Skip to content

Commit

Permalink
feat: integrate util logs
Browse files Browse the repository at this point in the history
  • Loading branch information
@jm33-m0
jm33-m0 committed Feb 8, 2025
1 parent 1d97aa8 commit dfc3257
Show file tree
Hide file tree
Showing 9 changed files with 63 additions and 70 deletions.
5 changes: 2 additions & 3 deletions core/lib/util/dll_windows.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ package util

import (
"fmt"
"log"
"unsafe"

"golang.org/x/sys/windows"
Expand Down Expand Up @@ -57,7 +56,7 @@ func GetAllDLLs() (modules map[string]*windows.ModuleInfo, err error) {
fname16 := make([]uint16, windows.MAX_PATH)
_, err = windows.GetModuleFileName(moduleHandles[i], &fname16[0], windows.MAX_PATH)
if err != nil {
log.Printf("get module file name: %v", err)
LogDebug("get module file name: %v", err)
continue
}
// Convert the UTF-16 encoded file name to a Go string
Expand All @@ -68,7 +67,7 @@ func GetAllDLLs() (modules map[string]*windows.ModuleInfo, err error) {
cb := uint32(unsafe.Sizeof(*modinfo))
err = windows.GetModuleInformation(processHandle, moduleHandles[i], modinfo, cb)
if err != nil {
log.Printf("get modinfo of %s: %v", fileName, err)
LogDebug("get modinfo of %s: %v", fileName, err)
continue
}
modules[fileName] = modinfo
Expand Down
31 changes: 15 additions & 16 deletions core/lib/util/extract_elf.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ package util
import (
"bytes"
"fmt"
"log"
"os"

emp3r0r_def "github.com/jm33-m0/emp3r0r/core/lib/emp3r0r_def"
Expand Down Expand Up @@ -37,23 +36,23 @@ func FindEmp3r0rELFInMem() (elf_bytes []byte, err error) {
for base, mem_region := range mem_regions {
if bytes.Contains(mem_region, exe_utils.ELFMAGIC) && bytes.Contains(mem_region, emp3r0r_def.OneTimeMagicBytes) {
if base != 0x400000 {
log.Printf("Found magic string in memory region 0x%x, but unlikely to contain our ELF", base)
LogDebug("Found magic string in memory region 0x%x, but unlikely to contain our ELF", base)
continue
}
log.Printf("Found magic string in memory region 0x%x", base)
LogDebug("Found magic string in memory region 0x%x", base)

// verify if it's a valid config data and thus the emp3r0r ELF
_, err := DigEmbeddedData(mem_region, base)
if err != nil {
log.Printf("Verify config data: %v", err)
LogDebug("Verify config data: %v", err)
continue
}
log.Printf("Found emp3r0r ELF in memory region 0x%x", base)
LogDebug("Found emp3r0r ELF in memory region 0x%x", base)

// parse ELF headers
elf_header, err = exe_utils.ParseELFHeaders(mem_region)
if err != nil {
log.Printf("Parse ELF headers: %v", err)
LogDebug("Parse ELF headers: %v", err)
continue
}
elf_header.Print()
Expand All @@ -65,11 +64,11 @@ func FindEmp3r0rELFInMem() (elf_bytes []byte, err error) {
// refine the start/end of current region using program headers
start, end, err := parseMemRegions(start_of_current_region)
if err != nil {
log.Printf("parseMemRegions: %v", err)
LogDebug("parseMemRegions: %v", err)
continue
}
log.Printf("Parsing memory region 0x%x - 0x%x", start_of_current_region, end_of_current_region)
log.Printf("Saving %d bytes from memory region 0x%x - 0x%x", end-start, start, end)
LogDebug("Parsing memory region 0x%x - 0x%x", start_of_current_region, end_of_current_region)
LogDebug("Saving %d bytes from memory region 0x%x - 0x%x", end-start, start, end)
elf_data := current_region[start-start_of_current_region : end-start_of_current_region]
os.WriteFile("/tmp/emp3r0r.restored.1", elf_data, 0o755)

Expand All @@ -80,11 +79,11 @@ func FindEmp3r0rELFInMem() (elf_bytes []byte, err error) {
// refine the start/end of current region using program headers
start, end, err = parseMemRegions(start_of_current_region)
if err != nil {
log.Printf("parseMemRegions: %v", err)
LogDebug("parseMemRegions: %v", err)
continue
}
log.Printf("Parsing memory region 0x%x - 0x%x", start_of_current_region, end_of_current_region)
log.Printf("Saving %d bytes from memory region 0x%x - 0x%x", end-start, start, end)
LogDebug("Parsing memory region 0x%x - 0x%x", start_of_current_region, end_of_current_region)
LogDebug("Saving %d bytes from memory region 0x%x - 0x%x", end-start, start, end)
elf_data = append(elf_data, current_region[start-start_of_current_region:end-start_of_current_region]...)
os.WriteFile("/tmp/emp3r0r.restored.2", current_region, 0o755)

