rubypwn 0.0.9 → 0.0.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 664749222c6cda64b3f8b081695a1253a0cecd02
-  data.tar.gz: 59e480b3859aee5e5a101dd59cff5a1526125c97
+  metadata.gz: 8c0d72fc09f9d7adca8c1e58494f061c2901d9cf
+  data.tar.gz: aadbaee90c0108328029d26591102a21f9933305
 SHA512:
-  metadata.gz: 17ca9d90c0f7f3dadd28c4dff5758f25e65f49ec5968ba8f33b39f40c145b349656ead4150c70fdcf7bf7bc2622644f6cc47014dd2890a20db5d5cf12e9db58a
-  data.tar.gz: a03a8798cea1f3ee0157a6bd39308a7c2e29a22f04d707879d959a54038ea0cd3a24eeb8c28e78d4e480c4fd595c1fa38044fa8d5891887590e41f8246005b65
+  metadata.gz: 93d38f069c3aeb10fe0fb5a0c8fc973c6b502259e666b7ac7852fa39aa551893a2c6f8c6376d2d3d8189f0b3c180a533611754212439dee124b4eba88f5b6bbf
+  data.tar.gz: f8ce8a3d75a3233bb100e68e679e475b468aafa518bef24ccebcdae7decd8a42936c32a5b409ef98f75ee86259a870893e5190c381edae0b5eb372a68ecef406

data/docs/source/elf.rst

@@ -3,12 +3,35 @@ class Elf
 
 Used to get some constant value from the binary::
 
+    2.2.0 :001 > require 'pp'
     2.2.0 :001 > require 'rubypwn'
      => true
-    2.2.0 :002 > e = Elf.new "/lib/i386-linux-gnu/libc.so.6"
-    2.2.0 :003 > e.gotplt.keys
-     => ["_Unwind_Find_FDE", "realloc", "malloc", "memalign", "_dl_find_dso_for_object", "calloc", "___tls_get_addr", "free", ""]
-    2.2.0 :004 > e.gotplt["malloc"]
-     => 1744916
-    2.2.0 :005 > puts "%08x" % e.gotplt["malloc"]
-    001aa014
+    2.2.0 :002 > e = Elf.new "traveller"
+    2.2.2 :005 > pp Elf.new "traveller"
+    #<Elf:0x007fdd23c3b510
+     @arch="x86",
+     @bits=32,
+     @dynamic=
+      {"strtab"=>134513496,
+       "symtab"=>134513160,
+       "rel_type"=>"REL",
+       "jmprel"=>134513844},
+     @global={"__gmon_start__"=>{"offset"=>134521192, "value"=>0}},
+     @got=
+      {"__errno_location"=>134521208,
+       "sigemptyset"=>134521212,
+       "getpid"=>134521216,
+       "__gmon_start__"=>134521220,
+       "__isoc99_sscanf"=>134521224,
+       "fgets"=>134521228,
+       "__libc_start_main"=>134521232,
+       "sigaltstack"=>134521236,
+       "siglongjmp"=>134521240,
+       "sigaction"=>134521244,
+       "strlen"=>134521248,
+       "printf"=>134521252,
+       "setvbuf"=>134521256,
+       "puts"=>134521260,
+       "kill"=>134521264,
+       "__sigsetjmp"=>134521268,
+       "exit"=>134521272}>

data/lib/elf.rb

@@ -1,5 +1,17 @@
 require 'bindata'
 
