diff --git a/xzre_8h_source.html b/xzre_8h_source.html
index ba8b225..0b370dc 100644
--- a/xzre_8h_source.html
+++ b/xzre_8h_source.html
@@ -884,801 +884,803 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1003 u8 shift_operations[31];
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1029 PADDING(
sizeof(
void*));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1133 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
-
- 1143 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1149 pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
- 1154 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1156 u64 hooks_installed;
-
-
- 1159 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
- 1160 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
- 1161 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
- 1162 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
- 1163 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
- 1164 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
- 1165 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
- 1166 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
- 1167 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
-
- 1169 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
- 1170 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
- 1171 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
- 1172 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
- 1173 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
- 1174 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
-
- 1176 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1199 uintptr_t (*symbind64)(
- 1200 Elf64_Sym *sym,
unsigned int ndx,
- 1201 uptr *refcook, uptr *defcook,
- 1202 unsigned int flags,
const char *symname);
- 1203 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
- 1204 pfn_RSA_get0_key_t hook_RSA_get0_key;
-
- 1209 PADDING(
sizeof(
void *));
- 1210 PADDING(
sizeof(
void *));
-
-
- 1219 PADDING(
sizeof(
void *));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1272 Elf64_Ehdr *dynamic_linker_ehdr;
- 1273 void **__libc_stack_end;
-
-
-
- 1277 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1004 u8 shift_operations[31];
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1031 PADDING(
sizeof(
void*));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1135 void (*_dl_audit_symbind_alt)(
struct link_map *l,
const ElfW(Sym) *ref,
void **value, lookup_t result);
+
+ 1145 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1151 pfn_RSA_public_decrypt_t hook_EVP_PKEY_set1_RSA;
+ 1156 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1158 u64 hooks_installed;
+
+
+ 1161 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
+ 1162 assert_offset(
ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
+ 1163 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
+ 1164 assert_offset(
ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
+ 1165 assert_offset(
ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
+ 1166 assert_offset(
ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
+ 1167 assert_offset(
ldso_ctx_t, _dl_audit_ptr, 0x70);
+ 1168 assert_offset(
ldso_ctx_t, _dl_naudit_ptr, 0x78);
+ 1169 assert_offset(
ldso_ctx_t, hooked_audit_ifaces, 0x80);
+
+ 1171 assert_offset(
ldso_ctx_t, libcrypto_l_name, 0xF8);
+ 1172 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
+ 1173 assert_offset(
ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
+ 1174 assert_offset(
ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
+ 1175 assert_offset(
ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
+ 1176 assert_offset(
ldso_ctx_t, hook_RSA_get0_key, 0x120);
+
+ 1178 assert_offset(
ldso_ctx_t, hooks_installed, 0x130);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1201 uintptr_t (*symbind64)(
+ 1202 Elf64_Sym *sym,
unsigned int ndx,
+ 1203 uptr *refcook, uptr *defcook,
+ 1204 unsigned int flags,
const char *symname);
+ 1205 pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
+ 1206 pfn_RSA_get0_key_t hook_RSA_get0_key;
+
+ 1211 PADDING(
sizeof(
void *));
+ 1212 PADDING(
sizeof(
void *));
+
+
+ 1221 PADDING(
sizeof(
void *));
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1274 Elf64_Ehdr *dynamic_linker_ehdr;
+ 1275 void **__libc_stack_end;
+
+
+
+ 1279 assert_offset(
main_elf_t, dynamic_linker_ehdr, 0x8);
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
- 1341 struct link_map *liblzma_map;
- 1342 struct link_map *libcrypto_map;
- 1343 struct link_map *libsystemd_map;
- 1344 struct link_map *libc_map;
-
-
+
+
+
+
+
+ 1343 struct link_map *liblzma_map;
+ 1344 struct link_map *libcrypto_map;
