status_t va2sym(drakvuf_t drakvuf, addr_t va, vmi_pid_t target_pid, char **out_mod, char **out_sym) { vmi_instance_t vmi = drakvuf->vmi; addr_t list_head; size_t pid_offset = vmi_get_offset(vmi, "win_pid"); size_t tasks_offset = vmi_get_offset(vmi, "win_tasks"); addr_t current_process, current_list_entry, next_list_entry; vmi_read_addr_ksym(vmi, "PsInitialSystemProcess", ¤t_process); /* walk the task list */ list_head = current_process + tasks_offset; current_list_entry = list_head; if (VMI_FAILURE == vmi_read_addr_va(vmi, current_list_entry, 0, &next_list_entry)) { PRINT_DEBUG("Failed to read next pointer at 0x%lx before entering loop\n", current_list_entry); return VMI_FAILURE; } do { current_list_entry = next_list_entry; current_process = current_list_entry - tasks_offset; /* follow the next pointer */ addr_t peb, ldr, inloadorder; vmi_pid_t pid; vmi_read_32_va(vmi, current_process + pid_offset, 0, (uint32_t*)&pid); if (pid == target_pid) { vmi_read_addr_va(vmi, current_process + drakvuf->offsets[EPROCESS_PEB], 0, &peb); vmi_read_addr_va(vmi, peb + drakvuf->offsets[PEB_LDR], pid, &ldr); vmi_read_addr_va(vmi, ldr + drakvuf->offsets[PEB_LDR_DATA_INLOADORDERMODULELIST], pid, &inloadorder); access_context_t ctx = { .translate_mechanism = VMI_TM_PROCESS_PID, .pid = pid, }; return modlist_va2sym(drakvuf, inloadorder, va, &ctx, out_mod, out_sym); } if (VMI_FAILURE == vmi_read_addr_va(vmi, current_list_entry, 0, &next_list_entry)) { PRINT_DEBUG("Failed to read next pointer in loop at %lx\n", current_list_entry); return VMI_FAILURE; } } while (next_list_entry != list_head);
addr_t sym2va(drakvuf_t drakvuf, vmi_pid_t target_pid, const char *mod_name, const char *symbol) { vmi_instance_t vmi = drakvuf->vmi; addr_t ret = 0; addr_t list_head; status_t status; size_t pid_offset = vmi_get_offset(vmi, "win_pid"); size_t tasks_offset = vmi_get_offset(vmi, "win_tasks"); addr_t current_process, current_list_entry, next_list_entry; vmi_read_addr_ksym(vmi, "PsInitialSystemProcess", ¤t_process); /* walk the task list */ list_head = current_process + tasks_offset; current_list_entry = list_head; status = vmi_read_addr_va(vmi, current_list_entry, 0, &next_list_entry); if (status == VMI_FAILURE) { PRINT_DEBUG("Failed to read next pointer at 0x%lx before entering loop\n", current_list_entry); return ret; } do { current_list_entry = next_list_entry; current_process = current_list_entry - tasks_offset; /* follow the next pointer */ vmi_pid_t pid = -1; vmi_read_32_va(vmi, current_process + pid_offset, 0, (uint32_t*)&pid); if (pid == target_pid) { return eprocess_sym2va(drakvuf, current_process, mod_name, symbol); } status = vmi_read_addr_va(vmi, current_list_entry, 0, &next_list_entry); if (status == VMI_FAILURE) { PRINT_DEBUG("Failed to read next pointer in loop at %lx\n", current_list_entry); return ret; } } while (next_list_entry != list_head); return ret; }
addr_t eprocess_list_search( vmi_instance_t vmi, addr_t list_head, int offset, size_t len, void *value) { addr_t next_process = 0; addr_t tasks_offset = 0; addr_t rtnval = 0; void *buf = g_malloc0(len); if ( !buf ) goto exit; if ( VMI_FAILURE == vmi_get_offset(vmi, "win_tasks", &tasks_offset) ) goto exit; if ( VMI_FAILURE == vmi_read_addr_va(vmi, list_head + tasks_offset, 0, &next_process) ) goto exit; if ( VMI_FAILURE == vmi_read_va(vmi, list_head + offset, 0, len, buf, NULL) ) goto exit; if (memcmp(buf, value, len) == 0) { rtnval = list_head + tasks_offset; goto exit; } list_head = next_process; while(1) { addr_t tmp_next = 0; if ( VMI_FAILURE == vmi_read_addr_va(vmi, next_process, 0, &tmp_next) ) goto exit; if (list_head == tmp_next) { break; } if ( VMI_FAILURE == vmi_read_va(vmi, next_process + offset - tasks_offset, 0, len, buf, NULL) ) goto exit; if (memcmp(buf, value, len) == 0) { rtnval = next_process; goto exit; } next_process = tmp_next; } exit: g_free(buf); return rtnval; }
