武器开发 - MacOS 内存执行

#include <stdio.h>#include <sys/mman.h>#include <sys/stat.h>#include <fcntl.h>#include <unistd.h>#include <dlfcn.h>
extern char **environ;
int dev_fd(char **argv) {    int fd = open("/bin/ls", O_RDONLY);    if (-1 == fd) {        perror("open");        return -1;    }
    return fd;}
int dev_fd_shm(char **argv) {    shm_unlink("ls");
    int shm_fd = shm_open("ls", O_RDWR | O_CREAT | O_EXCL, 0777);    if (-1 == shm_fd) {        perror("shm_open");        return -1;    }
    struct stat s = {0};    if (stat("/bin/ls", &s) == -1) {        perror("stat");        return -1;    }
    if (-1 == ftruncate(shm_fd, s.st_size)) {        perror("ftruncate");        return -1;    }
    void *ptr = mmap(NULL, s.st_size, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);    if (!ptr || ptr == -1) {        perror("mmap");        return -1;    }
    int fd = open("/bin/ls", O_RDONLY);    if (-1 == fd) {        perror("open");        return -1;    }
    int n = read(fd, ptr, s.st_size);    if (-1 == n || n != s.st_size) {        perror("read");        return -1;    }
    munmap(ptr, s.st_size);    close(shm_fd);    close(fd);
    shm_fd = shm_open("ls", O_RDONLY);    if (shm_fd == -1) {        perror("shm_open");        return -1;    }
    return shm_fd;}
void test(int fd, char** argv) {    struct stat s = {0};    if (-1 == fstat(fd, &s)) {        perror("fstat");        return;    }
    ftruncate(fd, s.st_size);
    char buf[8] = {0};    int n = read(fd, buf, 8);    if (n == -1 || n != 8) {        perror("read");        printf("read %dn", n);    }
    for (int i = 0; i < 8; i++)        printf("%i ", buf[i]);
    char f[64] = {0};    sprintf(f, "/dev/fd/%d", fd);
    printf("%sn", f);
    if (-1 == chmod(f, 0777))        perror("chmod");
    printf("dlopen %pn", dlopen(f, RTLD_NOW));
    execve(f, argv, environ);    perror("execve");}
int main(int argc, char **argv) {    printf("===== test /dev/fdn");    test(dev_fd(argv), argv);
    printf("===== test /dev/fd shmn");    test(dev_fd_shm(argv), argv);}

===== test /dev/fd-54 -2 -70 -66 0 0 0 2 /dev/fd/3chmod: Operation not permitteddlopen 0x204d35460execve: Permission denied
===== test /dev/fd shmread: Device not configuredread -10 0 0 0 0 0 0 0 /dev/fd/4chmod: Bad file descriptordlopen 0x0execve: Permission denied

NSObjectFileImageReturnCode APIs::NSCreateObjectFileImageFromMemory(const void* memImage, size_t memImageSize, NSObjectFileImage* ofi){    ...
    // this API can only be used with bundles    if ( !mf->isBundle() ) {        return NSObjectFileImageInappropriateFile;    }
    ...}

#include <mach-o/dyld.h>#include <stdio.h>#include <unistd.h>#include <fcntl.h>#include <sys/mman.h>#include <sys/stat.h>#include <stdlib.h>
int main(int argc, char** argv) {    int fd = open(argv[1], O_RDONLY);    if (fd == -1) {        perror("open");        return -1;    }
    struct stat s = { 0 };    if (-1 == fstat(fd, &s)) {        perror("fstat");        return -1;    }
    char* buf = malloc(s.st_size);    if (!buf) {        perror("malloc");        return -1;    }
    int total = 0;    do {        int n = read(fd, buf + total, s.st_size - total);        if (n == -1)             break;
        total += n;    } while (total < s.st_size);
    if (total != s.st_size) {        perror("read");        return -1;    }
    ((struct mach_header_64*)buf)->filetype = MH_BUNDLE;
    NSObjectFileImage img;    NSObjectFileImageReturnCode c = NSCreateObjectFileImageFromMemory(buf, s.st_size, &img);    if (c != NSObjectFileImageSuccess) {        printf("NSCreateObjectFileImageFromMemory %dn", c);        return -1;    }
    NSModule mod = NSLinkModule(img, "_", NSLINKMODULE_OPTION_NONE);    if (mod == -1) {        perror("NSLindModule");        return -1;    }
    printf("mod %pn", mod);
    NSSymbol sym = NSLookupSymbolInModule(mod, "_foo");    if (sym == -1) {        perror("NSLookupSymbolInModule");        return -1;    }
    void* addr = NSAddressOfSymbol(sym);
    printf("%pn", addr);
    ((void (*)())(addr))();}

