Skip to content

Commit 070d073

Browse files
evanpjensenevanpjensen
committed
IT WORKS BITCHES
1 parent 14b0ff3 commit 070d073

5 files changed

Lines changed: 78 additions & 36 deletions

File tree

‎lib_research/gs.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ void* find_symtab(void* module_base);
2222
void start_main_wrapper(int (*function)(void));
2323
void start_main_wrapper_alt(int (*function)(void));
2424
void do_patch_pie(void);
25+
void patch_l_info(void);
2526
/*
2627
int (*)(int (*main_func) (int, char * *, char * *),
2728
int argc,

‎lib_research/gs.s‎

Lines changed: 40 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
global get_base_pie
3434
global do_patch_pie
3535
global patch_host_dynamic_reloc
36+
global patch_l_info
3637
3738
extern _DYNAMIC
3839
extern _GLOBAL_OFFSET_TABLE_
@@ -163,7 +164,7 @@ patch_link_map:
163164
call get_dynamic_pie
164165
mov [ecx+8], eax ;link_map[0].l_ld = my_dynamic_section
165166
call get_base_pie
166-
;; mov [ecx], eax ;link_map[0].l_addr= my_base_load
167+
mov [ecx], eax ;link_map[0].l_addr= my_base_load
167168
168169
;; link_map[0].l_addr is used as an offset into the GOT
169170
;; 0xb7fec2df <_dl_fixup+271>: mov DWORD PTR [edx+ebp*1],eax
@@ -335,13 +336,16 @@ start_main_wrapper_alt:
335336

336337
do_patch_pie:
337338
call patchmygotpie
338-
;;call fixdynamicpie
339-
call patch_host_dynamic_reloc
340-
;; call patch_link_map ; does this even do anything?
339+
call fixdynamicpie
340+
;; call patch_host_dynamic_reloc
341+
call patch_link_map ; does this even do anything?
342+
call patch_l_info
341343
ret
342344

343345
344-
%define RELOC 17
346+
%define RELOC 0x17
347+
;; this function is bad.
348+
;; the reloc section of the host is not writable
345349
patch_host_dynamic_reloc:
346350
call get_link_map ; get host got
347351
mov eax,[eax+8] ; eax has the got
@@ -362,6 +366,36 @@ patch_host_dynamic_reloc:
362366
mov [ecx+4], eax ;patch it!
363367
ret
364368

365-
369+
370+
;; the structure we're looking to patch
371+
;; is located directly behind the first element
372+
;; of the link_map linked list
373+
;; the index of pointers in this list coresponds
374+
;; to the magic value inside the .dynamic section
375+
patch_l_info:
376+
call get_link_map
377+
add eax,0x20
378+
mov edx,eax
379+
call get_dynamic_pie
380+
.begin:
381+
mov ecx,[eax] ;grab element from dynamic
382+
test ecx, ecx
383+
jz patch_l_info.done
384+
;;
385+
cmp ecx,32
386+
;;
387+
jb patch_l_info.patch
388+
;; cmp ecx,RELOC
389+
;; jz patch_l_info.patch
390+
add eax,8 ;walk dynamic
391+
jmp patch_l_info.begin
392+
.patch:
393+
shl ecx,2
394+
mov [edx+ecx], eax ;index l_info with ecx
395+
add eax,8
396+
jmp patch_l_info.begin
397+
.done:
398+
ret
399+
366400

367401

‎lib_research/lib.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
#define _GNU_SOURCE
22

33
#include <stdio.h>
4-
#include "gs.h"
54
#include <dlfcn.h>
65

6+
#include "gs.h"
7+
78
#define BREAK() __asm__("int3")
89

910
#ifdef LIB
@@ -16,6 +17,7 @@ extern void print_hello(void){
1617
puts("hello");
1718
return;
1819
}
20+
1921
int main2(){
2022
puts("main2");
2123
return 2;

