-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
12 changed files
with
404 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package gopwn | ||
|
|
||
| import "bytes" | ||
|
|
||
| type BinaryReader interface { | ||
| Read(p []byte) (n int, err error) | ||
| ReadAt(b []byte, off int64) (n int, err error) | ||
| Seek(offset int64, whence int) (int64, error) | ||
| } | ||
|
|
||
| type Cave struct { | ||
| SectionName string | ||
| Begin int | ||
| End int | ||
| Size int | ||
| Addr int | ||
| Infos string | ||
| } | ||
|
|
||
| func searchCaves(name string, body []byte, offset, addr uint64, infos string, caveSize int) []Cave { | ||
| caveBytes := []byte("\x00") | ||
| var caves []Cave | ||
| caveCount := 0 | ||
| for currentOffset := 0; currentOffset < len(body); currentOffset++ { | ||
| currentByte := body[currentOffset] | ||
| if bytes.Contains([]byte{currentByte}, caveBytes) { | ||
| caveCount++ | ||
| } else { | ||
| if caveCount >= caveSize { | ||
| caves = append(caves, Cave{ | ||
| SectionName: name, | ||
| Size: caveCount, | ||
| Addr: int(addr) + currentOffset - caveCount, | ||
| Begin: int(offset) + currentOffset - caveCount, | ||
| End: int(offset) + currentOffset, | ||
| Infos: infos, | ||
| }) | ||
| } | ||
| caveCount = 0 | ||
| } | ||
| } | ||
| return caves | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "strconv" | ||
|
|
||
| "github.com/hupe1980/gopwn" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| func newCaveCmd() *cobra.Command { | ||
| cmd := &cobra.Command{ | ||
| Use: "cave [file] [size]", | ||
| Args: func(cmd *cobra.Command, args []string) error { | ||
| if len(args) < 2 { | ||
| return errors.New("requires a file and a size argument") | ||
| } | ||
| if _, err := strconv.Atoi(args[1]); err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| }, | ||
| Short: "Search for code caves", | ||
| SilenceUsage: true, | ||
| SilenceErrors: true, | ||
| Example: "gopwn cave /usr/bin/ping 200", | ||
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| size, err := strconv.Atoi(args[1]) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| fh, bt, err := gopwn.OpenFile(args[0]) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| var caves []gopwn.Cave | ||
| switch bt { | ||
| case gopwn.BINTYPE_ELF: | ||
| elf, err := gopwn.NewELFFromReader(fh) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer elf.Close() | ||
| caves = elf.Caves(size) | ||
| case gopwn.BINTYPE_PE: | ||
| pe, err := gopwn.NewPEFromReader(fh) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer pe.Close() | ||
| caves = pe.Caves(size) | ||
| case gopwn.BINTYPE_MACHO: | ||
| macho, err := gopwn.NewMACHOFromReader(fh) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer macho.Close() | ||
| caves = macho.Caves(size) | ||
| } | ||
|
|
||
| if len(caves) == 0 { | ||
| fmt.Println("\n[-] NO CAVE DETECTED!") | ||
| return nil | ||
| } | ||
|
|
||
| for _, cave := range caves { | ||
| fmt.Println("\n[+] CAVE DETECTED!") | ||
| fmt.Printf("[!] Section Name: %s\n", cave.SectionName) | ||
| fmt.Printf("[!] Section Flags: %s\n", cave.Infos) | ||
| fmt.Printf("[!] Virtual Address: %#x\n", cave.Addr) | ||
| fmt.Printf("[!] Cave Begin: %#x\n", cave.Begin) | ||
| fmt.Printf("[!] Cave End: %#x\n", cave.End) | ||
| fmt.Printf("[!] Cave Size: %#x (%d bytes)\n", cave.Size, cave.Size) | ||
| } | ||
|
|
||
| return nil | ||
| }, | ||
| } | ||
|
|
||
| return cmd | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.