1 /* i386-linux.elf.shell-main.c -- stub loader for Linux x86 shell script executable
2
3 This file is part of the UPX executable compressor.
4
5 Copyright (C) 1996-2020 Markus Franz Xaver Johannes Oberhumer
6 Copyright (C) 1996-2020 Laszlo Molnar
7 Copyright (C) 2000-2020 John F. Reiser
8 All Rights Reserved.
9
10 UPX and the UCL library are free software; you can redistribute them
11 and/or modify them under the terms of the GNU General Public License as
12 published by the Free Software Foundation; either version 2 of
13 the License, or (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; see the file COPYING.
22 If not, write to the Free Software Foundation, Inc.,
23 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24
25 Markus F.X.J. Oberhumer Laszlo Molnar
26 <markus@oberhumer.com> <ezerotven+github@gmail.com>
27
28 John F. Reiser
29 <jreiser@users.sourceforge.net>
30 */
31
32
33 #include "include/linux.h"
34
35
36 /*************************************************************************
37 // configuration section
38 **************************************************************************/
39
40 // In order to make it much easier to move this code at runtime and execute
41 // it at an address different from it load address: there must be no
42 // static data, and no string constants.
43
44 #define MAX_ELF_HDR 512 // Elf32_Ehdr + n*Elf32_Phdr must fit in this
45
46
47 /*************************************************************************
48 // "file" util
49 **************************************************************************/
50
51 struct Extent {
52 size_t size; // must be first to match size[0] uncompressed size
53 char *buf;
54 };
55
56
57 static void
xread(struct Extent * x,char * buf,size_t count)58 xread(struct Extent *x, char *buf, size_t count)
59 {
60 char *p=x->buf, *q=buf;
61 size_t j;
62 if (x->size < count) {
63 exit(127);
64 }
65 for (j = count; 0!=j--; ++p, ++q) {
66 *q = *p;
67 }
68 x->buf += count;
69 x->size -= count;
70 }
71
72
73 /*************************************************************************
74 // util
75 **************************************************************************/
76
77 #if 1 //{ save space
78 #define ERR_LAB error: exit(127);
79 #define err_exit(a) goto error
80 #else //}{ save debugging time
81 #define ERR_LAB /*empty*/
82 static void
err_exit(int a)83 err_exit(int a)
84 {
85 (void)a; // debugging convenience
86 exit(127);
87 }
88 #endif //}
89
90 static void *
do_brk(void * addr)91 do_brk(void *addr)
92 {
93 return brk(addr);
94 }
95
96 extern char *mmap(void *addr, size_t len,
97 int prot, int flags, int fd, off_t offset);
98
99 /*************************************************************************
100 // UPX & NRV stuff
101 **************************************************************************/
102
103 typedef int f_expand(
104 const nrv_byte *, nrv_uint,
105 nrv_byte *, nrv_uint *, int method );
106
107 static void
unpackExtent(struct Extent * const xi,struct Extent * const xo,f_expand * const f_decompress)108 unpackExtent(
109 struct Extent *const xi, // input
110 struct Extent *const xo, // output
111 f_expand *const f_decompress
112 )
113 {
114 while (xo->size) {
115 struct b_info h;
116 // Note: if h.sz_unc == h.sz_cpr then the block was not
117 // compressible and is stored in its uncompressed form.
118
119 // Read and check block sizes.
120 xread(xi, (char *)&h, sizeof(h));
121 if (h.sz_unc == 0) { // uncompressed size 0 -> EOF
122 if (h.sz_cpr != UPX_MAGIC_LE32) // h.sz_cpr must be h->magic
123 err_exit(2);
124 if (xi->size != 0) // all bytes must be written
125 err_exit(3);
126 break;
127 }
128 if (h.sz_cpr <= 0) {
129 err_exit(4);
130 ERR_LAB
131 }
132 if (h.sz_cpr > h.sz_unc
133 || h.sz_unc > xo->size ) {
134 err_exit(5);
135 }
136 // Now we have:
137 // assert(h.sz_cpr <= h.sz_unc);
138 // assert(h.sz_unc > 0 && h.sz_unc <= blocksize);
139 // assert(h.sz_cpr > 0 && h.sz_cpr <= blocksize);
140
141 if (h.sz_cpr < h.sz_unc) { // Decompress block
142 nrv_uint out_len = h.sz_unc; // EOF for lzma
143 int const j = (*f_decompress)((unsigned char *)xi->buf, h.sz_cpr,
144 (unsigned char *)xo->buf, &out_len, *(int *)(void *)&h.b_method );
145 if (j != 0 || out_len != (nrv_uint)h.sz_unc)
146 err_exit(7);
147 xi->buf += h.sz_cpr;
148 xi->size -= h.sz_cpr;
149 }
150 else { // copy literal block
151 xread(xi, xo->buf, h.sz_cpr);
152 }
153 xo->buf += h.sz_unc;
154 xo->size -= h.sz_unc;
155 }
156 }
157
158 static void
bzero(char * p,size_t len)159 bzero(char *p, size_t len)
160 {
161 if (len) do {
162 *p++= 0;
163 } while (--len);
164 }
165
166 #define REP8(x) \
167 ((x)|((x)<<4)|((x)<<8)|((x)<<12)|((x)<<16)|((x)<<20)|((x)<<24)|((x)<<28))
168 #define EXP8(y) \
169 ((1&(y)) ? 0xf0f0f0f0 : (2&(y)) ? 0xff00ff00 : (4&(y)) ? 0xffff0000 : 0)
170 #define PF_TO_PROT(pf) \
171 (7 & (( (REP8(PROT_EXEC ) & EXP8(PF_X)) \
172 |(REP8(PROT_READ ) & EXP8(PF_R)) \
173 |(REP8(PROT_WRITE) & EXP8(PF_W)) ) \
174 >> ((pf & (PF_R|PF_W|PF_X))<<2) ))
175
176
177 // Find convex hull of PT_LOAD (the minimal interval which covers all PT_LOAD),
178 // and mmap that much, to be sure that a kernel using exec-shield-randomize
179 // won't place the first piece in a way that leaves no room for the rest.
