From c9cbeced5b3f2bdd7407e29c0811e65954132540 Mon Sep 17 00:00:00 2001 From: Root THC Date: Tue, 24 Feb 2026 12:42:47 +0000 Subject: initial --- other/reducebind/pcdump.c | 186 ++++++++++++++++++++++++ other/reducebind/ptrace-legit.c | 137 ++++++++++++++++++ other/reducebind/reducebind | Bin 0 -> 9360 bytes other/reducebind/reducebind.c | 311 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 634 insertions(+) create mode 100644 other/reducebind/pcdump.c create mode 100644 other/reducebind/ptrace-legit.c create mode 100755 other/reducebind/reducebind create mode 100644 other/reducebind/reducebind.c (limited to 'other/reducebind') diff --git a/other/reducebind/pcdump.c b/other/reducebind/pcdump.c new file mode 100644 index 0000000..7072576 --- /dev/null +++ b/other/reducebind/pcdump.c @@ -0,0 +1,186 @@ +/* memory dump utility + * -scut + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include /* basename */ + + +void dr_dump (FILE *out, struct user *child); +void hexdump (unsigned char *data, unsigned int amount); + + +int +main (int argc, char *argv[], char *envp[]) +{ + pid_t fpid; /* child pid, gets ptraced */ + char * argv0; + struct user regs; /* PTRACE pulled registers */ + unsigned long int addr, /* segment start address */ + addr_end, /* segment end address */ + len; /* length of segment */ + unsigned long int addr_walker, /* walker to dump memory */ + eip; /* current childs eip */ + + /* array to temporarily store data into */ + unsigned char data_saved[sizeof (unsigned long int)]; + + /* file to read mapping information */ + FILE * map_f; /* /proc//maps stream */ + unsigned char map_line[256]; /* one line each from map */ + + /* data for the dump files */ + FILE * dump_f; /* stream */ + char dump_name[64]; /* filename buffer */ + + + if (argc < 2) { + printf ("usage: %s \n\n", argv[0]); + printf ("will run 'argv0' as program with given arguments.\n\n"); + + exit (EXIT_FAILURE); + } + + fpid = fork (); + if (fpid < 0) { + perror ("fork"); + exit (EXIT_FAILURE); + } + if (fpid == 0) { /* child */ + if (ptrace (PTRACE_TRACEME, 0, NULL, NULL) != 0) { + perror ("ptrace PTRACE_TRACEME"); + exit (EXIT_FAILURE); + } + fprintf (stderr, " child: TRACEME set\n"); + + fprintf (stderr, " child: executing: %s\n", argv[2]); + close (1); + dup2 (2, 1); + execve (argv[1], &argv[1], envp); + + /* failed ? */ + perror ("execve"); + exit (EXIT_FAILURE); + } + + wait (NULL); + + memset (®s, 0, sizeof (regs)); + + if (ptrace (PTRACE_GETREGS, fpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + fprintf (stderr, "[0x%08lx] first stop\n", regs.regs.eip); + dr_dump (stderr, ®s); + + regs.u_debugreg[0] = 0x41414141; + if (ptrace (PTRACE_SETREGS, fpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + sleep (10); + if (ptrace (PTRACE_GETREGS, fpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + fprintf (stderr, "[0x%08lx] first stop\n", regs.regs.eip); + dr_dump (stderr, ®s); + + /* now single step until given eip is reached */ + do { + sleep (1); + + if (ptrace (PTRACE_SYSCALL, fpid, NULL, NULL) < 0) { + perror ("ptrace PTRACE_SINGLESTEP"); + exit (EXIT_FAILURE); + } + wait (NULL); + + memset (®s, 0, sizeof (regs)); + if (ptrace (PTRACE_GETREGS, fpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + fprintf (stderr, "0x%08lx\n", regs.regs.eip); + dr_dump (stderr, ®s); + } while (1); + + if (ptrace (PTRACE_DETACH, fpid, NULL, NULL) < 0) { + perror ("ptrace PTRACE_DETACH"); + exit (EXIT_FAILURE); + } + + fprintf (stderr, "MEMDUMP: success. terminating.\n"); + exit (EXIT_SUCCESS); +} + + + +void +hexdump (unsigned char *data, unsigned int amount) +{ + unsigned int dp, p; /* data pointer */ + const char trans[] = + "................................ !\"#$%&'()*+,-./0123456789" + ":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklm" + "nopqrstuvwxyz{|}~...................................." + "....................................................." + "........................................"; + + for (dp = 1; dp <= amount; dp++) { + printf ("%02x ", data[dp-1]); + if ((dp % 8) == 0) + printf (" "); + if ((dp % 16) == 0) { + printf ("| "); + p = dp; + for (dp -= 16; dp < p; dp++) + printf ("%c", trans[data[dp]]); + printf ("\n"); + } + } + if ((amount % 16) != 0) { + p = dp = 16 - (amount % 16); + for (dp = p; dp > 0; dp--) { + printf (" "); + if (((dp % 8) == 0) && (p != 8)) + printf (" "); + } + printf (" | "); + for (dp = (amount - (16 - p)); dp < amount; dp++) + printf ("%c", trans[data[dp]]); + } + printf ("\n"); + + return; +} + + +void +dr_dump (FILE *out, struct user *child) +{ + char * desc[] = { "dr0 (debug address register)", + "dr1 (debug address register)", + "dr2 (debug address register)", + "dr3 (debug address register)", + "dr4 (reserved)", + "dr5 (reserved)", + "dr6 (debug status register)", + "dr7 (debug control register)" }; + int n; + + for (n = 0 ; n < 8 ; ++n) { + fprintf (out, "\t0x%08lx %s\n", child->u_debugreg[n], + desc[n]); + } +} + + diff --git a/other/reducebind/ptrace-legit.c b/other/reducebind/ptrace-legit.c new file mode 100644 index 0000000..da93830 --- /dev/null +++ b/other/reducebind/ptrace-legit.c @@ -0,0 +1,137 @@ + +#include +#include +#include +#include +#include +#include +#include + +void +hexdump (unsigned char *data, unsigned int amount); + +unsigned char shellcode[] = "\x90\x90\xcc\x73"; + +int +main (int argc, char *argv[]) +{ + pid_t cpid; + struct user regs; + unsigned long int safed_eip; + unsigned long int addr, + addr_walker; + unsigned char data_saved[256]; + + if (argc != 2 || sscanf (argv[1], "%d", &cpid) != 1) { + printf ("usage: %s \n", argv[0]); + exit (EXIT_FAILURE); + } + + printf ("pid = %d\n", cpid); + + printf ("exploiting\n\n"); + + if (ptrace (PTRACE_ATTACH, cpid, NULL, NULL) < 0) { + perror ("ptrace"); + exit (EXIT_FAILURE); + } + + /* save data */ + addr = 0xbffff010; + for (addr_walker = 0 ; addr_walker < 256 ; ++addr_walker) { + data_saved[addr_walker] = ptrace (PTRACE_PEEKDATA, cpid, + addr + addr_walker, NULL); + } + hexdump (data_saved, sizeof (data_saved)); + + /* write */ + for (addr_walker = 0 ; addr_walker < sizeof (shellcode) ; + ++addr_walker) + { + ptrace (PTRACE_POKEDATA, cpid, addr + addr_walker, + shellcode[addr_walker] & 0xff); + } + + /* redirect eip */ + memset (®s, 0, sizeof (regs)); + if (ptrace (PTRACE_GETREGS, cpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + // write eip */ + safed_eip = regs.regs.eip; + regs.regs.eip = 0xbffff010; + if (ptrace (PTRACE_SETREGS, cpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + + if (ptrace (PTRACE_CONT, cpid, NULL, NULL) < 0) { + perror ("ptrace PTRACE_CONT"); + exit (EXIT_FAILURE); + } + + wait (NULL); + printf ("detrap\n"); + + /* restore */ + for (addr_walker = 0 ; addr_walker < 256 ; ++addr_walker) { + ptrace (PTRACE_POKEDATA, cpid, addr + addr_walker, + data_saved[addr_walker] & 0xff); + } + + /* restore regs */ + regs.regs.eip = safed_eip; + if (ptrace (PTRACE_SETREGS, cpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + + if (ptrace (PTRACE_DETACH, cpid, NULL, NULL) < 0) { + perror ("ptrace PTRACE_DETACH"); + exit (EXIT_FAILURE); + } + + exit (EXIT_SUCCESS); +} + + + +void +hexdump (unsigned char *data, unsigned int amount) +{ + unsigned int dp, p; /* data pointer */ + const char trans[] = + "................................ !