aboutsummaryrefslogtreecommitdiff
path: root/common
diff options
context:
space:
mode:
authorn0p <0x90@n0p.cc>2018-02-12 18:15:36 +0100
committern0p <0x90@n0p.cc>2018-02-12 18:15:36 +0100
commit9e9c6d4bcfabadc1ad139ad5a81083485c2212d7 (patch)
tree492a41b8ced99e5f8bb62148267e2a23615cfe4c /common
parenta608d88b12dc300584be4e36e6eb85f26e2c42b5 (diff)
downloadlibc-database-9e9c6d4bcfabadc1ad139ad5a81083485c2212d7.tar.gz
libc-database-9e9c6d4bcfabadc1ad139ad5a81083485c2212d7.zip
Added support for Debian and ARM (armel, armhf, arm64).HEADmaster
Removed the unused tmp/ directory. Output format of dump/find/identify has changed. The folder structure of the database has changed.
Diffstat (limited to 'common')
-rw-r--r--common/libc.sh102
1 files changed, 73 insertions, 29 deletions
diff --git a/common/libc.sh b/common/libc.sh
index 7e2a760..2135b98 100644
--- a/common/libc.sh
+++ b/common/libc.sh
@@ -16,20 +16,35 @@ extract_label() {
}
dump_libc_start_main_ret() {
- local call_main=`objdump -D $1 \
- | egrep -A 100 '<__libc_start_main.*>' \
- | grep call \
- | egrep -B 1 '<exit.*>' \
- | head -n 1 \
- | extract_label`
- local offset=`objdump -D $1 | egrep -A 1 "(^| )$call_main:" | tail -n 1 | extract_label`
+ if [ `echo "$2" | egrep "i386|amd64" - ` ] \
+ && [ -x "$(command -v objdump)" ]; then
+ local call_main=`objdump -D $1 \
+ | egrep -A 100 '<__libc_start_main.*>' \
+ | grep call \
+ | egrep -B 1 '<exit.*>' \
+ | head -n 1 \
+ | extract_label`
+ local offset=`objdump -D $1 | egrep -A 1 "(^| )$call_main:" | tail -n 1 | extract_label`
+ elif [ `echo "$2" | egrep "armel|armhf|arm64" - ` ] \
+ && [ -x "$(command -v aarch64-linux-gnu-objdump)" ]; then
+ local call_main=`aarch64-linux-gnu-objdump -D $1 \
+ | egrep -A 100 '<__libc_start_main.*>' \
+ | grep -Pe "(bl\t|blr\t|blx\t|bx\t)" \
+ | egrep -B 1 '<exit.*>' \
+ | head -n 1 \
+ | extract_label`
+ local offset=`aarch64-linux-gnu-objdump -D $1 \
+ | egrep -A 1 "(^| )$call_main:" \
+ | tail -n 1 \
+ | extract_label`
+ fi
if [[ "$offset" != "" ]]; then
echo "__libc_start_main_ret $offset"
fi
}
dump_bin_sh() {
- local offset=`strings -a -t x $1 | grep '/bin/sh' | extract_label`
+ local offset=`strings -a -t x $1 | grep '/bin/sh' | head -n 1 | extract_label`
if [[ "$offset" != "" ]]; then
echo "str_bin_sh $offset"
fi
@@ -39,35 +54,48 @@ process_libc() {
local libc=$1
local id=$2
local info=$3
- echo " -> Writing libc to db/${id}.so"
- cp $libc db/${id}.so
- echo " -> Writing symbols to db/${id}.symbols"
- (dump_symbols $libc; dump_libc_start_main_ret $libc; dump_bin_sh $libc) \
- > db/${id}.symbols
- echo " -> Writing version info"
- echo "$info" > db/${id}.info
+ local sha256=$4
+ [[ -d db/$info ]] || mkdir db/$info
+ echo " -> Writing libc to db/${info}/${id}.so"
+ cp $libc db/${info}/${id}.so
+ echo " -> Writing symbols to db/${info}/${id}.symbols"
+ (dump_symbols $libc; dump_libc_start_main_ret $libc $id; dump_bin_sh $libc) \
+ > db/${info}/${id}.symbols
+ echo " -> Writing SHA-256 to db/${info}/${id}.sha256"
+ echo "$sha256" > db/${info}/${id}.sha256
