diff --git a/xzre_8h.html b/xzre_8h.html index 6acee8f..232ef5a 100644 --- a/xzre_8h.html +++ b/xzre_8h.html @@ -66,7 +66,8 @@ Macros | Typedefs | Enumerations | -Functions +Functions | +Variables
xzre.h File Reference
@@ -602,6 +603,12 @@ lzma_allocator * get_lzma_allocator ()  gets the fake LZMA allocator, used for imports resolution the "opaque" field of the structure holds a pointer to More...
  + +BOOL secret_data_append_from_instruction (dasm_ctx_t *dctx, secret_data_shift_cursor *cursor) +  + +BOOL secret_data_append_from_function (void *function_start, void *code_end, secret_data_shift_cursor shift_cursor, unsigned shift_count, unsigned operation_index) +  BOOL secret_data_append_if_flags (secret_data_shift_cursor shift_cursor, unsigned operation_index, unsigned reg2reg_instruction_count, int flags, u8 *code)  Calls secret_data_append_singleton, if flags are non-zero. More...
  @@ -617,6 +624,12 @@ BOOL resolve_libc_imports (struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)  parses the libc ELF from the supplied link map, and resolves its imports More...
  + + + +

+Variables

+global_context_t * global_ctx
 

Detailed Description

XZ backdoor structures and functions.

@@ -1700,7 +1713,7 @@

backdoor_setup from elf_get_code_segment)
  • search for shift_count number of "reg2reg" instructions (explained below)
    • -
  • for each instruction, shift a '1' in the data register, and increment the shift cursor to the next bit index if, at any given point, a non reg2reg instruction is encountered, the whole loop will stop and FALSE will be returned.
    • +
  • for each instruction, shift a '1' in the data register, and increment the shift cursor to the next bit index if, at any given point, a non reg2reg instruction is encountered, the whole loop will stop. the function will return TRUE if the number of shifts executed == number of wanted shifts NOTE: MOV instructions are counted, but don't cause any shift (they are skipped).

    • a reg2reg instruction is an x64 instruction with one of the following characteristics:

    diff --git a/xzre_8h_source.html b/xzre_8h_source.html index 528b199..e351964 100644 --- a/xzre_8h_source.html +++ b/xzre_8h_source.html @@ -567,33 +567,43 @@
    822 
    829 extern lzma_allocator *get_lzma_allocator();
    830 
    -
    841 extern BOOL secret_data_append_if_flags(
    -
    842  secret_data_shift_cursor shift_cursor,
    -
    843  unsigned operation_index,
    -
    844  unsigned reg2reg_instruction_count,
    -
    845  int flags, u8 *code);
    -
    846 
    -
    886 extern BOOL secret_data_append_singleton(
    -
    887  u8 *call_site, u8 *code,
    -
    888  secret_data_shift_cursor shift_cursor,
    -
    889  unsigned shift_count, unsigned operation_index);
    -
    890 
    -
    902 extern BOOL secret_data_append_from_call_site(
    -
    903  secret_data_shift_cursor shift_cursor,
    -
    904  unsigned shift_count, unsigned operation_index,
    -
    905  BOOL bypass
    -
    906 );
    -
    907 
    -
    914 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
    -
    915 
    -
    924 extern BOOL resolve_libc_imports(
    -
    925  struct link_map *libc,
    -
    926  elf_info_t *libc_info,
    -
    927  libc_imports_t *imports
    -
    928 );
    -
    929 
    -
    930 #include "util.h"
    -
    931 #endif
    +
    831 extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor *cursor);
    +
    832 
    +
    833 extern BOOL secret_data_append_from_function(
    +
    834  void *function_start,
    +
    835  void *code_end,
    +
    836  secret_data_shift_cursor shift_cursor,
    +
    837  unsigned shift_count, unsigned operation_index);
    +
    838 
    +
    849 extern BOOL secret_data_append_if_flags(
    +
    850  secret_data_shift_cursor shift_cursor,
    +
    851  unsigned operation_index,
    +
    852  unsigned reg2reg_instruction_count,
    +
    853  int flags, u8 *code);
    +
    854 
    +
    897 extern BOOL secret_data_append_singleton(
    +
    898  u8 *call_site, u8 *code,
    +
    899  secret_data_shift_cursor shift_cursor,
    +
    900  unsigned shift_count, unsigned operation_index);
    +
    901 
    +
    913 extern BOOL secret_data_append_from_call_site(
    +
    914  secret_data_shift_cursor shift_cursor,
    +
    915  unsigned shift_count, unsigned operation_index,
    +
    916  BOOL bypass
    +
    917 );
    +
    918 
    +
    925 extern BOOL backdoor_setup(backdoor_setup_params_t *params);
    +
    926 
    +
    935 extern BOOL resolve_libc_imports(
    +
    936  struct link_map *libc,
    +
    937  elf_info_t *libc_info,
    +
    938  libc_imports_t *imports
    +
    939 );
    +
    940 
    +
    941 extern global_context_t *global_ctx;
    +
    942 
    +
    943 #include "util.h"
    +
    944 #endif
    backdoor_data_t
    this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
    Definition: xzre.h:517
    backdoor_data_t::libcrypto_info
    elf_info_t libcrypto_info
    ELF context for libcrypto.so.
    Definition: xzre.h:548
    backdoor_data_t::libc
    elf_info_t * libc
    points to libc_info
    Definition: xzre.h:524