stuff
This commit is contained in:
commit
a532133a5d
|
|
@ -0,0 +1,3 @@
|
||||||
|
hello.glibc*
|
||||||
|
hello.musl*
|
||||||
|
manip-exe
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
|
||||||
|
.PHONY: default all clean
|
||||||
|
|
||||||
|
GLIBCC ?= $(CC)
|
||||||
|
MUSLCC ?= x86_64-linux-musl-gcc
|
||||||
|
|
||||||
|
default: all
|
||||||
|
|
||||||
|
manip-exe: manip-exe.c manip-exe.h
|
||||||
|
$(CC) -o "$@" $< -Og -g
|
||||||
|
|
||||||
|
# 'export-dynamic' so that functions defined in the exe actually end up in .dynsym
|
||||||
|
hello.glibc: hello.c
|
||||||
|
$(GLIBCC) -o "$@" $< -Wl,--export-dynamic -Og -g
|
||||||
|
hello.musl: hello.c
|
||||||
|
$(MUSLCC) -o "$@" $< -Wl,--export-dynamic -Og -g
|
||||||
|
|
||||||
|
hello.%.manip: ./manip-exe hello.%
|
||||||
|
./$^ "$@" main2
|
||||||
|
@chmod +x "$@"
|
||||||
|
|
||||||
|
all: hello.glibc.manip hello.musl.manip
|
||||||
|
|
||||||
|
clean:
|
||||||
|
@$(RM) -v hello.glibc hello.glibc.manip manip-exe hello.musl hello.musl.manip
|
||||||
|
|
||||||
|
|
@ -0,0 +1,49 @@
|
||||||
|
# relocmain
|
||||||
|
|
||||||
|
Swap out an ELF executable's `main` function with another function from its
|
||||||
|
symbol table, without touching its code at all.
|
||||||
|
|
||||||
|
## How it works
|
||||||
|
|
||||||
|
The typical ELF entrypoint isn't `main` directly, but rather `_start`, an
|
||||||
|
assembly stub that first does some runtime initialization before calling
|
||||||
|
`main`. But instead of directly calling the latter function, it is often
|
||||||
|
passed as a parameter to `__libc_start_main` (which in turn calls `main` after
|
||||||
|
doing *more* initialization stuff).
|
||||||
|
|
||||||
|
'Relocations' are instructions for an ELF linker or loader on how to patch a
|
||||||
|
binary when moving it around in memory or when resolving functions. Some
|
||||||
|
examples are "this value here is an absolute address, so when you move me
|
||||||
|
around, please keep it updated" (`R_<arch>_RELATIVE`), or "I'm using this
|
||||||
|
external function, and I'm accessing it through a PLT, so when you resolve
|
||||||
|
the symbol, please put it in the PLT" (`R_<arch>_JUMP_SLOT`).
|
||||||
|
|
||||||
|
This programs adds another relocation entry that replaces the code that loads
|
||||||
|
the address `main` (to pass it to `__libc_start_main`) with the address of a
|
||||||
|
different symbol. Due to how relocations work, it is restricted to replacing
|
||||||
|
it with another symbol that is either imported from another library, or
|
||||||
|
exported by the executable itself.
|
||||||
|
|
||||||
|
Currently, only x86_64 is supported (but it's not too hard to add support for
|
||||||
|
other instruction sets, 32-bit ELF support is a bit harder). The code looks for
|
||||||
|
a `lea rdi, [rel <pcrel32>]` instruction near `_start`, this is often the
|
||||||
|
instruction that loads `main` to pass it to `__libc_start_main` (at least on
|
||||||
|
glibc and musl it is). This then gets overwritten *at runtime by *`ld.so` due
|
||||||
|
to a relocation of type `R_X86_64_PC32` targetting the `pcrel32` operand of
|
||||||
|
that instruction --- all without touching any code of the executable.
