From 5594f532eee02bc6ae2bc5645a5cd0dac329dc97 Mon Sep 17 00:00:00 2001 From: Allan Wirth Date: Thu, 3 Jan 2013 12:01:30 -0500 Subject: [PATCH] Remove useless struct and add optimization for when no argv needs to be printed. --- includes/ropgadget.h | 12 +++--------- src/main.c | 10 +++++----- src/makecode.c | 25 +++++++++++++++++-------- src/x86/common_makecode.c | 2 +- src/x86/common_ropmaker.c | 8 ++++---- 5 files changed, 30 insertions(+), 27 deletions(-) diff --git a/includes/ropgadget.h b/includes/ropgadget.h index a5c6419..9f68627 100644 --- a/includes/ropgadget.h +++ b/includes/ropgadget.h @@ -133,7 +133,7 @@ typedef struct s_filter_mode t_word_linked *linked; } t_filter_mode; -/* -opcode (used by importsc) */ +/* -opcode and -importsc */ typedef struct s_opcode { unsigned char *opcode; @@ -148,13 +148,7 @@ typedef struct s_stringmode int flag; } t_stringmode; -/* -importsc */ -typedef struct s_importsc -{ - t_opcode opcode; -} t_importsc; - -/* -syntax (not implemented)*/ +/* -syntax */ typedef enum e_syntaxcode { SYN_PHP, @@ -243,7 +237,7 @@ t_binary *binary; t_opcode opcode_mode; /* -opcode */ t_stringmode stringmode; /* -string */ t_stringmode asm_mode; /* -asm */ -t_importsc importsc_mode; /* -importsc */ +t_opcode importsc_mode; /* -importsc */ t_bind_mode bind_mode; /* -bind & -port */ t_filter_mode filter_mode; /* -filter */ t_filter_mode only_mode; /* -only */ diff --git a/src/main.c b/src/main.c index 235070b..a38dd27 100644 --- a/src/main.c +++ b/src/main.c @@ -43,7 +43,7 @@ static void set_defaults(void) only_mode.flag = 0; only_mode.linked = NULL; opcode_mode.flag = 0; - importsc_mode.opcode.flag = 0; + importsc_mode.flag = 0; syntaxins = INTEL; /* Display with ATT syntax by default */ target_argv = NULL; @@ -64,7 +64,7 @@ static struct option long_options[] = { {"intel", no_argument, (int *)&syntaxins, INTEL}, {"bind", required_argument, &bind_mode.flag, 1}, - {"importsc", required_argument, &importsc_mode.opcode.flag, 1}, + {"importsc", required_argument, &importsc_mode.flag, 1}, {"filter", required_argument, &filter_mode.flag, 1}, {"only", required_argument, &only_mode.flag, 1}, @@ -150,7 +150,7 @@ int main(int argc, char **argv) { eprintf("%sEx%s: -importsc \"\\x6a\\x02\\x58\\xcd\\x80\\xeb\\xf9\"\n", RED, ENDC); return 1; } - make_opcode(optarg, &importsc_mode.opcode); + make_opcode(optarg, &importsc_mode); } else if (is_option("limit")) { if (optarg == NULL || strlen(optarg) == 0) { eprintf("%sSyntax%s: -limit \n", RED, ENDC); @@ -201,14 +201,14 @@ int main(int argc, char **argv) { syntax(argv[0]); return 1; } else if (optind < argc-1) { - if (bind_mode.flag || importsc_mode.opcode.flag) { + if (bind_mode.flag || importsc_mode.flag) { eprintf("\t%sIf specifying argv params, -bind or -importsc cannot be used.%s\n", RED, ENDC); return 1; } target_argv = &argv[optind+1]; } - if (bind_mode.flag && importsc_mode.opcode.flag) { + if (bind_mode.flag && importsc_mode.flag) { eprintf("\t%sError. -bind and -importsc are mutually exclusive.%s\n", RED, ENDC); return 1; } diff --git a/src/makecode.c b/src/makecode.c index c626321..a14c90a 100644 --- a/src/makecode.c +++ b/src/makecode.c @@ -322,16 +322,25 @@ size_t sc_print_argv(const char * const *args, const t_rop_writer *wr, int offse offset += strlen(args[i])+1; } - if (argv_start != NULL) - *argv_start = offset; + if (num_args == 1) { /* only single argument (binary) so no argv required */ + if (argv_start) + *argv_start = offset_start + strlen(args[0]); + if (envp_start) + *envp_start = offset_start + strlen(args[0]); + } else { + if (argv_start != NULL) + *argv_start = offset; - vector[i] = -1; + vector[i] = -1; - sc_print_vector(vector, wr, offset, data, bytes); + sc_print_vector(vector, wr, offset, data, bytes); + if (envp_start != NULL) + *envp_start = offset + (num_args)*bytes; + } free(vector); - if (envp_start != NULL) - *envp_start = offset + (num_args)*bytes; - - return (offset - offset_start) + (num_args+1)*bytes; + if (num_args != 1) + return (offset - offset_start) + (num_args+1)*bytes; + else + return (offset_start + strlen(args[0]) + bytes); } diff --git a/src/x86/common_makecode.c b/src/x86/common_makecode.c index 3a9ac00..aa2fb87 100644 --- a/src/x86/common_makecode.c +++ b/src/x86/common_makecode.c @@ -37,7 +37,7 @@ void x86_makecode_importsc(t_gadget *gadgets, size_t word_size) { sc_print_init(); - sc_print_raw_string(importsc_mode.opcode.opcode, importsc_mode.opcode.size, &wr, + sc_print_raw_string((char *)importsc_mode.opcode, importsc_mode.size, &wr, 0, FALSE, word_size); sc_print_sect_addr(0, FALSE, word_size); diff --git a/src/x86/common_ropmaker.c b/src/x86/common_ropmaker.c index 0d25960..e0f7494 100644 --- a/src/x86/common_ropmaker.c +++ b/src/x86/common_ropmaker.c @@ -29,19 +29,19 @@ void x86_ropmaker(size_t word_size) char **ropsh; t_asm *table = (word_size==4)?tab_x8632:tab_x8664; - if (importsc_mode.opcode.flag) + if (importsc_mode.flag) ropsh = (word_size==4)?tab_x8632_importsc:tab_x8664_importsc; else ropsh = (word_size==4)?tab_x8632_ropmaker:tab_x8664_ropmaker; flag = !combo_ropmaker(ropsh, table, &gadgets); - if (importsc_mode.opcode.flag) + if (importsc_mode.flag) { - if (importsc_mode.opcode.size > (binary->writable_exec_size)) + if (importsc_mode.size > (binary->writable_exec_size)) { eprintf("\n\t%s/!\\ Possible to make a ROP payload but .got size & .got.plt size isn't sufficient.%s\n", RED, ENDC); - eprintf(" \t%s got + got.plt = %s" SIZE_FORMAT " bytes%s and your shellcode size is %s" SIZE_FORMAT " bytes%s\n", RED, YELLOW, SIZE_WIDTH, (binary->writable_exec_size), RED, YELLOW, SIZE_WIDTH, (Size)importsc_mode.opcode.size, ENDC); + eprintf(" \t%s got + got.plt = %s" SIZE_FORMAT " bytes%s and your shellcode size is %s" SIZE_FORMAT " bytes%s\n", RED, YELLOW, SIZE_WIDTH, (binary->writable_exec_size), RED, YELLOW, SIZE_WIDTH, (Size)importsc_mode.size, ENDC); return ; } /* build a python code */