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
- 1914 u8 ivec[CHACHA20_IV_SIZE];
- 1915 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
- 1922 assert_offset( key_ctx_t, payload, 0x15);
-
- 1924 assert_offset( key_ctx_t, ed448_key, 0x27D);
-
-
-
-
-
- 1934 const BIGNUM *rsa_n;
- 1935 const BIGNUM *rsa_e;
-
- 1937 u16 payload_body_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1956 struct timespec timespec;
-
-
-
-
-
-
-
-
-
-
- 1971 u64 hostkey_hash_offset;
-
- 1973 u8 *payload_data_ptr;
-
-
-
-
-
-
-
-
- 1982 struct __attribute__((packed)) {
-
-
-
-
- 1987 struct __attribute__((packed)) {
-
- 1989 u64 num_host_pubkeys;
- 1990 u8 ed448_key[ED448_KEY_SIZE];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ 1533 PADDING( sizeof( void *));
+ 1534 sshd_monitor_func_t mm_answer_keyallowed;
+ 1535 sshd_monitor_func_t mm_answer_keyverify;
+ 1536 PADDING( sizeof( void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1592 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1593 void **__libc_stack_end;
+
+
+
+ 1597 assert_offset( main_elf_t, dynamic_linker_ehdr, 0x8);
+ 1598 assert_offset( main_elf_t, __libc_stack_end, 0x10);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1662 struct link_map *liblzma_map;
+ 1663 struct link_map *libcrypto_map;
+ 1664 struct link_map *libsystemd_map;
+ 1665 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1702 lzma_allocator fake_allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1778 u32 operation_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1801 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 1815 u8 signature[ED448_SIGNATURE_SIZE];
+
+
+
+
+
+
+
+
+
+
+
+
+ 1833 #define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
+
+
+
+
+
+
+
+
+
+
+
+
+ 1872 X_FLAGS2_AUTH_BYPASS = 0x4,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1910 const BIGNUM *rsa_n;
+ 1911 const BIGNUM *rsa_e;
+
+
+ 1914 PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
+ 1915 u8 ivec[CHACHA20_IV_SIZE];
+ 1916 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+ 1923 assert_offset( key_ctx_t, payload, 0x15);
+
+ 1925 assert_offset( key_ctx_t, ed448_key, 0x27D);
+
+
+
+
+
+ 1935 const BIGNUM *rsa_n;
+ 1936 const BIGNUM *rsa_e;
+
+ 1938 u16 payload_body_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1957 struct timespec timespec;
+
+
+
+
+
+
+
+
+
+
+ 1972 u64 hostkey_hash_offset;
+
+ 1974 u8 *payload_data_ptr;
+
+
+
+
+
+
+
+
+ 1983 struct __attribute__((packed)) {
+
+
+
+
+ 1988 struct __attribute__((packed)) {
+
+ 1990 u64 num_host_pubkeys;
+ 1991 u8 ed448_key[ED448_KEY_SIZE];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2061 PADDING( sizeof(u64));
-
- 2068 PADDING( sizeof(u64));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2062 PADDING( sizeof(u64));
+
2069 PADDING( sizeof(u64));
-
- 2076 PADDING( sizeof(u64));
-
-
-
-
-
-
-
-
-
- 2091 PADDING( sizeof(u64));
- 2092 lzma_allocator allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2122 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ 2070 PADDING( sizeof(u64));
+
+ 2077 PADDING( sizeof(u64));
+
+
+
+
+
+
+
+
+
+ 2092 PADDING( sizeof(u64));
+ 2093 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2123 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2255 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 2278 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2344 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2398 FuncFindType find_mode);
-
-
-
-
-
-
-
-
-
-
-
- 2457 extern char *check_argument( char arg_first_char, char* arg_name);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2570 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2604 StringXrefId xref_id,
- 2605 void **pOutCodeStart, void **pOutCodeEnd,
-
-
-
-
-
-
- 2624 EncodedStringId *stringId_inOut,
- 2625 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2695 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2709 unsigned operation_index,
- 2710 unsigned shift_count,
