path: root/other/burneye2/testcases/2-obf/reducebind.c

/* reducebind.c - dynamic to static binary conversion utility
 *
 * by scut
 *
 * BETA SOFTWARE, USE ON YOUR OWN RISK
 *
 * x86/linux only so far. some binaries segfault deep in their code, but this
 * does not seem to relate to the binary size. some binaries that have a 19mb
 * size statically linked (qt designer for example ;) work, some small
 * binaries, such as bash do not work.
 */

#include <sys/types.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/user.h>
#include <sys/stat.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <string.h>
#include <elf.h>

#define	VERSION "0.1.0"

/*** local prototypes */
static void elf_dump_new (pid_t pid, const char *pathname_new,
	const char *pathname_old);
static void file_advance_roundup (FILE *fp, unsigned int padding);
static Elf32_Addr elf_get_entrypoint (const char *pathname);


int
main (int argc, char *argv[], char *envp[])
{
	char *		pathname;
	char *		f_argv[2];
	pid_t		fpid;	/* child pid, gets ptraced */
	struct user	regs;	/* PTRACE pulled registers */
	Elf32_Addr	entry;
	char *		output = "output";

	fprintf (stderr, "reducebind version "VERSION"\n\n");

	if (argc < 2) {
		fprintf (stderr, "usage: %s <binary> [output]\n\n", argv[0]);

		exit (EXIT_FAILURE);
	}
	pathname = argv[1];
	if (argc >= 3)
		output = argv[2];

	entry = elf_get_entrypoint (pathname);

	fpid = fork ();
	if (fpid < 0) {
		perror ("fork");
		exit (EXIT_FAILURE);
	}

	/* child process.
	 */
	if (fpid == 0) {
		if (ptrace (PTRACE_TRACEME, 0, NULL, NULL) != 0) {
			perror ("ptrace PTRACE_TRACEME");
			exit (EXIT_FAILURE);
		}
		fprintf (stderr, "  child: TRACEME set\n");

		fprintf (stderr, "  child: executing: %s\n", pathname);
		close (1);
		dup2 (2, 1);

		/* prepare arguments and environment.
		 */
		f_argv[0] = pathname;
		f_argv[1] = NULL;

		putenv ("LD_BIND_NOW=1");
		execve (f_argv[0], f_argv, envp);

		/* failed ? */
		perror ("execve");
		exit (EXIT_FAILURE);
	}

	wait (NULL);

	memset (&regs, 0, sizeof (regs));

	if (ptrace (PTRACE_GETREGS, fpid, NULL, &regs) < 0) {
		perror ("ptrace PTRACE_GETREGS");
		exit (EXIT_FAILURE);
	}
	fprintf (stderr, "(%d) [0x%08lx] first stop\n", fpid, regs.regs.eip);
	fprintf (stderr, "(%d) tracing until entry point is reached (0x%08x)\n",
		fpid, entry);

	while (regs.regs.eip != entry) {
		if (ptrace (PTRACE_SINGLESTEP, fpid, NULL, NULL) < 0) {
			perror ("ptrace PTRACE_SINGLESTEP");
			exit (EXIT_FAILURE);
		}
		wait (NULL);

		memset (&regs, 0, sizeof (regs));
		if (ptrace (PTRACE_GETREGS, fpid, NULL, &regs) < 0) {
			perror ("ptrace PTRACE_GETREGS");
			exit (EXIT_FAILURE);
		}
		fprintf (stderr, "\r(%d) [0x%08lx]", fpid, regs.regs.eip);
	}

	fprintf (stderr, "\n(%d) entry point reached\n", fpid);
	fprintf (stderr, "(%d) dumping process memory to new ELF ET_EXEC file\n",
		fpid);

	elf_dump_new (fpid, output, pathname);

	exit (EXIT_SUCCESS);
}


static void
elf_dump_new (pid_t pid, const char *pathname_new, const char *pathname_old)
{
	FILE *		fpn;
	FILE *		fpo;
	FILE *		mapsfp;
	char		maps_pathname[32];
	char		map_line[256];
	Elf32_Ehdr	eh;
	Elf32_Phdr	phdr[128];
	unsigned int	pn;		/* program header table index */


	fpn = fopen (pathname_new, "wb");
	fpo = fopen (pathname_old, "rb");
	if (fpn == NULL || fpo == NULL) {
		perror ("fopen output ELF file creation");
		exit (EXIT_FAILURE);
	}

	if (fread (&eh, sizeof (eh), 1, fpo) != 1) {
		perror ("fread ELF header");
		exit (EXIT_FAILURE);
	}
	fclose (fpo);

