augure-profiler 0.0.1 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a668c990f083c8eb2d00f67ce45ccb99fb37525ee1013e484e63cf6b00f0b561
-  data.tar.gz: f86407235e580f36e236b52b1c406dfb7159b5d9dea733ec5d293ff68ac54678
+  metadata.gz: 286018f7712ec4f495a1703eaea59f3c114f49b18196f69e291a0a1e7ff3c699
+  data.tar.gz: 4403aef59eb80f8fac2425216d6f25f2cc25c06d8d62017089a2c1e15e03685b
 SHA512:
-  metadata.gz: 1493d1d5d121787f04ce661350f6eb89922cfe64555f15e9cf6cd90c7d543f45cd7d7e8eff4fcfaf7b4ad9b1492f7fd362cce5b043f10d80e319895824f2cf5f
-  data.tar.gz: 3a19f8acd46eaa23537b10bf279442631e93a567fd22d81e5aec918e50b63c5ae782874c8779836afa3815f6f5a21bd7c8169fd84e0e2450b182ff214c4d13f4
+  metadata.gz: 75a950feec5e2a0e5c225ee0561ae808e3693dc0fe95745f7635af553044457525c3b71a59e9a06117efab1e62aca711c200cf0bb8ef4a29dffe5f6787fb169c
+  data.tar.gz: bd1bc7c1c60722ca35038a554edb2311ab7a562e06853a6a6d11ac4e3bba77599fdd9a8451609731f7e5a240ccf17be00a0f7ad6ff2ae7ed0a3b7a2962f90c9a

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/profiler.rb

@@ -23,6 +23,7 @@ module AugureProfiler
       ["int80_ret", "cd 80 c3"],            # int 0x80 ; ret
       ["pop_rdi_ret", "5f c3"],             # pop rdi ; ret
       ["pop_rsi_ret", "5e c3"],             # pop rsi ; ret
+      ["pop_rsi_r15_ret", "5e 41 5f c3"],   # pop rsi ; pop r15 ; ret (the callme flavor)
       ["pop_rdx_ret", "5a c3"],             # pop rdx ; ret
       ["pop_rax_ret", "58 c3"],             # pop rax ; ret
       ["JMP_STACK", "ff e4"],               # jmp esp/rsp - renamed per arch
@@ -46,9 +47,60 @@ module AugureProfiler
       emit_checksec(facts)
       emit_symbols(facts)
       emit_gadgets(facts)
+      emit_vuln_facts(facts)
       facts
     end
 
+    # The vuln facts the binary itself carries, so the operator's
+    # suggest stays for the knowledge NO ELF can show (a lib-side
+    # overflow, a heap class, a filter). The static frame read is the
+    # evidence: an unsafe call site feeding an rbp-frame buffer whose
+    # room the copy can reach - the sized family only when the length
+    # is not a bounded immediate. The fmtstr class: the printf-family
+    # format argument living on the stack.
+    def emit_vuln_facts(facts)
+      static = StaticOffset.offset(@path)
+      if static
+        facts.add("vuln", "sof")
+        facts.add("vuln_function", static[:function]) if static[:function] && !static[:function].empty?
+        facts.add("sink", static[:sink]) if static[:sink]
+      end
+
+      sink = StaticOffset.stack_format_sink(@path)
+      return unless sink
+
+      facts.add("vuln", "fmtstr")
+      facts.add("fmtstr_read", "true")
+    end
+
+    # the csu byte signatures, both known compiler flavors: the popper
+    # = pop rbx,rbp,r12,r13,r14,r15 ; ret (the chain re-enters at the
+    # pop rbx), the mov block ends in the csu call signature and starts
+    # 9 bytes earlier (three 3-byte register movs, REX.W/REX.WR 0x89
+    # opcodes - the mov order is the compiler's choice: r15->rdx on
+    # recent gcc, r13->rdx on the classic layout)
+    CSU_POPPER_BIN = ["5b5d415c415d415e415fc3"].pack("H*").freeze
+    CSU_CALL_BIN = ["41ff14dc"].pack("H*").freeze
+
+    def self.csu_gadget_addrs(bytes, base, extent)
+      win = bytes.is_a?(String) ? bytes.b : bytes.pack("C*").b
+      win = win.byteslice(0, extent) if extent && extent < win.bytesize
+      popper = win.index(CSU_POPPER_BIN)
+      mov = find_csu_mov(win)
+      {popper: popper ? base + popper : nil, mov: mov ? base + mov : nil}
+    end
+
+    def self.find_csu_mov(win)
+      off = 0
+      while (call = win.index(CSU_CALL_BIN, off))
+        start = call - 9
+        return start if start >= 0 && [0x4c, 0x44].include?(win.getbyte(start)) && win.getbyte(start + 1) == 0x89
+
+        off = call + 1
+      end
+      nil
+    end
+
     private
 
     def emit_checksec(facts)
@@ -90,6 +142,10 @@ module AugureProfiler
       # needs the address, not just the existence.
       @elf.symbols.each do |sym|
         next unless sym.name.to_s.match?(/\Awin\z|win\z|flag\z/)
+        # an IMPORT is not a win HERE: the ret2csu shape imports its
+        # ret2win from the companion library; the symbol's value is 0
+        # and a built [qword win] payload would jump to NULL
+        next if sym.shndx.to_s == "UNDEF"
 
         facts.add("target_function", "true")
         facts.add("win_symbol", sym.name, sym.value.to_i)
@@ -189,15 +245,39 @@ module AugureProfiler
       hits.map { |(_order, type, addr)| [type, addr] }
     end
 