addr_t eprocess_list_search( vmi_instance_t vmi, int offset, size_t len, void *value) { addr_t next_process, list_head; int tasks_offset; void *buf = malloc(len); addr_t rtnval = 0; tasks_offset = vmi_get_offset(vmi, "win_tasks"); vmi_read_addr_ksym(vmi, "PsInitialSystemProcess", &list_head); vmi_read_addr_va(vmi, list_head + tasks_offset, 0, &next_process); vmi_read_va(vmi, list_head + offset, 0, buf, len); if (memcmp(buf, value, len) == 0) { rtnval = list_head + tasks_offset; goto exit; } list_head = next_process; while(1) { addr_t tmp_next = 0; vmi_read_addr_va(vmi, next_process, 0, &tmp_next); if (list_head == tmp_next) { break; } vmi_read_va(vmi, next_process + offset - tasks_offset, 0, buf, len); if (memcmp(buf, value, len) == 0) { rtnval = next_process; goto exit; } next_process = tmp_next; } exit: free(buf); return rtnval; }
status_t get_vm_offsets(vmi_instance_t vmi, image_offset *offset_struct) { /* TODO: (pwwp) * Get offset through config file * may use: libconfig * Below is just a linux example */ offset_struct->state_offset = 0x0; offset_struct->rt_priority_offset = 0x5c; offset_struct->total_vm_offset=0xa8; offset_struct->rss_stat_offset = 0x2a8; offset_struct->element_offset = 0x8; offset_struct->utime_offset = 0x388; offset_struct->stime_offset = 0x410; /* init the offset values */ if (VMI_OS_LINUX == vmi_get_ostype(vmi)) { offset_struct->tasks_offset = vmi_get_offset(vmi, "linux_tasks"); offset_struct->name_offset = vmi_get_offset(vmi, "linux_name"); offset_struct->pid_offset = vmi_get_offset(vmi, "linux_pid"); offset_struct->mm_offset = vmi_get_offset(vmi,"linux_mm"); } else if (VMI_OS_WINDOWS == vmi_get_ostype(vmi)) { offset_struct->tasks_offset = vmi_get_offset(vmi, "win_tasks"); offset_struct->name_offset = vmi_get_offset(vmi, "win_pname"); offset_struct->pid_offset = vmi_get_offset(vmi, "win_pid"); } // An error happens when any of the offset is 0. // When that happens, return S_ERROR if (!(offset_struct->tasks_offset && offset_struct->pid_offset && offset_struct->name_offset)) return VMI_FAILURE; else return VMI_SUCCESS; }
int introspect_process_list (char *name) { vmi_instance_t vmi; addr_t list_head = 0, next_list_entry = 0, current_process = 0; vmi_pid_t pid = 0; char *procname = NULL; if (vmi_init(&vmi, VMI_XEN | VMI_INIT_COMPLETE, name) == VMI_FAILURE) { printf("Failed to init LibVMI library.\n"); return 1; } vmi_pause_vm(vmi); /** * get offsets of the kernel data structures * get the head of the task_struct */ switch(vmi_get_ostype(vmi)) { case VMI_OS_LINUX: tasks_offset = vmi_get_offset(vmi, "linux_tasks"); name_offset = vmi_get_offset(vmi, "linux_name"); pid_offset = vmi_get_offset(vmi, "linux_pid"); list_head = vmi_translate_ksym2v(vmi, "init_task") + tasks_offset; break; case VMI_OS_WINDOWS: tasks_offset = vmi_get_offset(vmi, "win_tasks"); name_offset = vmi_get_offset(vmi, "win_pname"); pid_offset = vmi_get_offset(vmi, "win_pid"); list_head = vmi_translate_ksym2v(vmi, "PsActiveProcessHead"); break; default: goto exit; } if (tasks_offset == 0 || pid_offset == 0 || name_offset == 0) { printf("Failed to find offsets\n"); goto exit; } next_list_entry = list_head; /** * traverse the task lists and print out each process */ do { current_process = next_list_entry - tasks_offset; vmi_read_32_va(vmi, current_process + pid_offset, 0, (uint32_t*)&pid); procname = vmi_read_str_va(vmi, current_process + name_offset, 0); if (!procname) { printf("Failed to find procname\n"); goto exit; } printf("[%5d] %s\n", pid, procname); free(procname); procname = NULL; if (vmi_read_addr_va(vmi, next_list_entry, 0, &next_list_entry) == VMI_FAILURE) { printf("Failed to read next pointer in loop at %"PRIx64"\n", next_list_entry); goto exit; } } while(next_list_entry != list_head); exit: vmi_resume_vm(vmi); vmi_destroy(vmi); return 0; }