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
```sh
|
||||||
|
# build only the tool
|
||||||
|
make manip-exe
|
||||||
|
# usage: ./manip-exe <input> <output> <symbol>
|
||||||
|
|
||||||
|
# also show some example stuff
|
||||||
|
make all
|
||||||
|
```
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
See [LICENSE](/LICENSE).
|
||||||
|
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
int main(int argc, char** argv[]){printf("hello, world\n");return 42;}
|
||||||
|
|
||||||
|
extern int main2(int argc, char** argv[]);
|
||||||
|
int main2(int argc, char** argv[]) {
|
||||||
|
printf("be gay do crimes\n");
|
||||||
|
return 69;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,66 @@
|
||||||
|
|
||||||
|
#include <stddef.h>
|
||||||
|
#include <stdint.h>
|
||||||
|
#include <stdbool.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <sys/stat.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
|
||||||
|
// TODO: allow for non-native-bitness ELF parsing
|
||||||
|
#include "manip-exe.h"
|
||||||
|
|
||||||
|
int main(int argc, char* argv[]) {
|
||||||
|
if (argc < 4) {
|
||||||
|
fprintf(stderr,"usage: %s <input> <output> <symbol>\n", argv[0]);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
const char* symname = argv[3];
|
||||||
|
|
||||||
|
FILE* f = fopen(argv[1], "rb");
|
||||||
|
if (f == NULL) {
|
||||||
|
fprintf(stderr, "%s: can't open input file '%s'\n", argv[0], argv[1]);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
fseek(f, 0, SEEK_END);
|
||||||
|
long s = ftell(f);
|
||||||
|
fseek(f, 0, SEEK_SET);
|
||||||
|
fprintf(stderr, "s=%zu\n", s);
|
||||||
|
|
||||||
|
void* blob = calloc(1, (size_t)s);
|
||||||
|
|
||||||
|
if (fread(blob, 1, (size_t)s, f) != (size_t)s) {
|
||||||
|
fprintf(stderr, "%s: can't read input file '%s'\n", argv[0], argv[1]);
|
||||||
|
free(blob);
|
||||||
|
fclose(f);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
fclose(f);
|
||||||
|
|
||||||
|
if (manip_elf(blob, symname)) {
|
||||||
|
fprintf(stderr, "%s: ELF patching failed\n", argv[0]);
|
||||||
|
free(blob);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
f = fopen(argv[2], "wb");
|
||||||
|
if (f == NULL) {
|
||||||
|
fprintf(stderr, "%s: can't open output file '%s'\n", argv[0], argv[2]);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (fwrite(blob, 1, (size_t)s, f) != (size_t)s) {
|
||||||
|
fprintf(stderr, "%s: can't write output file '%s'\n", argv[0], argv[2]);
|
||||||
|
free(blob);
|
||||||
|
fclose(f);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
fclose(f);
|
||||||
|
free(blob);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,196 @@
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <string.h>
|
||||||
|
|
||||||
|
#include <elf.h>
|
||||||
|
#include <link.h>
|
||||||
|
|
||||||
|
#if (sizeof(ElfW(Ehdr)) != sizeof(Elf64_Ehdr))
|
||||||
|
#error "Need 64-bit ELF for now, sorry"
|
||||||
|
#endif
|
||||||
|
|
||||||
|
static bool manip_elf(ElfW(Ehdr)* elf, const char* symname) {
|
||||||
|
if (elf->e_ident[0] != ELFMAG0 || elf->e_ident[1] != ELFMAG1
|
||||||
|
|| elf->e_ident[2] != ELFMAG2 || elf->e_ident[3] != ELFMAG3) {
|
||||||
|
printf("bad elf magic\n");
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO: port to other architectures
|
||||||
|
// what would be needed for a port:
|
||||||
|
// * fix code looking for 'lea rdi, [rel main]'
|
||||||
|
// * fix relocation type
|
||||||
|
// * thats it i think??? (well also fix this validation stuff)
|
||||||
|
if (elf->e_ident[EI_CLASS] != ELFCLASS64 || elf->e_ident[EI_DATA] != ELFDATA2LSB) {
|
||||||
|
printf("not a 64-bit little-endian elf\n");
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