+ 1345 struct link_map *libsystemd_map;
+ 1346 struct link_map *libc_map;
-
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1477 typedef union __attribute__((packed)) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1547 u8 decrypted_secret_data[57];
-
-
-
-
-
-
- 1554 assert_offset(
key_ctx_t, payload, 0x15);
- 1555 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1603 PADDING(
sizeof(u64));
-
- 1610 PADDING(
sizeof(u64));
- 1611 PADDING(
sizeof(u64));
-
- 1618 PADDING(
sizeof(u64));
-
-
-
-
-
-
-
-
-
- 1633 PADDING(
sizeof(u64));
- 1634 lzma_allocator allocator;
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1664 u8 *output_register;
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1761 BOOL is_64bit_operand,
-
-
-
-
-
-
-
- 1784 BOOL is_64bit_operand,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1850 EncodedStringId encoded_string_id,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 1904 FuncFindType find_mode);
-
-
-
-
-
-
-
- 1942 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1479 typedef union __attribute__((packed)) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1549 u8 decrypted_secret_data[57];
+
+
+
+
+
+
+ 1556 assert_offset(
key_ctx_t, payload, 0x15);
+ 1557 static_assert(
sizeof(
key_ctx_t) == 0x2B8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1605 PADDING(
sizeof(u64));
+
+ 1612 PADDING(
sizeof(u64));
+ 1613 PADDING(
sizeof(u64));
+
+ 1620 PADDING(
sizeof(u64));
+
+
+
+
+
+
+
+
+
+ 1635 PADDING(
sizeof(u64));
+ 1636 lzma_allocator allocator;
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1666 u8 *output_register;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1763 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+ 1786 BOOL is_64bit_operand,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1852 EncodedStringId encoded_string_id,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 1906 FuncFindType find_mode);
+
+
+
+
+
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2055 EncodedStringId encoded_string_id);
-
-
-
-
-
-
- 2089 StringXrefId xref_id,
- 2090 void **pOutCodeStart,
void **pOutCodeEnd,
-
-
- 2093 BOOL *pCheckPrologue);
-
-
-
- 2109 EncodedStringId *stringId_inOut,
- 2110 void *rodata_start_ptr);
-
-
-
-
-
-
-
-
-
-
-
-
+ 1944 extern char *check_argument(
char arg_first_char,
char* arg_name);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2057 EncodedStringId encoded_string_id);
+
+
+
+
+
+
+ 2091 StringXrefId xref_id,
+ 2092 void **pOutCodeStart,
void **pOutCodeEnd,
+
+
+
+
+
+
+ 2111 EncodedStringId *stringId_inOut,
+ 2112 void *rodata_start_ptr);
+
+
+
+
+
+
+
+
+
+
-
-
-
-
- 2180 unsigned shift_count, BOOL start_from_call);
-
-
-
- 2194 unsigned operation_index,
- 2195 unsigned shift_count,
- 2196 int flags, u8 *code);
-
-
-
-
- 2211 unsigned shift_count,
unsigned operation_index);
-
-
- 2256 u8 *call_site, u8 *code,
-
- 2258 unsigned shift_count,
unsigned operation_index);
-
-
-
- 2273 unsigned shift_count,
unsigned operation_index,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2385 struct link_map *libc,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2462 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
-
- 2503 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
-
- 2516 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
-
-
-
-
-
-
-
-
-
-
- 2573 uptr *refcook, uptr *defcook,
-
- 2575 const char *symname);
-
-
-
-
-
- 2606 ptrdiff_t *libname_offset,
-
-
-
-
-
- 2634 ptrdiff_t *libname_offset,
-
-
-
-
-
-
-
-
-
-
-
- 2681 ptrdiff_t libname_offset,
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2724 void **host_keys_out);
-
-
-
-
-
-
- 2745 void **host_keys_out,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2815 u8 *buffer, u64 bufferSize,
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 2887 u64 sshkey_digest_offset,
- 2888 u64 signed_data_size,
-
-
-
-
-
-
- 2906 BOOL skip_root_patch,
-
- 2908 BOOL replace_monitor_reqtype,
- 2909 int monitor_reqtype,
-
-
-
-
-
-
-
- 2923 static_assert(
sizeof(global_ctx) == 0x8);
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+ 2182 unsigned shift_count, BOOL start_from_call);
+
+
+
+ 2196 unsigned operation_index,
+ 2197 unsigned shift_count,
+ 2198 int flags, u8 *code);
+
+
+
+
+ 2213 unsigned shift_count,
unsigned operation_index);
+
+
+ 2258 u8 *call_site, u8 *code,
+
+ 2260 unsigned shift_count,
unsigned operation_index);
+
+
+
+ 2275 unsigned shift_count,
unsigned operation_index,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2387 struct link_map *libc,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2464 extern EncodedStringId
get_string_id(
