@@ -45,8 +45,7 @@ EXPORTED_SYM int GetErrorCode(HIJACK *hijack)
*/
EXPORTED_SYM const char *GetErrorString(HIJACK *hijack)
{
switch (hijack->lastErrorCode)
{
switch (hijack->lastErrorCode) {
case ERROR_NONE:
return "No Error";
case ERROR_ATTACHED:
@@ -124,8 +123,7 @@ EXPORTED_SYM int ToggleFlag(HIJACK *hijack, unsigned int flag)
*/
EXPORTED_SYM void *GetValue(HIJACK *hijack, int vkey)
{
switch (vkey)
{
switch (vkey) {
case V_BASEADDR:
return &(hijack->baseaddr);
default:
@@ -142,8 +140,7 @@ EXPORTED_SYM void *GetValue(HIJACK *hijack, int vkey)
*/
EXPORTED_SYM int SetValue(HIJACK *hijack, int vkey, void *value)
{
switch (vkey)
{
switch (vkey) {
case V_BASEADDR:
memcpy(&(hijack->baseaddr), value, sizeof(unsigned long));
return SetError(hijack, ERROR_NONE);
@@ -202,8 +199,7 @@ EXPORTED_SYM int Attach(HIJACK *hijack)
if (ptrace(PTRACE_ATTACH, hijack->pid, NULL, NULL) < 0)
return SetError(hijack, ERROR_SYSCALL);

do
{
do {
waitpid(hijack->pid, &status, 0);
} while (!WIFSTOPPED(status));

@@ -259,8 +255,7 @@ EXPORTED_SYM int LocateSystemCall(HIJACK *hijack)
} while ((soe = read_data(hijack, soe->next, sizeof(struct Struct_Obj_Entry))) != NULL);
#else
map = hijack->linkhead;
do
{
do {
parse_linkmap(hijack, map, syscall_callback);
if (hijack->syscalladdr)
break;
@@ -361,8 +356,7 @@ EXPORTED_SYM REGS *GetRegs(HIJACK *hijack)
{
REGS *ret;

if (!IsAttached(hijack))
{
if (!IsAttached(hijack)) {
SetError(hijack, ERROR_NOTATTACHED);
return NULL;
}
@@ -105,8 +105,7 @@ unsigned long map_memory_args(HIJACK *hijack, size_t sz, struct mmap_arg_struct
}

write_data(hijack, addr, mmap_args, sizeof(struct mmap_arg_struct));
if (GetErrorCode(hijack) != ERROR_NONE)
{
if (GetErrorCode(hijack) != ERROR_NONE) {
err = GetErrorCode(hijack);
goto end;
}
@@ -137,8 +136,7 @@ unsigned long map_memory_args(HIJACK *hijack, size_t sz, struct mmap_arg_struct
err = ERROR_SYSCALL;
#endif

do
{
do {
waitpid(hijack->pid, &i, 0);
} while (!WIFSTOPPED(i));

@@ -166,8 +164,7 @@ unsigned long map_memory_args(HIJACK *hijack, size_t sz, struct mmap_arg_struct
#endif
}

if ((long)addr == -1)
{
if ((long)addr == -1) {
if (IsFlagSet(hijack, F_DEBUG))
fprintf(stderr, "[-] Could not map address. Calling mmap failed!\n");

@@ -247,10 +244,8 @@ int inject_shellcode(HIJACK *hijack, unsigned long addr, void *data, size_t sz)
More Info: http://fxr.watson.org/fxr/source/arch/i386/kernel/signal.c?v=linux-2.6#L623
Link valid on 09 April 2009
*/
if (origregs.orig_eax >= 0)
{
switch (origregs.eax)
{
if (origregs.orig_eax >= 0) {
switch (origregs.eax) {
case -514: /* -ERESTARTNOHAND */
case -512: /* -ERESTARTSYS */
case -513: /* -ERESTARTNOINTR */
@@ -274,10 +269,8 @@ int inject_shellcode(HIJACK *hijack, unsigned long addr, void *data, size_t sz)
origregs.rip = (unsigned long)addr;

