dot/macho
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

format code

Browse Source
This commit is contained in:
nganhkhoa
2023-05-31 16:31:52 +07:00
parent e3453ae127
commit 841a50f8e1
12 changed files with 201 additions and 196 deletions
Download Patch File Download Diff File Expand all files Collapse all files

149
research/custom_loader/b.c
View File

@ -1,39 +1,40 @@
#include <stdio.h>
#include <stdint.h>
#include <mach-o/dyld.h>
#include <mach/mach.h>
#include <stdint.h>
#include <stdio.h>
const uint32_t magic64 = 0xfeedfacf;
const uint32_t magic32 = 0xfeedface;
struct ProgramVars {
void* mh; // mach_header or mach_header64
int* NXArgcPtr;
const char*** NXArgvPtr;
const char*** environPtr;
const char** __prognamePtr;
void *mh; // mach_header or mach_header64
int *NXArgcPtr;
const char ***NXArgvPtr;
const char ***environPtr;
const char **__prognamePtr;
};
extern "C" uint32_t dyld_get_sdk_version(const mach_header* mh);
extern "C" uint32_t dyld_get_sdk_version(const mach_header *mh);
void decode_uleb128(char*& addr, uint32_t* ret) {
void decode_uleb128(char *&addr, uint32_t *ret) {
uint32_t result = 0;
int shift = 0;
while (1) {
unsigned char byte = *(unsigned char*)(addr);
unsigned char byte = *(unsigned char *)(addr);
addr++;
result |= (byte & 0x7f) << shift;
shift += 7;
if (!(byte & 0x80)) break;
if (!(byte & 0x80))
break;
}
*ret = result;
}
void* find_header(void* _func) {
void *find_header(void *_func) {
// Approach 1: (not stable)
// we assume that text section is small enough to fit on 1 page
// so the header should stay at the top of the page due to allocation logic
@ -63,41 +64,41 @@ void* find_header(void* _func) {
uint64_t func = (uint64_t)_func;
uint64_t potential_head = func + (0x1000 - (func % page_size));
void* head = 0;
uint32_t* x = (uint32_t*)(potential_head);
void *head = 0;
uint32_t *x = (uint32_t *)(potential_head);
while (*x != magic64 && *x != magic32) {
x -= 0x1000/4;
x -= 0x1000 / 4;
}
return (void*)x;
return (void *)x;
}
void print_macho_summary(const void* header) {
const uint32_t magic = *(uint32_t*)header;
char* ptr = (char*)header;
void print_macho_summary(const void *header) {
const uint32_t magic = *(uint32_t *)header;
char *ptr = (char *)header;
if (magic == magic64) {
ptr += 0x20;
} else {
ptr += 0x20 - 0x4;
}
const uint32_t ncmds = *((uint32_t*)header + 4);
const uint32_t ncmds = *((uint32_t *)header + 4);
printf("parsing macho at %p\n", header);
printf("ncmds %x\n", ncmds);
for (int i = 0; i < ncmds; i++) {
const uint32_t cmd = *((uint32_t*)ptr + 0);
const uint32_t cmdsize = *((uint32_t*)ptr + 1);
const uint32_t cmd = *((uint32_t *)ptr + 0);
const uint32_t cmdsize = *((uint32_t *)ptr + 1);
printf(" cmd %x %x\n", cmd, cmdsize);
if (cmd == LC_DYLD_EXPORTS_TRIE) {
const uint32_t offset = *((uint32_t*)ptr + 2);
const uint32_t size = *((uint32_t*)ptr + 3);
const uint32_t offset = *((uint32_t *)ptr + 2);
const uint32_t size = *((uint32_t *)ptr + 3);
printf(" export trie: offset=0x%x size=0x%x\n", offset, size);
}
if (cmd == LC_SEGMENT_64) {
char* name = (char*)((uint64_t*)ptr + 1);
uint64_t vmaddr = *((uint64_t*)ptr + 3);
uint64_t vmsize = *((uint64_t*)ptr + 4);
uint64_t fileoffset = *((uint64_t*)ptr + 5);
uint64_t filesize = *((uint64_t*)ptr + 6);
char *name = (char *)((uint64_t *)ptr + 1);
uint64_t vmaddr = *((uint64_t *)ptr + 3);
uint64_t vmsize = *((uint64_t *)ptr + 4);
uint64_t fileoffset = *((uint64_t *)ptr + 5);
uint64_t filesize = *((uint64_t *)ptr + 6);
if (strcmp(name, "__TEXT") == 0) {
uint64_t slide = (uint64_t)header - vmaddr;
printf(" --- slide=0x%llx ---\n", slide);
