diff --git a/content/pages/_index.md b/content/pages/_index.md new file mode 100644 index 0000000..ac36e06 --- /dev/null +++ b/content/pages/_index.md @@ -0,0 +1,2 @@ ++++ ++++ diff --git a/content/pages/bangbangcon2021/corrolove old.svg b/content/pages/bangbangcon2021/corrolove old.svg new file mode 100644 index 0000000..1c30d17 --- /dev/null +++ b/content/pages/bangbangcon2021/corrolove old.svg @@ -0,0 +1,3308 @@ + + + + + + + + + + + + + + + + + + + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/content/pages/bangbangcon2021/corrolove.svg b/content/pages/bangbangcon2021/corrolove.svg new file mode 100644 index 0000000..8f73f4c --- /dev/null +++ b/content/pages/bangbangcon2021/corrolove.svg @@ -0,0 +1,3345 @@ + + + + + + + + + + + + + + + + + + + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/content/pages/bangbangcon2021/corropeek-flip.svg b/content/pages/bangbangcon2021/corropeek-flip.svg new file mode 100644 index 0000000..1ec21d9 --- /dev/null +++ b/content/pages/bangbangcon2021/corropeek-flip.svg @@ -0,0 +1,1401 @@ + + + + + + + + + + + + + + + + + + + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/content/pages/bangbangcon2021/corropeek.svg b/content/pages/bangbangcon2021/corropeek.svg new file mode 100644 index 0000000..795f159 --- /dev/null +++ b/content/pages/bangbangcon2021/corropeek.svg @@ -0,0 +1,1398 @@ + + + + + + + + + + + + + + + + + + + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/content/pages/bangbangcon2021/custom.js b/content/pages/bangbangcon2021/custom.js new file mode 100644 index 0000000..a701b34 --- /dev/null +++ b/content/pages/bangbangcon2021/custom.js @@ -0,0 +1,12 @@ +slideshow.on('showSlide', s => { + if (s.properties['video-fullscreen']) { + const el = document.createElement("video"); + el.classList.add('video-fullscreen'); + el.src = s.properties['video-fullscreen']; + el.controls = false; + document.body.prepend(el); + el.play(); + } else { + document.querySelectorAll('.video-fullscreen').forEach(el => el.parentElement.removeChild(el)); + } +}); diff --git a/content/pages/bangbangcon2021/demo/.gitignore b/content/pages/bangbangcon2021/demo/.gitignore new file mode 100644 index 0000000..ea8c4bf --- /dev/null +++ b/content/pages/bangbangcon2021/demo/.gitignore @@ -0,0 +1 @@ +/target diff --git a/content/pages/bangbangcon2021/demo/.vim/coc-settings.json b/content/pages/bangbangcon2021/demo/.vim/coc-settings.json new file mode 100644 index 0000000..9966190 --- /dev/null +++ b/content/pages/bangbangcon2021/demo/.vim/coc-settings.json @@ -0,0 +1,6 @@ +{ + "suggest.floatEnable": false, + "signature.enable": false, + "suggest.enablePreview": false, + "suggest.autoTrigger": "none", +} diff --git a/content/pages/bangbangcon2021/demo/Cargo.lock b/content/pages/bangbangcon2021/demo/Cargo.lock new file mode 100644 index 0000000..db4a8d3 --- /dev/null +++ b/content/pages/bangbangcon2021/demo/Cargo.lock @@ -0,0 +1,129 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "aho-corasick" +version = "0.7.18" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f" +dependencies = [ + "memchr", +] + +[[package]] +name = "cfg-if" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" + +[[package]] +name = "demo" +version = "0.1.0" +dependencies = [ + "libc", + "owoify", +] + +[[package]] +name = "getrandom" +version = "0.1.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce" +dependencies = [ + "cfg-if", + "libc", + "wasi", +] + +[[package]] +name = "libc" +version = "0.2.94" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "18794a8ad5b29321f790b55d93dfba91e125cb1a9edbd4f8e3150acc771c1a5e" + +[[package]] +name = "memchr" +version = "2.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b16bd47d9e329435e309c58469fe0791c2d0d1ba96ec0954152a5ae2b04387dc" + +[[package]] +name = "owoify" +version = "0.1.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f5d5373685d13f2b6080231760ae4e1ca37161f129e1eb2393ea9028ffa49339" +dependencies = [ + "rand", + "regex", +] + +[[package]] +name = "ppv-lite86" +version = "0.2.10" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ac74c624d6b2d21f425f752262f42188365d7b8ff1aff74c82e45136510a4857" + +[[package]] +name = "rand" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03" +dependencies = [ + "getrandom", + "libc", + "rand_chacha", + "rand_core", + "rand_hc", +] + +[[package]] +name = "rand_chacha" +version = "0.2.