From c9048bd2b40b7edd604c4b7ad18617e96a987975 Mon Sep 17 00:00:00 2001 From: mykola2312 <49044616+mykola2312@users.noreply.github.com> Date: Mon, 10 Apr 2017 01:53:45 +0300 Subject: [PATCH] Initial commit --- proc.c | 89 +++++++++++++++++++++++++++ proc.h | 26 ++++++++ sh2load | Bin 0 -> 14501 bytes sh2load.c | 162 +++++++++++++++++++++++++++++++++++++++++++++++++ sh2load32 | Bin 0 -> 12870 bytes vm_shell32.bin | Bin 0 -> 40 bytes vm_shell32.s | 14 +++++ vm_shell64.bin | Bin 0 -> 42 bytes vm_shell64.s | 16 +++++ vmap.c | 60 ++++++++++++++++++ vmap.h | 41 +++++++++++++ 11 files changed, 408 insertions(+) create mode 100644 proc.c create mode 100644 proc.h create mode 100644 sh2load create mode 100644 sh2load.c create mode 100644 sh2load32 create mode 100644 vm_shell32.bin create mode 100644 vm_shell32.s create mode 100644 vm_shell64.bin create mode 100644 vm_shell64.s create mode 100644 vmap.c create mode 100644 vmap.h diff --git a/proc.c b/proc.c new file mode 100644 index 0000000..4411114 --- /dev/null +++ b/proc.c @@ -0,0 +1,89 @@ +#include "proc.h" + +int is_numeric(char* s) +{ + while(*s) + { + if(!isdigit(*s)) + return 0; + s++; + } + return 1; +} + +int walk_proc(walk_proc_callback func,void *data) +{ + struct dirent* dr; + DIR* d; + if(!(d = opendir("/proc"))) + return -1; + while((dr = readdir(d))) + { + if(dr->d_type == DT_DIR) + { + if(is_numeric(dr->d_name)) + { + if(func(atoi(dr->d_name),data)) + return 1; + } + } + } + closedir(d); + return 0; +} + +int walk_thread(pid_t pid,walk_thread_callback func,void *data) +{ + struct dirent* dr; + DIR* d; + char path[256]; + sprintf(path,"/proc/%d/task",pid); + if(!(d = opendir(path))) + return -1; + while((dr = readdir(d))) + { + if(dr->d_type == DT_DIR) + { + if(is_numeric(dr->d_name)==1) + { + if(func(atoi(dr->d_name),data)) + return 1; + } + } + } + closedir(d); + return 0; +} + +int suspend_proc_callback(pid_t tid,void *data) +{ + int status; + if(*(bool*)data == true) + { + ptrace(PTRACE_ATTACH,tid,0,0); + waitpid(tid,&status,0); + } + else + { + ptrace(PTRACE_DETACH,tid,0,0); + waitpid(tid,&status,0); + } + return 0; +} + +int suspend_proc(pid_t