Useful-IDAScripts/PatchPLT/PatchPLT_elf64_x64.py at master · Reinose/Useful-IDAScripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
from ida_bytes import *

import idaapi
import ida_kernwin
import struct

def main():
    u32 = lambda x: struct.unpack("<I", x)[0]
    u64 = lambda x: struct.unpack("<Q", x)[0]

    image_base = idaapi.get_imagebase()

    assert get_bytes(image_base, 4) == b"\x7fELF", "The file looks like non-ELF binary"
    assert get_byte(image_base + 4) == 2, "Only support 64bit ELF binary"
    if get_word(image_base + 0x12) != 0x3e:
        res = ida_kernwin.ask_yn(ida_kernwin.ASKBTN_NO, "Only x86-64 machine type has been tested.\nContinue?")
        if res != ida_kernwin.ASKBTN_YES:
            return;


    pht_base = image_base + get_qword(image_base + 0x20)
    pht_entry_size = get_word(image_base + 0x36)
    pht_entry_count = get_word(image_base + 0x38)

    jmprel = None
    for i in range(pht_entry_count):
        current = pht_base + pht_entry_size * i
        if get_dword(current) != 2:
            continue
        dynamic = get_qword(current + 0x10)
        j = 0
        tag = -1
        while tag != 0:
            tag = get_qword(dynamic + 0x10 * j)

            if tag == 0x17:
                jmprel = get_qword(dynamic + 0x10 * j + 0x8)
                break
            j += 1
        else:
            continue
        break
    else:
        ida_kernwin.warning("Cannot find DYNAMIC PHT Entry")
        return;

    got_start_ea = SegByBase(SegByName(".got"))
    got_end_ea = SegEnd(got_start_ea)

    extern_start_ea = SegByBase(SegByName("extern"))
    extern_end_ea = SegEnd(extern_start_ea)

    cur = got_start_ea + 0x18


    fails = []

    # Handle .got for full RELRO
    while cur < got_end_ea:
        plt_offset = u64(get_bytes(cur, 8))

        if get_segm_name(plt_offset) == "extern":
            cur += 0x8
            continue

        gen = FuncItems(plt_offset)
        gen.next()
        extern_idx = GetOperandValue(gen.next(), 0)
        del gen

        func_offset = ida_funcs.get_func(XrefsTo(cur, 0).next().frm).startEA

        real_func_name = GetCommentEx(jmprel + get_struc_size(get_struc_id("Elf64_Rela")) * extern_idx, 0).split()[-1]

        extern_ea = extern_start_ea
        while extern_ea < extern_end_ea:
            if get_name(extern_ea) == real_func_name:
                func_type = get_type(extern_ea)
                break
            extern_ea = NextNotTail(extern_ea)
        if extern_ea == BADADDR:
            fails.append((cur, real_func_name))
            cur += 0x8
            continue

        MakeNameEx(extern_ea, "__imp_" + real_func_name, 0)
        MakeNameEx(plt_offset, real_func_name + "_plt", 0)
        MakeNameEx(cur, real_func_name + "_ptr", 0)
        MakeNameEx(func_offset, real_func_name, 0)
        apply_type(func_offset, get_tinfo(extern_ea))

        cur += 0x8

    got_start_ea = SegByBase(SegByName(".got.plt"))
    got_end_ea = SegEnd(got_start_ea)
    cur = got_start_ea + 0x18

    # Handle .got for full RELRO
    while cur < got_end_ea:
        plt_offset = u64(get_bytes(cur, 8))

        if get_segm_name(plt_offset) == "extern":
            cur += 0x8
            continue

        gen = FuncItems(plt_offset)
        gen.next()
        extern_idx = GetOperandValue(gen.next(), 0)
        del gen

        func_offset = ida_funcs.get_func(XrefsTo(cur, 0).next().frm).startEA

        real_func_name = GetCommentEx(jmprel + get_struc_size(get_struc_id("Elf64_Rela")) * extern_idx, 0).split()[-1]

        print(real_func_name)
        extern_ea = extern_start_ea
        while extern_ea < extern_end_ea:
            if get_name(extern_ea) == real_func_name:
                func_type = get_type(extern_ea)
                break
            extern_ea = NextNotTail(extern_ea)
        if extern_ea == BADADDR:
            fails.append((cur, real_func_name))
            cur += 0x8
            continue

        MakeNameEx(extern_ea, "__imp_" + real_func_name, 0)
        MakeNameEx(plt_offset, real_func_name + "_plt", 0)
        MakeNameEx(cur, real_func_name + "_ptr", 0)
        MakeNameEx(func_offset, real_func_name, 0)
        apply_type(func_offset, get_tinfo(extern_ea))

        cur += 0x8

    print("DONE")
    if fails:
        print("Fails: {}".format(fails))

main()