augure-profiler 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 68f4e4a0deb75c047b7a76b09695771e42a28d1b81a36d7ecabf211061022078
-  data.tar.gz: 178c357a361d80a14934c4d0fa871f545fbd0c680ab6708f47e0f6e486f5b2df
+  metadata.gz: 286018f7712ec4f495a1703eaea59f3c114f49b18196f69e291a0a1e7ff3c699
+  data.tar.gz: 4403aef59eb80f8fac2425216d6f25f2cc25c06d8d62017089a2c1e15e03685b
 SHA512:
-  metadata.gz: a78bc1cdb1adf17cc25ca268508d6462b47da49466ffdedd4bfdbaae2be694c2ba74898bc822f949c98ad076ca1071f776b7fe2be6a3bbf6b6ed97484f171729
-  data.tar.gz: f99e40af9b29d45c48dc1ae999f4c5b18403b251ce854b78a14b83ab50e58c5812878620c3668501e1357aae7368397838b3e25737516807a7d95ffd7d585c68
+  metadata.gz: 75a950feec5e2a0e5c225ee0561ae808e3693dc0fe95745f7635af553044457525c3b71a59e9a06117efab1e62aca711c200cf0bb8ef4a29dffe5f6787fb169c
+  data.tar.gz: bd1bc7c1c60722ca35038a554edb2311ab7a562e06853a6a6d11ac4e3bba77599fdd9a8451609731f7e5a240ccf17be00a0f7ad6ff2ae7ed0a3b7a2962f90c9a

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/profiler.rb

@@ -47,9 +47,32 @@ module AugureProfiler
       emit_checksec(facts)
       emit_symbols(facts)
       emit_gadgets(facts)
+      emit_vuln_facts(facts)
       facts
     end
 
+    # The vuln facts the binary itself carries, so the operator's
+    # suggest stays for the knowledge NO ELF can show (a lib-side
+    # overflow, a heap class, a filter). The static frame read is the
+    # evidence: an unsafe call site feeding an rbp-frame buffer whose
+    # room the copy can reach - the sized family only when the length
+    # is not a bounded immediate. The fmtstr class: the printf-family
+    # format argument living on the stack.
+    def emit_vuln_facts(facts)
+      static = StaticOffset.offset(@path)
+      if static
+        facts.add("vuln", "sof")
+        facts.add("vuln_function", static[:function]) if static[:function] && !static[:function].empty?
+        facts.add("sink", static[:sink]) if static[:sink]
+      end
+
+      sink = StaticOffset.stack_format_sink(@path)
+      return unless sink
+
+      facts.add("vuln", "fmtstr")
+      facts.add("fmtstr_read", "true")
+    end
+
     # the csu byte signatures, both known compiler flavors: the popper
     # = pop rbx,rbp,r12,r13,r14,r15 ; ret (the chain re-enters at the
     # pop rbx), the mov block ends in the csu call signature and starts

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/static_offset.rb

@@ -9,7 +9,19 @@ module AugureProfiler
   # setup: offset = displacement + saved-rbp + return slot. The debugger
   # stays as the verifier, not the measurer.
   module StaticOffset
-    UNSAFE_CALLS = %w[strcpy gets scanf sprintf read readline strcat].freeze
+    # The unbounded family: no length argument exists, the copy runs to
+    # the NUL (or the newline). Any call site feeding it a stack buffer
+    # is the overflow, no further question asked.
+    UNSAFE_CALLS = %w[strcpy gets scanf sprintf readline strcat].freeze
+    # The sized family: the length rides in an argument (rdx on x64).
+    # When that argument is an immediate at most as large as the room
+    # between the buffer and the return slot, the copy cannot reach it:
+    # a bounded call, not the overflow - the scan moves on. A register
+    # (the read's count, the ret2plt memcpy) is unbounded by definition.
+    BOUNDED_CALLS = %w[read fgets fread memcpy memmove strncpy].freeze
+    # The variadic format users: the format argument is the attacker's
+    # bytes only when it comes from a stack buffer.
+    PRINTF_LIKE = %w[printf fprintf].freeze
 
     module_function
 
@@ -24,12 +36,12 @@ module AugureProfiler
 
     # Returns {offset:, sink:, function:} or nil when no unsafe call site
     # carries a readable rbp-frame buffer.
-    def offset(path)
+    def offset(path, calls: UNSAFE_CALLS + BOUNDED_CALLS)
       elf = Metasm::ELF.decode_file(path)
       arch = (elf.header.e_class.to_s == "64") ? :x64 : :x86
       @path = path
       stubs = plt_stubs(elf, arch)
-      unsafe = stubs.slice(*UNSAFE_CALLS)
+      unsafe = stubs.slice(*calls)
       return nil if unsafe.empty?
 