[cc2_mem]: delete executable file backup in memory![cc2_mem]: run executable file from memory![runExec]: add jobInfo-> cc2_frp, PID-> 418442022-07-06 17:27:10 - Created file: /private/var/folders/xx/6qkl26212b50t_twbbk51rhw0000gn/T/NSCreateObjectFileImageFromMemory-Ay24wFNH2022-07-06 17:27:10 - Modified directory: /private/var/folders/xx/6qkl26212b50t_twbbk51rhw0000gn/T2022-07-06 17:27:10 - Modified file: /private/var/folders/xx/6qkl26212b50t_twbbk51rhw0000gn/T/NSCreateObjectFileImageFromMemory-Ay24wFNH2022-07-06 17:27:10 - Modified file: /private/var/folders/xx/6qkl26212b50t_twbbk51rhw0000gn/T/NSCreateObjectFileImageFromMemory-Ay24wFNH2022-07-06 17:27:10 - Deleted file: /private/var/folders/xx/6qkl26212b50t_twbbk51rhw0000gn/T/NSCreateObjectFileImageFromMemory-Ay24wFNH2022-07-06 17:27:10 - Modified directory: /private/var/folders/xx/6qkl26212b50t_twbbk51rhw0000gn/T

NSModule APIs::NSLinkModule(NSObjectFileImage ofi, const char* moduleName, uint32_t options){    ...
    if ( ofi->memSource != nullptr ) {        // make temp file with content of memory buffer        ofi->path = nullptr;        char        tempFileName[PATH_MAX];        const char* tmpDir = this->libSystemHelpers->getenv("TMPDIR");        if ( (tmpDir != nullptr) && (strlen(tmpDir) > 2) ) {            strlcpy(tempFileName, tmpDir, PATH_MAX);            if ( tmpDir[strlen(tmpDir) - 1] != '/' )                strlcat(tempFileName, "/", PATH_MAX);        }        else            strlcpy(tempFileName, "/tmp/", PATH_MAX);        strlcat(tempFileName, "NSCreateObjectFileImageFromMemory-XXXXXXXX", PATH_MAX);        int fd = this->libSystemHelpers->mkstemp(tempFileName);        if ( fd != -1 ) {            ssize_t writtenSize = ::pwrite(fd, ofi->memSource, ofi->memLength, 0);            if ( writtenSize == ofi->memLength ) {                ofi->path = (char*)this->libSystemHelpers->malloc(strlen(tempFileName)+1);                ::strcpy((char*)(ofi->path), tempFileName);            }            else {                //log_apis("NSLinkModule() => NULL (could not save memory image to temp file)n");            }            ::close(fd);        }        // <rdar://74913193> support old licenseware plugins        openMode = RTLD_UNLOADABLE | RTLD_NODELETE;    }
    ...
    // dlopen the binary outside of the read lock as we don't want to risk deadlock    ofi->handle = dlopen(ofi->path, openMode);    if ( ofi->handle == nullptr ) {        if ( config.log.apis )            log("NSLinkModule(%p, %s) => NULL (%s)n", ofi, moduleName, dlerror());        return nullptr;    }
    ...}

import os
os.system('git tag --sort=v:refname > /tmp/tags')
tags = open('/tmp/tags').readlines()
os.chdir('/Users/x/Desktop/ld-test/dyld')
for t in tags:    print('=========', t)    os.system('git checkout ' + t)    os.system('grep -rn NSCreateObjectFileImageFromMemory-')

