From 98e4a3d2f841bce726473d418e2a5b10e28806d7 Mon Sep 17 00:00:00 2001 From: norly Date: Wed, 27 Feb 2013 21:34:34 +0000 Subject: [PATCH] Implement mInsertBefore, for pre-.interp injection --- include/libelfu/modelops.h | 3 + include/options.h | 2 + src/main.c | 10 +++- src/model/insert.c | 111 +++++++++++++++++++++++++++++++++++++ src/options.c | 23 ++++++-- 5 files changed, 141 insertions(+), 8 deletions(-) create mode 100644 src/model/insert.c diff --git a/include/libelfu/modelops.h b/include/libelfu/modelops.h index 9475eba..c89630f 100644 --- a/include/libelfu/modelops.h +++ b/include/libelfu/modelops.h @@ -17,4 +17,7 @@ int elfu_mCheck(ElfuElf *me); ElfuElf* elfu_mFromElf(Elf *e); void elfu_mToElf(ElfuElf *me, Elf *e); + +GElf_Xword elfu_mInsertBefore(ElfuElf *me, GElf_Off off, GElf_Xword size); + #endif diff --git a/include/options.h b/include/options.h index f39f01e..ee9d612 100644 --- a/include/options.h +++ b/include/options.h @@ -8,6 +8,8 @@ typedef struct { int printHeader; int printSegments; int printSections; + unsigned insertBeforeOffs; + unsigned insertBeforeSz; } CLIOpts; diff --git a/src/main.c b/src/main.c index 991fe09..4467a2c 100644 --- a/src/main.c +++ b/src/main.c @@ -67,12 +67,16 @@ int main(int argc, char **argv) if (me) { printf("Model successfully loaded.\n"); - elfu_mCheck(me); - printf("Model checked.\n"); + printf("Input model checked.\n"); - elfu_mToElf(me, hOut.e); + if (opts.insertBeforeSz) { + elfu_mInsertBefore(me, opts.insertBeforeOffs, opts.insertBeforeSz); + } + elfu_mCheck(me); + printf("Output model checked.\n"); + elfu_mToElf(me, hOut.e); printf("Model converted to ELF, ready to be written.\n"); } else { printf("Failed to load model.\n"); diff --git a/src/model/insert.c b/src/model/insert.c new file mode 100644 index 0000000..2086c6e --- /dev/null +++ b/src/model/insert.c @@ -0,0 +1,111 @@ +#include +#include +#include +#include + + + +/* + * Insert space at a given position in the file by moving everything + * after it towards the end of the file, and everything before it + * towards lower memory regions where it is mapped. + * + * off must not be in the middle of any data structure, such as + * PHDRs, SHDRs, or sections. Behaviour is undefined if it is. + * + * PHDRs will be patched such that everything AFTER off is mapped to + * the same address in memory, and everything BEFORE it is shifted to + * lower addresses, making space for the new data in-between. + */ +GElf_Xword elfu_mInsertBefore(ElfuElf *me, GElf_Off off, GElf_Xword size) +{ + ElfuScn *ms; + ElfuPhdr *mp; + + assert(me); + + // TODO: Take p_align into account + + /* Move SHDRs and PHDRs */ + if (me->ehdr.e_shoff >= off) { + me->ehdr.e_shoff += size; + } + + if (me->ehdr.e_phoff >= off) { + me->ehdr.e_phoff += size; + } + + /* Patch PHDRs to include new data */ + CIRCLEQ_FOREACH(mp, &me->phdrList, elem) { + GElf_Off end = mp->phdr.p_offset + mp->phdr.p_filesz; + + if (mp->phdr.p_offset >= off) { + /* Insertion before PHDR's content, so it's just shifted */ + mp->phdr.p_offset += size; + } else { + /* mp->phdr.p_offset < off */ + + if (off < end) { + /* Mark this as a modified area */ + + /* Insertion in the middle of PHDR, so let it span the new data */ + mp->phdr.p_filesz += size; + mp->phdr.p_memsz += size; + mp->phdr.p_vaddr -= size; + mp->phdr.p_paddr -= size; + } else { + /* Insertion after PHDR's content, so it may need to be + remapped. This will happen in a second pass. + */ + } + } + } + + /* For each LOAD header, find clashing headers that need to be + remapped to lower memory areas. + */ + CIRCLEQ_FOREACH(mp, &me->phdrList, elem) { + if (mp->phdr.p_type == PT_LOAD) { + ElfuPhdr *mp2; + + CIRCLEQ_FOREACH(mp2, &me->phdrList, elem) { + if (mp2->phdr.p_type != PT_LOAD + && mp2->phdr.p_offset + mp2->phdr.p_filesz <= off) { + /* The PHDR ends in the file before the injection site */ + GElf_Off vend1 = mp->phdr.p_vaddr + mp->phdr.p_memsz; + GElf_Off pend1 = mp->phdr.p_paddr + mp->phdr.p_memsz; + GElf_Off vend2 = mp2->phdr.p_vaddr + mp2->phdr.p_memsz; + GElf_Off pend2 = mp2->phdr.p_paddr + mp2->phdr.p_memsz; + + /* If mp and mp2 now overlap in memory */ + if ((mp2->phdr.p_vaddr < vend1 && vend2 > mp->phdr.p_vaddr) + || (mp2->phdr.p_paddr < pend1 && pend2 > mp->phdr.p_paddr)) { + /* Move mp2 down in memory, as mp has been resized. + Maintaining the relative offset between them is the best + guess at maintaining consistency. + */ + mp2->phdr.p_vaddr -= size; + mp2->phdr.p_paddr -= size; + } + } + } + } + } + + /* Move the sections themselves */ + CIRCLEQ_FOREACH(ms, &me->scnList, elem) { + if (ms->shdr.sh_offset >= off) { + ms->shdr.sh_offset += size; + } else { + /* sh_offset < off */ + + /* If this was in a LOAD segment, it has been adjusted there + and this synchronises it. + If not, it doesn't matter anyway. + */ + ms->shdr.sh_addr -= size; + } + } + + return size; +} diff --git a/src/options.c b/src/options.c index 1b258fe..55a91c5 100644 --- a/src/options.c +++ b/src/options.c @@ -11,13 +11,14 @@ static void printUsage(char *progname) printf("Usage: %s [OPTIONS] \n", progname); printf("\n" "Options:\n" - " -h, --help Print this help message\n" - " -o, --output Where to write the modified ELF file to\n" + " -h, --help Print this help message\n" + " -o, --output Where to write the modified ELF file to\n" "\n" - " --print-header Print ELF header\n" - " --print-segments Print program headers\n" - " --print-sections Print sections\n" + " --print-header Print ELF header\n" + " --print-segments Print program headers\n" + " --print-sections Print sections\n" "\n" + " --insert-before off,sz Insert spacing at given offset\n" "\n"); } @@ -28,6 +29,7 @@ void parseOptions(CLIOpts *opts, int argc, char **argv) char *progname = argv[0]; int c; int option_index = 0; + char *endptr; static struct option long_options[] = { {"help", 0, 0, 'h'}, @@ -35,6 +37,7 @@ void parseOptions(CLIOpts *opts, int argc, char **argv) {"print-header", 0, 0, 10001}, {"print-segments", 0, 0, 10002}, {"print-sections", 0, 0, 10003}, + {"insert-before", 1, 0, 10004}, {NULL, 0, NULL, 0} }; @@ -56,6 +59,16 @@ void parseOptions(CLIOpts *opts, int argc, char **argv) case 10003: opts->printSections = 1; break; + case 10004: + opts->insertBeforeOffs = strtoul(optarg, &endptr, 0); + if (endptr[0] != ',') { + goto USAGE; + } + opts->insertBeforeSz = strtoul(endptr + 1, &endptr, 0); + if (endptr[0] != '\0' || opts->insertBeforeSz == 0) { + goto USAGE; + } + break; case '?': default: goto USAGE; -- 2.30.2