11. Doing it in C

11.1. System calls

Have a look at the disassembly of function write in glibc. That code checks the return value of the system call and sets variable errno on error. We don't need this. Actually we can't access global variables at all. And Infection #1 does not care for the return code, anyway.

It is also remarkable that the code loads only the four required registers. The sources of glibc make great effort to provide optimal code for every case. I find the macros in glibc-2.2.4/sysdeps/unix/sysv/linux/i386/sysdep.h quite interesting.

For our needs a simple function will do. The line starting with a colon is a constraint. It somehow declares the value that eax has after the asm block to be the value of variable result. The following return statement would load the value of result into eax again, but fortunately gcc(1) optimizes this correctly. Of course the code would work without constraint and return. But the compiler would issue warning "no return statement in function returning non-void".

Red Hat's gcc-2.96-98 produces weird code if the assembly statements are grouped in a single asm block. In that case mov ebp,esp is done not on function entry, but after the asm. See All together now for a disassembly. do_syscall is the last part.

Note that we can't name our function plain syscall. There is already such a declaration in unistd.h.

11.2. Position independent code

Previous examples needed a separate pass to build the insertable code. Output of the first pass is one chunk of bytes. The only interface to the infector is the place to patch with the original entry address (4 bytes at offset 1).

The crucial part are the lines in target_write_infection #1 (i) where we pass the address of the chunk of bytes to write(2). In a real virus these lines will also be part of inserted code. The naive approach is to patch these instructions on infection. But this again leads to a two-pass process. The first is required to find the offset of patches. A more comfortable approach is to make the code position independent by calculating absolute addresses at run-time. Note that option -fpic of gcc(1) does not help the problem at all.

11.3. target_write_infection #2

We now have all parts to implement a position independent version of target_write_infection. This code works as part of a first stage infector. Output to prove it is at the end of this chapter. It should also work as part of an infection. But do you remember the paragraph about "exercise left to the reader"?

Compare this code with the first version, target_write_infection #1 (i). Instead of operating on a single variable, Infection #1, we write every byte between the start of infection and function end. The prototypes are required by the code of body. For reasons explained below, infection.inc and body.inc must lie next to each other. Anyway, the highlight of this chapter is the character constant msg.

11.4. A section called .text

It is very difficult to persuade the linker to arrange object files in a specific order. But by putting all definitions into a single compilation unit (a .c that ends up in a .o) we are quite safe on that front. And though it is nowhere specified, most compilers will write definitions in the order they read them. So the "only" remaining problem is implementation specific classification of definitions. A small test program illustrates the problem.

Functions are ordered intuitively. However, constant data is put in a separate section called .rodata. And sections are ordered as whole. See the section-to-segment mapping in the output of readelf(1) at Segments of /bin/tcsh.

I see a few approaches to the problem.

• Copy the complete code-segment as defined by the ELF header.

• Define begin and end for each section to copy.

• Put constant data into section .text.

Anyway, the real problem is accessing these bytes in a position independent fashion. For code this is more or less default. call and jmp work with relative offsets. Large contiguous switch blocks could get optimized as a lookup tables, but this is easy to work around. Explicit function pointers can be corrected manually with get_relocate_ofs. The same be could be done with items in virtual method tables. But then the table itself is accessed by compiler-generated code, which is hard to correct.

However, every data access requires explicit calculation through get_relocate_ofs. This includes innocent looking string literals. Basically you always have to look at the disassembly of your C code to go sure.

In our trivial example infection holds stub code written in assembler and is never accessed as data. Anyway, here is the documentation of gcc(1) on the issue.

11.5. The stub

This is the link between regular C code and the unsuspecting host. The requirements are:

• The new entry point should lie at a constant offset inside inserted code. Preferred value is 0.

• The original entry address is patched into the inserted code at a constant offset. Previous examples used 1.

• We need a mechanism to activate the host code again. Ideally we should leave no trace of our existence, but unmodified registers (especially esp) will suffice.

Calculating the offset to patch with the original entry point definitely requires a separate pass. But good design can make this pass constant. We can use the same stub, with the same offset, for every kind of infective code.

The natural approach is to code the stub in a mixture of C and inline assembly and use ndisasm(1) to check the offset. This has the disadvantage of limited control. Functions compiled by gcc(1) are decorated with entry and exit code. The disassembly of The address of main is a fine example. I have no way to suppress the first two lines, push ebp and mov ebp,esp. Even worse, functions containing asm statements seem the defy all logic. Just see where mov ebp,esp is in the code of get_relocate_ofs. And I also don't see how to put code between pop ebp and ret. So we would have to build our own exit code using inline assembly. Basically a pop ebp and some kind of jmp. The exit code generated by gcc(1) would still be there, but just not used.

On the other hand the traditional way of mixing C and assembler code through separate .o files is not possible. Fortunately we have a tool that converts disassembly into a C style array constant: Dressing up binary code (i) This approach has one major problem, though. The assembly code is built independent of the C code. So the offset of the virus body (a plain C function) is not known during assembly of the stub. Patching the offset into the stub at run time is the obvious solution. Assuming a constant offset is the kind of black magic I prefer. But then my other hobby is selling innocent readers bull. The real motivation for the following hack is to recycle the framework from One step closer to the edge (i). There are a lot of possible variations.

The code below relies on prober alignment through the compiler. Because of the __attribute__ clause the character array infection starts at an address that is a multiple of 8. An assembler directive pads the stub with enough nop instruction to make its size a multiple of 8. Which means that any object placed after the infection is also aligned on a multiple of 8.

On i386 the largest built-in type of C compilers is double. And sizeof(double) is 8. So this number is typically the highest alignment used in a section. Another school of thought uses higher alignment to put data on cache line boundaries. And sections themselves are usually aligned on paragraphs (16 bytes), a term known since the days of real mode. But for our example there is no reason for compiler or assembler to insert padding bytes between infection and the following function, called body.

11.6. All together now

The only missing piece is the actual infection body. We use another piece of magic, built-in functions. From the documentation of gcc(1):

11.7. Off we go again