\"#$%&'()*+,-./0123456789" + ":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklm" + "nopqrstuvwxyz{|}~...................................." + "....................................................." + "........................................"; + + for (dp = 1; dp <= amount; dp++) { + printf ("%02x ", data[dp-1]); + if ((dp % 8) == 0) + printf (" "); + if ((dp % 16) == 0) { + printf ("| "); + p = dp; + for (dp -= 16; dp < p; dp++) + printf ("%c", trans[data[dp]]); + printf ("\n"); + } + } + if ((amount % 16) != 0) { + p = dp = 16 - (amount % 16); + for (dp = p; dp > 0; dp--) { + printf (" "); + if (((dp % 8) == 0) && (p != 8)) + printf (" "); + } + printf (" | "); + for (dp = (amount - (16 - p)); dp < amount; dp++) + printf ("%c", trans[data[dp]]); + } + printf ("\n"); + + return; +} diff --git a/other/reducebind/reducebind b/other/reducebind/reducebind new file mode 100755 index 0000000..8e58100 Binary files /dev/null and b/other/reducebind/reducebind differ diff --git a/other/reducebind/reducebind.c b/other/reducebind/reducebind.c new file mode 100644 index 0000000..6432670 --- /dev/null +++ b/other/reducebind/reducebind.c @@ -0,0 +1,311 @@ +/* reducebind.c - dynamic to static binary conversion utility + * + * by scut + * + * BETA SOFTWARE, USE ON YOUR OWN RISK + * + * x86/linux only so far. some binaries segfault deep in their code, but this + * does not seem to relate to the binary size. some binaries that have a 19mb + * size statically linked (qt designer for example ;) work, some small + * binaries, such as bash do not work. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define VERSION "0.1.0" + +/*** local prototypes */ +static void elf_dump_new (pid_t pid, const char *pathname_new, + const char *pathname_old); +static void file_advance_roundup (FILE *fp, unsigned int padding); +static Elf32_Addr elf_get_entrypoint (const char *pathname); + + +int +main (int argc, char *argv[], char *envp[]) +{ + char * pathname; + char * f_argv[2]; + pid_t fpid; /* child pid, gets ptraced */ + struct user regs; /* PTRACE pulled registers */ + Elf32_Addr entry; + char * output = "output"; + + fprintf (stderr, "reducebind version "VERSION"\n\n"); + + if (argc < 2) { + fprintf (stderr, "usage: %s [output]\n\n", argv[0]); + + exit (EXIT_FAILURE); + } + pathname = argv[1]; + if (argc >= 3) + output = argv[2]; + + entry = elf_get_entrypoint (pathname); + + fpid = fork (); + if (fpid < 0) { + perror ("fork"); + exit (EXIT_FAILURE); + } + + /* child process. + */ + if (fpid == 0) { + if (ptrace (PTRACE_TRACEME, 0, NULL, NULL) != 0) { + perror ("ptrace PTRACE_TRACEME"); + exit (EXIT_FAILURE); + } + fprintf (stderr, " child: TRACEME set\n"); + + fprintf (stderr, " child: executing: %s\n", pathname); + close (1); + dup2 (2, 1); + + /* prepare arguments and environment. + */ + f_argv[0] = pathname; + f_argv[1] = NULL; + + putenv ("LD_BIND_NOW=1"); + execve (f_argv[0], f_argv, envp); + + /* failed ? */ + perror ("execve"); + exit (EXIT_FAILURE); + } + + wait (NULL); + + memset (®s, 0, sizeof (regs)); + + if (ptrace (PTRACE_GETREGS, fpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + fprintf (stderr, "(%d) [0x%08lx] first stop\n", fpid, regs.regs.eip); + fprintf (stderr, "(%d) tracing until entry point is reached (0x%08x)\n", + fpid, entry); + + while (regs.regs.eip != entry) { + if (ptrace (PTRACE_SINGLESTEP, fpid, NULL, NULL) < 0) { + perror ("ptrace PTRACE_SINGLESTEP"); + exit (EXIT_FAILURE); + } + wait (NULL); + + memset (®s, 0, sizeof (regs)); + if (ptrace (PTRACE_GETREGS, fpid, NULL, ®s) < 0) { + perror ("ptrace PTRACE_GETREGS"); + exit (EXIT_FAILURE); + } + fprintf (stderr, "\r(%d) [0x%08lx]", fpid, regs.regs.eip); + } + + fprintf (stderr, "\n(%d) entry point reached\n", fpid); + fprintf (stderr, "(%d) dumping process memory to new ELF ET_EXEC file\n", + fpid); + + elf_dump_new (fpid, output, pathname); + + exit (EXIT_SUCCESS); +} + + +static void +elf_dump_new (pid_t pid, const char *pathname_new, const char *pathname_old) +{ + FILE * fpn; + FILE * fpo; + FILE * mapsfp; + char maps_pathname[32]; + char map_line[256]; + Elf32_Ehdr eh; + Elf32_Phdr phdr[128]; + unsigned int pn; /* program header table index */ + + + fpn = fopen (pathname_new, "wb"); + fpo = fopen (pathname_old, "rb"); + if (fpn == NULL || fpo == NULL) { + perror ("fopen output ELF file creation"); + exit (EXIT_FAILURE); + } + + if (fread (&eh, sizeof (eh), 1, fpo) != 1) { + perror ("fread ELF header"); + exit (EXIT_FAILURE); + } + fclose (fpo); + + /* kill header values */ + eh.e_shoff = 0x0; /* we do not need any sections for loading */ + eh.e_shnum = 0; + eh.e_shstrndx = 0; + + /* the program header table will be fixed later */ + eh.e_phoff = 0; + eh.e_phnum = 0; + + fwrite (&eh, sizeof (eh), 1, fpn); + + snprintf (maps_pathname, sizeof (maps_pathname) - 1, + "/proc/%d/maps", pid); + maps_pathname[sizeof (maps_pathname) - 1] = '\0'; + mapsfp = fopen (maps_pathname, "r"); + if (mapsfp == NULL) { + perror ("fopen map file"); + exit (EXIT_FAILURE); + } + + while (1) { + Elf32_Phdr * ph; + unsigned int addr_start, + addr_end, + addr_walker; + char map_perm[8]; + unsigned char data_saved[sizeof (unsigned long int)]; + + + memset (map_line, '\0', sizeof (map_line)); + if (fgets (map_line, sizeof (map_line) - 1, mapsfp) == NULL) + break; + map_line[sizeof (map_line) - 1] = '\0'; + + fprintf (stderr, "%s", map_line); + if (sscanf (map_line, "%08x-%08x %7[rwxp-] ", + &addr_start, &addr_end, map_perm) != 3) + { + perror ("invalid map-line"); + + exit (EXIT_FAILURE); + } + + /* we do not need the stack in here. + */ + if (addr_end == 0xc0000000) + continue; + + file_advance_roundup (fpn, PAGE_SIZE); + + ph = &phdr[eh.e_phnum]; + eh.e_phnum += 1; + memset (ph, 0x00, sizeof (Elf32_Phdr)); + + ph->p_type = PT_LOAD; + ph->p_offset = ftell (fpn); + ph->p_vaddr = addr_start; + ph->p_paddr = 0x0; + ph->p_filesz = ph->p_memsz = addr_end - addr_start; + ph->p_flags = 0; + if (map_perm[0] == 'r') + ph->p_flags |= PF_R; + if (map_perm[1] == 'w') + ph->p_flags |= PF_W; + if (map_perm[2] == 'x') + ph->p_flags |= PF_X; + ph->p_align = PAGE_SIZE; + + /* save segment data, assuming addr is page aligned + */ + for (addr_walker = 0 ; addr_walker < (addr_end - addr_start); + addr_walker += sizeof (data_saved)) + { + errno = 0; + + *((unsigned long int *) &data_saved[0]) = + ptrace (PTRACE_PEEKDATA, pid, + addr_start + addr_walker, NULL); + + if (errno == 0 && fwrite (&data_saved[0], + sizeof (data_saved), 1, fpn) != 1) + { + perror ("fwrite segment"); + + exit (EXIT_FAILURE); + } else if (errno != 0) { + fprintf (stderr, + "[0x%08x] invalid PTRACE_PEEKDATA\n", + addr_start + addr_walker); + + exit (EXIT_FAILURE); + } + } + } + + fclose (mapsfp); + + /* now write program header table + */ + file_advance_roundup (fpn, PAGE_SIZE); + eh.e_phoff = ftell (fpn); + + for (pn = 0 ; pn < eh.e_phnum ; ++pn) { + if (fwrite (&phdr[pn], sizeof (Elf32_Phdr), 1, fpn) != 1) { + perror ("fwrite program header"); + exit (EXIT_FAILURE); + } + } + + fseek (fpn, 0, SEEK_SET); + if (fwrite (&eh, sizeof (Elf32_Ehdr), 1, fpn) != 1) { + perror ("fwrite final ELF header"); + exit (EXIT_FAILURE); + } + + fclose (fpn); + chmod (pathname_new, 0700); +} + + +static void +file_advance_roundup (FILE *fp, unsigned int padding) +{ + unsigned int pos; + + pos = ftell (fp); + if (pos % padding == 0) + return; + + pos %= padding; + pos = padding - pos; + + fseek (fp, pos, SEEK_CUR); +} + + +static Elf32_Addr +elf_get_entrypoint (const char *pathname) +{ + FILE * fp; + Elf32_Ehdr eh; + + + fp = fopen (pathname, "rb"); + if (fp == NULL) { + perror ("fopen input ELF file"); + exit (EXIT_FAILURE); + } + + if (fread (&eh, sizeof (eh), 1, fp) != 1) { + perror ("fread"); + exit (EXIT_FAILURE); + } + + fclose (fp); + + return (eh.e_entry); +} + + -- cgit v1.3