diff options
Diffstat (limited to 'run')
| -rw-r--r-- | run/common.hpp | 10 | ||||
| -rw-r--r-- | run/dos_emu.cpp | 43 | ||||
| -rw-r--r-- | run/run.cpp | 16 | ||||
| -rw-r--r-- | run/runner.cpp | 73 |
4 files changed, 113 insertions, 29 deletions
diff --git a/run/common.hpp b/run/common.hpp index becd0c9..375bdf8 100644 --- a/run/common.hpp +++ b/run/common.hpp @@ -5,7 +5,13 @@ const std::string socket_name = "/tmp/openle.socket"; struct __attribute__((packed, aligned(4))) BinaryLoadMessage { - uint32_t binary_size; - uint32_t base_address; uint32_t eip; }; + +struct __attribute__((packed, aligned(4))) BinarySizeMessage { + uint32_t binary_size; +}; + +struct __attribute__((packed, aligned(4))) BinaryBaseOffsetMessage { + uint32_t offset; +}; diff --git a/run/dos_emu.cpp b/run/dos_emu.cpp index f8e294d..c42df68 100644 --- a/run/dos_emu.cpp +++ b/run/dos_emu.cpp @@ -9,7 +9,7 @@ #include <ucontext.h> static void dos_functions(mcontext_t& mcontext); -static void dpmi_functions(mcontext_t& mcontext); +static void dpmi_functions(mcontext_t& mcontext, long unsigned int& flags); void dos_emu_handler(int, siginfo_t*, void* c) { ucontext_t* context = (ucontext_t*) c; @@ -27,7 +27,7 @@ void dos_emu_handler(int, siginfo_t*, void* c) { dos_functions(context->uc_mcontext); } if(instruction[1] == 0x31) { - dpmi_functions(context->uc_mcontext); + dpmi_functions(context->uc_mcontext, context->uc_flags); } //skip the interrupt and hopefully we handled it owk. @@ -40,10 +40,45 @@ void dos_emu_handler(int, siginfo_t*, void* c) { return; } -static void dos_functions(mcontext_t&) { +static void dos_functions(mcontext_t& mcontext) { + uint8_t ah = (mcontext.gregs[REG_EAX] & 0x0000FF00) >> 8; + uint8_t al = mcontext.gregs[REG_EAX] & 0x000000FF; + uint16_t ax = mcontext.gregs[REG_EAX] & 0x0000FFFF; + uint16_t dx = mcontext.gregs[REG_EDX] & 0x0000FFFF; + + //Get dos version + if(ah == 0x30) { + mcontext.gregs[REG_EAX] &= 0xFFFF0000; + mcontext.gregs[REG_EAX] |= 6 << 8; + mcontext.gregs[REG_EAX] |= 22; + + mcontext.gregs[REG_EBX] &= 0xFFFF0000; + mcontext.gregs[REG_EBX] |= 0x000000DE; + mcontext.gregs[REG_ECX] = 0xDEADBEAF; + + if(al == 1) { + mcontext.gregs[REG_EBX] |= 1 << 8; + } else { + mcontext.gregs[REG_EBX] |= 2 << 8; + } + } + + //Dos4gw install check + if(ax == 0xFF00 && dx == 0x0078) { + mcontext.gregs[REG_EAX] &= 0xFFFFFF00; + mcontext.gregs[REG_EAX] |= 1; + //should possible set GS... well fuck. + } } -static void dpmi_functions(mcontext_t&) { +static void dpmi_functions(mcontext_t& mcontext, long unsigned int& flags) { + uint16_t ax = mcontext.gregs[REG_EAX] & 0x0000FFFF; + //Get Segment base address + if (ax == 0x0006) { + mcontext.gregs[REG_ECX] &= 0xFFFF0000; + mcontext.gregs[REG_EDX] &= 0xFFFF0000; + flags = 0; + } } diff --git a/run/run.cpp b/run/run.cpp index 2f02a7b..b85e001 100644 --- a/run/run.cpp +++ b/run/run.cpp @@ -33,13 +33,21 @@ void accept_handler(boost::system::error_code const& error) { if(!error) { + uint32_t binary_size = determine_binary_size(file); + BinarySizeMessage size_message { + .binary_size = binary_size + }; + connection_socket.send(boost::asio::buffer(&size_message, sizeof size_message)); + + BinaryBaseOffsetMessage offset_message; + connection_socket.receive(boost::asio::buffer(&offset_message, sizeof offset_message)); + std::vector<uint8_t> binary = load_binary(file); + relocate(file, binary, binparse::Offset32(offset_message.offset)); + uint32_t base_address = file.object_table.entries.at(file.le_header.EIP_object).reloc_base_address; - uint32_t binary_size = binary.size(); BinaryLoadMessage message { - .binary_size = binary_size, - .base_address = base_address, - .eip = file.le_header.EIP + base_address + .eip = file.le_header.EIP + base_address + offset_message.offset }; connection_socket.send(boost::asio::buffer(&message, sizeof message)); diff --git a/run/runner.cpp b/run/runner.cpp index 8f19bfb..d8b9cad 100644 --- a/run/runner.cpp +++ b/run/runner.cpp @@ -4,40 +4,77 @@ #include <cstring> #include <cassert> #include <csignal> +#include <cmath> #include <iostream> +#include <memory> #include <sys/socket.h> #include <sys/un.h> #include <sys/mman.h> +#include <asm/ldt.h> + #include "common.hpp" #include "dos_emu.hpp" int loader_socket; +class mmap_deleter{ + size_t size; + +public: + mmap_deleter(size_t size) + : size(size) + {} + + void operator()(void* ptr) const { + munmap(ptr, size); + } +}; + enum ErrorCode { ok, socket_creation_failed, connection_error }; +using mmap_pointer_t = std::unique_ptr<void, mmap_deleter>; + static ErrorCode connect_to_loader(); -static BinaryLoadMessage receive_message(); -static void load_binary(BinaryLoadMessage const& message); + +template<typename T> +static T receive_message(); +static mmap_pointer_t map_memory(BinarySizeMessage const& message); +static void load_binary(mmap_pointer_t& binary, uint32_t binary_size); static void register_signal_handlers(); int main(int, char*[]) { if(connect_to_loader() != ok) { return -1; } - BinaryLoadMessage message = receive_message(); - load_binary(message); + auto size_message = receive_message<BinarySizeMessage>(); + auto binary = map_memory(size_message); + + BinaryBaseOffsetMessage offset_message + { + .offset = (uint32_t)binary.get() + }; + + send(loader_socket, &offset_message, sizeof offset_message, 0); + + auto binary_load_message = receive_message<BinaryLoadMessage>(); + load_binary(binary, size_message.binary_size); + register_signal_handlers(); - asm ("JMP *%0 \n\t" + std::cout << std::hex << "Binary base: " << offset_message.offset << std::endl; + + asm ( + "jmp *%0 \n\t" : - : "r" (message.eip)); + : "r" (binary_load_message.eip) + ); } static ErrorCode connect_to_loader() { @@ -58,28 +95,26 @@ static ErrorCode connect_to_loader() { return ok; } -static BinaryLoadMessage receive_message() { - BinaryLoadMessage message; +template <typename T> +static T receive_message() { + T message; uint32_t bytes_received = recv(loader_socket, &message, sizeof message, 0); - assert((bytes_received == sizeof message) && "Didn't receive full BinaryLoadMessage"); + assert((bytes_received == sizeof message) && "Didn't receive message"); return message; } -static void load_binary(BinaryLoadMessage const& message) { - uint8_t* binary = static_cast<uint8_t*>(mmap((void*)message.base_address, message.binary_size - message.base_address, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0)); +static mmap_pointer_t map_memory(BinarySizeMessage const& message) { + void* binary = mmap(NULL, message.binary_size, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if(binary == MAP_FAILED) { std::cerr << "error during mmap: " << errno << " " << strerror(errno) << std::endl; exit(1); } + return mmap_pointer_t(binary, message.binary_size); +} - assert((binary == (void*)message.base_address) && "binary couldn't be loaded on the prefered address."); - - uint8_t x[message.base_address]; - recv(loader_socket, x, sizeof(x), 0); - - size_t bytes_received = recv(loader_socket, binary, message.binary_size - message.base_address, 0); - - assert((bytes_received == message.binary_size - (size_t)message.base_address) && "bytes_received did not match expected"); +static void load_binary(mmap_pointer_t& binary, uint32_t binary_size) { + size_t bytes_received = recv(loader_socket, binary.get(), binary_size, 0); + assert((bytes_received == binary_size) && "bytes_received did not match expected"); } static void register_signal_handlers() { |