From 9e9c6d4bcfabadc1ad139ad5a81083485c2212d7 Mon Sep 17 00:00:00 2001
From: n0p <0x90@n0p.cc>
Date: Mon, 12 Feb 2018 18:15:36 +0100
Subject: Added support for Debian and ARM (armel, armhf, arm64). Removed the
 unused tmp/ directory. Output format of dump/find/identify has changed. The
 folder structure of the database has changed.

---
 common/libc.sh | 102 +++++++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 73 insertions(+), 29 deletions(-)

(limited to 'common/libc.sh')

diff --git a/common/libc.sh b/common/libc.sh
index 7e2a760..2135b98 100644
--- a/common/libc.sh
+++ b/common/libc.sh
@@ -16,20 +16,35 @@ extract_label() {
 }
 
 dump_libc_start_main_ret() {
-  local call_main=`objdump -D $1 \
-    | egrep -A 100 '<__libc_start_main.*>' \
-    | grep call \
-    | egrep -B 1 '<exit.*>' \
-    | head -n 1 \
-    | extract_label`
-  local offset=`objdump -D $1 | egrep -A 1 "(^| )$call_main:" | tail -n 1 | extract_label`
+  if [ `echo "$2" | egrep "i386|amd64" - ` ] \
+    && [ -x "$(command -v objdump)" ]; then
+    local call_main=`objdump -D $1 \
+      | egrep -A 100 '<__libc_start_main.*>' \
+      | grep call \
+      | egrep -B 1 '<exit.*>' \
+      | head -n 1 \
+      | extract_label`
+    local offset=`objdump -D $1 | egrep -A 1 "(^| )$call_main:" | tail -n 1 | extract_label`
+  elif [ `echo "$2" | egrep "armel|armhf|arm64" - ` ] \
+    && [ -x "$(command -v aarch64-linux-gnu-objdump)" ]; then
+    local call_main=`aarch64-linux-gnu-objdump -D $1 \
+      | egrep -A 100 '<__libc_start_main.*>' \
+      | grep -Pe "(bl\t|blr\t|blx\t|bx\t)" \
+      | egrep -B 1 '<exit.*>' \
+      | head -n 1 \
+      | extract_label`
+    local offset=`aarch64-linux-gnu-objdump -D $1 \
+      | egrep -A 1 "(^| )$call_main:" \
+      | tail -n 1 \
+      | extract_label`
+  fi
   if [[ "$offset" != "" ]]; then
     echo "__libc_start_main_ret $offset"
   fi
 }
 
 dump_bin_sh() {
-  local offset=`strings -a -t x $1 | grep '/bin/sh' | extract_label`
+  local offset=`strings -a -t x $1 | grep '/bin/sh' | head -n 1 | extract_label`
   if [[ "$offset" != "" ]]; then
     echo "str_bin_sh $offset"
   fi
@@ -39,35 +54,48 @@ process_libc() {
   local libc=$1
   local id=$2
   local info=$3
-  echo "  -> Writing libc to db/${id}.so"
-  cp $libc db/${id}.so
-  echo "  -> Writing symbols to db/${id}.symbols"
-  (dump_symbols $libc; dump_libc_start_main_ret $libc; dump_bin_sh $libc) \
-     > db/${id}.symbols
-  echo "  -> Writing version info"
-  echo "$info" > db/${id}.info
+  local sha256=$4
+  [[ -d db/$info ]] || mkdir db/$info
+  echo "  -> Writing libc to db/${info}/${id}.so"
+  cp $libc db/${info}/${id}.so
+  echo "  -> Writing symbols to db/${info}/${id}.symbols"
+  (dump_symbols $libc; dump_libc_start_main_ret $libc $id; dump_bin_sh $libc) \
+     > db/${info}/${id}.symbols
+  echo "  -> Writing SHA-256 to db/${info}/${id}.sha256"
+  echo "$sha256" > db/${info}/${id}.sha256
 }
 
 check_id() {
   local id=$1
-  if [[ -e db/${id}.info ]]; then
-    echo "  -> Already have this version, 'rm db/${id}.*' to force"
+  local info=$2
+  if [[ -e db/${info}/${id}.sha256 ]]; then
+    echo "  -> Already have this version, 'rm db/${info}/${id}.*' to force"
+    return 1
+  fi
+  return 0
+}
+
+check_sha256() {
+  local sha256=$1
+  local libc=`grep -r $sha256 db/ 2>/dev/null | cut -d ':' -f 1 - 2>/dev/null | sed 's/\.sha256/\.so/gI'`
+  if [[ "$libc" != "" ]]; then
+    echo "  -> Found SHA-256 match: $libc"
     return 1
   fi
   return 0
 }
 