pid,bool suspend) +{ + return walk_thread(pid,&suspend_proc_callback,(void*)&suspend); +} + +int open_proc(pid_t pid) +{ + char path[256]; + sprintf(path,"/proc/%d/mem",pid); + return open(path,O_RDWR); +} + +void close_proc(int pd) +{ + close(pd); +} diff --git a/proc.h b/proc.h new file mode 100644 index 0000000..4f6359d --- /dev/null +++ b/proc.h @@ -0,0 +1,26 @@ +#ifndef __PROC_H +#define __PROC_H + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +typedef int (*walk_proc_callback)(int pid,void *data); +typedef int (*walk_thread_callback)(pid_t tid,void *data); + +int walk_proc(walk_proc_callback func,void *data); +int walk_thread(pid_t pid,walk_thread_callback func,void *data); + +int suspend_proc(pid_t pid,bool suspend); + +int open_proc(pid_t pid); +void close_proc(int pd); + +#endif diff --git a/sh2load b/sh2load new file mode 100644 index 0000000000000000000000000000000000000000..5e611f8875450ca05ddb212fa8995516ea9f8b60 GIT binary patch literal 14501 zcmeHOeQ;D&mcQu^5QTKYrx6`!z|5jZ2p>k&Q9D53;RIwL!LPxWPP#*)opew4Ye<-4 z2P(v+CuC$-u_)KsiIz3v>{wgWmLkiJNe~Luu{1c2TDv%vavi4|(2XC%WE~{?JLlc| z`n{%K%~WmG{)I|OmDNdbn;s}MztnU&ab zafJwoS>hXFJdknt1Xx1UtSLGwT`O87^}L{k_$>FBz;aK3D~eug!a`BiL!#7PwghC= zq?4q9qC)stPIlDS(Qhyd+Q1b>7f^>#?v+&8QTNEMbQVd8HaO_8?3kizd^9%t)XDMH zc>>^w4-gTn_?o4pOJ&3Fj1bk&lrak$;EJM8nXph)*?k9g)X%@PluE^ovOTwXDU$tH zR1Q}xinKOXEn5@`EsV6bCp#8)EU#KvwX7l$tyse2CjX?nW_>-kq~_5Nj`}z9T=3&A_%$y0ZWsJ#F8GVUCyT2^U`_*S*pK;&3)W#M zVy-(~-`W;!*AqrCZs@uQMG~EDxJF~)c2a91ttt`jXf;GU91Mk8<027@x3(M2qM4Oq z;dne67rNe>h&J7Fi=Id{1>2iNQzV)QllIoI5o-;JX3&I481V=kgW$ht3%51JIz?MB z5{WjE`$#Nkvk>^^N)6-Lg3@@ z8J|aPO1zNJenkK99KgqqPjY7K74$^%5QtI$PxC?5{(4nwYcV}Re2^3N_}@N(ZMsmD zNq#EJy<(o^O@HX6^fxlQ0aoTS2n|_f)P_&AP+`RfJtJwKRHe+{z|{%3O4rQ$Z8&eP zj0!Q|hI=JOq|%0~XAj}aZMgmU9I)Z`=aXi`sZXkGu;EsWLwK(ZFTPS~gErU%v8Kx`)oKp6jgc7hEG=@ z=ph?E!-gNR;aA!4K^rdLDOmcd4Zqr^KV-va+VJ;nIBjaG4BK$~6FF_elLn*(Xc#7%F z5c3;}r&!JmGJhBGUg8fizk+y*-Ao_zw-Qe=o7vC&65=UVGrO3-fq071OpN)t#8Yf$ z8knC+Jgv>l2Ii*_&oP<_Fi?CYA+$;}l?-@@r(n(ang41USrA{!{O80|aApMaXNjkv z%#2(DQ2rtD6pWc+=Kqa&3c}0~^KTPR!Iv3i{&nIh=rV_xe}(vI#P>0Ol=$hy?