+class Dynamic32 < BinData::Record
+    endian :little
+    int32 :d_tag
+    uint32 :d_val
+end
+
+class Dynamic64 < BinData::Record
+    endian :little
+    int64 :d_tag
+    uint64 :d_val
+end
+
 class Symtab32 < BinData::Record
     endian :little
     int32 :st_name        #/* Symbol name (string tbl index) */
@@ -87,6 +99,7 @@ class Relaplt64 < BinData::Record
         r_info & 0xffffffff
     end
 end
+
 class ElfParser < BinData::Record
     endian :little
     # magic number
@@ -126,26 +139,7 @@ class ElfParser < BinData::Record
     # Section header string table index
     int16 :e_shstrndx
     skip :length => lambda{e_shoff - e_ehsize}
-    # Program header table
-    #array :ph, :initial_length => :e_phnum do
-        #int32 :p_type
-        ## Segment bit mask (RWX)
-        #int32 :p_flags
-        ## Segment file offset
-        #choice :p_offset, :selection => lambda{e_ident.ei_class}, :choices => {1 => :int32le, 2 => :int64le}
-        ## Segment virtual address
-        #choice :p_vaddr, :selection => lambda{e_ident.ei_class}, :choices => {1 => :int32le, 2 => :int64le}
-        ## Segment physical address
-        #choice :p_paddr, :selection => lambda{e_ident.ei_class}, :choices => {1 => :int32le, 2 => :int64le}
-        ## Segment size in file
-        #choice :p_filesz, :selection => lambda{e_ident.ei_class}, :choices => {1 => :int32le, 2 => :int64le}
-        ## Segment size in memory
-        #choice :p_memsz, :selection => lambda{e_ident.ei_class}, :choices => {1 => :int32le, 2 => :int64le}
-        ## Segment alignment
-        #choice :p_align, :selection => lambda{e_ident.ei_class}, :choices => {1 => :int32le, 2 => :int64le}
-        ##string :p_segment, :read_length => lambda{p_filesz - e_phentsize}
-    #end
-    # Contains index of the section header tab entry that contains the section names.
+
     array :sh, :initial_length => lambda{e_shnum} do
         # Section name (string tbl index)
         int32 :sh_name
@@ -179,22 +173,6 @@ class ElfParser < BinData::Record
         array 1, :type => :symtab32, :initial_length => 0
         array 2, :type => :symtab64, :initial_length => 0
     end
-    choice :relplt, :selection => lambda{e_ident.ei_class} do
-        array 1, :type => :relplt32, :initial_length => 0
-        array 2, :type => :relplt64, :initial_length => 0
-    end
-    choice :relaplt, :selection => lambda{e_ident.ei_class} do
-        array 1, :type => :relaplt32, :initial_length => 0
-        array 2, :type => :relaplt64, :initial_length => 0
-    end
-    choice :reldyn, :selection => lambda{e_ident.ei_class} do
-        array 1, :type => :relplt32, :initial_length => 0
-        array 2, :type => :relplt64, :initial_length => 0
-    end
-    choice :reladyn, :selection => lambda{e_ident.ei_class} do
-        array 1, :type => :relaplt32, :initial_length => 0
-        array 2, :type => :relaplt64, :initial_length => 0
-    end
 
     def parse_bits(ei_class)
         ei_class == 1 ? 32 : 64
@@ -292,24 +270,34 @@ class ElfParser < BinData::Record
 end
 
 class Elf
-    attr_accessor :gotplt
+    #attr_accessor :gotplt
+    attr_accessor :arch, :bits, :dynamic, :got, :global
 
     def initialize(file)
         # To avoid unicode
         binary = File.read(file).force_encoding('binary')
         # To fix bugs leading eof, that's why here is a newline ...
-        @elf = ElfParser.read binary + "\n" 
-        # Section name assignment
-        assign_section_name binary, @elf
-        # parse symbol table
-        parse_symtab binary, @elf
-        # parse rel.plt
-        parse_relplt binary, @elf
-        @gotplt = gen_gotplt @elf
+        elf = ElfParser.read binary + "\n" 
+        # parse information we need
+        extract_info binary, elf
     end
 
     private
-    def assign_section_name(binary, elf)
+
+    def extract_info(binary, elf)
+        @arch = elf.arch.to_s
+        @bits = elf.bits.to_i
+        # parse section name
+        parse_section_name binary, elf
+        # parse symbol table
+        parse_symtab binary, elf
+        # Parse dynamic section
+        parse_dynamic_constant binary, elf
+        ## parse rel.plt
+        parse_relplt binary, elf
+    end
+
+    def parse_section_name(binary, elf)
         strtab_offset = elf.sh[elf.e_shstrndx].sh_offset.to_i
         strtab = binary[(strtab_offset)..-1]
         elf.e_shnum.times do |i|
@@ -318,6 +306,42 @@ class Elf
         end
     end
 
+    def parse_dynamic_constant(binary, elf)
+        dynamic = nil
+        elf.e_shnum.times do |i|
+            content = binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
+            if elf.sh[i].sh_type == 6 # DYNAMIC
+                size = elf.sh[i].sh_size / elf.sh[i].sh_entsize
+                if @bits == 32
+                    dynamic = BinData::Array.new(:type => :dynamic32, :initial_length => size)
+                else
+                    dynamic = BinData::Array.new(:type => :dynamic64, :initial_length => size)
+                end
+                dynamic.read content
+            end
+        end
+        @dynamic = {}
+        dynamic.each do |d|
+            # PLTREL
+            if d.d_tag == 20 
+                if d.d_val == 7
+                    @dynamic["rel_type"]= "RELA"
+                elsif d.d_val == 17
+                    @dynamic["rel_type"]= "REL"
+                end
+            # STRTAB
+            elsif d.d_tag == 5
+                @dynamic["strtab"]= d.d_val.to_i
+            # SYMTAB
+            elsif d.d_tag == 6
+                @dynamic["symtab"]= d.d_val.to_i
+            # JMPREL
+            elsif d.d_tag == 0x17
+                @dynamic["jmprel"]= d.d_val.to_i
+            end
+        end
+    end
+
     def parse_symtab(binary, elf)
         # find dynamic symtab
         symtab = nil
@@ -350,67 +374,65 @@ class Elf
     end
 