int main (int argc, char **argv) { vmi_instance_t vmi; unsigned char *memory = NULL; uint32_t offset; addr_t list_head = 0, next_list_entry = 0; addr_t current_process = 0; addr_t tmp_next = 0; char *procname = NULL; vmi_pid_t pid = 0; unsigned long tasks_offset = 0, pid_offset = 0, name_offset = 0; status_t status; /* this is the VM or file that we are looking at */ if (argc != 2) { printf("Usage: %s <vmname>\n", argv[0]); return 1; } // if char *name = argv[1]; /* initialize the libvmi library */ if (vmi_init(&vmi, VMI_AUTO | VMI_INIT_COMPLETE, name) == VMI_FAILURE) { printf("Failed to init LibVMI library.\n"); return 1; } /* init the offset values */ if (VMI_OS_LINUX == vmi_get_ostype(vmi)) { tasks_offset = vmi_get_offset(vmi, "linux_tasks"); name_offset = vmi_get_offset(vmi, "linux_name"); pid_offset = vmi_get_offset(vmi, "linux_pid"); } else if (VMI_OS_WINDOWS == vmi_get_ostype(vmi)) { tasks_offset = vmi_get_offset(vmi, "win_tasks"); name_offset = vmi_get_offset(vmi, "win_pname"); pid_offset = vmi_get_offset(vmi, "win_pid"); } if (0 == tasks_offset) { printf("Failed to find win_tasks\n"); goto error_exit; } if (0 == pid_offset) { printf("Failed to find win_pid\n"); goto error_exit; } if (0 == name_offset) { printf("Failed to find win_pname\n"); goto error_exit; } /* pause the vm for consistent memory access */ if (vmi_pause_vm(vmi) != VMI_SUCCESS) { printf("Failed to pause VM\n"); goto error_exit; } // if /* demonstrate name and id accessors */ char *name2 = vmi_get_name(vmi); if (VMI_FILE != vmi_get_access_mode(vmi)) { unsigned long id = vmi_get_vmid(vmi); printf("Process listing for VM %s (id=%lu)\n", name2, id); } else { printf("Process listing for file %s\n", name2); } free(name2); /* get the head of the list */ if (VMI_OS_LINUX == vmi_get_ostype(vmi)) { /* Begin at PID 0, the 'swapper' task. It's not typically shown by OS * utilities, but it is indeed part of the task list and useful to * display as such. */ list_head = vmi_translate_ksym2v(vmi, "init_task") + tasks_offset; } else if (VMI_OS_WINDOWS == vmi_get_ostype(vmi)) { // find PEPROCESS PsInitialSystemProcess if(VMI_FAILURE == vmi_read_addr_ksym(vmi, "PsActiveProcessHead", &list_head)) { printf("Failed to find PsActiveProcessHead\n"); goto error_exit; } } next_list_entry = list_head; /* walk the task list */ do { current_process = next_list_entry - tasks_offset; /* Note: the task_struct that we are looking at has a lot of * information. However, the process name and id are burried * nice and deep. Instead of doing something sane like mapping * this data to a task_struct, I'm just jumping to the location * with the info that I want. This helps to make the example * code cleaner, if not more fragile. In a real app, you'd * want to do this a little more robust :-) See * include/linux/sched.h for mode details */ /* NOTE: _EPROCESS.UniqueProcessId is a really VOID*, but is never > 32 bits, * so this is safe enough for x64 Windows for example purposes */ vmi_read_32_va(vmi, current_process + pid_offset, 0, (uint32_t*)&pid); procname = vmi_read_str_va(vmi, current_process + name_offset, 0); if (!procname) { printf("Failed to find procname\n"); goto error_exit; } /* print out the process name */ printf("[%5d] %s (struct addr:%"PRIx64")\n", pid, procname, current_process); if (procname) { free(procname); procname = NULL; } /* follow the next pointer */ status = vmi_read_addr_va(vmi, next_list_entry, 0, &next_list_entry); if (status == VMI_FAILURE) { printf("Failed to read next pointer in loop at %"PRIx64"\n", next_list_entry); goto error_exit; } } while(next_list_entry != list_head); error_exit: /* resume the vm */ vmi_resume_vm(vmi); /* cleanup any memory associated with the LibVMI instance */ vmi_destroy(vmi); return 0; }