- 2711 int index, u8 *code);
-
-
-
-
-
-
-
-
-
- 2739 unsigned shift_count, unsigned operation_index);
-
-
- 2784 u8 *call_site, u8 *code,
-
- 2786 unsigned shift_count, unsigned operation_index);
-
-
-
- 2801 unsigned shift_count, unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2918 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2995 extern EncodedStringId get_string_id( const char *string_begin, const char *string_end);
-
- 3036 extern unsigned int _get_cpuid_modified( unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
-
- 3049 extern void _cpuid_gcc( unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3137 uptr *refcook, uptr *defcook,
-
- 3139 const char *symname);
-
-
-
-
-
- 3170 ptrdiff_t *libname_offset,
-
-
-
-
-
- 3198 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 3245 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3288 void **sensitive_data_out);
-
-
-
-
-
-
- 3309 void **sensitive_data_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3379 u8 *buffer, u64 bufferSize,
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2256 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 2279 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2345 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2399 FuncFindType find_mode);
+
+
+
+
+
+
+
+
+
+
+
+ 2458 extern char *check_argument( char arg_first_char, char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2571 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2605 StringXrefId xref_id,
+ 2606 void **pOutCodeStart, void **pOutCodeEnd,
+
+
+
+
+
+
+ 2625 EncodedStringId *stringId_inOut,
+ 2626 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2696 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2710 unsigned operation_index,
+ 2711 unsigned shift_count,
+ 2712 int index, u8 *code);
+
+
+
+
+
+
+
+
+
+ 2740 unsigned shift_count, unsigned operation_index);
+
+
+ 2785 u8 *call_site, u8 *code,
+
+ 2787 unsigned shift_count, unsigned operation_index);
+
+
+
+ 2802 unsigned shift_count, unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2919 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2996 extern EncodedStringId get_string_id( const char *string_begin, const char *string_end);
+
+ 3037 extern unsigned int _get_cpuid_modified( unsigned int leaf, unsigned int *eax, unsigned int *ebx, unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
+
+ 3050 extern void _cpuid_gcc( unsigned int level, unsigned int *a, unsigned int *b, unsigned int *c, unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3138 uptr *refcook, uptr *defcook,
+
+ 3140 const char *symname);
+
+
+
+
+
+ 3171 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 3199 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 3246 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3289 void **sensitive_data_out);
+
+
+
+
+
+
+ 3310 void **sensitive_data_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3380 u8 *buffer, u64 bufferSize,
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3460 u64 sshkey_digest_offset,
- 3461 u64 signed_data_size,
-
-
-
-
-
-
- 3479 BOOL skip_root_patch,
-
- 3481 BOOL replace_monitor_reqtype,
- 3482 int monitor_reqtype,
-
-
-
-
-
-
-
-
-
-
- 3510 u8 **code_start_out,
-
-
-
-
-
-
-
-
-
-
- 3548 void **monitor_field_ptr_out,
-
-
-
-
-
-
- 3566 void *mem_range_start,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3634 enum SocketMode socket_direction
-
-
-
-
-
-
-
-
-
-
-
- 3680 size_t *pOutPayloadSize,
-
-
-
-
- 3693 size_t payload_size,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3788 unsigned int num_pointers
-
-
-
-
-
-
-
-
-
-
-
-
- 3823 LogLevel level, const char *fmt, ...);
-
-
-
-
-
-
-
-
-
-
-
-
- 3853 static_assert( sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3461 u64 sshkey_digest_offset,
+ 3462 u64 signed_data_size,
+
+
+
+
+
+
+ 3480 BOOL skip_root_patch,
+
+ 3482 BOOL replace_monitor_reqtype,
+ 3483 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+ 3511 u8 **code_start_out,
