Skip to content

Instantly share code, notes, and snippets.

@romainthomas
Created October 29, 2017 17:34
Show Gist options
  • Save romainthomas/c262be2c29ab374451663b9f6dcdfc0d to your computer and use it in GitHub Desktop.
Save romainthomas/c262be2c29ab374451663b9f6dcdfc0d to your computer and use it in GitHub Desktop.
#!/usr/bin/env python
import lief
shellx = lief.parse("libshellx-2.10.3.1.so")
# .dynsym
dt_symtab = shellx[lief.ELF.DYNAMIC_TAGS.SYMTAB]
dynsym_section = shellx.get_section(".dynsym")
dynsym_section.virtual_address = dt_symtab.value
dynsym_section.offset = shellx.virtual_address_to_offset(dt_symtab.value)
dynsym_section.size = len(shellx.dynamic_symbols) * 0x10
# .dynstr
dt_strtab = shellx[lief.ELF.DYNAMIC_TAGS.STRTAB]
dynstr_section = shellx.get_section(".dynstr")
dynstr_section.virtual_address = dt_strtab.value
dynstr_section.offset = shellx.virtual_address_to_offset(dt_strtab.value)
dynstr_section.size = shellx[lief.ELF.DYNAMIC_TAGS.STRSZ].value
# .init_array
dt_init_array = shellx[lief.ELF.DYNAMIC_TAGS.INIT_ARRAY]
init_array_section = shellx.get_section(".init_array")
init_array_section.virtual_address = dt_init_array.value
init_array_section.offset = shellx.virtual_address_to_offset(dt_init_array.value)
init_array_section.size = len(dt_init_array.array) * 4
# .fini_array
dt_fini_array = shellx[lief.ELF.DYNAMIC_TAGS.FINI_ARRAY]
fini_array_section = shellx.get_section(".fini_array")
fini_array_section.virtual_address = dt_fini_array.value
fini_array_section.offset = shellx.virtual_address_to_offset(dt_fini_array.value)
fini_array_section.size = len(dt_fini_array.array) * 4
# .rel.dyn
dt_rel = shellx[lief.ELF.DYNAMIC_TAGS.REL]
rel_dyn_section = shellx.get_section(".rel.dyn")
rel_dyn_section.virtual_address = dt_rel.value
rel_dyn_section.offset = shellx.virtual_address_to_offset(dt_rel.value)
rel_dyn_section.size = shellx[lief.ELF.DYNAMIC_TAGS.RELSZ].value
# .rel.plt
dt_pltrel = shellx[lief.ELF.DYNAMIC_TAGS.JMPREL]
rel_plt_section = shellx.get_section(".rel.plt")
rel_plt_section.virtual_address = dt_pltrel.value
rel_plt_section.offset = shellx.virtual_address_to_offset(dt_pltrel.value)
rel_plt_section.size = shellx[lief.ELF.DYNAMIC_TAGS.PLTRELSZ].value
# .hash
dt_hash = shellx[lief.ELF.DYNAMIC_TAGS.HASH]
hash_section = shellx.get_section(".hash")
hash_section.virtual_address = dt_hash.value
hash_section.offset = shellx.virtual_address_to_offset(dt_hash.value)
hash_section.size = 0x200
# .plt section: Guessing
plt_section = shellx.get_section(".plt")
plt_section.virtual_address = 0x8d0
plt_section.offset = plt_section.virtual_address
plt_section.size = 0xb80 - 0x8d0
# .text
text_section = shellx.get_section(".text")
code_start = min(*[e.value for e in shellx.exported_symbols if e.value > 0])
code_start = min(code_start, *[c for c in dt_init_array.array if c > 0])
code_start = min(code_start, *[c for c in dt_fini_array.array if c > 0])
code_end = max(*[e.value for e in shellx.exported_symbols if e.value > 0])
code_end = max(code_start, *[c for c in dt_init_array.array if c > 0])
code_end = max(code_start, *[c for c in dt_fini_array.array if c > 0])
code_end = max(*[e.value for e in shellx.exported_symbols], *[c for c in dt_fini_array.array])
code_size = code_end - code_start
print("Assembly code: 0x{:06x} - 0x{:06x}".format(code_start, code_end))
text_section.virtual_address = code_start
text_section.offset = code_start
# First PT_LOAD
shellx.write("libshellx-2.10.3.1_FIXED.so")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment