i have a project that requires to use global varibales an array for example, append to it some items and save this array using only the executable file (im not allowed to use other files ) modification should be done on the exe file .The only indication i have is to use "libelf" i tried to look at the structure of an elf file but im still not able to access global variables(data segment) and change them.plz i need some help tx in advance.
And which OS are you trying to accomplish this on?
The first big question is are you even allowed to open your own executable image for writing?
If you are in Linux, you could always use getenv() in your code to gather "global" variables passed in by the outside world doing a export <VAR>=<STUFF>.
I m using ubuntu .Here is the project :
"Managing user names and passwords for email, network, accounts etc. can be a real hassle. A solution consist in listing ones credentials (in the form of tuples usernames, passwords) in a text file, then encrypting the entire file with a strong encryption algorithm requiring a pass phrase. To retrieve ones credentials i.e., usernames and passwords one has to have both the encrypted textfile and the decryption algorithm at hand. A more elegant solution uses only one executable file that contains both encryption and decryption algorithms as well as the credentials (in a data segment in OS/compiler terms). In this project you are required to implement this elegant solution. When executed, this executable file runs user choices to either view/append or delete credential tuples.
Hints: You can use libelf for managing data segments of executable files dynamically
"
I think this would be better to understand my problem
tanx for your replies
Took about 5 seconds
libelf by Example
The project description says "You can use libelf", not that you MUST. There are far easier ways of doing this than mucking with ELF format. In fact, you can do this in a completely portable way with no knowledge at all of the underlying executable format.
The trick is to embed a large block of data (as a global array) into the program. The beginning of this data is marked by some kind of unique signature. To read or write from this data block, then, all you need to do is open the file, scan until you find the signature, and then you know you are in the correct position to read or write data.
Of course, this is not even possible if the OS doesn't allow you to alter the program file while the program is executing. But most UNIX-like operating systems do allow you to do this.
Neat trick. Linux will presumably allow it, since you can recompile an executable while it is running.Quote:
Originally Posted by brewbuck
When I was working at a document imaging company, we did something exactly like that to embed customer license information into the executable. We supported 7 different platforms (officially) and had a single tool to read and write this information (we called it a "DIB" which I think stands for "deployment info block" which is a weird name but that's what it was)Quote:
Originally Posted by MK27
The tool didn't need any knowledge of the executable format, it just scanned the file for the signature and then it knew where the data was. The downside is that the size of the DIB is fixed and can't be changed, but we didn't need something like that anyway.
how do i know the signature of the variable if possible give a source code exampleQuote:
Originally Posted by brewbuck
thanksi advance
There may be some problems with this idea, in fact, altho I haven't done any reading about the structure of executables, so I'm kind of acting blindly, but:Quote:
Originally Posted by redone
Looking at that with hexdump -c ./a.out, it's possible to find XOXOX, or at least XOXO, which is to say that is not always contiguous. It is also possible to find "hello world", altho it is no where near XOXOX. And there is not a single Z in the file.Code:#include <string.h>
int main() {
char sig[1029]="XOXOX", *start=&sig[5];
memset(start,'Z',1024);
strcpy(start,"hello world");
return 0;
}
There are some interesting things in the hexdump that imply to me you could access the data segment without using libelf but probably not in as naive a way as this...
ps. anyone know why gcc's default output file is still called a.out? AFAIK an "a.out" binary is historically not the same as an ELF binary, but of course the a.out from gcc on linux is an ELF binary.
Normally what i understood is that I should scan my executable file until i find the the location of the global variable is that right ?? if it's right then how can compare a file descriptor with the my global variable
> how do i know the signature of the variable if possible give a source code example
You mean it's not YOUR executable?
And why does it seem like we're the ones doing all the work all of a sudden.
Try hexdump, it's probably installed by default. There's also readelf, which "readelf -h ./a.out" gives you output like this:Quote:
Originally Posted by redone
It looks to me like it may be more complicated than just finding an offset and writing to it. Brewbuck is a smart cookie, but he didn't say he had done this, he said "we", which might imply he has actually not, and therefore may be unaware of some complications.Code:ELF Header:
Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class: ELF64
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Advanced Micro Devices X86-64
Version: 0x1
Entry point address: 0x400420
Start of program headers: 64 (bytes into file)
Start of section headers: 2992 (bytes into file)
Flags: 0x0
Size of this header: 64 (bytes)
Size of program headers: 56 (bytes)
Number of program headers: 8
Size of section headers: 64 (bytes)
Number of section headers: 30
Section header string table index: 27
On the other hand, it must be possible:
http://www.cse.iitm.ac.in/moodle/mod...iew.php?id=459
But you are the one studying this stuff! Since you have to write something to the binary anyway, you might as well start experimenting. It is not as if it will matter if you accidentally wreck your executable.
>> if it's right then how can compare a file descriptor with the my global variable
Why would you want to do that? The point is simply to find the target block so that you can read/replace the stored data. Does that make sense?
I think the OP understands that and perhaps by fd meant like, what is in the file.Quote:
Originally Posted by Sebastiani
You won't find the name of the variable (eg, from my previous example, "sig" or "start"), but what you will find is the content ("XOXOX" and "hello world").
Now get busy, try some code and then ask more questions.
but the problem is how to find the target block in my executable so that i can modify my dataQuote:
Originally Posted by Sebastiani
I think we all agree on this point.Quote:
Originally Posted by redone
You open the file, you read some data, you compare.
If you're dickering about with modifying an executable and you don't know how to do this basic stuff, then chances are you're going to screw it up.
Post some effort, and stop trying to get others to do the basics as well.
Well, have you gotten the bit where you open a file and read the contents working yet? If not, that might be the next logical step. It might be a good idea to just read the entire file, just to keep things simple. Then it's just a matter of searching through a block of memory (think 'memcmp'), making changes, and then overwriting the file (once you get that working you may even want to make a backup copy of the file before making changes, just for posterity).Quote:
but the problem is how to find the target block in my executable so that i can modify my data
Quote:
Originally Posted by redone
And finding a string in a binary file is not really all that different than finding a string in a text file (especially in Linux). Read bytes until found, more or less.Quote:
Originally Posted by MK27
here the my code source :the part in bold is when i try to access the .data segment note that i m using lib elf i get as an output the offset of the .data section but I m unable to read the data in it.I need helpCode:/*
* Print the names of ELF sections.
*/
#include <err.h>
#include <fcntl.h>
#include <gelf.h>
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <sysexits.h>
#include <unistd.h>
#include <inttypes.h>
//#include <vis.h>
char *a="fggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg";
int
main(int argc, char **argv)
{
int fd;
Elf *e;
char *name, *p, pc[4*sizeof(char)];
Elf_Scn *scn;
Elf_Data *data;
GElf_Shdr shdr;
size_t n, shstrndx, sz;
char c[1000];
/* if (argc != 2)
errx(EX_USAGE, "usage: %s file-name", getprogname());
*/
if (elf_version(EV_CURRENT) == EV_NONE)
errx(EX_SOFTWARE, "ELF library initialization failed: %s",
elf_errmsg(-1));
if ((fd = open(argv[1], O_RDONLY, 0)) < 0)
err(EX_NOINPUT, "open \%s\" failed", argv[1]);
if ((e = elf_begin(fd, ELF_C_READ, NULL)) == NULL)
errx(EX_SOFTWARE, "elf_begin() failed: %s.",
elf_errmsg(-1));
if (elf_kind(e) != ELF_K_ELF)
errx(EX_DATAERR, "%s is not an ELF object.", argv[1]);
if (elf_getshstrndx(e, &shstrndx) == 0)
errx(EX_SOFTWARE, "getshstrndx() failed: %s.",
elf_errmsg(-1));
scn = NULL;
while ((scn = elf_nextscn(e, scn)) != NULL) {
if (gelf_getshdr(scn, &shdr) != &shdr)
errx(EX_SOFTWARE, "getshdr() failed: %s.",
elf_errmsg(-1));
if ((name = elf_strptr(e, shstrndx, shdr.sh_name)) == NULL)
errx(EX_SOFTWARE, "elf_strptr() failed: %s.",
elf_errmsg(-1));
if(strcmp(name,".data")==0)
{
data=elf_getdata(scn,NULL);
printf("%zd ",data->d_size);
//printf("%d ",(void *)data->d_off);
p = (char *) data->d_buf;
printf("%s",c);
printf("%p \n",p);
}
(void) printf("Section %-4.4jd %s\n", (uintmax_t) elf_ndxscn(scn),
name);
}
if ((scn = elf_getscn(e, shstrndx)) == NULL)
errx(EX_SOFTWARE, "getscn() failed: %s.",
elf_errmsg(-1));
if (gelf_getshdr(scn, &shdr) != &shdr)
errx(EX_SOFTWARE, "getshdr(shstrndx) failed: %s.",
elf_errmsg(-1));
(void) printf(".shstrab: size=%jd\n", (uintmax_t) shdr.sh_size);
/* data = NULL; n = 0;
while (n < shdr.sh_size && (data = elf_getdata(scn, data)) != NULL) {
p = (char *) data->d_buf;
while (p < (char *) data->d_buf + data->d_size) {
if (vis(pc, *p, VIS_WHITE, 0))
printf("%s", pc);
n++; p++;
(void) putchar((n % 16) ? ' ' : '\n');
}
}
(void) putchar('\n');*/
(void) elf_end(e);
(void) close(fd);
exit(EX_OK);
}
> data=elf_getdata(scn,NULL);
Calling it once is a start, but it would seem you really need to call it in a loop until you find what you're looking for, or you reach the end of the list.Quote:
Originally Posted by manual page
FWIW, your "fggg" thing isn't in the data segment in all likelihood, it is a string constant.
the while loop before the bold text loops through all the sections and then i check for the section whose name is ".data"when i call data=elf_getdata(scn,NULL); and i print the data->d_buf i get a address in hexadecimal I think this the begining address of the global variable .If I'm right Iwant to read from his memory location and this is what I m unable to do .plz help me
a) there is potentially more than one global variable (so a loop within the section). You're not the only one with global data you know, parts of the standard libraries have them too.
b) like I already mentioned, string constants MAY not be in the data section, but in .rodata.
Try
char a[] = "ffffgggg";
and see if you can find that.
I get an output like this :Code:#include <err.h>
#include <fcntl.h>
#include <gelf.h>
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <sysexits.h>
#include <unistd.h>
#include <inttypes.h>
//#include <vis.h>
char *a="fggg";
int b=4;
int
main(int argc, char **argv)
{
int fd;
Elf *e;
char *name, *p, pc[4*sizeof(char)];
Elf_Scn *scn;
Elf_Data *data;
GElf_Shdr shdr;
size_t n, shstrndx, sz;
char c[1000];
/* if (argc != 2)
errx(EX_USAGE, "usage: %s file-name", getprogname());
*/
if (elf_version(EV_CURRENT) == EV_NONE)
errx(EX_SOFTWARE, "ELF library initialization failed: %s",
elf_errmsg(-1));
if ((fd = open(argv[1], O_RDONLY, 0)) < 0)
err(EX_NOINPUT, "open \%s\" failed", argv[1]);
if ((e = elf_begin(fd, ELF_C_READ, NULL)) == NULL)
errx(EX_SOFTWARE, "elf_begin() failed: %s.",
elf_errmsg(-1));
if (elf_kind(e) != ELF_K_ELF)
errx(EX_DATAERR, "%s is not an ELF object.", argv[1]);
if (elf_getshstrndx(e, &shstrndx) == 0)
errx(EX_SOFTWARE, "getshstrndx() failed: %s.",
elf_errmsg(-1));
scn = NULL;
while ((scn = elf_nextscn(e, scn)) != NULL) {
if (gelf_getshdr(scn, &shdr) != &shdr)
errx(EX_SOFTWARE, "getshdr() failed: %s.",
elf_errmsg(-1));
if ((name = elf_strptr(e, shstrndx, shdr.sh_name)) == NULL)
errx(EX_SOFTWARE, "elf_strptr() failed: %s.",
elf_errmsg(-1));
if(strcmp(name,".data")==0)
{
data=elf_getdata(scn,NULL);
printf("%zd ",data->d_size);
//printf("%d ",(void *)data->d_off);
p = (char *) data->d_buf;
printf("%p \n",p);
}
if(strcmp(name,".rodata")==0)
{
data=elf_getdata(scn,NULL);
printf("%zd ",data->d_size);
p = (char *) data->d_buf;
printf("%p \n",p);
}
}
(void) elf_end(e);
(void) close(fd);
exit(EX_OK);
}
redone@ubuntu:~/Bureau$ ./sec sec
224 0xb7f29c68
16 0xb7f2a04c
I think this is the size and the offset of respectivly the .data and the .rodata
Still I m unable to read the content of this memory location and its size If anyone knows how to do that plz help me