This commit is contained in:
nganhkhoa 2025-01-13 12:54:05 -06:00
parent 1c495989d4
commit 06bbde2612
7 changed files with 414 additions and 418 deletions

View File

@ -18,4 +18,3 @@ func (action *removeStrings) withFat(ff *FatFile) error {
func NewRemoveStringsAction() *removeStrings {
return &removeStrings{}
}

View File

@ -133,7 +133,7 @@ func (mc *MachoContext) CollectBindSymbolsModern() []*ImportSymbol {
for page_i := 0; page_i < int(fix.page_count); page_i++ {
// loop through each page in segment, each page has size fix.page_size
// the first item in page is offset through pages[page_i]
address := int64(fix.segment) + int64(page_i) * int64(fix.page_size) + int64(pages[page_i])
address := int64(fix.segment) + int64(page_i)*int64(fix.page_size) + int64(pages[page_i])
reader.Seek(address, io.SeekStart)
fmt.Printf(" page %d offset=%x\n", page_i, address)
@ -147,7 +147,7 @@ func (mc *MachoContext) CollectBindSymbolsModern() []*ImportSymbol {
var bind C.int
var ret1 C.ulonglong
var ret2 C.ulonglong
if (fix.format != 2 && fix.format != 6) {
if fix.format != 2 && fix.format != 6 {
fmt.Printf("format is %d\n", fix.format)
}

View File

@ -5,8 +5,8 @@ import (
"encoding/binary"
"fmt"
"io"
"os"
"math/rand"
"os"
"strings"
"time"
@ -586,7 +586,7 @@ func (mc *MachoContext) RemoveStrings() {
// their reference down too,
// symtab and dysymtab can be ignored, by removing them lmao
var cstring *Section64;
var cstring *Section64
for _, command := range mc.commands {
switch command.(type) {
case *Segment64:
@ -617,7 +617,7 @@ func (mc *MachoContext) RemoveStrings() {
// at the end.
// last segment is always the linkedits
last_segment := mc.Segments()[len(mc.Segments()) - 1]
last_segment := mc.Segments()[len(mc.Segments())-1]
fmt.Printf("last segment %v %s\n", last_segment, string(last_segment.SegName()))
// all data must be inside the segment (or in header)
@ -634,13 +634,13 @@ func (mc *MachoContext) RemoveStrings() {
filestart := last_segment.Fileoff()
// align to page address, not sure if neccessary, because the
// loader can pick up from anywhere and load in memory (mmap)
if filestart % 0x4000 != 0 {
if filestart%0x4000 != 0 {
filestart += 0x4000 - (filestart % 0x4000)
}
fmt.Printf("section size %x\n", secsize)
secsize_aligned := uint64(0)
if secsize % 0x4000 == 0 {
if secsize%0x4000 == 0 {
// very rare, but possible, it occupies whole pages
secsize_aligned = secsize
} else {
@ -653,7 +653,6 @@ func (mc *MachoContext) RemoveStrings() {
secname := make([]byte, 16)
copy(secname, []byte("__secrets"))
fmt.Printf("segstart %x\n", segstart)
fmt.Printf("file_start %x\n", filestart)
@ -708,22 +707,22 @@ func (mc *MachoContext) RemoveStrings() {
}
// modify the segment list
mc.segments[len(mc.segments) - 1] = &string_segment
mc.segments[len(mc.segments)-1] = &string_segment
mc.segments = append(mc.segments, &edit_segment)
// modify the command list
for i, cmd := range mc.commands {
if cmd.(*Segment64) == last_segment.(*Segment64) {
mc.commands = append(mc.commands[:i + 1], mc.commands[i:]...)
mc.commands = append(mc.commands[:i+1], mc.commands[i:]...)
mc.commands[i] = &string_segment
mc.commands[i + 1] = &edit_segment
mc.commands[i+1] = &edit_segment
break
}
}
// modify offset in other commands to use new link edit offset
edit_offset_migrate := func (file_offset uint64) uint64 {
edit_offset_migrate := func(file_offset uint64) uint64 {
// they should keep the old offset,
// but the base related to linkedit is modified
relative_offset := file_offset - last_segment.Fileoff()
@ -745,18 +744,17 @@ func (mc *MachoContext) RemoveStrings() {
mc.RewriteHeader()
tmp_file := mc.file.Name()
// has to reopen file as append
mc.file.Close()
mc.file, _ = os.OpenFile(tmp_file, os.O_RDWR | os.O_APPEND, 0644)
mc.file, _ = os.OpenFile(tmp_file, os.O_RDWR|os.O_APPEND, 0644)
// make extra space
expected_end := edit_segment.Fileoff() + edit_segment.Filesize()
end, _ := mc.file.Seek(0, io.SeekEnd)
if end < int64(expected_end) {
mc.file.WriteAt(make([]byte, expected_end - uint64(end)), end)
mc.file.WriteAt(make([]byte, expected_end-uint64(end)), end)
}
// close and reopen as read/write, the buffer at the end is now empty
@ -771,7 +769,7 @@ func (mc *MachoContext) RemoveStrings() {
// prepare dummy bytes into new string segment, 0 for now
// this is a way to divert their effort, writing fake strings
// will be written again at runtime
dummy := make([]byte, edit_segment.Fileoff() - string_segment.Fileoff())
dummy := make([]byte, edit_segment.Fileoff()-string_segment.Fileoff())
mc.file.ReadAt(dummy, int64(cstring.Offset()))
// copy(dummy, []byte("We R BShield\n"))
for i := 0; i < len(dummy); i++ {
@ -806,7 +804,7 @@ func (mc *MachoContext) RemoveStrings() {
// this part uses file offsets for calculations
in_cstring := func (offset uint64) bool {
in_cstring := func(offset uint64) bool {
cstring_start := uint64(cstring.Offset())
cstring_end := cstring_start + cstring.Size()
return (offset >= cstring_start) && (offset < cstring_end)
@ -820,7 +818,7 @@ func (mc *MachoContext) RemoveStrings() {
for addr := text_start; addr < text_end; addr = addr + 4 {
mc.file.ReadAt(inst, int64(addr))
inst_adrp := binary.LittleEndian.Uint32(inst)
mc.file.ReadAt(inst, int64(addr + 4))
mc.file.ReadAt(inst, int64(addr+4))
inst_add := binary.LittleEndian.Uint32(inst)
if !(C.is_adrp(C.uint(inst_adrp)) != 0 && C.is_add(C.uint(inst_add)) != 0) {
@ -832,9 +830,9 @@ func (mc *MachoContext) RemoveStrings() {
// calculate the old string reference
ref_base := C.adrp_imm_get(C.uint(inst_adrp))
ref_offset := C.add_imm_get(C.uint(inst_add))
ref := base + uint64(ref_base + ref_offset)
ref := base + uint64(ref_base+ref_offset)
if (!in_cstring(ref)) {
if !in_cstring(ref) {
continue
}
@ -847,13 +845,13 @@ func (mc *MachoContext) RemoveStrings() {
newstr_base := (newstr >> 12) << 12 // to calculate new offset in adrp
newstr_offset := newstr - newstr_base // to calculate new offset in add
C.adrp_imm_set((*C.uint32_t)(unsafe.Pointer(&inst_adrp)), C.uint(newstr_base - base))
C.adrp_imm_set((*C.uint32_t)(unsafe.Pointer(&inst_adrp)), C.uint(newstr_base-base))
C.add_imm_set((*C.uint32_t)(unsafe.Pointer(&inst_add)), C.uint(newstr_offset))
binary.LittleEndian.PutUint32(inst, inst_adrp)
mc.file.WriteAt(inst, int64(addr))
binary.LittleEndian.PutUint32(inst, inst_add)
mc.file.WriteAt(inst, int64(addr + 4))
mc.file.WriteAt(inst, int64(addr+4))
}
// modify the rebase table (for both opcode and fixups chain versions)
@ -866,8 +864,8 @@ func (mc *MachoContext) RemoveStrings() {
} else {
// (high8 << 56 | target) - mach_header
ref := uint64(symbol.high8 << 56 | symbol.target)
if (!in_cstring(ref)) {
ref := uint64(symbol.high8<<56 | symbol.target)
if !in_cstring(ref) {
continue
}