const char *string_begin,
const char *string_end);
+
+ 2505 extern unsigned int _get_cpuid_modified(
unsigned int leaf,
unsigned int *eax,
unsigned int *ebx,
unsigned int *ecx,
unsigned int *edx, u64 *caller_frame);
+
+ 2518 extern void _cpuid_gcc(
unsigned int level,
unsigned int *a,
unsigned int *b,
unsigned int *c,
unsigned int *d);
+
+
+
+
+
+
+
+
+
+
+ 2575 uptr *refcook, uptr *defcook,
+
+ 2577 const char *symname);
+
+
+
+
+
+ 2608 ptrdiff_t *libname_offset,
+
+
+
+
+
+ 2636 ptrdiff_t *libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+ 2683 ptrdiff_t libname_offset,
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2726 void **host_keys_out);
+
+
+
+
+
+
+ 2747 void **host_keys_out,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2817 u8 *buffer, u64 bufferSize,
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2889 u64 sshkey_digest_offset,
+ 2890 u64 signed_data_size,
+
+
+
+
+
+
+ 2908 BOOL skip_root_patch,
+
+ 2910 BOOL replace_monitor_reqtype,
+ 2911 int monitor_reqtype,
+
+
+
+
+
+
+
+ 2925 static_assert(
sizeof(global_ctx) == 0x8);
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1575
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1563
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1569
data passed to functions that access the backdoor data
Definition: xzre.h:1285
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1330
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1375
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1380
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1335
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1365
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1370
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1361
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1355
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1385
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1340
ptrdiff_t backdoor_init_stage2_got_offset
offset from the symbol backdoor_init_stage2() to the GOT
Definition: xzre.h:1577
ptrdiff_t cpuid_random_symbol_got_offset
offset from the symbol cpuid_random_symbol to the GOT
Definition: xzre.h:1565
u64 cpuid_got_index
index in the GOT for _cpuid()
Definition: xzre.h:1571
data passed to functions that access the backdoor data
Definition: xzre.h:1287
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1332
libc_imports_t libc_imports
functions imported from libc
Definition: xzre.h:1377
string_references_t string_refs
information about resolved string references and the containing functions boundaries
Definition: xzre.h:1382
struct link_map * main_map
this is for sshd itself
Definition: xzre.h:1337
elf_info_t libc_info
ELF context for libc.so.
Definition: xzre.h:1367
elf_info_t libcrypto_info
ELF context for libcrypto.so.
Definition: xzre.h:1372
elf_info_t dynamic_linker_info
ELF context for ld.so.
Definition: xzre.h:1363
elf_info_t main_info
this is for sshd itself
Definition: xzre.h:1357
lzma_allocator * import_resolver
ELF import resolver (fake LZMA allocator)
Definition: xzre.h:1387
struct link_map * dynamic_linker_map
this is for ld.so
Definition: xzre.h:1342
PADDING(sizeof(void *))
set to addess of symbol .Llzma12_mode_map_part_1
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1417
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1422
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1412
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1589
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1595
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA_plt() in sshd
Definition: xzre.h:1419
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key_plt() in sshd
Definition: xzre.h:1424
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:1414
ptrdiff_t tls_get_addr_plt_offset
offset from the symbol __tls_get_addr() to the PLT
Definition: xzre.h:1591
ptrdiff_t tls_get_addr_random_symbol_got_offset
offset from the symbol tls_get_addr_random_symbol to the GOT
Definition: xzre.h:1597
void * symbol_ptr
points to a symbol in memory will be used to find the GOT value
Definition: xzre.h:436
ptrdiff_t got_offset
holds the offset of the symbol relative to the GOT. used to derive the got_ptr
Definition: xzre.h:456
void * cpuid_fn
points to the real cpuid function
Definition: xzre.h:451
u64 * frame_address
stores the value of __builtin_frame_address(0)-16
Definition: xzre.h:460
array of ELF handles
Definition: xzre.h:1247
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1258
elf_info_t * main
this is for sshd
Definition: xzre.h:1252
array of ELF handles
Definition: xzre.h:1249
elf_info_t * dynamic_linker
ELF context for ld.so.