int main (int argc, char **argv) { /* this is the VM or file that we are looking at */ if (argc != 2) { printf("Usage: %s <vmname>\n", argv[0]); return 1; } #if ENABLE_SHM_SNAPSHOT == 1 vmi_instance_t vmi; addr_t list_head = 0, current_list_entry = 0, next_list_entry = 0; addr_t current_process = 0; char *procname = NULL; vmi_pid_t pid = 0; unsigned long tasks_offset, pid_offset, name_offset; char *name = argv[1]; /* initialize the libvmi library */ if (vmi_init(&vmi, VMI_AUTO | VMI_INIT_COMPLETE, name) == VMI_FAILURE) { printf("Failed to init LibVMI library.\n"); return 1; } /* init the offset values */ if (VMI_OS_LINUX == vmi_get_ostype(vmi)) { tasks_offset = vmi_get_offset(vmi, "linux_tasks"); name_offset = vmi_get_offset(vmi, "linux_name"); pid_offset = vmi_get_offset(vmi, "linux_pid"); /* NOTE: * name_offset is no longer hard-coded. Rather, it is now set * via libvmi.conf. */ } else if (VMI_OS_WINDOWS == vmi_get_ostype(vmi)) { tasks_offset = vmi_get_offset(vmi, "win_tasks"); if (0 == tasks_offset) { printf("Failed to find win_tasks\n"); goto error_exit; } name_offset = vmi_get_offset(vmi, "win_pname"); if (0 == name_offset) { printf("Failed to find win_pname\n"); goto error_exit; } pid_offset = vmi_get_offset(vmi, "win_pid"); if (0 == pid_offset) { printf("Failed to find win_pid\n"); goto error_exit; } } /* create a shm-snapshot */ if (vmi_shm_snapshot_create(vmi) != VMI_SUCCESS) { printf("Failed to shm-snapshot VM\n"); goto error_exit; } /* demonstrate name and id accessors */ list_processes(vmi, current_process, list_head, tasks_offset, current_list_entry, next_list_entry, pid_offset, pid, procname, name_offset); error_exit: if (procname) free(procname); /* destroy the shm-snapshot, and return live mode */ vmi_shm_snapshot_destroy(vmi); /* cleanup any memory associated with the LibVMI instance */ vmi_destroy(vmi); return 0; #else printf("Error : this example should only run after ./configure --enable-shm-snapshot.\n"); return 1; // error #endif }
/*根据data,执行vmi函数,并发送返回值*/ int rvmi_handle_data(int fd, char *buf) { int vmiFunNum; int i=0; char delims[] = " "; char *vmiFunArg[5] = {NULL,NULL,NULL,NULL}; char returnBuf[100]; char * returnVal =NULL; vmiFunArg[i] = strtok(buf, delims ); while( vmiFunArg[i] != NULL ) { i++; vmiFunArg[i] = strtok( NULL, delims ); } vmiFunNum = atoi(vmiFunArg[0]); //printf("vmifun %d\n",vmiFunNum); switch(vmiFunNum) { case 1: break; case 2: break; case 3: { int vmiID=atoi(vmiFunArg[1]); sprintf(returnBuf, "%d\0", vmi_destroy(vmiArr[vmiID]) ); vmiFlagArr[vmiID]=0; returnVal = returnBuf; } break; case 13: { sprintf(returnBuf, "%lu\0", vmi_get_offset(vmiArr[atoi(vmiFunArg[1])], vmiFunArg[2]) ); returnVal = returnBuf; } break; case 23: { for(i=0;i<MAX_DOMU_PER_MACHINE;i++) { if(0 == vmiFlagArr[i]) break; } vmi_init(&vmiArr[i], atoi(vmiFunArg[1]), vmiFunArg[2]); vmiFlagArr[i]=1; sprintf(returnBuf,"%d\0",i); returnVal = returnBuf; } break; case 38: { uint16_t tmp; vmi_read_16_va(vmiArr[atoi(vmiFunArg[1])], atol(vmiFunArg[2]), atoi(vmiFunArg[3]), &tmp); sprintf(returnBuf, "%hu\0", tmp); returnVal = returnBuf; } break; case 40: { uint32_t tmp; vmi_read_32_va(vmiArr[atoi(vmiFunArg[1])], atol(vmiFunArg[2]), atoi(vmiFunArg[3]), &tmp); sprintf(returnBuf, "%u\0", tmp); returnVal = returnBuf; } break; case 44: { uint64_t tmp; vmi_read_64_va(vmiArr[atoi(vmiFunArg[1])], atol(vmiFunArg[2]), atoi(vmiFunArg[3]), &tmp); sprintf(returnBuf, "%lu\0", tmp); returnVal = returnBuf; } break; case 50: { addr_t tmp; vmi_read_addr_va(vmiArr[atoi(vmiFunArg[1])], atol(vmiFunArg[2]), atoi(vmiFunArg[3]), &tmp); sprintf(returnBuf, "%lu\0", tmp); returnVal = returnBuf; } break; case 55: { sprintf(returnBuf, "%s\0", vmi_read_str_va(vmiArr[atoi(vmiFunArg[1])], atol(vmiFunArg[2]), atoi(vmiFunArg[3]) )); returnVal = returnBuf; } break; case 67: { sprintf(returnBuf, "%lu\0", vmi_translate_ksym2v(vmiArr[atoi(vmiFunArg[1])], vmiFunArg[2]) ); returnVal = returnBuf; } break; default:break; } write (fd, returnVal, 100); return 1; }