‎lib_research/stage/makefile‎

Lines changed: 6 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,12 @@
11
all: test
2-
stage:
3-
gcc s.c -m32 -c -o stage.o
4-
gcc stage.o ../gs.o -o stage
5-
6-
start:
7-
gcc s.c -m32 -c -o stage.o -D start --shared -fPIC
8-
gcc stage.o ../gs.o -o stage -D start --shared -fPIC
9-
10-
main:
11-
gcc s.c -m32 -c -o stage.o
12-
gcc stage.o ../gs.o -o stage -Wl, --entry=main
132

3+
CFLAGS= -nostdlib -lc -D start -fPIE -pie
144
test:
15-
gcc s.c -m32 -c -o stage.o -nostdlib -lc -D start -fPIE -pie
16-
gcc stage.o ../gs.o -o stage -nostdlib -lc -D start -fPIE -pie
17-
gcc s.c -m32 -c -o debug.o -nostdlib -lc -D start -fPIE -pie -D DEBUG
18-
gcc debug.o ../gs.o -o debug_stage -nostdlib -lc -D start -fPIE -pie -D DEBUG
5+
gcc s.c -m32 -c -o stage.o $(CFLAGS)
6+
gcc stage.o ../gs.o -o stage $(CFLAGS)
7+
gcc s.c -m32 -c -o debug.o $(CFLAGS) -D start -D DEBUG
8+
gcc debug.o ../gs.o -o debug_stage $(CFLAGS) -D start -D DEBUG
199

2010

2111
clean:
22-
rm -rf stage.o stage
12+
rm -rf stage.o stage debug_stage

‎lib_research/stage/s.c‎

Lines changed: 28 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,39 +4,54 @@
44
#include <string.h>
55
#include <sys/mman.h>
66

7-
extern _GLOBAL_OFFSET_TABLE_;
8-
97
#define BREAK() __asm__("int3");
8+
#define RWE PROT_EXEC|PROT_READ|PROT_WRITE
109
//extern _GLOBAL_OFFSET_TABLE_
1110

12-
1311
#ifdef start
1412
void _start(void){
1513
main();
1614
}
1715
#endif
1816

17+
int test_functions(void);
18+
1919
int main(int argc,char** argv){
2020
#ifdef DEBUG
21-
mprotect((void*)(_GLOBAL_OFFSET_TABLE_&(~0xfff)), 0x1000, PROT_EXEC|PROT_READ|PROT_WRITE);
21+
//mprotect(((int)findgotpie())&(~0xfff), 0x1000, RWE);
22+
printf("gs:0 %p\n", getTLS);
23+
mprotect( (void*)(((int)findgot())&(~0xfff)), 0x1000, RWE);
2224
BREAK();
2325
#endif
24-
char buf[100];
25-
char* message="I'M THE BOSS\n";
26-
//BREAK();
26+
//BREAK();
27+
28+
do_patch_pie();
2729

28-
patchmygotpie();
29-
fixdynamicpie();
3030
#ifdef DEBUG
3131
BREAK();
3232
#endif
33-
puts("something something");
34-
35-
printf("whatever whatever\n");
36-
write("%s %s\n","figgure this shit out,","Sherlock");
33+
//start testing here
3734

35+
//int(*libc_start_main)() = get_libc_start_main();
36+
//libc_start_main(test_functions,0,0,0,0,0,getTLS());
37+
//start_main_wrapper_alt(test_functions);
38+
test_functions();
39+
//end testing here
3840
#ifdef DEBUG
3941
BREAK();
4042
#endif
4143
return 0;
4244
}
45+
46+
int test_functions(void){
47+
char buf[100];
48+
char* message="I'M THE BOSS\n";
49+
50+
//BREAK();
51+
puts("something something");
52+
printf("whatever whatever\n");
53+
gets(buf);
54+
puts(buf);
55+
_exit(0); // regular exit will
56+
return 2;//main 2
57+
}

0 commit comments

Comments
 (0)