`Qs> ziKpPo>|*{OiKn2-#F&4EcnYRW1M^Q3PeGK~!2I74Pr;K3F#kj1DQGg4;1_?gHg)yhbII&I1d1)kDNdRz6yHzsdTsZo?BLiXFC1v85$#y|POadi zcKVVr-SRe3c`KO>KX8fmcilb*{TIo}^)O7g;|6RwInD>D;0tbPplB9#>`sv!ckVIR zSZc{ZE zwcY~()X>F#v?w45U~Qmt^Rb#goZ^S>v7_@KF?+O^di1X_7$EKR)6}=#1OAJq2kJCD zT*7LT9{QvQidNIZ^W>q^@}Q%Z{_0QY%Q3CDTcDz)USZADTj>|Gj_#3;C@f7!$H-Bo z<~2Xr_xtr;xTL0qv$f z80^uvtE4QP^ozps;`pjdP{XFt8z54 zuz>W2l*56uIt+&_Gd=tZ7%F}$HERU$n zy!||lU4tGi)y)ogOx>nIo>pn+H(Q;8R&6V3hleL*m~P{Q{~{4h`#V5c-CFUbSn;Fh zmZcx#P9y4SMoSJ0t)zcYE5QGul9xouOM~U~rJ;K;If0GOP1m|=Mhm3wp26g?BNV}w zPe1J<*r|pGet>yPKQ~H|p*E3CM|cY{U_DZDI56c~g~Zv$x90rLMISU%Ku!JnkM=>`Zw~7FXi*Jn4b|149)-KE(Sqa> zJ2;4L(Wtm(tRS-=Ze#o0Y*3Ev2{_^*|2<&)*!VGVo+cj}!?=}u292ton)ClcVX9)4 zp8w{k&XCvMbr+$*LM=sM`Z3UR%W|#gEy1+XgUgLuOvBp8pk4~Dk z-q^J?d$qlRGM>fW4i0;4azzL+^I3{F%FXLi$JVAs`}^$ucnW^;a#^Y#nY+*LM|V;$ z@8g~6#a&Debb$06V63=GUoDtWH{58HwxX3Kfn-+`I(%!QL7e{GR$4UB%KNr($c1R z>Y)ulLoJP{F759y??U?Qm+Z}`ARVX!W_7J6fazS9KI-RY(X&(OS!mf@viF)EX-z1X z*Y>|7=i-lM2md0Mze4k-%W*lwN$otJN@BC9$0H|gJ|xXy_12FdwEIs?=UBXn0Fr<8RD5Fi7yr9@fvioPtxa861rKA>&S+i73$$B4NS>vyCl73?{%-Y_>IbX!`nUx0?Z1Hch znxkxs5pMUFhoB*oE@l=AAy|oEcp*u%=UW# zpMm_J=!>+EKUI%K)J$GCFPXPW0$e(e@e{9J=0`ABBpK-|Fv*fg+ zoq@c^A%Db@UkCXb+^=%Gyn)5$_#v-_{M&Z9XSHP?f_yvVWp??dtoUFCc%-AwOZsPe5LWIHLS^c79&B=FhB~IU#sO&AiGQbs;XRX86J}N4&sD5Nsc|+_mTxLot zkU*hA8wV97|HGxRDDek90V389zk}mUUL}+VJtogdH-WNHcA0W+RCpDGPG>HAq0Nhn zzk!Kb1%0xjc3R5*QBjH2^n?KO3h$G=>bS;IfnUkZqT0uX&jYHI`gjRsUbTyjoB2=2 z2c+fyE>XX3=eBxS-Qkm}@~*0UtST2&W&A|5^D`vx{3U()swWn5vQ!p{RKR5-GM4t*7r=Zw6 zed5G@LTxNgyhJp}4abR>TBj$R_+-&>b-)gB-HUfawNcrHUV+TH+@PHJG(nl)+~UP9 zlW!e)#SEc-&9mEhX;+c^j}ynPF{i-}aoubC71%EH3Tr#HVA=)?#b;v{AS<*_<-;*j z1nA}C@&osXV$qkgROU*2I0wH;;<-;0dfO^M|1~)-^<=r9@yq9VxAdc)P++FB?r>(rd5*81+`2TC*rO=<3qu=eK|0LtZ!Z*ci_Zis$y=~LDUX}f!H)JYzFn;;I zamd9#y_J)nqmu({&);59d&@;XjTZ>|Mwwgw!$tps3qA?+me0=u7yJ&!iv^`WsJz8j ze4_zQ^O-yU_ep(9-BIChO`uVU|4H88*H|hXCu9EUw-+k3pHle_aPprU=UZI-e2?*BK|h63;cwZX+a&%idB12srLs%n zhvd58Z_U8>x%hv^1%KKFf58QRmGNTnn4Ew0-uoLD{olLb7hP~40wdqLmMd_Ew{!Ni@Zc zgpq7+Mpf7ETDeiLUAw7{&TfU{;jOI+BOKR_HXWy-+QSKGgrfS^NVG8+(L+Wwp3sBI z4$%~Ci$%glI8;$}OI2llCA}H#>A`qB*r|uxjd&-HP6gY-dMMe})(I0Er&G@ys)?2* zk!Uc4E>eOHWLsM>#vNY0v3gyNUbB7`dTe%I)g4YkLSJ>?