コード例 #1
0
def do_instrument(target, output, bbs, disable_tls, daemon_mode, verbose,
                  daemonize, interp, bbcoverage, stateful, detailed_bbcoverage,
                  bb_index_path, path):
    ELFPATCHER_PATH = os.path.abspath(os.path.join("..", "ELFPatcher"))
    sys.path.append(ELFPATCHER_PATH)
    from elfpatcher import ELF

    elf = ELF(target)

    tlog('Start patching for %s' % target)

    if (not elf.check_imported_library('libc.so.6')
            and not elf.check_imported_library('libc.so.0')):
        die('The binary does not have libc.so.6/0 imported.')

    if daemon_mode == 'desock':
        init_entry = 'afl_manual_init'
        if stateful:
            elf.add_imported_library('libdesock-state.so')
        else:
            elf.add_imported_library('libdesock.so')
            # elf.add_imported_library('libdesock3-xiaomithrift.so')
            # elf.add_imported_library('libdesock3-persistent.so')
    elif daemon_mode == 'client':
        # init_entry = 'afl_manual_init_daemon'
        die('Historical use only.')
    else:
        init_entry = 'afl_manual_init'

    libaflinit_so = 'libaflinit.so'
    if bbcoverage:
        libaflinit_so = 'libaflinit-cov.so'
    elif detailed_bbcoverage:
        libaflinit_so = 'libaflinit-detailed-cov.so'
    elif path:
        libaflinit_so = 'libaflinit-path.so'
        # libaflinit_so = 'libaflinit-persistent2.so'
    elf.add_imported_symbol(init_entry, 'afl_init_entry', libaflinit_so)

    if daemonize:
        elf.add_imported_library('libdedaemon.so')

    if interp:
        elf.change_interp(interp)

    # avoid write to invalid address before initialization complete
    elf.add_data('afl_area_initial', '\x00' * 0x10000)
    elf.add_pointer('shm_pointer', 'afl_area_initial')

    if bbcoverage:
        elf.add_data('afl_area_cov_initial', '\x00' * 0x10000)
        elf.add_pointer('shm_cov_pointer', 'afl_area_cov_initial')
    elif detailed_bbcoverage:
        elf.add_data('afl_area_detailed_cov_initial', '\x00' * 0x10000)
        elf.add_pointer('shm_detailed_cov_pointer',
                        'afl_area_detailed_cov_initial')
    elif path:
        elf.add_data('afl_area_path_initial', '\xff\xff\xff\xff' * 0x400000)
        elf.add_pointer('shm_path_pointer', 'afl_area_path_initial')
        elf.add_data('afl_area_path_index_initial', '\x00\x00\x00\x00')
        elf.add_pointer('shm_path_index_pointer',
                        'afl_area_path_index_initial')

    afl_init_stub = afl_init
    if bbcoverage:
        afl_init_stub = afl_init_cov
    elif detailed_bbcoverage:
        afl_init_stub = afl_init_detailed_cov
    elif path:
        afl_init_stub = afl_init_path
    elf.add_code('afl_init', afl_init_stub)
    elf.add_init_function('afl_init')

    if disable_tls:
        elf.add_data('afl_prev_loc', '\x00' * 4)
        trampoline_template = trampoline_template_single_thread
        if bbcoverage:
            trampoline_template = trampoline_template_single_thread_cov
        elif detailed_bbcoverage:
            trampoline_template = trampoline_template_single_thread_detailed_cov
        elif path:
            trampoline_template = trampoline_template_single_thread_path
    else:
        elf.add_tls_bss_data('afl_prev_loc', 4, 'afl_prev_loc_offset')
        trampoline_template = trampoline_template_with_tls
        if bbcoverage:
            trampoline_template = trampoline_template_with_tls_cov
        elif detailed_bbcoverage:
            trampoline_template = trampoline_template_with_tls_detailed_cov
        elif path:
            trampoline_template = trampoline_template_with_tls_path
            # trampoline_template = trampoline_template_with_tls_path_and_pmode

    bb_index = ['bb,index,magic\n']

    for index, bb in enumerate(bbs):
        magic = new_magic(bb, bbcoverage)
        trampoline = ''
        if detailed_bbcoverage:
            trampoline = trampoline_template.format(magic=magic,
                                                    magic_shift=magic >> 1,
                                                    block_index=index)
        elif path:
            trampoline = trampoline_template.format(magic=magic,
                                                    magic_shift=magic >> 1,
                                                    offset=bb)
        else:
            trampoline = trampoline_template.format(magic=magic,
                                                    magic_shift=magic >> 1)