180 static unsigned long // returns relocation constant
181 __attribute__((regparm(3), stdcall))
xfind_pages(unsigned mflags,Elf32_Phdr const * phdr,int phnum)182 xfind_pages(unsigned mflags, Elf32_Phdr const *phdr, int phnum)
183 {
184 size_t lo= ~0, hi= 0, szlo= 0;
185 char *addr;
186 mflags += MAP_PRIVATE | MAP_ANONYMOUS; // '+' can optimize better than '|'
187 for (; --phnum>=0; ++phdr) if (PT_LOAD==phdr->p_type) {
188 if (phdr->p_vaddr < lo) {
189 lo = phdr->p_vaddr;
190 szlo = phdr->p_filesz;
191 }
192 if (hi < (phdr->p_memsz + phdr->p_vaddr)) {
193 hi = phdr->p_memsz + phdr->p_vaddr;
194 }
195 }
196 if (MAP_FIXED & mflags) { // the "shell", and not the PT_INTERP
197 // This is a dirty hack to set the proper value for brk(0) as seen by
198 // the "shell" which we will mmap() soon, upon return to do_xmap().
199 // It depends on our own brk() starting out at 0x08048000, which is the
200 // default base address used by /bin/ld for an ET_EXEC. We must brk()
201 // now. If we wait until after mmap() of shell pages, then the kernel
202 // "vma" containing our original brk() of 0x08048000 will not be contiguous
203 // with hi [the mmap'ed pages from the shell will be in between],
204 // and various linux kernels will not move the brk() in this case;
205 // the typical symptom is SIGSEGV early in ld-linux.so.2 (the PT_INTERP).
206 do_brk((void *)hi);
207 }
208 szlo += ~PAGE_MASK & lo; // page fragment on lo edge
209 lo -= ~PAGE_MASK & lo; // round down to page boundary
210 hi = PAGE_MASK & (hi - lo - PAGE_MASK -1); // page length
211 szlo = PAGE_MASK & (szlo - PAGE_MASK -1); // page length
212 addr = mmap((void *)lo, hi, PROT_READ|PROT_WRITE|PROT_EXEC, mflags, -1, 0);
213
214 // Doing this may destroy the brk() that we set so carefully above.
215 // The munmap() is "needed" only for discontiguous PT_LOAD,
216 // and neither shells nor ld-linux.so.2 have that.
217 // munmap(szlo + addr, hi - szlo);
218
219 return (unsigned long)addr - lo;
220 }
221
222 // This do_xmap() has no Extent *xi input because it doesn't decompress anything;
223 // it only maps the shell and its PT_INTERP. So, it was specialized by hand
224 // to reduce compiled instruction size. gcc 2.91.66 does not notice that
225 // there is only one call to this static function (from getexec(), which
226 // would specify 0 for xi), so gcc does not propagate the constant parameter.
227 // Notice there is no make_hatch(), either.
228
229 static Elf32_Addr // entry address
do_xmap(int const fdi,Elf32_Ehdr const * const ehdr,Elf32_auxv_t * const av)230 do_xmap(int const fdi, Elf32_Ehdr const *const ehdr, Elf32_auxv_t *const av)
231 {
232 #define EM_386 3 /* Intel 80386 */
233 if (EM_386 != ehdr->e_machine) {
234 return 1; // not an i386 executable!
235 }
236 Elf32_Phdr const *phdr = (Elf32_Phdr const *) (ehdr->e_phoff +
237 (char const *)ehdr);
238 unsigned long const reloc = xfind_pages(
239 ((ET_DYN!=ehdr->e_type) ? MAP_FIXED : 0), phdr, ehdr->e_phnum);
240 int j;
241 for (j=0; j < ehdr->e_phnum; ++phdr, ++j)
242 if (PT_PHDR==phdr->p_type) {
243 av[AT_PHDR -1].a_un.a_val = phdr->p_vaddr;
244 }
245 else if (PT_LOAD==phdr->p_type) {
246 unsigned const prot = PF_TO_PROT(phdr->p_flags);
247 struct Extent xo;
248 size_t mlen = xo.size = phdr->p_filesz;
249 char *addr = xo.buf = (char *)phdr->p_vaddr;
250 char *haddr = phdr->p_memsz + addr;
251 size_t frag = (int)addr &~ PAGE_MASK;
252 mlen += frag;
253 addr -= frag;
254 addr += reloc;
255 haddr += reloc;
256
257 // Decompressor can overrun the destination by 3 bytes.
