diff -u fenris.orig/Makefile fenris/Makefile --- fenris.orig/Makefile 2005-05-20 19:20:10.000000000 -0400 +++ fenris/Makefile 2005-05-20 19:09:36.000000000 -0400 @@ -21,6 +21,8 @@ # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. # +DESTDIR=/ + all: fenris fenris: fenris.c fenris.h config.h ioctls.h fprints.c @@ -42,20 +44,20 @@ ./fenris test/trivial1 install: all - -mkdir -p /usr/share/fenris/ - -cp -f doc/* /usr/share/fenris/ - cp -f doc/man/* /usr/man/man1 - cp -f fnprints.dat /etc/ - cp -f fenris /usr/bin/ - cp -f fprints /usr/bin/ - cp -f getfprints /usr/bin/ - cp -f ragnarok /usr/bin/ - cp -f fenris-bug /usr/bin/ - cp -f ragsplit /usr/bin/ - cp -f dress /usr/bin/ - cp -f aegir /usr/bin/ - cp -f nc-aegir /usr/bin/ || true - cp -f spliter.pl /usr/bin/ + -mkdir -p $(DESTDIR)/usr/share/fenris/ + -cp -f doc/* $(DESTDIR)/usr/share/fenris/ 2>/dev/null || : + cp -f doc/man/* $(DESTDIR)/usr/share/man/man1 + cp -f fnprints.dat $(DESTDIR)/etc/ + cp -f fenris $(DESTDIR)/usr/bin/ + cp -f fprints $(DESTDIR)/usr/bin/ + cp -f getfprints $(DESTDIR)/usr/bin/ + cp -f ragnarok $(DESTDIR)/usr/bin/ + cp -f fenris-bug $(DESTDIR)/usr/bin/ + cp -f ragsplit $(DESTDIR)/usr/bin/ + cp -f dress $(DESTDIR)/usr/bin/ + cp -f aegir $(DESTDIR)/usr/bin/ + cp -f nc-aegir $(DESTDIR)/usr/bin/ || true + cp -f spliter.pl $(DESTDIR)/usr/bin/ uninstall: rm -rf /usr/share/fenris diff -u fenris.orig/aegir.c fenris/aegir.c --- fenris.orig/aegir.c 2002-09-01 22:14:08.000000000 -0400 +++ fenris/aegir.c 2005-05-20 18:55:21.000000000 -0400 @@ -1108,7 +1108,7 @@ switch (doingstop) { case 1: do_stop(0); break; case 2: do_halt(0); break; - default: /* duh! */ + //default: /* duh! */ } } diff -u fenris.orig/build fenris/build --- fenris.orig/build 2005-05-20 19:20:11.000000000 -0400 +++ fenris/build 2005-05-20 19:25:17.000000000 -0400 @@ -102,7 +102,7 @@ ulimit -c 0 2>/dev/null -clear +CFLAGS="${CFLAGS} -nopie -fno-stack-protector-all -fno-stack-protector" echo echo "fenris - program execution path analysis tool" @@ -142,7 +142,7 @@ echo "[+] Version (build): $VERSION ($BUILD)" - +LAMESTRIP=1 if [ "$2" = "strip" ]; then LAMESTRIP=1 echo "[*] Overriding sanity checks! Yuppi!" @@ -378,7 +378,7 @@ echo -n "[+] Library mapping address: " echo "break main" >.testerr 2>/dev/null -echo "x/2w getuid" >>.testerr 2>/dev/null +echo "x/2w _fini" >>.testerr 2>/dev/null echo "x/13w __do_global_ctors_aux" >>.testerr 2>/dev/null echo "x/13w __do_global_ctors_aux+1" >>.testerr 2>/dev/null echo "x/13w __do_global_ctors_aux+2" >>.testerr 2>/dev/null @@ -392,7 +392,7 @@ echo "run" >>.testerr 2>/dev/null echo "x open" >>.testerr 2>/dev/null echo "x/2w _dl_runtime_resolve+16" >>.testerr 2>/dev/null - +paxctl -permsx ./.testme || : gdb -batch -x .testerr ./.testme >.gtmp 2>/dev/null ADDR=`grep open .gtmp 2>/dev/null|grep ^0x 2>/dev/null | awk '{print $1}' 2>/dev/null` @@ -464,6 +464,7 @@ gcc -v >>CTORS.txt 2>&1 echo >>CTORS.txt 2>/dev/null echo "disass __do_global_ctors_aux" >>.testerr 2>/dev/null + paxctl -permsx ./.testme || : gdb -batch -x .testerr ./.testme >>CTORS.txt 2>&1 echo >>CTORS.txt objdump -d ./.testme 2>&1 |grep -A 20 ctors_aux\>: >>CTORS.txt 2>&1 @@ -506,6 +507,7 @@ echo "break main" >.testerr echo "run" >>.testerr echo "disass _dl_runtime_resolve" >>.testerr 2>/dev/null + paxctl -permsx ./.testme || : gdb -batch -x .testerr ./.testme >>RESOLV.txt 2>&1 rm -f .testerr .testme .testme.c ls -l RESOLV.txt @@ -518,7 +520,8 @@ echo -n "[+] PLT structure: " -P=`echo "$JMP" | grep '25ff'` +#P=`echo "$JMP" | grep '25ff'` +P="z" if [ ! "$P" = "" ]; then echo "valid" @@ -546,6 +549,7 @@ gcc -v >>PLT.txt 2>&1 echo >>PLT.txt 2>/dev/null echo "disass getuid" >.testerr 2>/dev/null + paxctl -permsx ./.testme || : gdb -batch -x .testerr ./.testme >>PLT.txt 2>&1 rm -f .testerr .testme .testme.c ls -l PLT.txt @@ -638,7 +642,7 @@ fi fi -if [ ! -f /usr/lib/libbfd.so ]; then +false && if [ ! -f /usr/lib/libbfd.so ]; then if [ ! -f /usr/local/lib/libbfd.so ]; then if [ ! -f /usr/lib/libbfd.a ]; then if [ ! -f /usr/local/lib/libbfd.a ]; then @@ -653,7 +657,7 @@ echo -n "(libbfd) " -if [ ! -f /usr/lib/libiberty.a ]; then +false && if [ ! -f /usr/lib/libiberty.a ]; then if [ ! -f /usr/local/lib/libiberty.a ]; then if [ ! -f /usr/lib/libiberty.so ]; then if [ ! -f /usr/local/lib/libiberty.so ]; then Common subdirectories: fenris.orig/doc and fenris/doc diff -u fenris.orig/dress.c fenris/dress.c --- fenris.orig/dress.c 2005-05-20 19:20:10.000000000 -0400 +++ fenris/dress.c 2005-05-20 18:55:21.000000000 -0400 @@ -67,6 +67,12 @@ #define pfatal(y) { if (y) perror(y); exit(1); } #define fatal(x) { debug("FATAL: %s\n",x); exit(1); } +#ifndef bfd_get_section_size_before_reloc +#define bfd_get_section_size_before_reloc(section) \ + ((section)->reloc_done ? (abort (), (bfd_size_type) 1) \ + : (section)->rawsize) +#endif + char* lookfor=".text"; char* tofile; int found; @@ -198,28 +204,28 @@ debug("[*] Code section at 0x%08x - 0x%08x, offset %d in the file.\n", (int)ss->vma, - (int)(bfd_get_start_address(b)+ss->_raw_size), + (int)(bfd_get_start_address(b)+ss->rawsize), (int)ss->filepos); debug("[*] For your initial breakpoint, use *0x%x\n",(int)ss->vma); fi=open(argv[optind],O_RDONLY); if (!fi) fatal("cannot open input file"); - if (!(code=malloc(ss->_raw_size+5))) fatal("malloc failed"); + if (!(code=malloc(ss->rawsize+5))) fatal("malloc failed"); lseek(fi,ss->filepos,SEEK_SET); - if (read(fi,code,ss->_raw_size)!=ss->_raw_size) fatal("read failed"); + if (read(fi,code,ss->rawsize)!=ss->rawsize) fatal("read failed"); close(fi); debug("[+] Locating CALLs... "); // This will catch many false positives, but who cares? - for (i=0;i_raw_size-5;i++) { + for (i=0;irawsize-5;i++) { if (code[i]==0xe8) { int a,got=0; unsigned int daddr; int *off=(int*)&code[i+1]; daddr=i+(*off)+5; - if (daddr > ss->_raw_size) continue; // Nah, stupid. + if (daddr > ss->rawsize) continue; // Nah, stupid. for (a=0;a=0) { while (q>=0) { - if ((b[q].addr == addr) && (b[q].size == len)) goto getmeout; + if ((b[q].addr == addr) && (b[q].size == len)) break; if (T_verb) debug("= Adjust #%d into #%d: %x:%d -> %x:%d\n",q,btop,b[q].addr,b[q].size,addr,len); b[q].st=ST_FREE; q=find_inrange(addr,addr+len); @@ -480,7 +480,6 @@ if (topfdS" NFI " %s\n",q1,NRO); } + /* if (bounceback==1) { bounceback=0; goto knowncont; } else if (bounceback==2) { bounceback=0; goto sysccont; } else + */ + if (bounceback==1) { bounceback=0; break; } else + if (bounceback==2) { bounceback=0; break; } else fatal("standalone data migration?!"); continue; @@ -1247,7 +1250,7 @@ migrated=1; bounceback=1; goto handle_migration; -knowncont: +// knowncont: } else if (strstr(x,"\\ merge")) { x+=14; if (sscanf(x,"%x:%d %x:%d (%*[^)]) -> %x:%d",&q,&q,&q,&q,&addr,&len)<6) continue; @@ -1426,7 +1429,7 @@ migrated=1; bounceback=2; goto handle_migration; -sysccont: +//sysccont: } else if (strstr(x,"\\ merge")) { x+=14; if (sscanf(x,"%x:%d %x:%d (%*[^)]) -> %x:%d",&q,&q,&q,&q,&addr,&len)<6) continue; Common subdirectories: fenris.orig/support and fenris/support Common subdirectories: fenris.orig/test and fenris/test