/* Above comment about adjusting EIP is valid for x86_64, too. */
if (origregs.orig_rax >= 0)
{
switch (origregs.rax)
{
if (origregs.orig_rax >= 0) {
switch (origregs.rax) {
case -514: /* -ERESTARTNOHAND */
case -512: /* -ERESTARTSYS */
case -513: /* -ERESTARTNOINTR */
@@ -38,3 +38,12 @@ void *_hijack_malloc(HIJACK *hijack, size_t sz)

return p;
}

void _hijack_free(HIJACK *hijack, void *p, size_t sz)
{
if (!(p))
return;

memset(p, 0x00, sz);
free(p);
}
@@ -21,7 +21,7 @@
#include "os_resolv.h"

/*
* Find the RTLD's linkmap.
* Find the RTLD's linkmap. On FreeBSD, the RTLD's linkmap is the last entry.
*
* We need it on both Linux and FreeBSD so that we can resolve RTLD functions
* and piggyback off the native RTLD and eventually patch into it.
@@ -33,6 +33,9 @@ unsigned long find_rtld_linkmap(HIJACK *hijack)
struct link_map *l, *p=NULL;
unsigned long addr=NULL;

if (!(hijack) || !(hijack->soe))
return (unsigned long)NULL;

l = &(hijack->soe->linkmap);

while ((l->l_next)) {
@@ -41,6 +44,8 @@ unsigned long find_rtld_linkmap(HIJACK *hijack)

p = l;
l = read_data(hijack, l->l_next, sizeof(struct link_map));
if (!(l))
return (unsigned long)NULL;
}

addr = (unsigned long)(p->l_next);
@@ -85,27 +90,20 @@ RTLD_SYM *resolv_rtld_sym(HIJACK *hijack, char *name)
return NULL;

l = read_data(hijack, find_rtld_linkmap(hijack), sizeof(struct link_map));
if (!(l)) {
fprintf(stderr, "[-] Cannot find rtld's linkmap\n");
if (!(l))
return NULL;
}

path = read_str(hijack, l->l_name);
if (!(path)) {
fprintf(stderr, "[-] Cannot read rtld's path\n");
if (!(path))
return NULL;
}

stat(path, &sb);
fd = open(path, O_RDONLY);
if (fd < 0) {
fprintf(stderr, "[-] Cannot open rtld file\n");
if (fd < 0)
return NULL;
}

buf = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
if (buf == MAP_FAILED) {
fprintf(stderr, "[-] Cannot mmap rtld into tmp mapping\n");
close(fd);
return NULL;
}
@@ -138,6 +136,10 @@ RTLD_SYM *resolv_rtld_sym(HIJACK *hijack, char *name)
}
}

/* XXX This should _never_ happen with the RTLD */
if (!(dyn) || !(strtab))
return NULL;

for (i=0; i < symsz; i++) {
if (!strcmp(name, strtab+symtab[i].st_name)) {
sym = _hijack_malloc(hijack, sizeof(RTLD_SYM));
@@ -1,5 +1,5 @@
/*
* Copyright (c) 2011, Shawn Webb
* Copyright (c) 2011, 2012, Shawn Webb
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
@@ -30,21 +30,17 @@ void *read_data(HIJACK *hijack, unsigned long start, size_t sz)
long ptracedata;
size_t readsz=0;

do
{
do {
ptracedata = ptrace(PTRACE_PEEKTEXT, hijack->pid, (void *)((unsigned long)start + readsz), 1);
if (ptracedata == -1)
{
if (errno)
{
if (ptracedata == -1) {
if (errno) {
SetError(hijack, ERROR_SYSCALL);
return data;
}
}

tmpdata = realloc(data, readsz+1);
if (!(tmpdata))
{
if (!(tmpdata)) {
SetError(hijack, ERROR_SYSCALL);
return data;
}
@@ -83,15 +79,11 @@ int write_data(HIJACK *hijack, unsigned long start, void *buf, size_t sz)
long word;
int err = ERROR_NONE;

while (i < sz)
{
if (i + sizeof(word) > sz)
{
while (i < sz) {
if (i + sizeof(word) > sz) {
word = ptrace(PTRACE_PEEKTEXT, hijack->pid, (void *)(start + i), NULL);
memcpy(&word, (void *)((unsigned char *)buf + i), sz-i);
}
else
{
} else {
memcpy(&word, (void *)((unsigned char *)buf + i), sizeof(word));
}
if (ptrace(PTRACE_POKETEXT, hijack->pid, (void *)(start + i), word) < 0)