View File

@ -86,7 +86,7 @@ func (mc *MachoContext) CollectObjectiveCClasses() {
// struct class_ro_t *ro;
// };
for i := uint64(0); i < (section.Size() / uint64(mc.pointersize * 5)); i++ {
for i := uint64(0); i < (section.Size() / uint64(mc.pointersize*5)); i++ {
var isa uint64
var superclass uint64
var cache uint64
@ -98,8 +98,7 @@ func (mc *MachoContext) CollectObjectiveCClasses() {
binary.Read(reader, mc.byteorder, &vtable)
binary.Read(reader, mc.byteorder, &ro)
fmt.Printf("at=0x%x\n", section.Offset() + uint32(i) * mc.pointersize * 5)
fmt.Printf("at=0x%x\n", section.Offset()+uint32(i)*mc.pointersize*5)
fmt.Printf("isa=0x%x superclass=0x%x\n", isa, superclass)
fmt.Printf("cache=0x%x vtable=0x%x\n", cache, vtable)
fmt.Printf("ro=0x%x\n", ro)
@ -115,7 +114,7 @@ func (mc *MachoContext) CollectObjectiveCClasses() {
// is rebase, because ro points to objc_const
// and address is in range
if (bind != 1 && ret1 >= objc_const_start && ret1 < objc_const_end) {
if bind != 1 && ret1 >= objc_const_start && ret1 < objc_const_end {
offset := ret1 - objc_const_start
objc_const.Seek(int64(offset), 0)
@ -482,7 +481,7 @@ func (mc *MachoContext) ReworkForObjc() {
}
}
encode_movz((data_end - text_start) + (shellcode_size - len(shellcode_start))+3)
encode_movz((data_end - text_start) + (shellcode_size - len(shellcode_start)) + 3)
shellcode_offset = text_start - shellcode_size
shellcode_bytes := append(shellcode_start, offset...)