if (elf->e_type != ET_DYN || elf->e_machine != EM_X86_64) {
|
||||||
|
printf("need dynamic x86_64 elf\n");
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
ElfW(Phdr)* phdr = (ElfW(Phdr)*)(elf->e_phoff + (size_t)elf), *ph_loadexec;
|
||||||
|
ElfW(Dyn)* dyn = NULL;
|
||||||
|
for (size_t i = 0; i < elf->e_phnum;
|
||||||
|
++i, phdr = (ElfW(Phdr)*)((size_t)phdr + elf->e_phentsize)) {
|
||||||
|
if (phdr->p_type == PT_LOAD) {
|
||||||
|
// need this at runtime for the relocs to work (yeah, sorry)
|
||||||
|
if (phdr->p_flags & PF_X) {
|
||||||
|
ph_loadexec = phdr;
|
||||||
|
phdr->p_flags |= PF_W;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (phdr->p_type == PT_DYNAMIC) {
|
||||||
|
dyn = (ElfW(Dyn)*)((size_t)elf + phdr->p_offset);
|
||||||
|
printf("dyn=%zu\n", phdr->p_offset);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (dyn == NULL) {
|
||||||
|
fprintf(stderr, "No DYNAMIC table! bailing out...\n");
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
ElfW(Addr)* relasz = NULL, *relaent = NULL, *jmprel = NULL;
|
||||||
|
ElfW(Rela)* relatab = NULL;
|
||||||
|
ElfW(Sym)* dynsym = NULL;
|
||||||
|
const char* dynstr = NULL;
|
||||||
|
size_t strsz = 0, syment = 0;
|
||||||
|
|
||||||
|
ElfW(Addr) relaoff = 0;
|
||||||
|
|
||||||
|
for (size_t i = 0; dyn->d_tag != DT_NULL; ++i, ++dyn) {
|
||||||
|
if (dyn->d_tag == DT_RELA) {
|
||||||
|
relatab = (ElfW(Rela)*)((size_t)elf + dyn->d_un.d_ptr);
|
||||||
|
relaoff = dyn->d_un.d_ptr;
|
||||||
|
}
|
||||||
|
if (dyn->d_tag == DT_RELASZ) relasz = (ElfW(Addr)*)(&dyn->d_un.d_ptr);
|
||||||
|
if (dyn->d_tag == DT_RELAENT) relaent = (ElfW(Addr)*)(&dyn->d_un.d_ptr);
|
||||||
|
if (dyn->d_tag == DT_JMPREL) jmprel = (ElfW(Addr)*)(&dyn->d_un.d_ptr);
|
||||||
|
|
||||||
|
if (dyn->d_tag == DT_REL) {
|
||||||
|
printf("WARN: REL table present in DYN\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
if (dyn->d_tag == DT_SYMTAB) dynsym = (ElfW(Sym)*)((size_t)elf + dyn->d_un.d_ptr);
|
||||||
|
if (dyn->d_tag == DT_STRTAB) dynstr = (const char*)((size_t)elf + dyn->d_un.d_ptr);
|
||||||
|
if (dyn->d_tag == DT_SYMENT) syment = dyn->d_un.d_val;
|
||||||
|
if (dyn->d_tag == DT_STRSZ ) strsz = dyn->d_un.d_val;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!relasz || !relaent || !relatab) {
|
||||||
|
fprintf(stderr, "No RELA/RELASZ/RELAENT in DYN!\n");
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
if (!dynsym || !dynstr || !strsz || !syment) {
|
||||||
|
fprintf(stderr, "no SYMTAB/STRTAB/STRSZ/SYMENT in DYN!\n");
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
// now we have everything to start patching stuff
|
||||||
|
|
||||||
|
static const uint8_t magic_code[] = {0x48,0x8d,0x3d}; // lea rdi, [rel <pcrel32>]
|
||||||
|
|
||||||
|
// assumption: the first matching instruction loads 'main' into rdi
|
||||||
|
// both glibc and musl load main this way, they could do it in a different
|
||||||
|
// way, but apparently it's not the case
|
||||||
|
ElfW(Addr) reloctarget = 0;
|
||||||
|
ElfW(Addr) entry_vma = elf->e_entry;
|
||||||
|
ElfW(Addr) entry_lma = elf->e_entry - ph_loadexec->p_vaddr + ph_loadexec->p_offset;
|
||||||
|
printf("entry_vma=0x%zx, entry_lma=0x%zx\n", entry_vma, entry_lma);
|
||||||
|
void* entry_mem = (void*)(entry_lma + (size_t)elf);
|
||||||
|
for (size_t i = 0; entry_lma+i - ph_loadexec->p_offset < ph_loadexec->p_filesz; ++i) {
|
||||||
|
const uint8_t* tocmp = (const uint8_t*)((size_t)entry_mem + i);
|
||||||
|
|
||||||
|
for (size_t j = 0; j < sizeof(magic_code)/sizeof(*magic_code); ++j) {
|
||||||
|
if (tocmp[j] != magic_code[j]) goto next;
|
||||||
|
}
|
||||||
|
|
||||||
|
// found it!