-# ===== Ubuntu ===== #
+# ===== Debian and Ubuntu ===== #
 
-get_ubuntu() {
+get_deb() {
   local url="$1"
   local info="$2"
   local tmp=`mktemp -d || mktemp -d -t "libc-database" || die "Cannot get temp dir"`
   echo "Getting $info"
   echo "  -> Location: $url"
-  local id=`echo $url | perl -n -e '/(libc6[^\/]*)\./ && print $1'`
+  local id=`echo $url | perl -n -e '/(libc6[^\/]*)\./ && print $1' | sed 's/\%2b/+/gI'`
   echo "  -> ID: $id"
-  check_id $id || return
+  check_id $id $info || return
   echo "  -> Downloading package"
   wget $url 2>/dev/null -O $tmp/pkg.deb || die "Failed to download package from $url"
   echo "  -> Extracting package"
@@ -76,7 +104,13 @@ get_ubuntu() {
   tar xf data.tar.* || die "tar failed"
   popd 1>/dev/null
   local libc=`find $tmp -name libc.so.6 || die "Cannot locate libc.so.6"`
-  process_libc $libc $id $info
+  if [[ ! -e $libc ]]; then 
+    echo "  -> The package does not seem to contain a valid libc (e.g. just contains a broken symbolic link)"
+    return
+  fi
+  local sha256=`sha256sum $libc`
+  check_sha256 $sha256 || return
+  process_libc $libc $id $info $sha256
   rm -rf $tmp
 }
 
@@ -88,14 +122,22 @@ get_current_ubuntu() {
   echo "Getting package location for ubuntu-$version-$arch"
   local url=`(wget http://packages.ubuntu.com/$version/$arch/$pkg/download -O - 2>/dev/null \
                | grep -oh 'http://[^"]*libc6[^"]*.deb') || die "Failed to get package version"`
-  get_ubuntu $url $info
+  get_deb $url $info
+}
+
+get_all_debian() {
+  local info=debian-$1
+  local url=$2
+  for f in `wget $url/ -O - 2>/dev/null | egrep -oh 'libc6(-i386|-i686|-amd64|-armel|-armhf|-arm64)?(-cross)?_[^"]*(i386|amd64|armel|armhf|arm64|all)\.deb' | grep -v "</a>"`; do
+    get_deb $url/$f $info
+  done
 }
 
 get_all_ubuntu() {
-  local info=$1
+  local info=ubuntu-$1
   local url=$2
-  for f in `wget $url/ -O - 2>/dev/null | egrep -oh 'libc6(-i386|-amd64)?_[^"]*' |grep -v "</a>"`; do
-    get_ubuntu $url/$f $1
+  for f in `wget $url/ -O - 2>/dev/null | egrep -oh 'libc6(-i386|-i686|-amd64|-armel|-armel-armhf|-armhf|-arm64)?(-cross)?_[^"]*(i386|amd64|armel|armhf|arm64|all)\.deb' | grep -v "</a>"`; do
+    get_deb $url/$f $info
   done
 }
 
@@ -105,8 +147,10 @@ add_local() {
   local libc=$1
   [[ -e $libc ]] || return
   local info="local"
-  local id="local-`sha1sum $libc`"
+  local id="local-`sha256sum $libc`"
   echo "Adding local libc $libc (id $id)"
-  check_id $id || return
-  process_libc $libc $id $info
+  check_id $id $info || return
+  local sha256=`sha256sum $libc`
+  check_sha256 $sha256 || return
+  process_libc $libc $id $info $sha256
 }
-- 
cgit v1.2.3