        try:
            elf.insert_code(where=bb, label="patch_%#x" % bb, code=trampoline)
        except Exception, e:
            log('[-] No.%d basic block @ %#x failed: %s.' %
                (index + 1, bb, str(e)))
            continue
        if (index + 1) % 10000 == 0:
            tlog('%d/%d basic blocks processed.' % (index + 1, len(bbs)))
        if verbose:
            log('No.%d basic block @ %#x (magic = %#x).' %
                (index + 1, bb, magic))
        if detailed_bbcoverage:
            bb_index.append('%#x,%d,%#x\n' % (bb, index, magic))
コード例 #2
0
ファイル: main.py プロジェクト: SocietyMaster/ELFPatcher
def test_x64(infile, outfile):
    elf = ELF(infile)

    # add imported function from external library
    elf.add_imported_library('lib_x64_library.so')
    elf.add_imported_symbol('export_function', '_export_function',
                            'lib_x64_library.so')

    elf.add_data('constdata', 'C' * 5 + '\x00')
    elf.add_pointer('constdata_pointer', 'constdata')
    elf.add_code(
        'pointer_verifier', """
        push rdi
        mov rdi, qword ptr [constdata_pointer]
        call qword ptr [_puts]
        pop rdi
        ret
    """)
    elf.add_init_function('pointer_verifier')

    elf.add_tls_bss_data('tls_bss_long', 0x4, 'tls_bss_long_offset')
    elf.add_tls_bss_data('tls_bss_char_array', 0x100,
                         'tls_bss_char_array_offset')

    elf.add_imported_symbol('puts', '_puts')
    elf.add_data('init_message', 'Hello From Init Array\x00')
    elf.add_code(
        "new_init_function", """
        push rdi
        lea rdi, byte ptr [init_message]
        call qword ptr [_puts]
        pop rdi
        ret
    """)
    elf.add_init_function("new_init_function")

    # hook function_2, call export_function
    elf.patch_code(fromwhere=0x40068C,
                   towhere=0x400697,
                   label='patch_40068C',
                   code="""
                        call qword ptr [_export_function]
                        push rbp
                        mov rbp, rsp
                        lea rdi, [_commandline]
                        """)
    elf.add_data('_commandline', '/bin/sh')

    # .text:00000000004006E2    lea     rdi, aParent    ; "parent"
    # .text:00000000004006E9    call    _puts
    # .text:00000000004006EE    lea     rax, function_3
    elf.insert_code(where=0x4006e9,
                    label="patch_4006e9",
                    code="""
    add rdi, 1  # rdi -> "arent"
    """,
                    nbound=0x4006ee)

    # .text:0000000000400678    lea     rdi, a255s      ; "%255s"
    # .text:000000000040067F    mov     eax, 0
    elf.insert_code(where=0x400678,
                    label="patch_400678",
                    code="""
    lea rdi, [_commandline]
    call 0x400540
    xor rax, rax
    leave
    ret
    """,
                    nbound=0x40067f)

    # add imported function from libc
    elf.add_imported_symbol('getpid', '_getpid')

    # data and code manipulate
    elf.add_data('global_data', 'A' * 0x20)

    # x64 has problems with direct addressing
    elf.add_code(
        'entry1', """
                 mov rax, [global_data2222]
                 mov rbx, [entry2]
                 mov rax, [_getpid]
                 """)

    elf.add_code(
        'entry2', """
                 mov rax, [global_data]
                 mov rbx, [entry1]
                 mov rcx, [_getpid]
                 """)

    elf.add_data('global_data2222', 'B' * 0x20)

    elf.add_code(
        'entry3', """
                 lea rcx, [global_data2222]
                 mov rax, [global_data2222]
                 mov rbx, [entry1]
                 mov rcx, [entry2]
                 mov rcx, [entry3]
                 mov rcx, [_getppid]
                 """)

    elf.add_imported_symbol('getppid', '_getppid')

    elf.add_code(
        'entry4', """
                 mov rcx, [_getppid]
                 """)

    elf.save(outfile)
コード例 #3
0
ファイル: main.py プロジェクト: SocietyMaster/ELFPatcher
def test_arm_afl(target, output, daemon_mode, disable_tls, bbs):
    import sys
    import datetime

    def die(s):
        sys.stdout.write(s + '\n') or exit()

    def log(s):
        sys.stdout.write(s + '\n')

    def tlog(msg):
        log('%s %s' % (str(datetime.datetime.now()), msg))

