disinfect.c
/*
* = 编译:
* gcc -O2 disinfect.c -o disinfect
* ./disinfect <executable>
*/
#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <fcntl.h>
#include <dirent.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <elf.h>
#include <errno.h>
//elf 相关信息
typedef struct elfdesc {
Elf64_Ehdr *ehdr;
Elf64_Phdr *phdr;
Elf64_Shdr *shdr;
Elf64_Addr textVaddr;
Elf64_Addr dataVaddr;
//程序头偏移
Elf64_Addr dataOff;
size_t textSize;
size_t dataSize;
uint8_t *mem;
struct stat st;
char *path;
} elfdesc_t;
//缓冲区
#define TMP ".disinfect_file.xyz"
//如果找到了push/ret 同时地址在正常x86_64范围内
//说明正常
//判断是否在正常范围内
//770CD526 68 00000000 PUSH 0x0
//770CD52B C3 RETN
uint32_t locate_orig_entry(elfdesc_t *elf)
{
uint32_t i, entry;
uint8_t *mem = elf->mem;
for (i = 0; i < elf->st.st_size; i++) {
if (mem[0] == 0x68 && mem[5] == 0xc3) {
entry = *(uint32_t *)&mem[1];
if (entry >= 0x400000 && entry < 0x4fffff)
return entry;
}
}
//没有找到
return 0;
}
//770CD53A |. 31ED XOR EBP,EBP
//770CD53C |. 49 DEC ECX
//770CD53D |. 89D1 MOV ECX,EDX
//770CD53F |. 5E POP ESI
//770CD540 |. 48 DEC EAX
//770CD541 |. 89E2 MOV EDX,ESP
uint32_t locate_glibc_init_offset(elfdesc_t *elf)
{
uint32_t i;
uint8_t *mem = elf->mem;
for (i = 0; i < elf->st.st_size; i++) {
if (
mem[i + 0] == 0x31 && mem[i + 1] == 0xed &&
mem[i + 2] == 0x49 && mem[i + 3] == 0x89 &&
mem[i + 4] == 0xd1 && mem[i + 5] == 0x5e &&
mem[i + 6] == 0x48 && mem[i + 7] == 0x89 && mem[i + 8] == 0xe2)
return i;
}
return 0;
}
//移除 PLT/GOT hooks
int disinfect_pltgot(elfdesc_t *elf)
{
//文件头
Elf64_Ehdr *ehdr = elf->ehdr;
//程序头
Elf64_Phdr *phdr = elf->phdr;
//节表头
Elf64_Shdr *shdr = elf->shdr;
//映射基址
uint8_t *mem = elf->mem;
//动态库符号表基地
Elf64_Sym *symtab = NULL;
//重定位表
Elf64_Rela *rela = NULL;
Elf64_Addr addr = 0, plt_addr = 0;
Elf64_Off plt_off = 0, gotoff = 0;
size_t plt_size = 0, symtab_size = 0, rela_size = 0;
//字符串表基址
char *shstrtab = (char *)&mem[shdr[elf->ehdr->e_shstrndx].sh_offset];
char *strtab = NULL;
uint8_t *gotptr, *plt;
int i, j, symindex = 0, c = 0;
//遍历所有的节表
for (i = 0; i < ehdr->e_shnum; i++) {
//类型
switch(shdr[i].sh_type) {
//动态库中符号
case SHT_DYNSYM:
//符号表
symtab = (Elf64_Sym *)&mem[shdr[i].sh_offset];
symtab_size = shdr[i].sh_size;
//对于符号表段sh_link记录的是符号表使用的串表所在段(一般是.strtab)对应段表项在段表内的索引
//.strtab偏移
strtab = (char *)&mem[shdr[shdr[i].sh_link].sh_offset];
break;
//重定位所使用的节的节表索引
case SHT_RELA:
if (!strcmp(&shstrtab[shdr[i].sh_name], ".rela.plt")) {
//重定位表
rela = (Elf64_Rela *)&mem[shdr[i].sh_offset];
//大小
rela_size = shdr[i].sh_size;
}
break;
//程序数据
case SHT_PROGBITS:
if (!strcmp(&shstrtab[shdr[i].sh_name], ".plt")) {
//plt相关
plt_off = shdr[i].sh_offset;
plt_addr = shdr[i].sh_addr;
plt_size = shdr[i].sh_size;
}
break;
}
}
if (plt_off == 0 || symtab == NULL || rela == NULL) {
printf("没有找到relocation/symbol/plt info！！！\n");
return -1;
}
//第一个PLT地址
plt = &mem[plt_off];
//遍历所有重定位表条目
for (i = 0; i < rela_size/sizeof(Elf64_Rela); i++) {
//高24 位表示重定位符号对应符号表项在符号表内有索引
symindex = ELF64_R_SYM(rela->r_info);
//在symtab中找到puts函数符号
if (!strcmp(&strtab[symtab[ELF64_R_SYM(rela->r_info)].st_name], "puts")) {
printf("尝试消毒PLT/GOT！！！\n");
gotoff = elf->dataOff + (rela->r_offset - elf->dataVaddr);
gotptr = &mem[gotoff];
addr = gotptr[0] + (gotptr[1] << 8) + (gotptr[2] << 16) + (gotptr[3] << 24);
if (!(addr >= plt_addr && addr < plt_addr + plt_size)) {
for (c = 0, j = 0; j < plt_size; j += 16, c++) {
//判断索引号
if (c == symindex) {
printf("成功消毒PLT/GOT表！！！\n");
*(uint32_t *)gotptr = plt_addr + j + 6;
return 0;
}
}
}
printf(" PLT/GOT表解毒失败！！！\n");
return -1;
}
}
return 0;
}
//尝试消毒 一般64位的代码加载基址为0x400000
int disinfect(elfdesc_t *elf)
{
size_t paddingSize;