...
========= dyld-433.5
Previous HEAD position was 7691c4c dyld-421.2HEAD is now at bd2e880 dyld-433.5========= dyld-519.2.1
Previous HEAD position was bd2e880 dyld-433.5HEAD is now at 628c97f dyld-519.2.1./dyld3/APIs_macOS.cpp:153:        ofi->path = ::tempnam(nullptr, "NSCreateObjectFileImageFromMemory-");./testing/test-cases/NSCreateObjectFileImageFromMemory-basic.dtest/main.c:3:// BUILD:  $CC main.c  -o $BUILD_DIR/NSCreateObjectFileImageFromMemory-basic.exe -Wno-deprecated-declarations./testing/test-cases/NSCreateObjectFileImageFromMemory-basic.dtest/main.c:6:// RUN:  ./NSCreateObjectFileImageFromMemory-basic.exe $RUN_DIR/foo.bundle./testing/test-cases/NSCreateObjectFileImageFromMemory-basic.dtest/main.c:103:    printf("[BEGIN] NSCreateObjectFileImageFromMemory-basicn");./testing/test-cases/NSCreateObjectFileImageFromMemory-basic.dtest/main.c:112:    printf("[PASS] NSCreateObjectFileImageFromMemory-basicn");Binary file ./.git/index matches
...

NSObjectFileImageReturnCode NSCreateObjectFileImageFromMemory(const void* address, size_t size, NSObjectFileImage *objectFileImage){    ...
        ImageLoader* image = dyld::loadFromMemory((const uint8_t*)address, size, NULL);         if ( ! image->isBundle() ) {            // this API can only be used with bundles...            dyld::garbageCollectImages();            return NSObjectFileImageInappropriateFile;        }        // Note:  We DO NOT link the image!  NSLinkModule will do that        if ( image != NULL ) {            *objectFileImage = createObjectImageFile(image, address, size);            return NSObjectFileImageSuccess;        }    }
    ...
    return NSObjectFileImageFailure;}
ImageLoader* loadFromMemory(const uint8_t* mem, uint64_t len, const char* moduleName){    // if fat wrapper, find usable sub-file    const fat_header* memStartAsFat = (fat_header*)mem;    uint64_t fileOffset = 0;    uint64_t fileLength = len;    if ( memStartAsFat->magic == OSSwapBigToHostInt32(FAT_MAGIC) ) {        if ( fatFindBest(memStartAsFat, &fileOffset, &fileLength) ) {            mem = &mem[fileOffset];            len = fileLength;        }        ...    }
    // try each loader    if ( isCompatibleMachO(mem, moduleName) ) {        ImageLoader* image = ImageLoaderMachO::instantiateFromMemory(moduleName, (macho_header*)mem, len, gLinkContext);        // don't add bundles to global list, they can be loaded but not linked.  When linked it will be added to list        if ( ! image->isBundle() )             addImage(image);        return image;    }
    // try other file formats here...
    // throw error about what was found    switch (*(uint32_t*)mem) {        case MH_MAGIC:        case MH_CIGAM:        case MH_MAGIC_64:        case MH_CIGAM_64:            throw "mach-o, but wrong architecture";        default:        throwf("unknown file type, first eight bytes: 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X 0x%02X",             mem[0], mem[1], mem[2], mem[3], mem[4], mem[5], mem[6],mem[7]);    }}

NSModule NSLinkModule(NSObjectFileImage objectFileImage, const char* moduleName, uint32_t options){        ...
        // support private bundles        if ( (options & NSLINKMODULE_OPTION_PRIVATE) != 0 )            objectFileImage->image->setHideExports();
        // set up linking options        bool forceLazysBound = ( (options & NSLINKMODULE_OPTION_BINDNOW) != 0 );
        // load libraries, rebase, bind, to make this image usable        dyld::link(objectFileImage->image, forceLazysBound, false, ImageLoader::RPathChain(NULL,NULL), UINT32_MAX);
        // bump reference count to keep this bundle from being garbage collected        objectFileImage->image->incrementDlopenReferenceCount();
        // run initializers unless magic flag says not to        if ( (options & NSLINKMODULE_OPTION_DONT_CALL_MOD_INIT_ROUTINES) == 0 )            dyld::runInitializers(objectFileImage->image);
        return ImageLoaderToNSModule(objectFileImage->image);
        ...}