int main (int argc, char **argv) { // local variables vmi_instance_t vmi; int ret_val = 0; // return code for after goto struct sigaction signal_action; // process list vars vmi_pid_t pid = 0; char *procname = NULL; addr_t list_head = 0; addr_t next_list_entry = 0; addr_t current_process = 0; addr_t tmp_next = 0; status_t status; // breakpoint vars char* *sym; uint16_t *off; vmi_pid_t *bpid; addr_t *add; uint8_t *byt; addr_t lib_map_addr = 0; addr_t BN_rand_addr = 0; int bnrand_jump_offset = 0; addr_t bnrand_addr = 0; // this is the VM or file that we are looking at if (argc < 2) { printf("Usage: %s <vmname>\n", argv[0]); return 1; } char *name = argv[1]; //////////////////// // Initialization // //////////////////// // initialize the libvmi library printf("Initializing libvmi for VM \"%s\"\n", name); if (vmi_init(&vmi, VMI_XEN|VMI_INIT_COMPLETE|VMI_INIT_EVENTS, name) == VMI_FAILURE) { printf("Failed to init LibVMI library.\n"); ret_val = 2; goto error_exit; } // verify OS is Linux printf("Verifying the VM is running Linux..."); // TODO: verify that the VM is running a *supported* Linux kernel // if kernel is not one we recognize, don't run because we'll be mucking around in memory we don't understand if (VMI_OS_LINUX != vmi_get_ostype(vmi)) { // this only checks if /etc/libvmi.conf says it's "Linux" printf("\nVM is running %s, exiting...\n", vmi_get_ostype(vmi)); ret_val = 3; goto error_exit; } printf(" Yup. Good to go.\n"); // pause the vm for consistent memory access printf("Pausing the VM\n"); if (vmi_pause_vm(vmi) != VMI_SUCCESS) { printf("Failed to pause VM\n"); ret_val = 4; goto error_exit; // don't return directly, do cleanup first } tasks_offset = vmi_get_offset(vmi, "linux_tasks"); name_offset = vmi_get_offset(vmi, "linux_name"); pid_offset = vmi_get_offset(vmi, "linux_pid"); mm_offset = vmi_get_offset(vmi, "linux_mm"); // hardcoded because config_parser doesn't support dynamic config vars mmap_offset = 0x0; vm_area_file_offset = 0xa0; vm_area_next_offset = 0x10; vm_area_start_offset = 0x0; file_path_offset = 0x10; dentry_offset = 0x8; iname_offset = 0x38; //mmap_offset = vmi_get_offset(vmi, "linux_mmap"); //vm_area_file_offset = vmi_get_offset(vmi, "linux_vm_file"); //vm_area_next_offset = vmi_get_offset(vmi, "linux_vm_next"); //vm_area_start_offset = vmi_get_offset(vmi, "linux_vm_start"); //file_path_offset = vmi_get_offset(vmi, "linux_f_path"); //dentry_offset = vmi_get_offset(vmi, "linux_dentry"); //iname_offset = vmi_get_offset(vmi, "linux_d_iname"); if (0 == tasks_offset) { printf("Failed to find tasks_offset\n"); goto error_exit; } if (0 == pid_offset) { printf("Failed to find pid_offset\n"); goto error_exit; } if (0 == name_offset) { printf("Failed to find name_offset\n"); goto error_exit; } if (0 == mm_offset) { printf("Failed to find mm_offset\n"); goto error_exit; } //if (0 == mmap_offset) { // printf("Failed to find mmap_offset\n"); // goto error_exit; //} //if (0 == vm_area_file_offset) { // printf("Failed to find vm_area_file_offset\n"); // goto error_exit; //} //if (0 == vm_area_next_offset) { // printf("Failed to find vm_area_next_offset\n"); // goto error_exit; //} //if (0 == vm_area_start_offset) { // printf("Failed to find vm_area_start_offset\n"); // goto error_exit; //} //if (0 == file_path_offset) { // printf("Failed to find file_path_offset\n"); // goto error_exit; //} //if (0 == dentry_offset) { // printf("Failed to find dentry_offset\n"); // goto error_exit; //} //if (0 == iname_offset) { // printf("Failed to find iname_offset\n"); // goto error_exit; //} // Set up breakpoints breakpoints = (breakpoint_t*)calloc(MAX_BREAKPOINTS, sizeof(breakpoint_t)); // allocate space for each breakpoint, zero memory //add_breakpoint("extract_entropy_user", 155, 0, 0xe8, before_extract_buf); //add_breakpoint("extract_entropy_user", 160, 0, 0x83, after_extract_buf); // new breakpoints created below ////////////////////////// // Find apache2 process // ////////////////////////// // find pid of apache2 processes // for each process, read symbol table and find BN_rand function // at offset +13 bytes from BN_rand, we find an offset from the instruction at BN_rand+17 (probably around -700 bytes) // +570 bytes