Definition: xzre.h:1260
elf_info_t * main
this is for sshd
Definition: xzre.h:1254
u64 code_segment_size
page-aligned virtual size of the first executable ELF segment
Definition: xzre.h:629
u64 first_vaddr
virtual address of the first program header
Definition: xzre.h:558
Elf64_Sym * symtab
pointer to the ELF symbol table
Definition: xzre.h:582
u64 dyn_num_entries
number of entries in the ELF dynamic segment
Definition: xzre.h:574
u32 plt_relocs_num
number of entries in the PLT relocation table
Definition: xzre.h:590
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:992
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:940
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:948
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:960
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:936
void * sshd_data_start
sshd data segment end
Definition: xzre.h:973
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:956
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1007
void * sshd_code_start
sshd code segment start
Definition: xzre.h:965
void * sshd_data_end
sshd data segment start
Definition: xzre.h:977
void * sshd_code_end
sshd code segment end
Definition: xzre.h:969
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:985
void * lzma_code_end
liblzma code segment end
Definition: xzre.h:993
libc_imports_t * libc_imports
pointer to the structure containing resolved libc functions
Definition: xzre.h:941
BOOL disable_backdoor
This flag gets set to TRUE by run_backdoor_commands if any of the validity checks fail,...
Definition: xzre.h:949
char * rsa_sha2_256_str
location of sshd .rodata string "rsa-sha2-256"
Definition: xzre.h:961
imported_funcs_t * imported_funcs
pointer to the structure containing resolved OpenSSL functions
Definition: xzre.h:937
void * sshd_data_start
sshd data segment end
Definition: xzre.h:974
char * ssh_rsa_cert_v01_openssh_com_str
location of sshd .rodata string "ssh-rsa-cert-v01@openssh.com"
Definition: xzre.h:957
u32 num_shifted_bits
number of bits copied
Definition: xzre.h:1008
void * sshd_code_start
sshd code segment start
Definition: xzre.h:966
void * sshd_data_end
sshd data segment start
Definition: xzre.h:978
void * sshd_code_end
sshd code segment end
Definition: xzre.h:970
void * lzma_code_start
liblzma code segment start
Definition: xzre.h:986
void * RSA_public_decrypt_plt
address of the PLT for RSA_public_decrypt() in sshd
Definition: xzre.h:745
void * RSA_get0_key_plt
address of the PLT for RSA_get0_key() in sshd
Definition: xzre.h:755
void * EVP_PKEY_set1_RSA_plt
address of the PLT for EVP_PKEY_set1_RSA() in sshd
Definition: xzre.h:750
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1669
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1658
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1648
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1653
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1663
the payload header. also used as Chacha IV
Definition: xzre.h:1457
the contents of the RSA 'n' field
Definition: xzre.h:1472
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1069
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1058
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1053
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1090
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1109
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1074
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1126
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1138
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1100
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1083
BOOL result
TRUE if the instruction sequence was found, FALSE otherwise.