+
+
+
+
+
+
+
+
+
+
+ 3549 void **monitor_field_ptr_out,
+
+
+
+
+
+
+ 3567 void *mem_range_start,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3635 enum SocketMode socket_direction
+
+
+
+
+
+
+
+
+
+
+
+ 3681 size_t *pOutPayloadSize,
+
+
+
+
+ 3694 size_t payload_size,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3789 unsigned int num_pointers
+
+
+
+
+
+
+
+
+
+
+
+
+ 3824 LogLevel level, const char *fmt, ...);
+
+
+
+
+
+
+
+
+
+
+
+
+ 3854 static_assert( sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding) Definition: ssh_patch.c:37 ptrdiff_t backdoor_init_stage2_got_offset offset from the symbol backdoor_init_stage2() to the GOT Definition: xzre.h:2033 ptrdiff_t cpuid_random_symbol_got_offset offset from the symbol cpuid_random_symbol to the GOT Definition: xzre.h:2021 u64 cpuid_got_index index in the GOT for _cpuid() Definition: xzre.h:2027 data passed to functions that access the backdoor data Definition: xzre.h:1605 this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1650 libc_imports_t libc_imports functions imported from libc Definition: xzre.h:1695 string_references_t string_refs information about resolved string references and the containing functions boundaries Definition: xzre.h:1700 struct link_map * main_map this is for sshd itself Definition: xzre.h:1655 elf_info_t libc_info ELF context for libc.so. Definition: xzre.h:1685 elf_info_t libcrypto_info ELF context for libcrypto.so. Definition: xzre.h:1690 elf_info_t dynamic_linker_info ELF context for ld.so. Definition: xzre.h:1681 elf_info_t main_info this is for sshd itself Definition: xzre.h:1675 lzma_allocator * import_resolver ELF import resolver (fake LZMA allocator) Definition: xzre.h:1705 struct link_map * dynamic_linker_map this is for ld.so Definition: xzre.h:1660 void * EVP_PKEY_set1_RSA_plt address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd Definition: xzre.h:1739 void * RSA_get0_key_plt address of the PLT for RSA_get0_key_plt() in sshd Definition: xzre.h:1744 void * RSA_public_decrypt_plt address of the PLT for RSA_public_decrypt() in sshd Definition: xzre.h:1734 ptrdiff_t tls_get_addr_plt_offset offset from the symbol __tls_get_addr() to the PLT Definition: xzre.h:2047 ptrdiff_t tls_get_addr_random_symbol_got_offset offset from the symbol tls_get_addr_random_symbol to the GOT Definition: xzre.h:2053 u8 flags2 see InstructionFlags2 Definition: xzre.h:680 u8 flags see InstructionFlags Definition: xzre.h:676 void * symbol_ptr points to a symbol in memory will be used to find the GOT value Definition: xzre.h:656 u64 * frame_address stores the value of __builtin_frame_address(0)-16 Definition: xzre.h:661 array of ELF handles Definition: xzre.h:1565 elf_info_t * dynamic_linker ELF context for ld.so. Definition: xzre.h:1576 elf_info_t * main this is for sshd Definition: xzre.h:1570 u64 code_segment_size page-aligned virtual size of the first executable ELF segment Definition: xzre.h:834 u64 first_vaddr virtual address of the first program header Definition: xzre.h:763 u64 gnurelro_memsize size of the GNU relro segment Definition: xzre.h:809 Elf64_Verdef * verdef pointer to the EFL symbol versioning (from DT_VERDEF) Definition: xzre.h:813 u32 gnu_hash_last_bloom last valid bloom value Definition: xzre.h:851 Elf64_Dyn * dyn pointer to the ELF dynamic segment Definition: xzre.h:775 char * strtab pointer to the ELF string table Definition: xzre.h:783 Elf64_Phdr * phdrs pointer to the ELF program headers array in memory Definition: xzre.h:767 u32 gnu_hash_nbuckets number of GNU hash buckets (from DT_GNU_HASH) Definition: xzre.h:847 Elf64_Ehdr * elfbase pointed to the ELF base address in memory Definition: xzre.h:759 u64 e_phnum copy of the ELF program header count from the ELF header Definition: xzre.h:771 Elf64_Rela * plt_relocs pointer to the ELF PLT relocations table Definition: xzre.h:791 BOOL gnurelro_found whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen... Definition: xzre.h:801 u64 code_segment_start page-aligned virtual address of the first executable ELF segment Definition: xzre.h:829 u64 verdef_num number of entries in the symbol versioning table Definition: xzre.h:817 u64 gnurelro_vaddr location of the GNU relro segment Definition: xzre.h:805 Elf64_Sym * symtab pointer to the ELF symbol table Definition: xzre.h:787 u64 dyn_num_entries number of entries in the ELF dynamic segment Definition: xzre.h:779 u32 plt_relocs_num number of entries in the PLT relocation table Definition: xzre.h:795 void * lzma_code_end liblzma code segment end Definition: xzre.h:1283 libc_imports_t * libc_imports pointer to the structure containing resolved libc functions Definition: xzre.h:1226 char * STR_ssh_rsa_cert_v01_openssh_com location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com" Definition: xzre.h:1244 BOOL disable_backdoor This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,... Definition: xzre.h:1236 imported_funcs_t * imported_funcs pointer to the structure containing resolved OpenSSL functions Definition: xzre.h:1222 void * sshd_data_start sshd data segment end Definition: xzre.h:1264 u32 num_shifted_bits number of bits copied Definition: xzre.h:1308 void * sshd_code_start sshd code segment start Definition: xzre.h:1256 void * sshd_data_end sshd data segment start Definition: xzre.h:1268 char * STR_rsa_sha2_256 location of sshd .rodata string "rsa-sha2-256" Definition: xzre.h:1248 void * sshd_code_end sshd code segment end Definition: xzre.h:1260 void * lzma_code_start liblzma code segment start Definition: xzre.h:1276 ptrdiff_t backdoor_init_stage2_got_offset offset from the symbol backdoor_init_stage2() to the GOT Definition: xzre.h:2034 ptrdiff_t cpuid_random_symbol_got_offset offset from the symbol cpuid_random_symbol to the GOT Definition: xzre.h:2022 u64 cpuid_got_index index in the GOT for _cpuid() Definition: xzre.h:2028 data passed to functions that access the backdoor data Definition: xzre.h:1606 this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1651 libc_imports_t libc_imports functions imported from libc Definition: xzre.h:1696 string_references_t string_refs information about resolved string references and the containing functions boundaries Definition: xzre.h:1701 struct link_map * main_map this is for sshd itself Definition: xzre.h:1656 elf_info_t libc_info ELF context for libc.so. Definition: xzre.h:1686 elf_info_t libcrypto_info ELF context for libcrypto.so. Definition: xzre.h:1691 elf_info_t dynamic_linker_info ELF context for ld.so. Definition: xzre.h:1682 elf_info_t main_info this is for sshd itself Definition: xzre.h:1676 lzma_allocator * import_resolver ELF import resolver (fake LZMA allocator) Definition: xzre.h:1706 struct link_map * dynamic_linker_map this is for ld.so Definition: xzre.h:1661 void * EVP_PKEY_set1_RSA_plt address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd Definition: xzre.h:1740 void * RSA_get0_key_plt address of the PLT for RSA_get0_key_plt() in sshd Definition: xzre.h:1745 void * RSA_public_decrypt_plt address of the PLT for RSA_public_decrypt() in sshd Definition: xzre.h:1735 ptrdiff_t tls_get_addr_plt_offset offset from the symbol __tls_get_addr() to the PLT Definition: xzre.h:2048 ptrdiff_t tls_get_addr_random_symbol_got_offset offset from the symbol tls_get_addr_random_symbol to the GOT Definition: xzre.h:2054 u8 flags2 see InstructionFlags2 Definition: xzre.h:681 u8 flags see InstructionFlags Definition: xzre.h:677 void * symbol_ptr points to a symbol in memory will be used to find the GOT value Definition: xzre.h:657 u64 * frame_address stores the value of __builtin_frame_address(0)-16 Definition: xzre.h:662 array of ELF handles Definition: xzre.h:1566 elf_info_t * dynamic_linker ELF context for ld.so. Definition: xzre.h:1577 elf_info_t * main this is for sshd Definition: xzre.h:1571 u64 code_segment_size page-aligned virtual size of the first executable ELF segment