`s#ISS3=7s;e%>`@E)z# zXu9c5TeVT>YijRaQC+Lwy?XVgnmWC%dPQvwwZOT?rbLp5!>7Lj0sHYU>X;r2#uH%? zZcFO1WTHi$S##>?X8u(kPIJn(2O|%g*;0F+(>(0v)ND=Y?a8)qyp;~L(Lpt*n2)gK zfp8qoiOO-A$M)!4n^VlE?VJ$zk;Y1SSj-D$lg)E+B9TnckvkrNj(l*WG1&Al-!Yx6 zpzJs!2-`$dZwa=CB4O*)UbeBN@?2jQ!Ff7;?cHcB)Y`5maV$_BCCsYOK|C`d?8I#M zkAgsEqjPl}M-Q{Yn`QPqi%>IGjvV7^OeEwSm|1P7CZ89~X2N*}jTSlvsm>fa_4z=g z6EaUnIx&v8c=&taWWwMRj83sUUg-qs0HzZ$Pe3{`U9VfWQm!pN$>|i^@3TCE=~Qr> zxXg-{%EOmggyxZB)r@*kfm5SKuo2XVo3usMa8xuLkBJKWAQ7&pUa@we5!@=dt?kK* z#$+qbgX4f`1#vAwtiFm+XFHujWr|~>EZG*0Ct9QJ4n~J89*zV_QPyG+LsW32R2bn7 z)M*ogEXqHgRD@gPw$*~)AuP_cF!wLhLe(E?f*QOB+pu6OwnpI)mkMsh^oR%&71&PO zutlnU`hQ3%qUFHCjc({XAdgl#UL)EYcKP_P?8DHDK2%MfTT<=dr8CN#!(i7 zv)db<0Lu;O@H*zQmt6Z*5aCBndQaqX&=Zi93IF6kwQ(kEW$q*^)}t~JA7wx234jyG zQ7|$81^`vceJ_d2goxcZxQIbtHr*a*i%G6;% z8mj&)Jw+deoRW5mS2>YNnfZ%JdvZrQs{axeJ5ZrHRrV@((kJcJ3zKSJ*{kvIk@hR3 zLzQAlOZz_QnCvMznQQ+eU^FKxQ);DZQ2~siQko`b_Ey!2rtqf!#VaU`_v)xs9n;?3KR{P@w=+_9{E3{-$bJ&c6y$ z)vgMlk6~+XUuDro{Svsnee2ux9MfQ4j(u)_ zzJi>5sqqKqG_b`yX`id_XKD6A={st_G7E7{+0V?uNtcS9=7bo_1G0U;T7dL4q9=wL oxY~tifvL{3rMxsOFe^{yM7(NP=}tx^pZ!;hOpT%(gB(`;H-}{~Qvd(} literal 0 HcmV?d00001 diff --git a/sh2load.c b/sh2load.c new file mode 100644 index 0000000..b8b69f7 --- /dev/null +++ b/sh2load.c @@ -0,0 +1,162 @@ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "proc.h" +#include "vmap.h" + +#ifdef __i386__ + +char shellcode[] = { + 0x6A,0x01,0xEB,0x07,0xFF,0xD3,0x83,0xC4, + 0x08,0x5B,0xC3,0xE8,0xF4,0xFF,0xFF,0xFF, + 0x90 +}; + +#define STR_OFFSET 0x10 +#define SHELL_SIZE 0x10 + +#elif __x86_64__ + +char shellcode[] = { + 0x48,0x31,0xF6,0xEB,0x08,0x5F,0x48,0xFF, + 0xC6,0xFF,0xD3,0x5B,0xC3,0xE8,0xF3,0xFF, + 0xFF,0xFF,0x90 +}; + +#define STR_OFFSET 0x12 +#define SHELL_SIZE 0x12 + +#endif + +void emu_push(pid_t pid,struct user_regs_struct *regs, + unsigned long value) +{ +#ifdef __i386__ + regs->esp -= sizeof(unsigned long); + if(ptrace(PTRACE_POKEDATA,pid,regs->esp,value) < 0) + perror("ptrace_pokedata"); +#elif __x86_64__ + regs->rsp -= sizeof(unsigned long); + if(ptrace(PTRACE_POKEDATA,pid,regs->rsp,value) < 0) + perror("ptrace_pokedata"); +#endif +} + +unsigned long getfuncaddr(const char* name) +{ + void* mod; + if(!