@ -110,9 +111,9 @@ void print_macho_summary(const void* header) {
}
}
void* get_export_trie(const void* header, uint32_t& size) {
const uint32_t magic = *(uint32_t*)header;
char* ptr = (char*)header;
void *get_export_trie(const void *header, uint32_t &size) {
const uint32_t magic = *(uint32_t *)header;
char *ptr = (char *)header;
if (magic == magic64) {
ptr += 0x20;
} else {
@ -122,20 +123,20 @@ void* get_export_trie(const void* header, uint32_t& size) {
uint64_t slice = 0;
uint64_t linkedit_vmaddr = 0;
uint64_t linkedit_fileoffset = 0;
const uint32_t ncmds = *((uint32_t*)header + 4);
const uint32_t ncmds = *((uint32_t *)header + 4);
for (int i = 0; i < ncmds; i++) {
const uint32_t cmd = *((uint32_t*)ptr + 0);
const uint32_t cmdsize = *((uint32_t*)ptr + 1);
const uint32_t cmd = *((uint32_t *)ptr + 0);
const uint32_t cmdsize = *((uint32_t *)ptr + 1);
if (cmd == LC_DYLD_EXPORTS_TRIE) {
const uint32_t offset = *((uint32_t*)ptr + 2);
size = *((uint32_t*)ptr + 3);
const uint32_t offset = *((uint32_t *)ptr + 2);
size = *((uint32_t *)ptr + 3);
uint64_t offset_in_linkedit = (uint64_t)offset - linkedit_fileoffset;
return (void*)(linkedit_vmaddr + slice + offset_in_linkedit);
return (void *)(linkedit_vmaddr + slice + offset_in_linkedit);
}
if (cmd == LC_SEGMENT_64) {
char* name = (char*)((uint64_t*)ptr + 1);
uint64_t vmaddr = *((uint64_t*)ptr + 3);
uint64_t fileoffset = *((uint64_t*)ptr + 5);
char *name = (char *)((uint64_t *)ptr + 1);
uint64_t vmaddr = *((uint64_t *)ptr + 3);
uint64_t fileoffset = *((uint64_t *)ptr + 5);
if (strcmp(name, "__TEXT") == 0) {
slice = (uint64_t)header - vmaddr;
} else if (strcmp(name, "__LINKEDIT") == 0) {
@ -148,9 +149,9 @@ void* get_export_trie(const void* header, uint32_t& size) {
return 0;
}
uint32_t should_follow_symbol(char*& buffer, char*& _find) {
uint32_t should_follow_symbol(char *&buffer, char *&_find) {
// printf("follow check %s has prefix: %s\n", _find, buffer);
char* find = _find;
char *find = _find;
char is_prefix = true;
while (1) {
int find_end = *find == 0;
@ -183,11 +184,11 @@ uint32_t should_follow_symbol(char*& buffer, char*& _find) {
return is_prefix;
}
void* find_in_export_trie(const void* header, void* trie, char* symbol) {
void *find_in_export_trie(const void *header, void *trie, char *symbol) {
uint32_t func = 0;
char* ptr = (char*)trie;
char* find = symbol;
char *ptr = (char *)trie;
char *find = symbol;
while (1) {
// terminal node will have data
uint32_t data_count = 0;
@ -206,7 +207,7 @@ void* find_in_export_trie(const void* header, void* trie, char* symbol) {
uint32_t follow_offset;
decode_uleb128(ptr, &follow_offset);
if (still_following) {
ptr = (char*)trie + follow_offset;
ptr = (char *)trie + follow_offset;
break;
}
}
@ -221,10 +222,10 @@ void* find_in_export_trie(const void* header, void* trie, char* symbol) {
ptr++; // flags
// uleb128 offset
decode_uleb128(ptr, &func);
return (void*)((char*)header + func);
return (void *)((char *)header + func);
}
int hook_printf (const char * format, ... ) {
int hook_printf(const char *format, ...) {
va_list args;
va_start(args, format);
@ -236,16 +237,17 @@ int hook_printf (const char * format, ... ) {
return status;
}
__attribute__((constructor))
static void bruh(int argc, const char* const argv[], const char* const envp[], const char* const apple[], const struct ProgramVars* vars) {
__attribute__((constructor)) static void
bruh(int argc, const char *const argv[], const char *const envp[],
const char *const apple[], const struct ProgramVars *vars) {
// ProgramVars contains pointer to main executable (mapped) file
const void* main = (int*)(vars->mh);