     def parse_relplt(binary, elf)
-        plt = nil
+        rel = nil
+        reldyn = nil
         elf.e_shnum.times do |i|
-            if elf.sh[i].name_str.to_s == ".rel.plt"
-                size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
-                if elf.e_ident[:ei_class] == 1
-                    plt = BinData::Array.new(:type => :relplt32, :initial_length => size)
-                else
-                    plt = BinData::Array.new(:type => :relplt64, :initial_length => size)
-                end
-                elf.relplt.assign plt.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
-            elsif elf.sh[i].name_str.to_s == ".rel.dyn"
-                size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
-                if elf.e_ident[:ei_class] == 1
-                    plt = BinData::Array.new(:type => :relplt32, :initial_length => size)
-                else
-                    plt = BinData::Array.new(:type => :relplt64, :initial_length => size)
-                end
-                elf.reldyn.assign plt.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
-            elsif elf.sh[i].name_str.to_s == ".rela.plt"
-                size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
-                if elf.e_ident[:ei_class] == 1
-                    plt = BinData::Array.new(:type => :relaplt32, :initial_length => size)
-                else
-                    plt = BinData::Array.new(:type => :relaplt64, :initial_length => size)
+            if @dynamic["rel_type"] == "REL"
+                if elf.sh[i].name_str == ".rel.plt"
+                    size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
+                    if elf.e_ident[:ei_class] == 1
+                        rel = BinData::Array.new(:type => :relplt32, :initial_length => size)
+                    else
+                        rel = BinData::Array.new(:type => :relplt64, :initial_length => size)
+                    end
+                    rel.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
+                elsif elf.sh[i].name_str == ".rel.dyn"
+                    size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
+                    if @bits == 32
+                        reldyn = BinData::Array.new(:type => :relplt32, :initial_length => size)
+                    else
+                        reldyn = BinData::Array.new(:type => :relplt64, :initial_length => size)
+                    end
+                    reldyn.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
                 end
-                elf.relaplt.assign plt.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
-            elsif elf.sh[i].name_str.to_s == ".rela.dyn"
-                size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
-                if elf.e_ident[:ei_class] == 1
-                    plt = BinData::Array.new(:type => :relaplt32, :initial_length => size)
-                else
-                    plt = BinData::Array.new(:type => :relaplt64, :initial_length => size)
+            elsif @dynamic["rel_type"] == "RELA"
+                if elf.sh[i].name_str == ".rela.plt"
+                    size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
+                    if @bits == 32
+                        rel = BinData::Array.new(:type => :relaplt32, :initial_length => size)
+                    else
+                        rel = BinData::Array.new(:type => :relaplt64, :initial_length => size)
+                    end
+                    rel.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
+                elsif elf.sh[i].name_str == ".rela.dyn"
+                    size = elf.sh[i].sh_size/elf.sh[i].sh_entsize
+                    if @bits == 32
+                        reldyn = BinData::Array.new(:type => :relaplt32, :initial_length => size)
+                    else
+                        reldyn = BinData::Array.new(:type => :relaplt64, :initial_length => size)
+                    end
+                    reldyn.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
                 end
-                elf.reladyn.assign plt.read binary[elf.sh[i].sh_offset, elf.sh[i].sh_size]
             end
         end
-    end
-
-    def gen_gotplt(elf)
-        result = {}
-        rel = nil
         
-        elf.relplt.each do |r|
-            result[elf.symtab[r.sym_index.to_i].name_str.to_s] = r.r_offset.to_i
-        end
-
-        elf.relaplt.each do |r|
-            result[elf.symtab[r.sym_index.to_i].name_str.to_s] = r.r_offset.to_i
-        end
-
-        elf.reldyn.each do |r|
-            result[elf.symtab[r.sym_index.to_i].name_str.to_s] = elf.symtab[r.sym_index.to_i].st_value.to_i
+        # extract information
+        @got = {}
+        rel.each do |r|
+            if r.type.to_i == 7 # JMP_SLOT
+                @got[elf.symtab[r.sym_index.to_i].name_str.to_s] = r.r_offset.to_i
+            end
         end
-
-        elf.reladyn.each do |r|
-            result[elf.symtab[r.sym_index.to_i].name_str.to_s] = elf.symtab[r.sym_index.to_i].st_value.to_i
+        @global = Hash.new {|h, k| h[k] = Hash.new}
+        reldyn.each do |r|
+            if r.type.to_i == 6 # GLOB_DAT
+                @global[elf.symtab[r.sym_index.to_i].name_str.to_s]["offset"] = r.r_offset.to_i
+                @global[elf.symtab[r.sym_index.to_i].name_str.to_s]["value"] = elf.symtab[r.sym_index.to_i].st_value.to_i
+            end
         end
-        result
     end
 end
 
 #require 'pp'
 #e = Elf.new ARGV[0]
-#pp e.gotplt["__free_hook"]
+#pp e

data/rubypwn.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name        = 'rubypwn'
-  s.version     = '0.0.9'
+  s.version     = '0.0.10'
   s.date        = '2015-09-06'
   s.summary     = "ruby pwn tools"
   s.description   = <<-DESCRIPTION.strip.gsub(/\s+/, " ")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubypwn
 version: !ruby/object:Gem::Version
-  version: 0.0.9
+  version: 0.0.10
 platform: ruby
 authors:
 - atdog