(mod = dlopen("libc.so.6",RTLD_LAZY))) + return -1; + return (unsigned long)dlsym(mod,name); +} + +int main(int argc,char** argv) +{ + pid_t pid = atoi(argv[1]); + struct user_regs_struct regs; + struct stat st; + vmap_t shell,libc,local_libc; + unsigned long dlpn_off,dlpn_addr; + char* local_shell; + size_t path_size,total_size; + int pd,wr; + char filename[PATH_MAX]; + + + if(vmap_reqeust(pid,VMAP_WALK_SHELL,&shell) < 0) + { + fputs("[-] Place for shellcode not found!\n",stderr); + exit(0); + } + + if(vmap_reqeust(pid,VMAP_WALK_LIBC,&libc) < 0) + { + fputs("[-] Libc not found!\n",stderr); + exit(0); + } + + if(vmap_reqeust(getpid(),VMAP_WALK_LIBC,&local_libc) < 0) + { + fputs("[-] Local libc not found!\n",stderr); + exit(0); + } + + suspend_proc(pid,true); + + if((pd = open_proc(pid)) < 0) + { + perror("open_proc"); + suspend_proc(pid,false); + exit(1); + } + + realpath(argv[2],filename); + path_size = strlen(filename) + 1; + total_size = path_size + SHELL_SIZE; + + local_shell = (char*)malloc(total_size); + if(!local_shell) + { + perror("malloc"); + suspend_proc(pid,false); + exit(1); + } + + memcpy((void*)local_shell,shellcode,SHELL_SIZE); + memcpy((void*)(local_shell+STR_OFFSET),filename,path_size); + + printf("%lx-%lx\n",shell.vm_start,shell.vm_end); + + if((wr = pwrite(pd,(void*)local_shell, + total_size,(off_t)shell.vm_start)) < 0) + { + perror("pwrite"); + goto ex; + } + else + printf("[+] Shellcode written %d\n",wr); + + if(!(dlpn_addr = getfuncaddr("__libc_dlopen_mode"))) + { + perror("getfuncaddr"); + goto ex; + } + + printf("__libc_dlopen_mode %lx\n",dlpn_addr); + dlpn_off = dlpn_addr - local_libc.vm_start; + printf("offset %lx\n",dlpn_off); + dlpn_addr = dlpn_off + libc.vm_start; + printf("remote __libc_dlopen_mode %lx\n",dlpn_addr); + + ptrace(PTRACE_GETREGS,pid,0,®s); +#ifdef __i386__ + emu_push(pid,®s,regs.eip); + emu_push(pid,®s,regs.ebx); + + regs.eip = (unsigned long)shell.vm_start+2; + regs.ebx = (unsigned long)dlpn_addr; +#elif __x86_64__ + emu_push(pid,®s,regs.rip); + emu_push(pid,®s,regs.rbx); + + regs.rip = (unsigned long)shell.vm_start+2; + regs.rbx = (unsigned long)dlpn_addr; +#endif + + ptrace(PTRACE_SETREGS,pid,0,®s); +ex: + suspend_proc(pid,false); + + free((void*)local_shell); + close_proc(pd); + return 0; +} diff --git a/sh2load32 b/sh2load32 new file mode 100644 index 0000000000000000000000000000000000000000..b858dfa08cc2b743033e8eca70650d70ea4a1838 GIT binary patch literal 12870 zcmeHOe{@t;e!r8Mz^EZVFuDk+vq}^dLIQ}Oc1=hIaE&-Zh;9*|LuSI8FqxU1c>@Ut zPGQF&ahx_Hy6e%iW<7RGTdJN@tEq0+Xb|;iPbs<{cbB$l7q`O_cT>$;*0N4NpL^e% zd3j=c`e)DKhCAQ;`F_9md++_;AMf7xE`Q{2Tjg@OgcZt!TM$j`^LUqn-nURmmI|LZ zPs|sWi_63`uqa!)8#;(SWMC`@&x7bjYzJ=NA>H2;0hb|A>C}ltk0i1 z@Ldi(?!W^M{J8^52bw(E?{vsJ9C(!juXW&`I`A9^e#e1->A)!me%66sbl}6lL(hA> z96vQ;wpa{$XupLq;xHCNQ8frPZA(u)rlpKv($F*!ipCS+7)YwGhiaYFS|+qx?|@1u z64TPDa7cuEBZf$ZgP~9)DN>1KBxZDpE}1hCPA20?p=ps+ymQ40EtTpF#=1mjG>(kW z-V!zvk&x&DO^K9|jG{CU{1ZLlp3X#{=m|!n@lKkLCW3}8XqGuOt<&gBgtg5Y#i$KR z5(y(2>b6@~wrGp% z8;hxiV(NxsY6;z3=J<0pu#05eumkc3pCan~riL?rf zE-6~NhO`EYJSk>bfD})Jc2cZ*cavTu#66@Jkak4j9p>FmFgBNEenI%+9SJ})udsQZYAB&Iv{`NV?~ z)2%wk!^zze)4lp~;)KL>v))8}pTu;xzJ@p;F}=n*-qCxBC%yoqj=iMsCLWWRy`}FXJ}NPLO&=s4k(j-we~`nb3@u0-)RsDJ5-4e5R^-tgRCW+bm`iH~~ z5_1&jW5hm*ISsm4Ul|%dzIWhXGbbhj?d$YGER=c!e(vnhw?63c<_pL$*)?eY%g&uQ zYRAJ*!TiD}@sl|{ZQE?tTVQC_Y#8_`GhVAxP&k@7T>bW^qk}o)Dltrs)PL=C*}&_s z{pxbp(SJN`%z0U6JZ8+48LI;-=P{L&8FN3nnku{h;29VY=?kTvH@_2Ibfla-7mDZ_ z9QLAl+3Nmd>GD&L198{-j zpaFA*^kn{JmG|w@T-!VkJYV?s85miA=bmxycn03dws@$Bw=D*{w*wrQwyIB1Lcpvz;$*5F#`IArS8I-s;WhFK%oKuL}u57 z=)0D__0ho3{>!YrS2c81F!k2-Aw6!EyDtCv=d%9UM;D;8va-vdu`ZxDvVb3%Qq`5HOCf!tke>3k&7ttLzGQ&G6!^txk{BjVD>CNP)6rXw&1+#M!YIccP9z<)UFKR)0;P%=2f@+XQ_<6#*dWY#b` zk>9CmAp3P9->YPD70QKAe{18WT=0yVqux{X`QM;D+3Kv{TlJ!-`tgWs#C5dlB~kU# zNS*L<*}`n)8guHxjNj{0YWI(%-x|hKQk158h5jnrzF#@Vn&|CnqHoXoC#qg-nsNTk zp7ctjGb0zEZh?FsRslID8+cQ3kPjn7Qul@#Vnd_h6l9AtQ6;xqy-nUGub!vmEelIF#Rlmhn(O1-}mO1T8 z+w0$CnMM7pQU8jssQ>BHvh`N|pD^p+tg@HtpBbM8Bj}y`M~thx1v}i^U7i1(%8qt* zi=2Ow3v>P_|0zwLsGvUSnhTDz-H?n}+2> z=pLx$`X`w&*FVI^L7rPGIhojjCiBbPc%>|PQs?&FG?1_R%pB0^KX*D8#b*7JZ#H>2 zZ;;AzYGE{aGb3oMx4Soxf56IZT&Gky@2J{Dcj&dqi9QMBpZl#WMa_l{(iX?yDru~i z&8|hW1Npm@9%jz}Y)`Y>EB|uE$FqJsCgj7`KOWFmJgmk>pBfvO5T!+;TsjrKepko( z{J*0;dq&^HrW@U#jn4Ds{@MfA<};IpLN3FNGo!AtkdvoY`qY@WfN?|N zz$?_ryy-$`toS1Ri_GDQjrVGsMzMqW6q|FogU`q^I#~v{?07QCBb7P_YKi#Pa42X5 zZAVujHZI)c3q)~D^mWCPzLXx0Mmyu7urC%jz)8nKU&pzHN^LkBo`oCl3`TuCH%^uD zT&g9KIE$Jm*1Bl#LPQudPn#RB+vHncERH8oBOLS9g`i;`MAdOy>p^vRGVV&pI&rAx zSy!G@ZDOCY9PjE%g$)x39FlwDM%ee2>WgIk|z4+A4|&=WSuu*;kkH)io>+ z`RcB1SRA@h{vr)#%BCMoq(pMF^ex{2y5_iV`W`4>k(~IXPxOP{Q&e3Xf4L(yPyW>EDQ?1He+z@SSMUNy{l%uYun@+WbZft*W}d z3)+T-bTw$H+?Haw^m7XGr>4lCD9Y*oPauDFiu{$Loc;1J`lEA-Tr0}kAm@X!&Mps1 zv21q~@}EM!!Y)sjct)qlN`&jafa9-vddTQb!R-iqs>Q3{(T>ME{qo* z8%ut8rdZEO$Oj<*+bQzDDavaxKCZyH`i5P;L)BvqcuOH~f_zg^-dtJnfV;V}datLs zvNlt`w$c}=oYz`8zqN8fb7jNrmA=)LwaufI)y+pLE1KV|^ftdyiB9AA*$rFmumy51 zob$jr51jMBIS-ukz&Q{6Kl8xIfX6$8$ZBJIQH=AEu0VW$ug8n;H{t+Z8{%Vx{5;Li zd)&L>qlEC_MJ)G@#J~Nb5I=-Z&-j`m#xnQ}19}vgUrodcSjSfrxp}}>4;i>m6nM|Z zO++4%n_7G^5!^_P_j|ld9|z?IoSP1OJ>e@Hfjw~i9`JFPiZky7=xksl|IdNn(ydGv zKj86Rg}4lH6=DZs7veU=y@-z?{t)p+#3P6wApR2ZGsJ1QJ8&`LRfx+FS0Q#Fb|G#< z+>7`a;tvsDL_C7{0isoQx9imO!h0E>`SRF<7Y0|iwA|>MkI&-Q_?Fc#sc-ZxZfLxr zp|N3wIJ;y?!!pa3lkz?SdFqyfx+9>l+P>{8%4LrTcA}EATU942%&t|Pt1!D51HtsY z8{hdD*f*qZ*;}d)6+Vwd_N~HlXsA)97#t!9a43mejzJV?I?63L7S%-!Qn$c|Hw2DO zQn$bdID~^m%weN0J&@wFA&D5q>jYA_Jli2*4g$9vVroE8$w6B$NGjO5l0KRk3<84Bk@*waj_=Bfn;%;CcFsH`M zGGG|8`qw8e5kFUR2vX`p2K^!QKlOQ8VLz}HD1X|4UvS_zfFC!Er*h(N09*56Cg#Jx0l%N~czL>}{9|A%u>67p*Qhl?s!-0i6ILMRn|Uh` zuL0&8G@eRnzr!KtJ59?!tbZDqZ)15Hr+yarVfg!?i66D)_ks6}4YRx#fbTc`QB!t_ zc+DaIi35KGY`+{b>5xxz^cUZ*Sb^nT56sV{JTN9i3;tVS+ItrGWsDEL z4WayHU@Ndae-Hc#`ipM~DF2y5{;>o9-hr!7QGVW~P5OTh@Nx7f-=5IkEzsw#f%2Jn zeOV0j`Eix~BtqBCivjC5BQlA89-mUUX&t?S!) z<0qU9Z;7Oga8fgRG+dgAg;UT7#kDQb_~u|#3mNfbN(-iYMQ6Mx5e*yRQ2nyyD{eTu zlGcUtv|utB?9;+ABiV-=Ho=~-7E1T@^dXB4X{^~4)s((C8V`n0MZUKL+13+G$O^Ao z*L=HQ^RI11jaBun^b{i@p|yT%ZS(E7wm{1!k=L8R!gfLPuhEpXHLdG}wz}<(mCbG1 z9jjKY_qS{9%`4mdEJ410?M$U*bIc1$O-+S`NCt?HGt{bg|^rNz=c;ba7E zlee$zIn~W5JIA~qWoN1P)g?}&c}=UtX~4BAl#TAt_>$Uu_Yt=@f5m z$+~KIeIDH$?A)rHMmuoTlv`)KPv)?difei>7K(<87r{yjOXQuf5^iwbPg9q^>o=!Trl;g3 zw9=;p>19Lb-8$=nUCER=?2_Schtny;x_D=o^8%b5s}Bez4l1Ly-`-+QBzrHJH|a{M z4eHL`ml(K;XXlx>^X#lC7xhYlCCZ>0zoH%&42|GsP$Q|RZl!RWFq}+?dVHS=*Eg@c zb)ga5Vxldvbp7UZ1ovohhp?VV4`Sxkhx%f?uqY{R5=zOoa55E%$EE-cvSc_)J(WmA z4N)(2kXW6+7q&q?)R-CVhJe4QyGl~pZaDus(9DW^{XDNYNdaX#~^5Da__0&^G9i>OzwTL{Ouw0&Mk3z2+fJY!Cr9GZD zIuQBDq#jSfV*ot-TER-*3x;)o0ZbjsQmuViX?t#K?q**R`tQ*4) zL>{lmm<50*WO+B7gEWL-2W?fkhpXcu*LEl@!D)#{} zEIoN{gVV>XMnc9qP2be% z0GkVST9ax;zx961cV0|aKU z^xg#K>6BwZo=+|>^%YsvV|)*hr&j9moa6Zly?