from the offset above, we find the instruction at which we want a breakpoint // so, breakpoint at BN_rand+17+[BN_rand+13]+570 // then, at callback, read r13 for address of buffer, overwrite with TODO bytes // find pid of apache2 processes list_head = vmi_translate_ksym2v(vmi, "init_task") + tasks_offset; // find init_task struct and move to first linked list entry next_list_entry = list_head; // iterator do { current_process = next_list_entry - tasks_offset; // subtract tasks_offset back off to get to head of struct vmi_read_32_va(vmi, current_process + pid_offset, 0, (uint32_t*)&pid); // get pid of this process procname = vmi_read_str_va(vmi, current_process + name_offset, 0); // get process name of this process if (strncmp(procname,"apache2",sizeof("apache2")) == 0) { printf("Finding library address in %s [pid %d]\n",procname,pid); lib_map_addr = walk_vmmap_for_lib(vmi, current_process, "libcrypto.so.1.0.2"); if (lib_map_addr == 0) { // if failed to find lib printf("Failed to find library in %s\n",procname); ret_val = 9; goto error_exit; } printf("Found library address: 0x%llx\n", lib_map_addr); // for each process, read symbol table and find BN_rand function BN_rand_addr = lib_map_addr + 0xd5a50; // static offset for BN_rand function // at offset +13 bytes from BN_rand, we find an offset from the instruction at BN_rand+17 (probably around -700 bytes) vmi_read_32_va(vmi, BN_rand_addr+13, pid, &bnrand_jump_offset); // get jump offset to bnrand function //printf("jump offset: %d\n",bnrand_jump_offset); bnrand_addr = BN_rand_addr+17+bnrand_jump_offset; // get address of bnrand function //printf("bnrand: 0x%llx\n", bnrand_addr); // +570 bytes from the offset above, we find the instruction at which we want a breakpoint add_breakpoint_addr(bnrand_addr + 570, pid, 0x31, bnrand_callback); //printf("Added breakpoint at 0x%llx\n",bnrand_addr+570); } status = vmi_read_addr_va(vmi, next_list_entry, 0, &next_list_entry); // follow linked-list->next to next element if (status == VMI_FAILURE) { printf("Failed to read next pointer in loop at %"PRIx64"\n", next_list_entry); goto error_exit; } } while(next_list_entry != list_head); for (int i = 0; i < num_breakpoints; i++) { // iterate over breakpoints and find the right addresses for them //////////////////////////////////////////// // Find memory location to put breakpoint // //////////////////////////////////////////// // assign short names (note: modifying these modifies the breakpoint struct) sym = &breakpoints[i].symbol; off = &breakpoints[i].offset; bpid = &breakpoints[i].pid; add = &breakpoints[i].addr; byt = &breakpoints[i].inst_byte; // remember that if this is not set above, it should be zeroed from calloc if (breakpoints[i].addr == 0) { // if don't have address, find symbol // find address to break on printf("Accessing System Map for %s symbol\n", *sym); *add = vmi_translate_ksym2v(vmi, *sym) + *off; printf("%s + %u is at 0x%llx\n", *sym, *off, *add); } // either verify the byte there is correct, or record which byte is there for later replacing if (*byt == 0) { // if this byte was not set, we need to get it vmi_read_8_va(vmi, *add, *bpid, byt); // read it directly into byt printf("[pid %d] Saving byte at address 0x%llx: %x\n", *bpid, *add, *byt); } else { // if the byte was set, verify that it's currently set to that value uint8_t temp_byte = 0; vmi_read_8_va(vmi, *add, *bpid, &temp_byte); // read it temporarily printf("[pid %d] Checking byte at address 0x%llx is set to %x: %x\n", *bpid, *add, *byt, temp_byte); if (*byt != temp_byte) { // uh oh, we have an error ret_val = 8; goto error_exit; } } } // end first for loop after breakpoints are constructed properly /////////////////// // Main gameplan // // // // https://groups.google.com/forum/#!topic/vmitools/jNGxM0LBEDM // Based on the google groups discussion above (which I wish I found earlier, meh), it looks like the way people trap on instructions is to: // 1) actually *modify* the memory to have the 0xcc (interrupt 3, aka breakpoint) instruction in place of the instruction it would have executed // 2) register an event on receiving the INT3 signal and receive the callback // 3) at the end of the callback, fix the memory to its original instruction, // 4) single-step one instruction forward, executing the one instruction, then getting another callback // 5) replace the previous instruction with to 0xcc, "resetting" the breakpoint, then clearing the event and continuing // // /////////////////// for (int i = 0; i < num_breakpoints; i++) { // iterate over breakpoints and insert them all // assign short names (note: modifying these modifies the breakpoint struct) add = &breakpoints[i].addr; bpid = &breakpoints[i].pid; byt = &breakpoints[i].inst_byte; // Step 1: modify memory in the VM with an INT3 instruction (0xcc) printf("[pid %d] Setting breakpoint at address 0x%llx.\n", *bpid, *add); uint8_t int3 = INT3_INST; // create temporary variable because we can't use an address to a static #defined int if (VMI_SUCCESS != vmi_write_8_va(vmi, *add, *bpid, &int3)) { printf("[pid %d] Couldn't write INT3 instruction to memory... exiting.\n", *bpid); ret_val = 5; goto error_exit; } // debug: check memory is now an INT3 instruction uint8_t temp_byte = 0; vmi_read_8_va(vmi, *add, 0, &temp_byte); printf("[pid %d] This should be an INT3 instruction (0xcc): 0x%x\n", *bpid, temp_byte); } // end second for loop after breakpoints are all inserted and callback is registered // Step 2: register an event on receiving INT3 signal printf("Creating event for callback when breakpoint is reached.\n"); memset(&rng_event, 0, sizeof(vmi_event_t)); // clear rng_event so we can set everything fresh rng_event.type = VMI_EVENT_INTERRUPT; // interrupt event -- trigger when interrupt occurs rng_event.interrupt_event.intr = INT3; // trigger on INT3 instruction rng_event.interrupt_event.reinject = 0; // swallow interrupt silently without passing it on to guest rng_event.callback = rng_int3_event_callback; // reference to our callback function printf("Registering event...\n"); if (VMI_SUCCESS == vmi_register_event(vmi, &rng_event)) {; // register the event! printf("Event Registered!\n"); } else { // uh oh, event failed printf("Problem registering event... exiting.\n"); ret_val = 6; goto error_exit; // don't return directly, do cleanup first } // resume the VM printf("Resuming the VM\n"); vmi_resume_vm(vmi); ////////////////////////////////////// // Spin and wait for event callback // ////////////////////////////////////// // for a clean exit, catch signals (from host, not VM), set "interrupted" to non-zero, exit while loop at end of main() signal_action.sa_handler = close_handler; signal_action.sa_flags = 0; sigemptyset(&signal_action.sa_mask); sigaction(SIGHUP, &signal_action, NULL); sigaction(SIGTERM, &signal_action, NULL); sigaction(SIGINT, &signal_action, NULL); sigaction(SIGALRM, &signal_action, NULL); while(!interrupted) { // until an interrupt happens printf("Waiting for events...\n"); if (VMI_SUCCESS != vmi_events_listen(vmi, 500)) { // listen for events for 500ms (no event = VMI_SUCCESS) printf("Error waiting for events... exiting.\n"); interrupted = -1; } } printf("Finished with test.\n"); ////////////////// // Exit cleanly // ////////////////// error_exit: // attempt to remove breakpoints for (int i = 0; i < num_breakpoints; i++) { // iterate over breakpoints and insert them all // assign short names (note: modifying these modifies the breakpoint struct) add = &breakpoints[i].addr; bpid = &breakpoints[i].pid; byt = &breakpoints[i].inst_byte; printf("[pid %d] Removing breakpoint %d at 0x%llx.\n", *bpid, i, *add); if (VMI_SUCCESS != vmi_write_8_va(vmi, *add, *bpid, byt)) { printf("Couldn't write to memory... exiting.\n"); ret_val = 7; } } // resume the vm printf("Resuming the VM\n"); vmi_resume_vm(vmi); // cleanup any memory associated with the LibVMI instance printf("Cleaning up\n"); vmi_destroy(vmi); return ret_val; }