Definition: xzre.h:1671
u8 * offset_to_match
offset to match in the instruction displacement
Definition: xzre.h:1660
u8 * start_addr
start of the code address range to search
Definition: xzre.h:1650
u8 * end_addr
start of the code address range to search
Definition: xzre.h:1655
u32 * output_register_to_match
register to match as the instruction output
Definition: xzre.h:1665
the payload header. also used as Chacha IV
Definition: xzre.h:1459
the contents of the RSA 'n' field
Definition: xzre.h:1474
void * sshd_auditstate_bindflags_ptr
the location of sshd's auditstate::bindflags field
Definition: xzre.h:1071
void * libcrypto_auditstate_bindflags_old_value
backup of the old value of libcrypto's libname_list::next field
Definition: xzre.h:1060
void * libcrypto_auditstate_bindflags_ptr
the location of libcrypto's auditstate::bindflags field
Definition: xzre.h:1055
u8 link_map_l_audit_any_plt_bitmask
bitmask that sets the link_map::l_audit_any_plt flag
Definition: xzre.h:1092
unsigned int * _dl_naudit_ptr
location of ld.so's _rtld_global_ro::_dl_naudit_ptr field
Definition: xzre.h:1111
void * sshd_auditstate_bindflags_old_value
backup of the old value of sshd's libname_list::next field
Definition: xzre.h:1076
char ** libcrypto_l_name
location of libcrypto's link_map::l_name field
Definition: xzre.h:1128
size_t _dl_audit_symbind_alt__size
code size of ld.so's _dl_audit_symbind_alt() function
Definition: xzre.h:1140
struct audit_ifaces ** _dl_audit_ptr
location of ld.so's _rtld_global_ro::_dl_audit_ptr field
Definition: xzre.h:1102
void * sshd_link_map_l_audit_any_plt_addr
location of sshd's link_map::l_audit_any_plt flag
Definition: xzre.h:1085
struct sensitive_data from openssh-portable
Definition: xzre.h:387
struct sshkey from openssh-portable
Definition: xzre.h:398
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1302
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1297
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1310
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1306
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1441
u32 index
Definition: xzre.h:1443
u32 byte_index
Definition: xzre.h:1448
u32 bit_index
Definition: xzre.h:1446
void * func_start
the starting address of the function that referenced the string
Definition: xzre.h:1304
EncodedStringId string_id
the string that was referenced, in encoded form
Definition: xzre.h:1299
void * xref
location of the instruction that referenced the string
Definition: xzre.h:1312
void * func_end
the ending address of the function that referenced the string
Definition: xzre.h:1308
represents a shift register, which will shift a '1' into the secret data array. the low 3 bits repres...
Definition: xzre.h:1443
u32 index
Definition: xzre.h:1445
u32 byte_index
Definition: xzre.h:1450
u32 bit_index
Definition: xzre.h:1448
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, global_context_t *ctx)
this function searches for a function pointer, pointing to a function designated by the given xref_id
BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info)
Parses the given in-memory ELF file into elf_info.
BOOL process_is_sshd(elf_info_t *elf, u8 *stack_end)
checks if the current process is sshd by inspecting argv and envp.
void * elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id)
Looks up an ELF symbol from a parsed ELF, and returns its memory address.
BOOL backdoor_setup(backdoor_setup_params_t *params)
the backdoor main method that installs the backdoor_symbind64() callback
void * elf_get_reloc_symbol(elf_info_t *elf_info, Elf64_Rela *relocs, u32 num_relocs, u64 reloc_type, EncodedStringId encoded_string_id)
Searches the ELF relocations for a symbol having name encoded_string id and relocation of type reloc_...
BOOL elf_contains_vaddr(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags)
checks if given ELF file contains the range [vaddr, vaddr+size) in a segment with the specified memor...
BOOL is_range_mapped(u8 *addr, u8 length, global_context_t *ctx)
verify if a memory range is mapped
BOOL find_link_map_l_audit_any_plt(backdoor_data_handle_t *data, ptrdiff_t libname_offset, backdoor_hooks_data_t *hooks, imported_funcs_t *imported_funcs)
Find struct link_map offset required to modify ld.so's private link_map::l_audit_any_plt state.
const u64 tls_get_addr_random_symbol
a bogus global variable that is used by the backdoor to generate an extra symbol
backdoor_hooks_data_t * hooks_data_addr
location of backdoor_hooks_data_t
BOOL find_mov_instruction(u8 *code_start, u8 *code_end, BOOL is_64bit_operand, BOOL load_flag, dasm_ctx_t *dctx)
finds a MOV instruction.
ElfId
Definition: xzre.h:212
@ X_ELF_MAIN
this is for sshd itself
Definition: xzre.h:217
CommandFlags2
Definition: xzre.h:1501
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1511
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1521
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1506
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1516
CommandFlags2
Definition: xzre.h:1503
@ CMDF_CHANGE_MONITOR_REQ
if set, changes the monitor_reqtype field from MONITOR_REQ_AUTHPASSWORD to what's contained in the pa...
Definition: xzre.h:1513
@ CMDF_PSELECT
executes pselect, then exit not compatible with command 2
Definition: xzre.h:1523
@ CMDF_IMPERSONATE
if set, impersonate a user (info from payload) if not set, impersonate root
Definition: xzre.h:1508
@ CMDF_CONTINUATION
more data available in the following packet not compatible with command 3
Definition: xzre.h:1518
struct key_payload_hdr key_payload_hdr_t
the payload header. also used as Chacha IV
BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx)
finds a call instruction
BOOL sshd_get_host_keys_address_via_xcalloc(u8 *data_start, u8 *data_end, u8 *code_start, u8 *code_end, string_references_t *string_refs, void **host_keys_out)
finds the address of sensitive_data.host_keys in sshd by using XREF_xcalloc_zero_size in xcalloc
BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part)
Checks if the code between code_start and code_end is an endbr64 instruction.
void fake_lzma_free(void *opaque, void *ptr)
a fake free function called by lzma_free()
void * elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize)
Obtains the address and size of the last readonly segment in the given ELF file this corresponds to t...
CommandFlags1
Definition: xzre.h:1482
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1490
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1498
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1494
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1486
BOOL is_range_mapped(u8 *addr, u64 length, global_context_t *ctx)
verify if a memory range is mapped
CommandFlags1
Definition: xzre.h:1484
@ CMDF_SETLOGMASK
disable all logging by setting mask 0x80000000
Definition: xzre.h:1492
@ CMDF_NO_EXTENDED_SIZE
if set, the union size field must be 0
Definition: xzre.h:1500
@ CMDF_DISABLE_PAM
if set, disables PAM authentication
Definition: xzre.h:1496
@ CMDF_8BYTES
the data block contains 8 additional bytes
Definition: xzre.h:1488
uintptr_t backdoor_symbind64(Elf64_Sym *sym, unsigned int ndx, uptr *refcook, uptr *defcook, unsigned int flags, const char *symname)
the backdoored symbind64 installed in GLRO(dl_audit)
BOOL find_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA or MOV instruction with an immediate memory operand
EncodedStringId get_string_id(const char *string_begin, const char *string_end)
Get the.
BOOL find_lea_instruction_with_mem_operand(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx, void *mem_address)
finds a LEA instruction with an immediate memory operand
const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts
special .rodata section that contains _cpuid() related GOT offsets
int sshd_get_host_keys_score_in_main(void *host_keys, elf_info_t *elf, string_references_t *refs)
obtains a numeric score which indicates if main accesses host_keys or not
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1280
struct backdoor_data backdoor_data_t
this structure is used to hold most of the backdoor information. it's used as a local variable in fun...
Definition: xzre.h:1282
u8 * find_string_reference(u8 *code_start, u8 *code_end, const char *str)
finds an instruction that references the given string
BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx)
obtains a decrypted copy of the secret data
BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode)
locates the function prologue
Elf64_Sym * elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version)
Looks up an ELF symbol from a parsed ELF.
u32 count_bits(u64 x)
returns the number of 1 bits in x
elf_functions_t * get_elf_functions_address()
gets the address of the elf_functions
BOOL elf_find_function_pointer(StringXrefId xref_id, void **pOutCodeStart, void **pOutCodeEnd, void **pOutFptrAddr, elf_info_t *elf_info, string_references_t *xrefs, BOOL *pCheckPrologue)
this function searches for a function pointer, pointing to a function designated by the given xref_id
BOOL secret_data_append_from_address(void *addr, secret_data_shift_cursor_t shift_cursor, unsigned shift_count, unsigned operation_index)
calls secret_data_append_singleton with either the given code address or the return address,...
const ptrdiff_t fake_lzma_allocator_offset
special .data.rel.ro section that contains the offset to fake_lzma_allocator_struct
struct key_payload key_payload_t
the contents of the RSA 'n' field