    trampoline_template_with_tls = """
    stmfd sp!, {{r0 - r4}}      @ save registers
    ldr r0, =afl_prev_loc_offset
    ldr r1, [r0]                @ afl_prev_loc offset
    mrc p15, 0, r0, c13, c0, 3  @ tls pointer
    ldrh r2, [r0, r1]           @ load afl_prev_loc, zero-extended
    movw r4, #{magic:#x}        @ cur_loc, zero-extended
    eor r2, r2, r4              @ afl_prev_loc ^ cur_loc
    ldr r3, =shm_pointer
    ldr r3, [r3]                @ shm_pointer
    ldrb r4, [r3, r2]
    add r4, r4, #1              @ shm[xored] += 1
    strb r4, [r3, r2]
    movw r2, #{magic_shift:#x}  @ cur_loc >> 1
    strh r2, [r0, r1]           @ afl_prev_loc = cur_loc >> 1
    ldmfd sp!, {{r0 - r4}}      @ restore registers
    """

    trampoline_template_single_thread = """
    stmfd sp!, {{r0, r2 - r4}}  @ save registers
    ldr r0, =afl_prev_loc
    ldrh r2, [r0]               @ load afl_prev_loc, zero-extended
    movw r4, #{magic:#x}        @ cur_loc, zero-extended
    eor r2, r2, r4              @ afl_prev_loc ^ cur_loc
    ldr r3, =shm_pointer
    ldr r3, [r3]                @ shm_pointer
    ldrb r4, [r3, r2]
    add r4, r4, #1              @ shm[xored] += 1
    strb r4, [r3, r2]
    movw r2, #{magic_shift:#x}  @ cur_loc >> 1
    strh r2, [r0]               @ afl_prev_loc = cur_loc >> 1
    ldmfd sp!, {{r0, r2 - r4}}  @ restore registers
    """

    afl_init = """
    stmfd sp!, {lr}
    ldr r3, =afl_init_entry
    ldr r3, [r3]
    blx r3                  @ call afl_init_entry(r0, r1, r2)
    ldr r3, =shm_pointer
    str r0, [r3]            @ save shm_pointer
    ldmfd sp!, {pc}
    """

    # it is okay we have duplicate magics, since what we actually need is making
    # magic1 ^ magic2 unique. it helps nothing by making magic itself unique.
    # magics = []
    from zlib import crc32

    def new_magic(seed):
        return crc32(str(seed)) % 2**16

    elf = ELF(target)

    tlog('Start patching for %s' % target)

    if (not elf.check_imported_library('libc.so.6')
            and not elf.check_imported_library('libc.so.0')):
        die('The binary does not have libc.so.6/0 imported.')

    if daemon_mode == 'desock':
        init_entry = 'afl_manual_init'
        elf.add_imported_library('libdesock.so')
    elif daemon_mode == 'client':
        init_entry = 'afl_manual_init_daemon'
    else:
        init_entry = 'afl_manual_init'
    elf.add_imported_symbol(init_entry, 'afl_init_entry', 'libaflinit.so')

    # avoid write to invalid address before initialization complete
    elf.add_data('afl_area_initial', '\x00' * 0x10000)
    elf.add_pointer('shm_pointer', 'afl_area_initial')

    elf.add_code('afl_init', afl_init)
    elf.add_init_function('afl_init')

    if disable_tls:
        elf.add_data('afl_prev_loc', '\x00' * 4)
        trampoline_template = trampoline_template_single_thread
    else:
        elf.add_tls_bss_data('afl_prev_loc', 4, 'afl_prev_loc_offset')
        trampoline_template = trampoline_template_with_tls

    for index, bb in enumerate(bbs):
        magic = new_magic(bb)
        trampoline = trampoline_template.format(magic=magic,
                                                magic_shift=magic >> 1)
        try:
            elf.insert_code(where=bb, label="patch_%#x" % bb, code=trampoline)
        except Exception, e:
            log('[-] No.%d basic block @ %#x failed: %s.' %
                (index + 1, bb, str(e)))
            continue
        if (index + 1) % 10000 == 0:
            tlog('%d basic blocks processed.' % (index + 1))
コード例 #4
0
ファイル: main.py プロジェクト: SocietyMaster/ELFPatcher
def test_arm_pie(infile, outfile):
    elf = ELF(infile)

    elf.add_imported_symbol('puts', '_puts', 'libc.so.0')

    elf.add_data('init_message', 'Hello From Init Array\x00')
    elf.add_code(
        "new_init_function", """
        stmfd sp!, {r0, r3, lr}
        ldr r0, =init_message
        ldr r3, =_puts
        ldr r3, [r3]
        blx r3
        ldmfd sp!, {r0, r3, pc}
    """)
    elf.add_init_function("new_init_function")