const void *main = (int *)(vars->mh);
// Find our lib (mapped) file
const void* thislib = find_header((void*)bruh);
const void *thislib = find_header((void *)bruh);
// Find dyld lib (mapped) file using a no-sus function
const void* libdyld = find_header((void*)dyld_get_sdk_version);
const void *libdyld = find_header((void *)dyld_get_sdk_version);
const void* libc = find_header((void*)printf);
const void *libc = find_header((void *)printf);
// From libdyld header, we can list exports table
// to find all function we want to use
@ -273,16 +275,16 @@ static void bruh(int argc, const char* const argv[], const char* const envp[], c
printf("libdyld header at %p\n", libdyld);
for (int i = 0; i < _dyld_image_count(); i++) {
void* header = (void*)_dyld_get_image_header(i);
char* name = (char*)_dyld_get_image_name(i);
void *header = (void *)_dyld_get_image_header(i);
char *name = (char *)_dyld_get_image_name(i);
int offset = _dyld_get_image_vmaddr_slide(i);
printf("%p 0x%x name=%s\n", header, offset, name);
}
uint32_t trie_size;
void* thislib_export_trie = get_export_trie(thislib, trie_size);
void* libdyld_export_trie = get_export_trie(libdyld, trie_size);
void* libc_export_trie = get_export_trie(libc, trie_size);
void *thislib_export_trie = get_export_trie(thislib, trie_size);
void *libdyld_export_trie = get_export_trie(libdyld, trie_size);
void *libc_export_trie = get_export_trie(libc, trie_size);
// printf("export this lib address %p\n", thislib_export_trie);
// for (int i = 0; i < 136; i++) {
@ -291,7 +293,6 @@ static void bruh(int argc, const char* const argv[], const char* const envp[], c
// }
// printf("\n");
// printf("export dyld lib address %llx\n", (uint64_t)libdyld_export_trie);
// for (int i = 0; i < 0x11e0; i++) {
// if (i % 0x10 == 0) printf("\n");
@ -310,22 +311,24 @@ static void bruh(int argc, const char* const argv[], const char* const envp[], c
// fwrite(system_export_trie, trie_size, 1, write_ptr);
struct test_find_export {
const char* name;
const void* lib;
void* trie;
void* original;
const char *name;
const void *lib;
void *trie;
void *original;
};
struct test_find_export find_export_testcases[] = {
{"__Z11find_headerPv", thislib, thislib_export_trie, (void*)find_header},
{"__dyld_get_image_name", libdyld, libdyld_export_trie, (void*)_dyld_get_image_name},
{"__dyld_image_count", libdyld, libdyld_export_trie, (void*)_dyld_image_count},
{"_printf",libc, libc_export_trie, (void*)printf},
{"__Z11find_headerPv", thislib, thislib_export_trie, (void *)find_header},
{"__dyld_get_image_name", libdyld, libdyld_export_trie,
(void *)_dyld_get_image_name},
{"__dyld_image_count", libdyld, libdyld_export_trie,
(void *)_dyld_image_count},
{"_printf", libc, libc_export_trie, (void *)printf},
};
for (int i = 0; i < 4; i++) {
struct test_find_export test = find_export_testcases[i];
void* found = find_in_export_trie(test.lib, test.trie, (char*)test.name);
void *found = find_in_export_trie(test.lib, test.trie, (char *)test.name);
printf("%s: Found=%p | Expect=%p\n", test.name, found, test.original);
}
@ -334,11 +337,11 @@ static void bruh(int argc, const char* const argv[], const char* const envp[], c
// modern symbol resolve
// fix got
uint64_t* got = (uint64_t*)((char*)main + 0x4000);
uint64_t *got = (uint64_t *)((char *)main + 0x4000);
printf("BEFORE symbol bind code is %llx\n", *got);
vm_protect(mach_task_self(), (uint64_t)got, 0x4000, 0, VM_PROT_READ | VM_PROT_WRITE);
vm_protect(mach_task_self(), (uint64_t)got, 0x4000, 0,
VM_PROT_READ | VM_PROT_WRITE);
// fix got table
// *got = (uint64_t)find_in_export_trie(libc, libc_export_trie, "_printf");