	/* kill header values */
	eh.e_shoff = 0x0;	/* we do not need any sections for loading */
	eh.e_shnum = 0;
	eh.e_shstrndx = 0;

	/* the program header table will be fixed later */
	eh.e_phoff = 0;
	eh.e_phnum = 0;

	fwrite (&eh, sizeof (eh), 1, fpn);

	snprintf (maps_pathname, sizeof (maps_pathname) - 1,
		"/proc/%d/maps", pid);
	maps_pathname[sizeof (maps_pathname) - 1] = '\0';
	mapsfp = fopen (maps_pathname, "r");
	if (mapsfp == NULL) {
		perror ("fopen map file");
		exit (EXIT_FAILURE);
	}

	while (1) {
		Elf32_Phdr *	ph;
		unsigned int	addr_start,
				addr_end,
				addr_walker;
		char		map_perm[8];
		unsigned char	data_saved[sizeof (unsigned long int)];


		memset (map_line, '\0', sizeof (map_line));
		if (fgets (map_line, sizeof (map_line) - 1, mapsfp) == NULL)
			break;
		map_line[sizeof (map_line) - 1] = '\0';

		fprintf (stderr, "%s", map_line);
		if (sscanf (map_line, "%08x-%08x %7[rwxp-] ",
			&addr_start, &addr_end, map_perm) != 3) 
		{
			perror ("invalid map-line");

			exit (EXIT_FAILURE);
		}

		/* we do not need the stack in here.
		 */
		if (addr_end == 0xc0000000)
			continue;

		file_advance_roundup (fpn, PAGE_SIZE);

		ph = &phdr[eh.e_phnum];
		eh.e_phnum += 1;
		memset (ph, 0x00, sizeof (Elf32_Phdr));

		ph->p_type = PT_LOAD;
		ph->p_offset = ftell (fpn);
		ph->p_vaddr = addr_start;
		ph->p_paddr = 0x0;
		ph->p_filesz = ph->p_memsz = addr_end - addr_start;
		ph->p_flags = 0;
		if (map_perm[0] == 'r')
			ph->p_flags |= PF_R;
		if (map_perm[1] == 'w')
			ph->p_flags |= PF_W;
		if (map_perm[2] == 'x')
			ph->p_flags |= PF_X;
		ph->p_align = PAGE_SIZE;

		/* save segment data, assuming addr is page aligned
		 */
		for (addr_walker = 0 ; addr_walker < (addr_end - addr_start);
			addr_walker += sizeof (data_saved))
		{
			errno = 0;

			*((unsigned long int *) &data_saved[0]) =
				ptrace (PTRACE_PEEKDATA, pid,
					addr_start + addr_walker, NULL);

			if (errno == 0 && fwrite (&data_saved[0],
				sizeof (data_saved), 1, fpn) != 1)
			{
				perror ("fwrite segment");

				exit (EXIT_FAILURE);
			} else if (errno != 0) {
				fprintf (stderr,
					"[0x%08x] invalid PTRACE_PEEKDATA\n",
					addr_start + addr_walker);

				exit (EXIT_FAILURE);
			}
		}
	}

	fclose (mapsfp);

	/* now write program header table
	 */
	file_advance_roundup (fpn, PAGE_SIZE);
	eh.e_phoff = ftell (fpn);

	for (pn = 0 ; pn < eh.e_phnum ; ++pn) {
		if (fwrite (&phdr[pn], sizeof (Elf32_Phdr), 1, fpn) != 1) {
			perror ("fwrite program header");
			exit (EXIT_FAILURE);
		}
	}

	fseek (fpn, 0, SEEK_SET);
	if (fwrite (&eh, sizeof (Elf32_Ehdr), 1, fpn) != 1) {
		perror ("fwrite final ELF header");
		exit (EXIT_FAILURE);
	}

	fclose (fpn);
	chmod (pathname_new, 0700);
}


static void
file_advance_roundup (FILE *fp, unsigned int padding)
{
	unsigned int	pos;

	pos = ftell (fp);
	if (pos % padding == 0)
		return;

	pos %= padding;
	pos = padding - pos;

	fseek (fp, pos, SEEK_CUR);
}


static Elf32_Addr
elf_get_entrypoint (const char *pathname)
{
	FILE *		fp;
	Elf32_Ehdr	eh;


	fp = fopen (pathname, "rb");
	if (fp == NULL) {
		perror ("fopen input ELF file");
		exit (EXIT_FAILURE);
	}

	if (fread (&eh, sizeof (eh), 1, fp) != 1) {
		perror ("fread");
		exit (EXIT_FAILURE);
	}

	fclose (fp);

	return (eh.e_entry);
}