int main (int argc, char **argv) { vmi_instance_t vmi; unsigned char *memory = NULL; uint32_t offset; addr_t next_process, list_head; char *procname = NULL; int pid = 0; int tasks_offset, pid_offset, name_offset; status_t status; /* this is the VM or file that we are looking at */ if (argc != 2) { printf ("Usage: %s <vmname>\n", argv[0]); return 1; } // if char *name = argv[1]; /* initialize the libvmi library */ if (vmi_init(&vmi, VMI_AUTO | VMI_INIT_COMPLETE, name) == VMI_FAILURE){ printf("Failed to init LibVMI library.\n"); goto error_exit; } /* init the offset values */ if (VMI_OS_LINUX == vmi_get_ostype(vmi)){ tasks_offset = vmi_get_offset(vmi, "linux_tasks"); name_offset = vmi_get_offset(vmi, "linux_name"); pid_offset = vmi_get_offset(vmi, "linux_pid"); /* NOTE: * name_offset is no longer hard-coded. Rather, it is now set * via libvmi.conf. */ } else if (VMI_OS_WINDOWS == vmi_get_ostype(vmi)){ tasks_offset = vmi_get_offset(vmi, "win_tasks"); if (0 == tasks_offset) { printf("Failed to find win_tasks\n"); goto error_exit; } name_offset = vmi_get_offset(vmi, "win_pname"); if (0 == tasks_offset) { printf("Failed to find win_pname\n"); goto error_exit; } pid_offset = vmi_get_offset(vmi, "win_pid"); if (0 == tasks_offset) { printf("Failed to find win_pid\n"); goto error_exit; } } /* pause the vm for consistent memory access */ if (vmi_pause_vm(vmi) != VMI_SUCCESS) { printf("Failed to pause VM\n"); goto error_exit; } // if /* demonstrate name and id accessors */ char *name2 = vmi_get_name(vmi); if (VMI_FILE != vmi_get_access_mode(vmi)){ unsigned long id = vmi_get_vmid(vmi); printf("Process listing for VM %s (id=%lu)\n", name2, id); } else{ printf("Process listing for file %s\n", name2); } free(name2); /* get the head of the list */ if (VMI_OS_LINUX == vmi_get_ostype(vmi)){ addr_t init_task_va = vmi_translate_ksym2v(vmi, "init_task"); vmi_read_addr_va(vmi, init_task_va + tasks_offset, 0, &next_process); } else if (VMI_OS_WINDOWS == vmi_get_ostype(vmi)){ uint32_t pdbase = 0; // find PEPROCESS PsInitialSystemProcess vmi_read_addr_ksym(vmi, "PsInitialSystemProcess", &list_head); vmi_read_addr_va(vmi, list_head + tasks_offset, 0, &next_process); vmi_read_32_va(vmi, list_head + pid_offset, 0, &pid); vmi_read_32_va(vmi, list_head + pid_offset, 0, &pid); procname = vmi_read_str_va(vmi, list_head + name_offset, 0); if (!procname) { printf ("Failed to find first procname\n"); goto error_exit; } printf("[%5d] %s\n", pid, procname); if (procname){ free(procname); procname = NULL; } } list_head = next_process; /* walk the task list */ while (1){ /* follow the next pointer */ addr_t tmp_next = 0; vmi_read_addr_va(vmi, next_process, 0, &tmp_next); /* if we are back at the list head, we are done */ if (list_head == tmp_next){ break; } /* print out the process name */ /* Note: the task_struct that we are looking at has a lot of information. However, the process name and id are burried nice and deep. Instead of doing something sane like mapping this data to a task_struct, I'm just jumping to the location with the info that I want. This helps to make the example code cleaner, if not more fragile. In a real app, you'd want to do this a little more robust :-) See include/linux/sched.h for mode details */ procname = vmi_read_str_va(vmi, next_process + name_offset - tasks_offset, 0); if (!procname) { printf ("Failed to find procname\n"); } // if vmi_read_32_va(vmi, next_process + pid_offset - tasks_offset, 0, &pid); /* trivial sanity check on data */ if (pid >= 0 && procname){ printf("cr3: %lx [%5d] %s\n", vmi_pid_to_dtb(vmi, pid), pid, procname); } if (procname){ free(procname); procname = NULL; } next_process = tmp_next; } error_exit: if (procname) free(procname); /* resume the vm */ vmi_resume_vm(vmi); /* cleanup any memory associated with the LibVMI instance */ vmi_destroy(vmi); return 0; }