|
||||||
|
reloctarget = entry_vma + i + sizeof(magic_code)/sizeof(*magic_code);
|
||||||
|
printf("target = 0x%zx\n", reloctarget);
|
||||||
|
break;
|
||||||
|
|
||||||
|
next:;
|
||||||
|
}
|
||||||
|
if (!reloctarget) {
|
||||||
|
printf("couldn't find relocation target...\n");
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
ElfW(Word) sym = 0;
|
||||||
|
|
||||||
|
for (size_t i = 0; (size_t)dynsym < (size_t)dynstr; ++i, dynsym = (ElfW(Sym)*)((size_t)dynsym + syment)) {
|
||||||
|
if (i && dynsym->st_name != 0 && dynsym->st_name < strsz
|
||||||
|
&& !strcmp(symname, dynstr + dynsym->st_name)) {
|
||||||
|
sym = i;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!sym) {
|
||||||
|
printf("replacement symbol '%s' not found!\n", symname);
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
printf("symbol '%s' -> index %zu\n", symname, sym);
|
||||||
|
|
||||||
|
ElfW(Rela) extrarel;
|
||||||
|
extrarel.r_offset = reloctarget;
|
||||||
|
extrarel.r_info = ELF64_R_INFO(sym, R_X86_64_PC32); // TODO: make portable
|
||||||
|
extrarel.r_addend = -4; // TODO: make portable
|
||||||
|
|
||||||
|
printf("extrarel: *0x%016zx = 0x%016zx + %d\n", extrarel.r_offset, extrarel.r_info, extrarel.r_addend);
|
||||||
|
|
||||||
|
// resize the phdr containing the relocations
|
||||||
|
phdr = (ElfW(Phdr)*)(elf->e_phoff + (size_t)elf);
|
||||||
|
for (size_t i = 0; i < elf->e_phnum;
|
||||||
|
++i, phdr = (ElfW(Phdr)*)((size_t)phdr + elf->e_phentsize)) {
|
||||||
|
if (phdr->p_offset >= relaoff && phdr->p_offset + phdr->p_filesz < relaoff) {
|
||||||
|
printf("rela phdr index = %zu\n", i);
|
||||||
|
phdr->p_filesz += *relaent;
|
||||||
|
phdr->p_memsz += *relaent;
|
||||||
|
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// resize the shdr containing the relocations
|
||||||
|
// FIXME: ASSUMPTION: the relocation tables end up at the very end of this
|
||||||
|
// phdr, first .rela.dyn and then .rela.plt, and no others
|
||||||
|
// things will break BADLY if this isn't true, and it's hard to detect
|
||||||
|
// if this will happen, so watch out!
|
||||||
|
ElfW(Shdr)* shdr = (ElfW(Shdr)*)(elf->e_shoff + (size_t)elf);
|
||||||
|
for (size_t i = 0; i < elf->e_shnum;
|
||||||
|
++i, shdr = (ElfW(Shdr)*)((size_t)shdr + elf->e_shentsize)) {
|
||||||
|
if (shdr->sh_type == SHT_REL) {
|
||||||
|
printf("WARN: REL table present\n");
|
||||||
|
} else if (shdr->sh_type == SHT_RELA) {
|
||||||
|
if (shdr->sh_offset == relaoff) { // .rela.dyn
|
||||||
|
shdr->sh_size += shdr->sh_entsize; // one extra entry
|
||||||
|
} else { // .rela.plt
|
||||||
|
if (jmprel && *jmprel != shdr->sh_offset) {
|
||||||
|
printf("WARN: RELA tables look fishy\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
// move one entry below to make room
|
||||||
|
memmove((void*)((size_t)elf + shdr->sh_offset + shdr->sh_entsize),
|
||||||
|
(void*)((size_t)elf + shdr->sh_offset),
|
||||||
|
shdr->sh_size);
|
||||||
|
shdr->sh_offset += shdr->sh_entsize;
|
||||||
|
if (jmprel) *jmprel += shdr->sh_entsize;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// FINALLY write back the actually relevant stuff
|
||||||
|
printf("relasz = %zu, index = %zu\n", *relasz, *relasz / *relaent);
|
||||||
|
relatab[*relasz / *relaent] = extrarel;
|
||||||
|
*relasz += *relaent;
|
||||||
|
|
||||||
|
printf("relasz now %zu\n", *relasz);
|
||||||
|
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
Loading…
Reference in New Issue