       @unsafe_addrs = unsafe.invert
@@ -39,7 +51,9 @@ module AugureProfiler
       bytes = data.bytes
       # The CHEAP scan first: a linear e8 rel32 walk nets every call to
       # an unsafe stub - the full .text disassembly (minutes on a 1MB
-      # text) is only needed if this finds nothing.
+      # text) is only needed if this finds nothing. Sites without an
+      # rbp-frame buffer (a global, a pointer arg) no longer stop the
+      # scan: a later site may carry the overflow.
       call_site = nil
       sink = nil
       bytes.each_index do |i|
@@ -48,7 +62,14 @@ module AugureProfiler
         target = text.addr + i + 5 + bytes[(i + 1)..(i + 4)].pack("C*").unpack1("l<")
         next unless (name = @unsafe_addrs[target])
 
-        call_site = text.addr + i
+        site = text.addr + i
+        frame = frame_bytes(data, site - text.addr, arch)
+        next if frame.nil? || !frame[:offset]&.positive?
+
+        next if BOUNDED_CALLS.include?(name) &&
+          size_imm_cannot_reach?(bytes, site - text.addr, frame[:offset], arch, name)
+
+        call_site = site
         sink = name
         break
       end
@@ -112,6 +133,100 @@ module AugureProfiler
       nil
     end
 
+    # The sized family's length argument rides rdx (x64): an immediate
+    # at most as large as the room between the buffer and the return
+    # slot means the copy cannot reach it. x86 passes the length on the
+    # stack, no immediate to read: treated as unbounded (the
+    # conservative direction: a false vuln beats a missed one).
+    def size_imm_cannot_reach?(bytes, call_off, room, arch, sink)
+      return false unless arch == :x64
+
+      # the length argument's register: rdx for the memcpy family, rsi
+      # for fgets (buf, size, stream)
+      opcodes = (sink == "fgets") ?
+        [[0xbe], [0x48, 0xc7, 0xc6], [0x49, 0xc7, 0xc6]] : # mov esi/rsi, imm32
+        [[0xba], [0x48, 0xc7, 0xc2], [0x49, 0xc7, 0xc2]]   # mov edx/rdx, imm32
+
+      start = [call_off - 16, 0].max
+      (start..(call_off - 5)).each do |j|
+        opcodes.each do |ops|
+          if ops.size == 1
+            return true if bytes[j] == ops[0] && (imm = imm32(bytes, j + 1)) && imm <= room
+          elsif j >= ops.size - 1
+            opcode_ok = (1...(ops.size)).all? { |k| bytes[j - k] == ops[ops.size - 1 - k] }
+            return true if opcode_ok && bytes[j] == ops.last && (imm = imm32(bytes, j + 1)) && imm <= room
+          end
+        end
+      end
+      false
+    end
+
+    def imm32(bytes, off)
+      return nil if off.negative? || off + 4 > bytes.size
+
+      bytes[off, 4].pack("C*").unpack1("L<")
+    end
+
+    # The printf-family sites whose format argument is a STACK buffer:
+    # lea reg,[rbp-disp] feeding rdi (directly, 48 8d 7d d8, or through
+    # a register move, 48 8d 45 d8 then 48 89 c7) means the format is
+    # the attacker's bytes - the fmtstr class. A .rodata format rides
+    # an immediate (mov edi, imm32): not a vuln. x86 passes args on the
+    # stack, no lea-into-rdi idiom to read: nil (an honest miss).
+    def stack_format_sink(path)
+      elf = Metasm::ELF.decode_file(path)
+      arch = (elf.header.e_class.to_s == "64") ? :x64 : :x86
+      return nil unless arch == :x64
+
+      @path = path # plt_stubs reads the section bytes through @path
+
+      stubs = plt_stubs(elf, arch)
+      like = stubs.slice(*PRINTF_LIKE)
+      return nil if like.empty?
+
+      like_addrs = like.invert
+      text = elf.sections.find { |s| s.name == ".text" }
+      data = section_data(path, text)
+      bytes = data.bytes
+      bytes.each_index do |i|
+        next unless bytes[i] == 0xe8
+
+        target = text.addr + i + 5 + bytes[(i + 1)..(i + 4)].pack("C*").unpack1("l<")
+        next unless like_addrs[target]
+
+        return like_addrs[target] if stack_format_rdi?(bytes, i)
+      end
+      nil
+    rescue Metasm::ParseError, Metasm::InvalidExeFormat
+      nil
+    end
+
+    # a mini-modrm decode of the lea feeding the format argument: REX.W
+    # (48) + 8d + modrm(mod=01|10, rm=101=rbp) = lea reg,[rbp-disp8|32].
+    # reg=rdi (111) is the direct form; reg=rax (000) needs the
+    # immediate mov rdi, rax (48 89 c7) right after the lea. Only 0x48
+    # qualifies as REX: REX.B would turn rbp into r13.
+    def stack_format_rdi?(bytes, call_off)
+      start = [call_off - 24, 0].max
+      (start...(call_off - 3)).each do |j|
+        next unless bytes[j] == 0x48
+        next unless bytes[j + 1] == 0x8d
+
+        modrm = bytes[j + 2]
+        mod = modrm >> 6
+        next unless mod == 0b01 || mod == 0b10
+        next unless (modrm & 7) == 0b101
+
+        reg = (modrm >> 3) & 7
+        len = (mod == 0b01) ? 4 : 7
+        return true if reg == 0b111
+        next unless reg == 0b000
+
+        return true if bytes[j + len, 3] == [0x48, 0x89, 0xc7]
+      end
+      false
+    end
+
     # The buffer displacement in the argument setup, then the frame math:
     # on x64: [rbp-N] -> saved rbp at N..N+8, return at N+8..N+16.
     def frame_disp(instrs, call_idx, arch)

data/home/runner/work/augure/augure/profiler/lib/augure-profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module AugureProfiler
-  VERSION = "0.0.2"
+  VERSION = "0.0.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: augure-profiler
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Gregory Epp