=q6}x1nMo7DfL5{6>aVpN1-vm_start,&map->vm_end,map->perms, + &map->magic_num,map->path); +} + +int vmap_walk(pid_t pid,walk_map_callback func,void *arg) +{ + char buf[256]; + char path[64]; + vmap_t map; + FILE* fmap; + + sprintf(path,"/proc/%d/maps",pid); + if(!(fmap = fopen(path,"rb"))) + return -1; + + while(fgets(buf,256,fmap) != NULL) + { + vmap_parse(&map,buf); + if(func(&map,arg)) + return 1; + } + return 0; +} + +int walk_map_func(vmap_t *map,void *arg) +{ + vmap_request_t *vreq = (vmap_request_t*)arg; + vreq->status = VMAP_NOTFOUND; + if(vreq->type == VMAP_WALK_SHELL && strchr(map->perms,'x')) + { + vreq->status = VMAP_OK; + memcpy(vreq->map,map,sizeof(vmap_t)); + return 1; + } + else if(vreq->type == VMAP_WALK_LIBC && strstr(map->path,"libc-")) + { + vreq->status = VMAP_OK; + memcpy(vreq->map,map,sizeof(vmap_t)); + return 1; + } + return 0; +} + +int vmap_reqeust(pid_t pid,request_t what,vmap_t *map) +{ + vmap_request_t vreq; + + vreq.type = what; + vreq.map = map; + vmap_walk(pid,&walk_map_func,(void*)&vreq); + if(vreq.status == VMAP_OK) + return 0; + + return -1; +} diff --git a/vmap.h b/vmap.h new file mode 100644 index 0000000..f6e89f6 --- /dev/null +++ b/vmap.h @@ -0,0 +1,41 @@ +#ifndef __VMAP_H +#define __VMAP_H + +#include +#include +#include +#include +#include +#include + +typedef enum { + VMAP_WALK_SHELL, + VMAP_WALK_LIBC, +} request_t; + +typedef enum { + VMAP_OK, + VMAP_NOTFOUND, +} status_t; + +typedef struct { + uintptr_t vm_start; + uintptr_t vm_end; + char perms[5]; + uint32_t magic_num; + char path[256]; +} vmap_t; + +typedef struct { + request_t type; + status_t status; + vmap_t *map; +} vmap_request_t; + +typedef int (*walk_map_callback)(vmap_t *map,void *arg); + +void vmap_parse(vmap_t* map,const char* str); +int vmap_walk(pid_t pid,walk_map_callback func,void *arg); +int vmap_reqeust(pid_t pid,request_t what,vmap_t *map); + +#endif