Definition: xzre.h:835 u64 first_vaddr virtual address of the first program header Definition: xzre.h:764 u64 gnurelro_memsize size of the GNU relro segment Definition: xzre.h:810 Elf64_Verdef * verdef pointer to the EFL symbol versioning (from DT_VERDEF) Definition: xzre.h:814 u32 gnu_hash_last_bloom last valid bloom value Definition: xzre.h:852 Elf64_Dyn * dyn pointer to the ELF dynamic segment Definition: xzre.h:776 char * strtab pointer to the ELF string table Definition: xzre.h:784 Elf64_Phdr * phdrs pointer to the ELF program headers array in memory Definition: xzre.h:768 u32 gnu_hash_nbuckets number of GNU hash buckets (from DT_GNU_HASH) Definition: xzre.h:848 Elf64_Ehdr * elfbase pointed to the ELF base address in memory Definition: xzre.h:760 u64 e_phnum copy of the ELF program header count from the ELF header Definition: xzre.h:772 Elf64_Rela * plt_relocs pointer to the ELF PLT relocations table Definition: xzre.h:792 BOOL gnurelro_found whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen... Definition: xzre.h:802 u64 code_segment_start page-aligned virtual address of the first executable ELF segment Definition: xzre.h:830 u64 verdef_num number of entries in the symbol versioning table Definition: xzre.h:818 u64 gnurelro_vaddr location of the GNU relro segment Definition: xzre.h:806 Elf64_Sym * symtab pointer to the ELF symbol table Definition: xzre.h:788 u64 dyn_num_entries number of entries in the ELF dynamic segment Definition: xzre.h:780 u32 plt_relocs_num number of entries in the PLT relocation table Definition: xzre.h:796 void * lzma_code_end liblzma code segment end Definition: xzre.h:1284 libc_imports_t * libc_imports pointer to the structure containing resolved libc functions Definition: xzre.h:1227 char * STR_ssh_rsa_cert_v01_openssh_com location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com" Definition: xzre.h:1245 BOOL disable_backdoor This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,... Definition: xzre.h:1237 imported_funcs_t * imported_funcs pointer to the structure containing resolved OpenSSL functions Definition: xzre.h:1223 void * sshd_data_start sshd data segment end Definition: xzre.h:1265 u32 num_shifted_bits number of bits copied Definition: xzre.h:1309 void * sshd_code_start sshd code segment start Definition: xzre.h:1257 void * sshd_data_end sshd data segment start Definition: xzre.h:1269 char * STR_rsa_sha2_256 location of sshd .rodata string "rsa-sha2-256" Definition: xzre.h:1249 void * sshd_code_end sshd code segment end Definition: xzre.h:1261 void * lzma_code_start liblzma code segment start Definition: xzre.h:1277 void * return_address the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ... Definition: xzre.h:633 void * cpuid_fn points to the real cpuid function Definition: xzre.h:637 void * got_ptr points to the Global Offset Table Definition: xzre.h:626 ptrdiff_t got_offset holds the offset of the symbol relative to the GOT. used to derive the got_ptr Definition: xzre.h:642 void * RSA_public_decrypt_plt address of the PLT for RSA_public_decrypt() in sshd Definition: xzre.h:951 void * RSA_get0_key_plt address of the PLT for RSA_get0_key() in sshd Definition: xzre.h:961 void * EVP_PKEY_set1_RSA_plt address of the PLT for EVP_PKEY_set1_RSA() in sshd Definition: xzre.h:956 BOOL result TRUE if the instruction sequence was found, FALSE otherwise. Definition: xzre.h:2127 u8 * offset_to_match offset to match in the instruction displacement Definition: xzre.h:2116 u8 * start_addr start of the code address range to search Definition: xzre.h:2106 u8 * end_addr start of the code address range to search Definition: xzre.h:2111 u32 * output_register_to_match register to match as the instruction output Definition: xzre.h:2121 the payload header. also used as Chacha IV Definition: xzre.h:1794 the contents of the RSA 'n' field Definition: xzre.h:1826 u8 link_map_l_audit_any_plt_bitmask bitmask that sets the link_map::l_audit_any_plt flag Definition: xzre.h:1409 unsigned int * _dl_naudit_ptr location of ld.so's _rtld_global_ro::_dl_naudit_ptr field Definition: xzre.h:1428 u32 * sshd_auditstate_bindflags_ptr the location of sshd's auditstate::bindflags field Definition: xzre.h:1387 char ** libcrypto_l_name location of libcrypto's link_map::l_name field Definition: xzre.h:1445 size_t _dl_audit_symbind_alt__size code size of ld.so's _dl_audit_symbind_alt() function Definition: xzre.h:1457 u32 libcrypto_auditstate_bindflags_old_value backup of the old value of libcrypto's libname_list::next field Definition: xzre.h:1375 struct audit_ifaces ** _dl_audit_ptr location of ld.so's _rtld_global_ro::_dl_audit_ptr field Definition: xzre.h:1419 void * sshd_link_map_l_audit_any_plt_addr location of sshd's link_map::l_audit_any_plt flag Definition: xzre.h:1402 u32 * libcrypto_auditstate_bindflags_ptr the location of libcrypto's auditstate::bindflags field Definition: xzre.h:1370 u32 sshd_auditstate_bindflags_old_value backup of the old value of sshd's libname_list::next field Definition: xzre.h:1392 void * return_address the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ... Definition: xzre.h:634 void * cpuid_fn points to the real cpuid function Definition: xzre.h:638 void * got_ptr points to the Global Offset Table Definition: xzre.h:627 ptrdiff_t got_offset holds the offset of the symbol relative to the GOT. used to derive the got_ptr Definition: xzre.h:643 void * RSA_public_decrypt_plt address of the PLT for RSA_public_decrypt() in sshd Definition: xzre.h:952 void * RSA_get0_key_plt address of the PLT for RSA_get0_key() in sshd Definition: xzre.h:962 void * EVP_PKEY_set1_RSA_plt address of the PLT for EVP_PKEY_set1_RSA() in sshd Definition: xzre.h:957 BOOL result TRUE if the instruction sequence was found, FALSE otherwise. Definition: xzre.h:2128 u8 * offset_to_match offset to match in the instruction displacement Definition: xzre.h:2117 u8 * start_addr start of the code address range to search Definition: xzre.h:2107 u8 * end_addr start of the code address range to search Definition: xzre.h:2112 u32 * output_register_to_match register to match as the instruction output Definition: xzre.h:2122 the payload header. also used as Chacha IV Definition: xzre.h:1795 the contents of the RSA 'n' field Definition: xzre.h:1827 u8 link_map_l_audit_any_plt_bitmask bitmask that sets the link_map::l_audit_any_plt flag Definition: xzre.h:1410 unsigned int * _dl_naudit_ptr location of ld.so's _rtld_global_ro::_dl_naudit_ptr field Definition: xzre.h:1429 u32 * sshd_auditstate_bindflags_ptr the location of sshd's auditstate::bindflags field Definition: xzre.h:1388 char ** libcrypto_l_name location of libcrypto's link_map::l_name field Definition: xzre.h:1446 size_t _dl_audit_symbind_alt__size code size of ld.so's _dl_audit_symbind_alt() function Definition: xzre.h:1458 u32 libcrypto_auditstate_bindflags_old_value backup of the old value of libcrypto's libname_list::next field Definition: xzre.h:1376 struct audit_ifaces ** _dl_audit_ptr location of ld.so's _rtld_global_ro::_dl_audit_ptr field Definition: xzre.h:1420 void * sshd_link_map_l_audit_any_plt_addr location of sshd's link_map::l_audit_any_plt flag Definition: xzre.h:1403 u32 * libcrypto_auditstate_bindflags_ptr the location of libcrypto's auditstate::bindflags field Definition: xzre.h:1371 u32 sshd_auditstate_bindflags_old_value backup of the old value of sshd's libname_list::next field Definition: xzre.h:1393 Structure to hold internal state of the check being calculated. Definition: xzre.h:280 State for the internal SHA-256 implementation. Definition: xzre.h:268 uint64_t size Size of the message excluding padding. Definition: xzre.h:273 data used within sshd_proxy_elevate Definition: xzre.h:1930 struct monitor from openssh-portable Definition: xzre.h:566 stack frame layout for run_backdoor_commands Definition: xzre.h:1967 struct sensitive_data from openssh-portable Definition: xzre.h:578 struct sshkey