258 if (addr != mmap(addr, mlen, PROT_READ | PROT_WRITE,
259 MAP_FIXED | MAP_PRIVATE,
260 fdi, phdr->p_offset - frag) ) {
261 err_exit(8);
262 }
263 bzero(addr, frag); // fragment at lo end
264 frag = (-mlen) &~ PAGE_MASK; // distance to next page boundary
265 bzero(mlen+addr, frag); // fragment at hi end
266 if (0!=mprotect(addr, mlen, prot)) {
267 err_exit(10);
268 ERR_LAB
269 }
270 addr += mlen + frag; /* page boundary on hi end */
271 if (addr < haddr) { // need pages for .bss
272 if (addr != mmap(addr, haddr - addr, prot,
273 MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0 ) ) {
274 err_exit(9);
275 }
276 }
277 }
278 if (0!=close(fdi)) {
279 err_exit(11);
280 }
281 return ehdr->e_entry + reloc;
282 }
283
284 static Elf32_Addr // entry address
getexec(char const * const fname,Elf32_Ehdr * const ehdr,Elf32_auxv_t * const av)285 getexec(char const *const fname, Elf32_Ehdr *const ehdr, Elf32_auxv_t *const av)
286 {
287 int const fdi = open(fname, O_RDONLY, 0);
288 if (0 > fdi) {
289 err_exit(18);
290 ERR_LAB
291 }
292 if (MAX_ELF_HDR!=read(fdi, (void *)ehdr, MAX_ELF_HDR)) {
293 err_exit(19);
294 }
295 return do_xmap(fdi, ehdr, av);
296 }
297
298
299 /*************************************************************************
300 // upx_main - called by our entry code
301 //
302 // This function is optimized for size.
303 **************************************************************************/
304
305 void *upx_main(
306 Elf32_auxv_t *const av,
307 unsigned const junk,
308 f_expand *const f_decompress,
309 Elf32_Ehdr *const ehdr, // temp char[MAX_ELF_HDR]
310 struct Extent xi,
311 struct Extent xo
312 ) __asm__("upx_main");
313
upx_main(Elf32_auxv_t * const av,unsigned const junk,f_expand * const f_decompress,Elf32_Ehdr * const ehdr,struct Extent xi,struct Extent xo)314 void *upx_main(
315 Elf32_auxv_t *const av,
316 unsigned const junk,
317 f_expand *const f_decompress,
318 Elf32_Ehdr *const ehdr, // temp char[MAX_ELF_HDR]
319 struct Extent xi,
320 struct Extent xo
321 )
322 {
323 // 'fn' and 'efn' must not suffer constant-propagation by gcc
324 // UPX2 = offset to name_of_shell
325 // UPX3 = strlen(name_of_shell)
326 char * /*const*/ volatile fn = UPX2 + xo.buf; // past "-c" and "#!"
327 char * /*const*/ volatile efn = UPX3 + fn; // &terminator
328 Elf32_Addr entry;
329
330 (void)junk;
331 unpackExtent(&xi, &xo, f_decompress);
332
333 { // Map shell program
334 char const c = *efn; *efn = 0; // terminator
335 entry = getexec(fn, ehdr, av);
336 *efn = c; // replace terminator character
337 if (1==entry) { // must execve, such as /bin/sh is amd64
338 return (void *)entry;
339 }
340
341 // av[AT_PHDR -1].a_un.a_val is set again by do_xmap if PT_PHDR is present.
342 av[AT_PHDR -1].a_type = AT_PHDR ; // av[AT_PHDR-1].a_un.a_val is set by do_xmap
343 av[AT_PHENT -1].a_type = AT_PHENT ; av[AT_PHENT -1].a_un.a_val = ehdr->e_phentsize;
344 av[AT_PHNUM -1].a_type = AT_PHNUM ; av[AT_PHNUM -1].a_un.a_val = ehdr->e_phnum;
345 av[AT_PAGESZ -1].a_type = AT_PAGESZ; av[AT_PAGESZ -1].a_un.a_val = PAGE_SIZE;
346 av[AT_ENTRY -1].a_type = AT_ENTRY ; av[AT_ENTRY -1].a_un.a_val = entry;
347 }
348
349 { // Map PT_INTERP program interpreter
350 Elf32_Phdr const *phdr = (Elf32_Phdr *)(1+ehdr);
351 int j;
352 for (j=0; j < ehdr->e_phnum; ++phdr, ++j) if (PT_INTERP==phdr->p_type) {
353 entry = getexec((char const *)phdr->p_vaddr, ehdr, 0);
354 break;
355 }
356 }
357
358 return (void *)entry;
359 }
360
361 /* vim:set ts=4 sw=4 et: */
362