-    # Static binaries expose the __libc_csu_init universal gadgets under
-    # well-known symbols; their presence IS the gadget fact.
+    # Static binaries expose the __libc_csu_init universal gadgets; their
+    # presence IS the gadget fact. The two useful sequences sit at
+    # compiler-dependent offsets INSIDE the function (the entry/+0x40
+    # guess broke on the newer mov rdx,r15 flavor), so both are located
+    # by byte signature within the symbol's extent: the popper fact aims
+    # at the pop rbx (the chain entry, the leading add rsp,8 stays one
+    # slot earlier for layouts that need it), the mov block by its call
+    # signature. The pack teaches the arg mapping for its target.
     def emit_csu_gadgets(facts)
-      names = @elf.symbols.map(&:name).compact
-      return unless names.include?("__libc_csu_init")
-
       sym = @elf.symbols.find { |s| s.name == "__libc_csu_init" }
-      facts.add("gadget", "csu_popper", sym.value.to_i)
-      facts.add("gadget", "csu_mov", sym.value.to_i + 0x40)
+      return unless sym
+
+      base = sym.value.to_i
+      extent = sym.size.to_i
+      extent = 0x100 if extent <= 0
+      section = executable_sections.find do |s|
+        s.addr.to_i <= base && base < s.addr.to_i + s.size.to_i
+      end
+      return unless section
+
+      window = bytes_slice(section, base - section.addr.to_i)
+      return if window.nil? || window.empty?
+
+      addrs = self.class.csu_gadget_addrs(window, base, extent)
+      facts.add("gadget", "csu_popper", addrs[:popper]) if addrs[:popper]
+      facts.add("gadget", "csu_mov", addrs[:mov]) if addrs[:mov]
+    end
+
+    def bytes_slice(section, from)
+      bytes = section_bytes(section)
+      return nil if bytes.nil?
+
+      bytes[from, bytes.size - from] || []
     end
   end
 end

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/static_offset.rb

@@ -9,7 +9,19 @@ module AugureProfiler
   # setup: offset = displacement + saved-rbp + return slot. The debugger
   # stays as the verifier, not the measurer.
   module StaticOffset
-    UNSAFE_CALLS = %w[strcpy gets scanf sprintf read readline strcat].freeze
+    # The unbounded family: no length argument exists, the copy runs to
+    # the NUL (or the newline). Any call site feeding it a stack buffer
+    # is the overflow, no further question asked.
+    UNSAFE_CALLS = %w[strcpy gets scanf sprintf readline strcat].freeze
+    # The sized family: the length rides in an argument (rdx on x64).
+    # When that argument is an immediate at most as large as the room
+    # between the buffer and the return slot, the copy cannot reach it:
+    # a bounded call, not the overflow - the scan moves on. A register
+    # (the read's count, the ret2plt memcpy) is unbounded by definition.
+    BOUNDED_CALLS = %w[read fgets fread memcpy memmove strncpy].freeze
+    # The variadic format users: the format argument is the attacker's
+    # bytes only when it comes from a stack buffer.
+    PRINTF_LIKE = %w[printf fprintf].freeze
 
     module_function
 
@@ -24,12 +36,12 @@ module AugureProfiler
 
     # Returns {offset:, sink:, function:} or nil when no unsafe call site
     # carries a readable rbp-frame buffer.
-    def offset(path)
+    def offset(path, calls: UNSAFE_CALLS + BOUNDED_CALLS)
       elf = Metasm::ELF.decode_file(path)
       arch = (elf.header.e_class.to_s == "64") ? :x64 : :x86
       @path = path
       stubs = plt_stubs(elf, arch)
-      unsafe = stubs.slice(*UNSAFE_CALLS)
+      unsafe = stubs.slice(*calls)
       return nil if unsafe.empty?
 
       @unsafe_addrs = unsafe.invert
@@ -39,7 +51,9 @@ module AugureProfiler
       bytes = data.bytes
       # The CHEAP scan first: a linear e8 rel32 walk nets every call to
       # an unsafe stub - the full .text disassembly (minutes on a 1MB
-      # text) is only needed if this finds nothing.
+      # text) is only needed if this finds nothing. Sites without an
+      # rbp-frame buffer (a global, a pointer arg) no longer stop the
+      # scan: a later site may carry the overflow.
       call_site = nil
       sink = nil
       bytes.each_index do |i|
@@ -48,7 +62,14 @@ module AugureProfiler
         target = text.addr + i + 5 + bytes[(i + 1)..(i + 4)].pack("C*").unpack1("l<")
         next unless (name = @unsafe_addrs[target])
 