from openssh-portable Definition: xzre.h:589 void * func_start the starting address of the function that referenced the string Definition: xzre.h:1622 EncodedStringId string_id the string that was referenced, in encoded form Definition: xzre.h:1617 void * xref location of the instruction that referenced the string Definition: xzre.h:1630 void * func_end the ending address of the function that referenced the string Definition: xzre.h:1626 union used within run_backdoor_commands Definition: xzre.h:1954 represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres... Definition: xzre.h:1763 u32 index Definition: xzre.h:1765 u32 byte_index Definition: xzre.h:1770 u32 bit_index Definition: xzre.h:1768 data used within sshd_proxy_elevate Definition: xzre.h:1931 struct monitor from openssh-portable Definition: xzre.h:567 stack frame layout for run_backdoor_commands Definition: xzre.h:1968 struct sensitive_data from openssh-portable Definition: xzre.h:579 struct sshkey from openssh-portable Definition: xzre.h:590 void * func_start the starting address of the function that referenced the string Definition: xzre.h:1623 EncodedStringId string_id the string that was referenced, in encoded form Definition: xzre.h:1618 void * xref location of the instruction that referenced the string Definition: xzre.h:1631 void * func_end the ending address of the function that referenced the string Definition: xzre.h:1627 union used within run_backdoor_commands Definition: xzre.h:1955 represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres... Definition: xzre.h:1764 u32 index Definition: xzre.h:1766 u32 byte_index Definition: xzre.h:1771 u32 bit_index Definition: xzre.h:1769 BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx) this function searches for a function pointer, pointing to a function designated by the given xref_id fake_lzma_allocator_t * get_lzma_allocator_address(void) gets the address of the fake LZMA allocator BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info) Parses the given in-memory ELF file into elf_info. backdoor_hooks_data_t * hooks_data_addr location of backdoor_hooks_data_t BOOL sha256(const void *data, size_t count, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs) computes the SHA256 hash of the supplied data BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx) finds a MOV instruction. ElfId Definition: xzre.h:383 @ X_ELF_MAIN this is for sshd itself Definition: xzre.h:388 ElfId Definition: xzre.h:384 @ X_ELF_MAIN this is for sshd itself Definition: xzre.h:389 int init_hooks_ctx(backdoor_hooks_ctx_t *ctx) Initializes the structure with hooks-related data. CommandFlags2 Definition: xzre.h:1857 @ X_FLAGS2_CHANGE_MONITOR_REQ if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa... Definition: xzre.h:1867 @ X_FLAGS2_PSELECT executes pselect, then exit not compatible with command 2 Definition: xzre.h:1881 @ X_FLAGS2_CONTINUATION more data available in the following packet not compatible with command 3 Definition: xzre.h:1876 @ X_FLAGS2_SOCKFD_MASK (0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified Definition: xzre.h:1888 @ X_FLAGS2_IMPERSONATE if set, impersonate a user (info from payload) if not set, impersonate root Definition: xzre.h:1862 CommandFlags2 Definition: xzre.h:1858 @ X_FLAGS2_CHANGE_MONITOR_REQ if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa... Definition: xzre.h:1868 @ X_FLAGS2_PSELECT executes pselect, then exit not compatible with command 2 Definition: xzre.h:1882 @ X_FLAGS2_CONTINUATION more data available in the following packet not compatible with command 3 Definition: xzre.h:1877 @ X_FLAGS2_SOCKFD_MASK (0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified Definition: xzre.h:1889 @ X_FLAGS2_IMPERSONATE if set, impersonate a user (info from payload) if not set, impersonate root Definition: xzre.h:1863 struct key_payload_hdr key_payload_hdr_t the payload header. also used as Chacha IV BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx) finds