    # hook function_2, call export_function
    elf.insert_code(where=0x90c,
                    label="patch_90c",
                    code="""
        stmfd sp!, {r0, r3}
        ldr r0, =init_message
        ldr r3, =5
        ldr r3, =_puts
        ldr r3, [r3]
        ldmfd sp!, {r0, r3}
    """)

    # hook function_2, call export_function
    elf.insert_code(where=0x920,
                    label="patch_920",
                    code="""
        stmfd sp!, {r0, r3}
        ldr r0, =init_message
        ldr r3, =5
        ldr r3, =_puts
        ldr r3, [r3]
        ldmfd sp!, {r0, r3}
    """)

    # test pc-related instruction wrap
    elf.insert_code(where=0x8C4, label="patch_8C4", code="nop")

    trampoline_template_with_tls = """
    stmfd sp!, {{r0 - r4}}      @ save registers
    ldr r0, =afl_prev_loc_offset
    ldr r1, [r0]                @ afl_prev_loc offset
    mrc p15, 0, r0, c13, c0, 3  @ tls pointer
    ldrh r2, [r0, r1]           @ load afl_prev_loc, zero-extended
    movw r4, #{magic:#x}        @ cur_loc, zero-extended
    eor r2, r2, r4              @ afl_prev_loc ^ cur_loc
    ldr r3, =shm_pointer
    ldr r3, [r3]                @ shm_pointer
    ldrb r4, [r3, r2]
    add r4, r4, #1              @ shm[xored] += 1
    strb r4, [r3, r2]
    movw r2, #{magic_shift:#x}  @ cur_loc >> 1
    strh r2, [r0, r1]           @ afl_prev_loc = cur_loc >> 1
    ldmfd sp!, {{r0 - r4}}      @ restore registers
    """

    afl_init = """
    stmfd sp!, {lr}
    ldr r3, =afl_init_entry
    ldr r3, [r3]
    blx r3                  @ call afl_init_entry(r0, r1, r2)
    ldr r3, =shm_pointer
    str r0, [r3]            @ save shm_pointer
    ldmfd sp!, {pc}
    """

    init_entry = 'afl_manual_init'
    elf.add_imported_symbol(init_entry, 'afl_init_entry', 'libaflinit.so')

    # avoid write to invalid address before initialization complete
    elf.add_data('afl_area_initial', '\x00' * 0x10000)
    elf.add_pointer('shm_pointer', 'afl_area_initial')

    elf.add_code('afl_init', afl_init)
    elf.add_init_function('afl_init')

    elf.add_tls_bss_data('afl_prev_loc', 4, 'afl_prev_loc_offset')
    trampoline_template = trampoline_template_with_tls

    for index, bb in enumerate([0x938, 0x8E8]):
        magic = bb * 0xdeadbeef % 2**16
        trampoline = trampoline_template.format(magic=magic,
                                                magic_shift=magic >> 1)
        elf.insert_code(where=bb, label="patch_%#x" % bb, code=trampoline)

    elf.save(outfile)
コード例 #5
0
ファイル: main.py プロジェクト: SocietyMaster/ELFPatcher
def test_arm(infile, outfile):
    elf = ELF(infile)

    # add imported function from external library
    elf.add_imported_library('lib_arm_library.so')
    elf.add_imported_symbol('export_function', '_export_function',
                            'lib_arm_library.so')

    elf.add_tls_bss_data('tls_bss_long', 0x4, 'tls_bss_long_offset')
    elf.add_tls_bss_data('tls_bss_char_array', 0x100,
                         'tls_bss_char_array_offset')

    elf.add_data('constdata', 'C' * 5 + '\x00')
    elf.add_pointer('constdata_pointer', 'constdata')
    elf.add_code(
        'pointer_verifier', """        
        stmfd sp!, {r0, r3, lr}
        ldr r0, =constdata_pointer
        ldr r0, [r0]
        ldr r3, =_puts
        ldr r3, [r3]
        blx r3
        ldmfd sp!, {r0, r3, pc}
    """)
    elf.add_init_function('pointer_verifier')

    elf.add_imported_symbol('puts', '_puts')
    elf.add_data('init_message', 'Hello From Init Array\x00')
    elf.add_code(
        "new_init_function", """
        stmfd sp!, {r0, r3, lr}
        ldr r0, =init_message
        ldr r3, =_puts
        ldr r3, [r3]
        blx r3
        ldmfd sp!, {r0, r3, pc}
    """)
    elf.add_init_function("new_init_function")

