metasploit-framework/lib/rex/elfscan/scanner.rb

# -*- coding: binary -*-
require 'metasm'

module Rex
module ElfScan
module Scanner
class Generic

  attr_accessor :elf, :regex

  def initialize(elf)
    self.elf = elf
  end

  def config(param)
  end

  def scan(param)
    config(param)

    $stdout.puts "[#{param['file']}]"
    elf.program_header.each do |program_header|

      # Scan only loadable segment entries in the program header table
      if program_header.p_type == Rex::ElfParsey::ElfBase::PT_LOAD
        hits = scan_segment(program_header, param)
        hits.each do |hit|
          rva  = hit[0]
          message  = hit[1].is_a?(Array) ? hit[1].join(" ") : hit[1]
          $stdout.puts elf.ptr_s(rva) + " " + message
          if(param['disasm'])
            message.gsub!("; ", "\n")
            if message.include?("retn")
              message.gsub!("retn", "ret")
            end

            begin
              d2 = Metasm::Shellcode.assemble(Metasm::Ia32.new, message).disassemble
            rescue Metasm::ParseError
              d2 = Metasm::Shellcode.disassemble(Metasm::Ia32.new, [message].pack('H*'))
            end

            addr = 0
            while ((di = d2.disassemble_instruction(addr)))
              disasm = "0x%08x\t" % (rva + addr)
              disasm << di.instruction.to_s
              $stdout.puts disasm
              addr = di.next_addr
            end
          end
        end
      end

    end
  end

  def scan_segment(program_header, param={})
    []
  end
end

class JmpRegScanner < Generic

  def config(param)
    regnums = param['args']

    # build a list of the call bytes
    calls  = _build_byte_list(0xd0, regnums - [4]) # note call esp's don't work..
    jmps   = _build_byte_list(0xe0, regnums)
    pushs1 = _build_byte_list(0x50, regnums)
    pushs2 = _build_byte_list(0xf0, regnums)

    regexstr = '('
    if !calls.empty?
      regexstr += "\xff[#{calls}]|"
    end

    regexstr += "\xff[#{jmps}]|([#{pushs1}]|\xff[#{pushs2}])(\xc3|\xc2..))"

    self.regex = Regexp.new(regexstr, nil, 'n')
  end

  # build a list for regex of the possible bytes, based on a base
  # byte and a list of register numbers..
  def _build_byte_list(base, regnums)
    regnums.collect { |regnum| Regexp.escape((base | regnum).chr) }.join('')
  end

  def _ret_size(offset)
    case elf.read(offset, 1)
      when "\xc3"
        return 1
      when "\xc2"
        return 3
    end

    raise "wtf"
  end

  def _parse_ret(data)
    if data.length == 1
      return "ret"
    else
      return "retn 0x%04x" % data[1, 2].unpack('v')[0]
    end
  end


  def scan_segment(program_header, param={})
    offset = program_header.p_offset

    hits = []

    while (offset = elf.index(regex, offset)) != nil

      rva     = elf.offset_to_rva(offset)
      message = ''

      parse_ret = false

      byte1 = elf.read(offset, 1).unpack('C')[0]

      if byte1 == 0xff
        byte2   = elf.read(offset+1, 1).unpack('C')[0]
        regname = Rex::Arch::X86.reg_name32(byte2 & 0x7)

        case byte2 & 0xf8
        when 0xd0
          message = "call #{regname}"
          offset += 2
        when 0xe0
          message = "jmp #{regname}"
          offset += 2
        when 0xf0
          retsize = _ret_size(offset+2)
          message = "push #{regname}; " + _parse_ret(elf.read(offset+2, retsize))
          offset += 2 + retsize
        else
          raise "wtf"
        end
      else
        regname = Rex::Arch::X86.reg_name32(byte1 & 0x7)
        retsize = _ret_size(offset+1)
        message = "push #{regname}; " + _parse_ret(elf.read(offset+1, retsize))
        offset += 1 + retsize
      end

      hits << [ rva, message ]
    end

    return hits
  end
end

class PopPopRetScanner < JmpRegScanner

  def config(param)
    pops = _build_byte_list(0x58, (0 .. 7).to_a - [4]) # we don't want pop esp's...
    self.regex = Regexp.new("[#{pops}][#{pops}](\xc3|\xc2..)", nil, 'n')
  end

  def scan_segment(program_header, param={})
    offset = program_header.p_offset

    hits = []

    while offset < program_header.p_offset + program_header.p_filesz &&
    (offset = elf.index(regex, offset)) != nil

      rva     = elf.offset_to_rva(offset)
      message = ''

      pops = elf.read(offset, 2)
      reg1 = Rex::Arch::X86.reg_name32(pops[0,1].unpack('C*')[0] & 0x7)
      reg2 = Rex::Arch::X86.reg_name32(pops[1,1].unpack('C*')[0] & 0x7)

      message = "pop #{reg1}; pop #{reg2}; "

      retsize = _ret_size(offset+2)
      message += _parse_ret(elf.read(offset+2, retsize))

      offset += 2 + retsize

      hits << [ rva, message ]
    end

    return hits
  end
end

class RegexScanner < JmpRegScanner

  def config(param)
    self.regex = Regexp.new(param['args'], nil, 'n')
  end

  def scan_segment(program_header, param={})
    offset = program_header.p_offset

    hits = []

    while offset < program_header.p_offset + program_header.p_filesz &&
    (offset = elf.index(regex, offset)) != nil

      idx = offset
      buf = ''
      mat = nil

      while (! (mat = buf.match(regex)))
        buf << elf.read(idx, 1)
        idx += 1
      end

      rva = elf.offset_to_rva(offset)

      hits << [ rva, buf.unpack("H*") ]
      offset += buf.length
    end

    return hits
  end
end

end
end
end