search

En14c / PIvirus

sample linux x86_64 ELF virus
53 stars 18 forks source link

DT_JMPREL error #2

Open wangxi19 opened 4 years ago

wangxi19 commented 4 years ago

594 case DT_JMPREL://.rela.plt The below arithmatic is incorrect, but result is correct. quite funny. should use (target_elf->mmap + (offset of the segment that contains the .rela.plt) + (tmp_dynseg->d_un.d_ptr - (viraddr of the segment that contains the .rela.plt))) 595 target_elf->elfstructs.pltrela = (Elf64_Rela *)(target_elf->mmap + target_code_offset + 596 (tmp_dynseg->d_un.d_ptr - target_code_vaddr)); 597 break;

wangxi19 commented 4 years ago

tested in debian10 gcc (Debian 8.3.0-6) 8.3.0

wangxi19 commented 4 years ago

root@Debian10:/tmp/build-junk2-Desktop_Qt_5_12_8_GCC_64bit-Debug# readelf -l ./junk2

Elf file type is DYN (Shared object file) Entry point 0x1150 There are 11 program headers, starting at offset 64

Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x0000000000000268 0x0000000000000268 R 0x8 INTERP 0x00000000000002a8 0x00000000000002a8 0x00000000000002a8 0x000000000000001c 0x000000000000001c R 0x1 [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2] LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000ce8 0x0000000000000ce8 R 0x1000 LOAD 0x0000000000001000 0x0000000000001000 0x0000000000001000 0x000000000000244d 0x000000000000244d R E 0x1000 LOAD 0x0000000000004000 0x0000000000004000 0x0000000000004000 0x0000000000001bf0 0x0000000000001bf0 R 0x1000 LOAD 0x0000000000005d48 0x0000000000006d48 0x0000000000006d48 0x0000000000000378 0x0000000000000380 RW 0x1000 DYNAMIC 0x0000000000005db0 0x0000000000006db0 0x0000000000006db0 0x0000000000000210 0x0000000000000210 RW 0x8 NOTE 0x00000000000002c4 0x00000000000002c4 0x00000000000002c4 0x0000000000000044 0x0000000000000044 R 0x4 GNU_EH_FRAME 0x00000000000040a0 0x00000000000040a0 0x00000000000040a0 0x0000000000000524 0x0000000000000524 R 0x4 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x10 GNU_RELRO 0x0000000000005d48 0x0000000000006d48 0x0000000000006d48 0x00000000000002b8 0x00000000000002b8 R 0x1

Section to Segment mapping: Segment Sections... 00
01 .interp 02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt 03 .init .plt .plt.got .text .fini 04 .rodata .eh_frame_hdr .eh_frame .gcc_except_table 05 .init_array .fini_array .data.rel.ro .dynamic .got .got.plt .data .bss 06 .dynamic 07 .note.ABI-tag .note.gnu.build-id 08 .eh_frame_hdr 09
10 .init_array .fini_array .data.rel.ro .dynamic .got root@Debian10:/tmp/build-junk2-Desktop_Qt_5_12_8_GCC_64bit-Debug#

The above shows the current ELF format

wangxi19 commented 4 years ago

.rela.plt and .text are in differenct segment now