}
check_id() {
local id=$1
- if [[ -e db/${id}.info ]]; then
- echo " -> Already have this version, 'rm db/${id}.*' to force"
+ local info=$2
+ if [[ -e db/${info}/${id}.sha256 ]]; then
+ echo " -> Already have this version, 'rm db/${info}/${id}.*' to force"
+ return 1
+ fi
+ return 0
+}
+
+check_sha256() {
+ local sha256=$1
+ local libc=`grep -r $sha256 db/ 2>/dev/null | cut -d ':' -f 1 - 2>/dev/null | sed 's/\.sha256/\.so/gI'`
+ if [[ "$libc" != "" ]]; then
+ echo " -> Found SHA-256 match: $libc"
return 1
fi
return 0
}
-# ===== Ubuntu ===== #
+# ===== Debian and Ubuntu ===== #
-get_ubuntu() {
+get_deb() {
local url="$1"
local info="$2"
local tmp=`mktemp -d || mktemp -d -t "libc-database" || die "Cannot get temp dir"`
echo "Getting $info"
echo " -> Location: $url"
- local id=`echo $url | perl -n -e '/(libc6[^\/]*)\./ && print $1'`
+ local id=`echo $url | perl -n -e '/(libc6[^\/]*)\./ && print $1' | sed 's/\%2b/+/gI'`
echo " -> ID: $id"
- check_id $id || return
+ check_id $id $info || return
echo " -> Downloading package"
wget $url 2>/dev/null -O $tmp/pkg.deb || die "Failed to download package from $url"
echo " -> Extracting package"
@@ -76,7 +104,13 @@ get_ubuntu() {
tar xf data.tar.* || die "tar failed"
popd 1>/dev/null
local libc=`find $tmp -name libc.so.6 || die "Cannot locate libc.so.6"`
- process_libc $libc $id $info
+ if [[ ! -e $libc ]]; then
+ echo " -> The package does not seem to contain a valid libc (e.g. just contains a broken symbolic link)"
+ return
+ fi
+ local sha256=`sha256sum $libc`
+ check_sha256 $sha256 || return
+ process_libc $libc $id $info $sha256
rm -rf $tmp
}
@@ -88,14 +122,22 @@ get_current_ubuntu() {
echo "Getting package location for ubuntu-$version-$arch"
local url=`(wget http://packages.ubuntu.com/$version/$arch/$pkg/download -O - 2>/dev/null \
| grep -oh 'http://[^"]*libc6[^"]*.deb') || die "Failed to get package version"`
- get_ubuntu $url $info
+ get_deb $url $info
+}
+
+get_all_debian() {
+ local info=debian-$1
+ local url=$2
+ for f in `wget $url/ -O - 2>/dev/null | egrep -oh 'libc6(-i386|-i686|-amd64|-armel|-armhf|-arm64)?(-cross)?_[^"]*(i386|amd64|armel|armhf|arm64|all)\.deb' | grep -v "</a>"`; do
+ get_deb $url/$f $info
+ done
}
get_all_ubuntu() {
- local info=$1
+ local info=ubuntu-$1
local url=$2
- for f in `wget $url/ -O - 2>/dev/null | egrep -oh 'libc6(-i386|-amd64)?_[^"]*' |grep -v "</a>"`; do
- get_ubuntu $url/$f $1
+ for f in `wget $url/ -O - 2>/dev/null | egrep -oh 'libc6(-i386|-i686|-amd64|-armel|-armel-armhf|-armhf|-arm64)?(-cross)?_[^"]*(i386|amd64|armel|armhf|arm64|all)\.deb' | grep -v "</a>"`; do
+ get_deb $url/$f $info
done
}
@@ -105,8 +147,10 @@ add_local() {
local libc=$1
[[ -e $libc ]] || return
local info="local"
- local id="local-`sha1sum $libc`"
+ local id="local-`sha256sum $libc`"
echo "Adding local libc $libc (id $id)"
- check_id $id || return
- process_libc $libc $id $info
+ check_id $id $info || return
+ local sha256=`sha256sum $libc`
+ check_sha256 $sha256 || return
+ process_libc $libc $id $info $sha256
}