-        call_site = text.addr + i
+        site = text.addr + i
+        frame = frame_bytes(data, site - text.addr, arch)
+        next if frame.nil? || !frame[:offset]&.positive?
+
+        next if BOUNDED_CALLS.include?(name) &&
+          size_imm_cannot_reach?(bytes, site - text.addr, frame[:offset], arch, name)
+
+        call_site = site
         sink = name
         break
       end
@@ -112,6 +133,100 @@ module AugureProfiler
       nil
     end
 
+    # The sized family's length argument rides rdx (x64): an immediate
+    # at most as large as the room between the buffer and the return
+    # slot means the copy cannot reach it. x86 passes the length on the
+    # stack, no immediate to read: treated as unbounded (the
+    # conservative direction: a false vuln beats a missed one).
+    def size_imm_cannot_reach?(bytes, call_off, room, arch, sink)
+      return false unless arch == :x64
+
+      # the length argument's register: rdx for the memcpy family, rsi
+      # for fgets (buf, size, stream)
+      opcodes = (sink == "fgets") ?
+        [[0xbe], [0x48, 0xc7, 0xc6], [0x49, 0xc7, 0xc6]] : # mov esi/rsi, imm32
+        [[0xba], [0x48, 0xc7, 0xc2], [0x49, 0xc7, 0xc2]]   # mov edx/rdx, imm32
+
+      start = [call_off - 16, 0].max
+      (start..(call_off - 5)).each do |j|
+        opcodes.each do |ops|
+          if ops.size == 1
+            return true if bytes[j] == ops[0] && (imm = imm32(bytes, j + 1)) && imm <= room
+          elsif j >= ops.size - 1
+            opcode_ok = (1...(ops.size)).all? { |k| bytes[j - k] == ops[ops.size - 1 - k] }
+            return true if opcode_ok && bytes[j] == ops.last && (imm = imm32(bytes, j + 1)) && imm <= room
+          end
+        end
+      end
+      false
+    end
+
+    def imm32(bytes, off)
+      return nil if off.negative? || off + 4 > bytes.size
+
+      bytes[off, 4].pack("C*").unpack1("L<")
+    end
+
+    # The printf-family sites whose format argument is a STACK buffer:
+    # lea reg,[rbp-disp] feeding rdi (directly, 48 8d 7d d8, or through
+    # a register move, 48 8d 45 d8 then 48 89 c7) means the format is
+    # the attacker's bytes - the fmtstr class. A .rodata format rides
+    # an immediate (mov edi, imm32): not a vuln. x86 passes args on the
+    # stack, no lea-into-rdi idiom to read: nil (an honest miss).
+    def stack_format_sink(path)
+      elf = Metasm::ELF.decode_file(path)
+      arch = (elf.header.e_class.to_s == "64") ? :x64 : :x86
+      return nil unless arch == :x64
+
+      @path = path # plt_stubs reads the section bytes through @path
+
+      stubs = plt_stubs(elf, arch)
+      like = stubs.slice(*PRINTF_LIKE)
+      return nil if like.empty?
+
+      like_addrs = like.invert
+      text = elf.sections.find { |s| s.name == ".text" }
+      data = section_data(path, text)
+      bytes = data.bytes
+      bytes.each_index do |i|
+        next unless bytes[i] == 0xe8
+
+        target = text.addr + i + 5 + bytes[(i + 1)..(i + 4)].pack("C*").unpack1("l<")
+        next unless like_addrs[target]
+
+        return like_addrs[target] if stack_format_rdi?(bytes, i)
+      end
+      nil
+    rescue Metasm::ParseError, Metasm::InvalidExeFormat
+      nil
+    end
+
+    # a mini-modrm decode of the lea feeding the format argument: REX.W
+    # (48) + 8d + modrm(mod=01|10, rm=101=rbp) = lea reg,[rbp-disp8|32].
+    # reg=rdi (111) is the direct form; reg=rax (000) needs the
+    # immediate mov rdi, rax (48 89 c7) right after the lea. Only 0x48
+    # qualifies as REX: REX.B would turn rbp into r13.
+    def stack_format_rdi?(bytes, call_off)
+      start = [call_off - 24, 0].max
+      (start...(call_off - 3)).each do |j|
+        next unless bytes[j] == 0x48
+        next unless bytes[j + 1] == 0x8d
+
+        modrm = bytes[j + 2]
+        mod = modrm >> 6
+        next unless mod == 0b01 || mod == 0b10
+        next unless (modrm & 7) == 0b101
+
+        reg = (modrm >> 3) & 7
+        len = (mod == 0b01) ? 4 : 7
+        return true if reg == 0b111
+        next unless reg == 0b000
+
+        return true if bytes[j + len, 3] == [0x48, 0x89, 0xc7]
+      end
+      false
+    end
+
     # The buffer displacement in the argument setup, then the frame math:
     # on x64: [rbp-N] -> saved rbp at N..N+8, return at N+8..N+16.
     def frame_disp(instrs, call_idx, arch)

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AugureProfiler
-  VERSION = "0.0.1"
+  VERSION = "0.0.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: augure-profiler
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.3
 platform: ruby
 authors:
 - Gregory Epp