    # hook function_2, call export_function
    elf.insert_code(where=0x10610,
                    label="patch_10610",
                    code="""
    stmfd sp!, {r3, lr}
    ldr r3, =_export_function
    ldr r3, [r3, #0x0]
    blx r3
    ldmfd sp!, {r3, lr}
    """)

    # test pc-related instruction wrap
    elf.insert_code(where=0x10684, label="patch_10684", code="nop")

    # add imported function from libc
    elf.add_imported_symbol('getpid', '_getpid')

    # data and code manipulate
    elf.add_data('global_data', 'A' * 0x20)

    elf.add_code(
        'entry1', """
                 ldr r1, =global_data2222
                 ldr r1, =entry2
                 ldr r1, =_getpid
                 """)

    elf.add_code(
        'entry2', """
                 ldr r1, =global_data
                 ldr r1, =entry1
                 ldr r1, =_getpid
                 """)

    elf.add_data('global_data2222', 'B' * 0x20)

    elf.add_code(
        'entry3', """
                 ldr r1, =global_data2222
                 ldr r1, =entry1
                 ldr r1, =entry2
                 ldr r1, =entry3
                 ldr r1, =_getppid
                 """)

    elf.add_imported_symbol('getppid', '_getppid')

    elf.add_code('entry4', """
                 ldr r1, =_getppid
                 """)

    elf.save(outfile)
コード例 #6
0
ファイル: main.py プロジェクト: SocietyMaster/ELFPatcher
def test_386(infile, outfile):
    elf = ELF(infile)

    # add imported function from external library
    elf.add_imported_library('lib_x86_library.so')
    elf.add_imported_symbol('export_function', '_export_function',
                            'lib_x86_library.so')

    elf.add_tls_bss_data('tls_bss_long', 0x4, 'tls_bss_long_offset')
    elf.add_tls_bss_data('tls_bss_char_array', 0x100,
                         'tls_bss_char_array_offset')

    elf.add_data('constdata', 'C' * 5 + '\x00')
    elf.add_pointer('constdata_pointer', 'constdata')
    elf.add_code(
        'pointer_verifier', """
        mov eax, dword ptr [constdata_pointer]
        push eax
        call dword ptr [_puts]
        add esp, 4
        ret
    """)
    elf.add_init_function('pointer_verifier')

    elf.add_imported_symbol('puts', '_puts')
    elf.add_data('init_message', 'Hello From Init Array\x00')
    elf.add_code(
        "new_init_function", """
        push edi
        lea edi, byte ptr [init_message]
        push edi
        call dword ptr [_puts]
        add esp, 4
        pop edi
        ret
    """)
    elf.add_init_function("new_init_function")

    # hook function_2, call export_function
    elf.patch_code(fromwhere=0x0804857C,
                   towhere=0x08048583,
                   label='patch_804857C',
                   code="""
                        call dword ptr[_export_function]
                        push ebp
                        mov ebp, esp
                        push ebx
                        sub esp, 4
                        """)

    # .text:0804860B    lea     eax, (aParent - 804A000h)[ebx] ; "parent"
    # .text:08048611    push    eax             ; s
    # .text:08048612    call    _puts
    # .text:08048617    add     esp, 10h
    elf.insert_code(where=0x08048611,
                    label="patch_08048611",
                    code="""
    add eax, 1  # eax -> "arent"
    """,
                    nbound=0x08048617)

    # add imported function from libc
    elf.add_imported_symbol('getpid', '_getpid')

    # data and code manipulate
    elf.add_data('global_data', 'A' * 0x20)

    elf.add_code(
        'entry1', """
                 mov eax, [global_data2222]
                 mov ebx, [entry2]
                 mov ecx, [_getpid]
                 """)

    elf.add_code(
        'entry2', """
                 mov eax, [global_data]
                 mov ebx, [entry1]
                 mov ecx, [_getpid]
                 """)

    elf.add_data('global_data2222', 'B' * 0x20)

    elf.add_code(
        'entry3', """
                 mov eax, [global_data2222]
                 mov ebx, [entry1]
                 mov ebx, [entry2]
                 mov ebx, [entry3]
                 mov ecx, [_getppid]
                 """)

    elf.add_imported_symbol('getppid', '_getppid')

    elf.add_code(
        'entry4', """
                 mov ecx, [_getppid]
                 """)

    elf.save(outfile)