a call instruction const elf_functions_t elf_functions special .data.rel.ro section that contains addresses to various functions BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx) verify if a memory range is mapped int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs) obtains a numeric score which indicates if do_child accesses sensitive_data or not BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx) locates sensitive_data within sshd, and resolves some additional libcrypto functions CommandFlags1 Definition: xzre.h:1834 @ X_FLAGS1_SETLOGMASK disable all logging by setting mask 0x80000000 Definition: xzre.h:1842 @ X_FLAGS1_NO_EXTENDED_SIZE if set, the union size field must be 0 Definition: xzre.h:1854 @ X_FLAGS1_SOCKET_INDEX custom monitor socket index override Definition: xzre.h:1846 @ X_FLAGS1_8BYTES the data block contains 8 additional bytes Definition: xzre.h:1838 @ X_FLAGS1_DISABLE_PAM if set, disables PAM authentication Definition: xzre.h:1850 CommandFlags1 Definition: xzre.h:1835 @ X_FLAGS1_SETLOGMASK disable all logging by setting mask 0x80000000 Definition: xzre.h:1843 @ X_FLAGS1_NO_EXTENDED_SIZE if set, the union size field must be 0 Definition: xzre.h:1855 @ X_FLAGS1_SOCKET_INDEX custom monitor socket index override Definition: xzre.h:1847 @ X_FLAGS1_8BYTES the data block contains 8 additional bytes Definition: xzre.h:1839 @ X_FLAGS1_DISABLE_PAM if set, disables PAM authentication Definition: xzre.h:1851 void update_cpuid_got_index(elf_entry_ctx_t *ctx) get the cpuid() GOT index BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx) forges a new MONITOR_REQ_KEYALLOWED packet, and injects it into the server to gain root privileges th... uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname) the backdoored symbind64 installed in GLRO(dl_audit) BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address) finds a LEA instruction with an immediate memory operand const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts special .rodata section that contains _cpuid() related GOT offsets BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf) finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME ) struct backdoor_data backdoor_data_t this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1600 struct backdoor_data backdoor_data_t this structure is used to hold most of the backdoor information. it's used as a local variable in fun... Definition: xzre.h:1601 u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str) finds an instruction that references the given string int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs) obtains a numeric score which indicates if accesses sensitive_data or not BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx) obtains a decrypted copy of the secret data void * find_addr_referenced_in_mov_instruction(StringXrefId id, string_references_t *refs, void *mem_range_start, void *mem_range_end) find an address referenced in a function u32 resolver_call_count counts the number of times the IFUNC resolver is called BOOL sshd_configure_log_hook(cmd_arguments_t *cmd_flags, global_context_t *ctx) configure the log hook CommandFlags3 Definition: xzre.h:1891 @ X_FLAGS3_MONITOR_REQ_VAL 6 bits used to store the monitor req / 2 (might be unused) Definition: xzre.h:1899 @ X_FLAGS3_SOCKET_NUM 5 bits used to store number of sockets (in cmd3) Definition: xzre.h:1895 CommandFlags3 Definition: xzre.h:1892 @ X_FLAGS3_MONITOR_REQ_VAL 6 bits used to store the monitor req / 2 (might be unused) Definition: xzre.h:1900 @ X_FLAGS3_SOCKET_NUM 5 bits used to store number of sockets (in cmd3) Definition: xzre.h:1896 struct monitor_data monitor_data_t data used within sshd_proxy_elevate const u64 cpuid_random_symbol a bogus global variable that is used by the backdoor to generate an extra symbol void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id) Gets the GOT symbol with name encoded_string_id from the parsed ELF file. |