Expand All @@ -95,15 +94,15 @@ func FindEmp3r0rELFInMem() (elf_bytes []byte, err error) {
// refine the start/end of current region using program headers
start, end, err = parseMemRegions(start_of_current_region)
if err != nil {
log.Printf("parseMemRegions: %v", err)
LogDebug("parseMemRegions: %v", err)
continue
}
log.Printf("Parsing memory region 0x%x - 0x%x", start_of_current_region, end_of_current_region)
log.Printf("Saving %d bytes from memory region 0x%x - 0x%x", end-start, start, end)
LogDebug("Parsing memory region 0x%x - 0x%x", start_of_current_region, end_of_current_region)
LogDebug("Saving %d bytes from memory region 0x%x - 0x%x", end-start, start, end)
elf_data = append(elf_data, current_region[start-start_of_current_region:end-start_of_current_region]...)
os.WriteFile("/tmp/emp3r0r.restored.3", current_region, 0o755)

log.Printf("Saved %d bytes to EXE_MEM_FILE", len(elf_data))
LogDebug("Saved %d bytes to EXE_MEM_FILE", len(elf_data))
elf_bytes = elf_data
break
}
Expand Down
11 changes: 5 additions & 6 deletions core/lib/util/file.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ import (
"bytes"
"encoding/json"
"fmt"
"log"
"os"
"os/exec"
"path/filepath"
Expand Down Expand Up @@ -34,7 +33,7 @@ type FileStat struct {
func LsPath(path string) (res string, err error) {
files, err := os.ReadDir(path)
if err != nil {
log.Printf("LsPath: %v", err)
LogDebug("LsPath: %v", err)
return
}

Expand All @@ -43,7 +42,7 @@ func LsPath(path string) (res string, err error) {
for _, f := range files {
info, statErr := f.Info()
if statErr != nil {
log.Printf("LsPath: %v", statErr)
LogDebug("LsPath: %v", statErr)
continue
}
var dent Dentry
Expand Down Expand Up @@ -167,7 +166,7 @@ func AppendTextToFile(filename string, text string) (err error) {
func IsStrInFile(text, filepath string) bool {
f, err := os.Open(filepath)
if err != nil {
log.Printf("IsStrInFile: %v", err)
LogDebug("IsStrInFile: %v", err)
return false
}
defer f.Close()
Expand Down Expand Up @@ -213,7 +212,7 @@ func copyFile(src, dst string) error {
if IsFileExist(dst) {
err = os.RemoveAll(dst)
if err != nil {
log.Printf("Copy: %s exists and cannot be removed: %v", dst, err)
LogDebug("Copy: %s exists and cannot be removed: %v", dst, err)
}
}

Expand Down Expand Up @@ -350,7 +349,7 @@ func GetWritablePaths(root_path string, depth int) ([]string, error) {

files, err := os.ReadDir(path)
if err != nil {
log.Printf("Skipping unreadable directory %s: %v", path, err)
LogDebug("Skipping unreadable directory %s: %v", path, err)
return nil
}

Expand Down
9 changes: 4 additions & 5 deletions core/lib/util/mem.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@ package util
import (
"bytes"
"fmt"
"log"
"os"
"runtime"

Expand Down Expand Up @@ -76,7 +75,7 @@ func GetProcessExe(pid int) (exe_data []byte, err error) {
// separator is MagicString*3
func DigEmbeddedDataFromExe() ([]byte, error) {
wholeStub, err := GetProcessExe(os.Getpid())
log.Printf("Read %d bytes from process executable", len(wholeStub))
LogDebug("Read %d bytes from process executable", len(wholeStub))
if err != nil {
return nil, err
}
Expand All @@ -91,7 +90,7 @@ func DigEmbeddedData(data []byte, base int64) (embedded_data []byte, err error)
// generated by CC per session (delete ~/.emp3r0r to reset)
// we use it to locate the embedded data
magic_str := emp3r0r_def.OneTimeMagicBytes
log.Printf("Digging with magic string '%x' (%d bytes)", magic_str, len(magic_str))
LogDebug("Digging with magic string '%x' (%d bytes)", magic_str, len(magic_str))
sep := bytes.Repeat(magic_str, 2)

if !bytes.Contains(data, sep) {
Expand Down Expand Up @@ -120,7 +119,7 @@ func DigEmbeddedData(data []byte, base int64) (embedded_data []byte, err error)
}

// confirm
log.Printf("Digged %d config bytes from %d bytes of given data at (0x%x)", len(embedded_data), len(data), base)
LogDebug("Digged %d config bytes from %d bytes of given data at (0x%x)", len(embedded_data), len(data), base)
return
}