Elf64_Phdr *phdr = elf->phdr;
Elf64_Shdr *shdr = elf->shdr;
uint32_t text_offset = 0;
char *strtab = NULL;
uint8_t *mem = elf->mem;
int i, textfound, fd;
ssize_t c, last_chunk;
//如果大于0x400000
if (elf->textVaddr >= 0x400000) {
printf("不是所要消除的特征！！！\n");
return -1;
}
//0x400000-代码段的基址(病毒用的逆向text技术)
//计算差值
paddingSize = 0x400000 - elf->textVaddr;
//如果存在 hook移除
int ret = disinfect_pltgot(elf);
//移除magic 标记
*(uint32_t *)&elf->ehdr->e_ident[EI_PAD] = 0x00000000;
// PT_PHDR, PT_INTERP 前移
phdr[0].p_offset -= paddingSize;
phdr[1].p_offset -= paddingSize;
//phdr设置回正常
for (textfound = 0, i = 0; i < elf->ehdr->e_phnum; i++) {
if (textfound) {
phdr[i].p_offset -= paddingSize;
continue;
}
if (phdr[i].p_type == PT_LOAD && phdr[i].p_offset == 0 && phdr[i].p_flags & PF_X) {
if (phdr[i].p_paddr == phdr[i].p_vaddr) {
phdr[i].p_vaddr += paddingSize;
phdr[i].p_paddr += paddingSize;
} else
phdr[i].p_vaddr += paddingSize;
//重置文本段大小
phdr[i].p_filesz -= paddingSize;
phdr[i].p_memsz -= paddingSize;
phdr[i].p_align = 0x200000;
phdr[i + 1].p_align = 0x200000;
textfound = 1;
}
}
//偏移
text_offset = locate_glibc_init_offset(elf);
//校正节表
strtab = (char *)&mem[shdr[elf->ehdr->e_shstrndx].sh_offset];
for (i = 0; i < elf->ehdr->e_shnum; i++) {
//只要处理感染部分代码
if (!strcmp(&strtab[shdr[i].sh_name], ".text")) {
//保持不变
if (text_offset == 0)
continue;
shdr[i].sh_offset = text_offset - paddingSize;
shdr[i].sh_addr = (text_offset - paddingSize) + 0x400000;
continue;
}
shdr[i].sh_offset -= paddingSize;
}
//设置phdr和shdr表
elf->ehdr->e_shoff -= paddingSize;
elf->ehdr->e_phoff -= paddingSize;
//设回正常OEP
elf->ehdr->e_entry = 0x400000 + text_offset;
elf->ehdr->e_entry -= paddingSize;
//重建elf
if ((fd = open(TMP, O_CREAT | O_TRUNC | O_WRONLY, elf->st.st_mode)) < 0)
return -1;
if ((c = write(fd, mem, sizeof(Elf64_Ehdr))) != sizeof(Elf64_Ehdr))
return -1;
mem += paddingSize + sizeof(Elf64_Ehdr);
last_chunk = elf->st.st_size - (paddingSize + sizeof(Elf64_Ehdr));
if ((c = write(fd, mem, last_chunk)) != last_chunk)
return -1;
if (fchown(fd, elf->st.st_uid, elf->st.st_gid) < 0)
return -1;
//重命名
rename(TMP, elf->path);
return 0;
}
//加载文件
int load_executable(const char *path, elfdesc_t *elf)
{
uint8_t *mem;
Elf64_Ehdr *ehdr;
Elf64_Phdr *phdr;
Elf64_Shdr *shdr;
int fd;
struct stat st;
int i;
if ((fd = open(path, O_RDONLY)) < 0) {
perror("open");
return -1;
}
fstat(fd, &st);
mem = mmap(NULL, st.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
if (mem == MAP_FAILED) {
perror("mmap");
return -1;
}
ehdr = (Elf64_Ehdr *)mem;
phdr = (Elf64_Phdr *)&mem[ehdr->e_phoff];
shdr = (Elf64_Shdr *)&mem[ehdr->e_shoff];
elf->st = st;
//为了找到以0 为偏移的代码段
for (i = 0; i < ehdr->e_phnum; i++) {
//非0 为1 0 还是0
switch(!!phdr[i].p_offset) {
case 0:
elf->textVaddr = phdr[i].p_vaddr;
elf->textSize = phdr[i].p_filesz;
break;
case 1:
elf->dataOff = phdr[i].p_offset;
elf->dataVaddr = phdr[i].p_vaddr;
elf->dataSize = phdr[i].p_filesz;
break;
}
}
elf->mem = mem;
elf->ehdr = ehdr;
elf->phdr = phdr;
elf->shdr = shdr;
elf->path = (char *)path;
return 0;
}
//检查是否为病毒
int test_for_skeksi(elfdesc_t *elf)
{
uint32_t magic = *(uint32_t *)&elf->ehdr->e_ident[EI_PAD];
return (magic == 0x15D25);
}
int main(int argc, char **argv)
{
elfdesc_t elf;
if (argc < 2) {
printf("Usage: %s <executable>\n", argv[0]);
exit(0);
}
//加载 elf 同时保存相关信息
if (load_executable(argv[1], &elf) < 0) {
printf("加载失败: %s\n", argv[1]);
exit(-1);
}
//检查病毒
if (test_for_skeksi(&elf) == 0) {
printf("File: %s, 没有感染virus\n", argv[1]);
exit(-1);
}
printf("File: %s, 已经感染virus! 尝试消毒！\n", argv[1]);
if (disinfect(&elf) < 0) {
printf("消毒失败 file: %s\n", argv[1]);
exit(-1);
}
printf("消毒成功: %s\n", argv[1]);
}