Expand All @@ -136,7 +135,7 @@ func DigEmbededDataFromMem() (data []byte, err error) {
for base, mem_region := range mem_regions {
data, err = DigEmbeddedData(mem_region, base)
if err != nil {
log.Printf("Nothing in memory region %d (%d bytes): %v", base, len(mem_region), err)
LogDebug("Nothing in memory region %d (%d bytes): %v", base, len(mem_region), err)
continue
}
break
Expand Down
23 changes: 11 additions & 12 deletions core/lib/util/mem_linux.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ package util
import (
"bufio"
"fmt"
"log"
"math"
"os"
"strconv"
Expand Down Expand Up @@ -61,45 +60,45 @@ func DumpProcMem(pid int) (memdata map[int64][]byte, err error) {
line := strings.TrimSpace(scanner.Text())
lineSplit := strings.Fields(line)
if len(lineSplit) == 1 {
log.Printf("%s: failed to parse", line)
LogDebug("%s: failed to parse", line)
continue
}
if !strings.HasPrefix(lineSplit[1], "r") {
// if not readable
log.Printf("%s: not readable", line)
LogDebug("%s: not readable", line)
continue
}

// parse map line
start_end := strings.Split(lineSplit[0], "-")
if len(start_end) == 1 {
log.Printf("%s: failed to parse", line)
LogDebug("%s: failed to parse", line)
continue
}
start, err := strconv.ParseInt(start_end[0], 16, 64)
if err != nil {
log.Printf("%s: failed to parse start", line)
LogDebug("%s: failed to parse start", line)
}
if start < 0 || start > int64(^uint64(0)>>1) {
log.Printf("%s: start address out of bounds", line)
LogDebug("%s: start address out of bounds", line)
continue
}
end, err := strconv.ParseInt(start_end[1], 16, 64)
if err != nil {
log.Printf("%s: failed to parse end", line)
LogDebug("%s: failed to parse end", line)
}
if end < 0 || end == math.MaxInt64 {
log.Printf("%s: end address out of bounds", line)
LogDebug("%s: end address out of bounds", line)
continue
}

// read memory region
read_buf, err := ReadMemoryRegion(0, uintptr(start), uintptr(end-start))
if err != nil {
log.Printf("%s: %v", line, err)
LogDebug("%s: %v", line, err)
continue
}
log.Printf("%s: read %d bytes", line, len(read_buf))
LogDebug("%s: read %d bytes", line, len(read_buf))
memdata[start] = read_buf
}

Expand All @@ -125,12 +124,12 @@ func MemFDWrite(data []byte) int {
mem_name := ""
fd, _, errno := syscall.Syscall(memfdCreateX64, uintptr(unsafe.Pointer(&mem_name)), uintptr(0), 0)
if errno <= 0 {
log.Printf("MemFDWrite: %v", errno)
LogDebug("MemFDWrite: %v", errno)
return -1
}
_, err := syscall.Write(int(fd), data)
if err != nil {
log.Printf("MemFDWrite: %v", err)
LogDebug("MemFDWrite: %v", err)
return -1
}
return int(fd)
Expand Down
7 changes: 3 additions & 4 deletions core/lib/util/mem_windows.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@
package util

import (
"log"
"os"
"syscall"
"unsafe"
Expand Down Expand Up @@ -85,7 +84,7 @@ func DumpProcessMem(hProcess uintptr) (mem_data map[int64][]byte, bytes_read int
address += mbi.RegionSize

// Print information about the memory region
log.Printf("BaseAddress: 0x%x, RegionSize: 0x%x, State: %d, Protect: %d, Type: %d\n",
LogDebug("BaseAddress: 0x%x, RegionSize: 0x%x, State: %d, Protect: %d, Type: %d\n",
mbi.BaseAddress, mbi.RegionSize, mbi.State, mbi.Protect, mbi.Type)

// if memory is not committed or is read-only, skip it
Expand Down Expand Up @@ -157,7 +156,7 @@ func DumpCurrentProcMem() (mem_data map[int64][]byte, err error) {
for fileName, dll := range dlls {
dll_data, err := ReadDLL(dll, fileName)
if err != nil {
log.Printf("reading DLL %s: %v", fileName, err)
LogDebug("reading DLL %s: %v", fileName, err)
continue
}
mem_data[int64(dll.BaseOfDll)] = dll_data
Expand All @@ -166,7 +165,7 @@ func DumpCurrentProcMem() (mem_data map[int64][]byte, err error) {
// dump all memory regions
self_mem_data, err := DumpProcMem(os.Getpid())
if err != nil {
log.Printf("reading self memory: %v", err)
LogDebug("reading self memory: %v", err)
}
for base, data := range self_mem_data {
mem_data[base] = data
Expand Down
Loading

0 comments on commit dfc3257

Please sign in to comment.