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402" +dependencies = [ + "ppv-lite86", + "rand_core", +] + +[[package]] +name = "rand_core" +version = "0.5.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19" +dependencies = [ + "getrandom", +] + +[[package]] +name = "rand_hc" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c" +dependencies = [ + "rand_core", +] + +[[package]] +name = "regex" +version = "1.5.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ce5f1ceb7f74abbce32601642fcf8e8508a8a8991e0621c7d750295b9095702b" +dependencies = [ + "aho-corasick", + "memchr", + "regex-syntax", +] + +[[package]] +name = "regex-syntax" +version = "0.6.25" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b" + +[[package]] +name = "wasi" +version = "0.9.0+wasi-snapshot-preview1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519" diff --git a/content/pages/bangbangcon2021/demo/Cargo.toml b/content/pages/bangbangcon2021/demo/Cargo.toml new file mode 100644 index 0000000..d0407b1 --- /dev/null +++ b/content/pages/bangbangcon2021/demo/Cargo.toml @@ -0,0 +1,14 @@ +[package] +name = "demo" +version = "0.1.0" +edition = "2018" + +# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html + +[dependencies] +libc = "0.2.94" +owoify = "0.1.5" + +[profile.dev] +opt-level = 3 +debug = true diff --git a/content/pages/bangbangcon2021/demo/src/main.rs b/content/pages/bangbangcon2021/demo/src/main.rs new file mode 100644 index 0000000..5ca9755 --- /dev/null +++ b/content/pages/bangbangcon2021/demo/src/main.rs @@ -0,0 +1,35 @@ +use crate::things::*; +use libc::*; +use std::{mem, slice, str}; +mod things; + +use owoify::OwOifiable; +static mut REAL_WRITE: Option = None; + +unsafe extern "C" fn write_owo(fd: i32, ptr: *const c_void, len: usize) -> isize { + let s = slice::from_raw_parts(ptr as *const _, len); + let s = str::from_utf8(s).unwrap(); + let owoified = s.to_string().owoify(); + + REAL_WRITE.unwrap()(fd, owoified.as_ptr() as *const _, owoified.len()); + len as isize +} + +fn main() { + let addr = get_hex_from_cmdline(); + let addr = (addr + 0x555555554000) as *mut usize; + + unsafe { + REAL_WRITE = Some(mem::transmute(*addr)); + mprotect( + (addr as usize & !(0x1000 - 1)) as *mut _, + 0x1000, + PROT_READ | PROT_WRITE, + ); + *addr = write_owo as usize; + } + let s = "hello !!con!!\n"; + unsafe { write(1, s.as_ptr() as *const _, s.len()) }; + + println!("hello !!con!! from println"); +} diff --git a/content/pages/bangbangcon2021/demo/src/things.rs b/content/pages/bangbangcon2021/demo/src/things.rs new file mode 100644 index 0000000..32d0c6b --- /dev/null +++ b/content/pages/bangbangcon2021/demo/src/things.rs @@ -0,0 +1,4 @@ +pub type LibcWrite = unsafe extern "C" fn(fd: i32, ptr: *const libc::c_void, len: usize) -> isize; +pub fn get_hex_from_cmdline() -> usize { + usize::from_str_radix(&std::env::args().skip(1).next().unwrap(), 16).unwrap() +} diff --git a/content/pages/bangbangcon2021/flow.dot b/content/pages/bangbangcon2021/flow.dot new file mode 100644 index 0000000..1dba6dc --- /dev/null +++ b/content/pages/bangbangcon2021/flow.dot @@ -0,0 +1,35 @@ +digraph A { + // rankdir=LR + node [shape=record, style=rounded, fontname = "Source Sans Pro"] + edge [fontname="Source Sans Pro", fontsize=12] + + auxv [label = "getauxval(AT_PHDR)" shape=ellipse] + pbase [label = "program base address"] + phdr[label = "{ Elf64_Phdr | p_type | p_vaddr}"] + auxv -> phdr:name + phdr:ty -> pbase:n [headlabel = "p_type=PT_PHDR", labeldistance=5, labelangle=-80] + phdr:va:se -> pbase:w [headlabel = "phdr addr - p_vaddr", labelangle=140, labeldistance=2.5] + + dyn [label=" Elf64_Dyn |
d_tag | d_val"] + strtab [label=" string table| write\\0writev\\0..."] + rela [label=" + Elf64_Rela | {r_info | symbol table offset(32) | type(32)} | r_offset + "] + + symtab [label=" + Elf64_Sym | st_name + "] + + sym [label = "target symbol! | name | offset"] + + phdr:ty -> dyn:name [label="p_type=PT_DYNAMIC"] + phdr:va:sw -> dyn:name + dyn:dt -> rela:name [label="d_tag=DT_RELA"] + dyn:dt -> strtab:name [label="d_tag=DT_STRTAB"] + dyn:dt -> symtab:name:n [label="d_tag=DT_SYMTAB"] + rela:u32:sw->symtab:name:ne [headlabel="index", labeldistance=2.5, labelangle=40] + strtab:val -> sym:symname [headlabel = "compare with", labeldistance=5.5, labelangle=60] + symtab:symname -> strtab:val + rela:roffs->sym:symoffs + pbase->sym:symoffs [headlabel = "add for\na ptr!", labeldistance=4] +} \ No newline at end of file diff --git a/content/pages/bangbangcon2021/flow.svg b/content/pages/bangbangcon2021/flow.svg new file mode 100644 index 0000000..9bc6d43 --- /dev/null +++ b/content/pages/bangbangcon2021/flow.svg @@ -0,0 +1,652 @@ + + + + + + image/svg+xml + + + + + + + + A + + + + auxv + + getauxval(AT_PHDR) + + + + phdr + + Elf64_Phdr + + p_type + + p_vaddr + + + + auxv->phdr:name + + + + + + pbase + + program base address + + + + sym + + target symbol! + + name + + offset + + + + pbase->sym:symoffs + + + add for + a ptr! + + + + phdr:ty->pbase:n + + + p_type=PT_PHDR + + + + phdr:se->pbase:w + + + phdr addr - p_vaddr + + + + dyn + + Elf64_Dyn + + d_tag + + d_val + + + + phdr:ty->dyn:name + + + p_type=PT_DYNAMIC + + + + phdr:sw->dyn:name + + + + + + strtab + + string table + + write\0writev\0... + + + + dyn:dt->strtab:name + + + d_tag=DT_STRTAB + + + + rela + + Elf64_Rela + + r_info + + symbol table offset(32) + + type(32) + + r_offset + + + + dyn:dt->rela:name + + + d_tag=DT_RELA + + + + symtab + + Elf64_Sym + + st_name + + + + dyn:dt->symtab:n + + + d_tag=DT_SYMTAB + + + + strtab:val->sym:symname + + + compare with + + + + rela:sw->symtab:ne + + + index + + + + rela:roffs->sym:symoffs + + + + + + symtab:symname->strtab:val + + + + + diff --git a/content/pages/bangbangcon2021/getauxval.png b/content/pages/bangbangcon2021/getauxval.png new file mode 100644 index 0000000..30de943 Binary files /dev/null and b/content/pages/bangbangcon2021/getauxval.png differ diff --git a/content/pages/bangbangcon2021/index.md b/content/pages/bangbangcon2021/index.md new file mode 100644 index 0000000..55e108e --- /dev/null +++ b/content/pages/bangbangcon2021/index.md @@ -0,0 +1,20 @@ ++++ +title = "!!Con 2021!!" +date = 2021-05-15 +path = "/bangbangcon2021" +[extra] +isPage = true ++++ + +This is the page for my talk "pwintln!(): teaching an ELF to uwu!!" at [!!Con +2021](https://bangbangcon.com/). + +You can find the slides [here](./slides.html). + +The source code for the presentation, demo, etc is +[here](https://github.com/lf-/blog/tree/main/content/pages/bangbangcon2021/). + +If you'd like to send me a message: + +* [@ me on twitter](https://twitter.com/leftpaddotpy) +* email me at jade at jade dot fyi diff --git a/content/pages/bangbangcon2021/pwintln.png b/content/pages/bangbangcon2021/pwintln.png new file mode 100644 index 0000000..83c500a Binary files /dev/null and b/content/pages/bangbangcon2021/pwintln.png differ diff --git a/content/pages/bangbangcon2021/readelf-headers.png b/content/pages/bangbangcon2021/readelf-headers.png new file mode 100644 index 0000000..e8ffce9 Binary files /dev/null and b/content/pages/bangbangcon2021/readelf-headers.png differ diff --git a/content/pages/bangbangcon2021/slides.css b/content/pages/bangbangcon2021/slides.css new file mode 100644 index 0000000..7d504c8 --- /dev/null +++ b/content/pages/bangbangcon2021/slides.css @@ -0,0 +1,121 @@ +@import url(https://fonts.googleapis.com/css?family=Yanone+Kaffeesatz); +@import url(https://fonts.googleapis.com/css?family=Droid+Serif:400,700,400italic); +@import url(https://fonts.googleapis.com/css?family=Ubuntu+Mono:400,700,400italic); + +body { + font-family: "Droid Serif"; +} + +h1, +h2, +h3 { + font-family: "Yanone Kaffeesatz"; + font-weight: normal; +} + +.remark-slide-content { + font-size: 30px; +} + +.remark-slide-number, +.siteLink { + font-size: 20px; +} + +.remark-code { + font-size: 30px; +} + +h1#motivation, h1#fin { + /* this is terrible */ + margin-bottom: 0; +} + +h1#fin + p { + margin: 0; +} + +.tweetbox { + margin: auto; + width: 80%; + height: 100%; +} + +.firstslideCode { + /* twitter: @leftpaddotpy */ + /* this is a crime but it achieves centering */ + width: 22ch; +} + +.siteLink { + position: absolute; + left: 20px; + bottom: 12px; +} + +.siteLink a:visited { + color: #222; +} + +.siteLink a { + color: #222; +} + +.siteLink p { + display: inline; + margin: 0; +} + +.fullscale { + width: 80%; +} + +.remark-code, +.remark-inline-code { + font-family: "Ubuntu Mono"; +} + +.video-fullscreen { + width: 100vw; + top: 0; + height: 100vh; + position: fixed; + z-index: 100; +} + +.corroPeekTopRight { + position: absolute; + right: 0; + top: 0; +} + +.corroPeekTopLeft { + position: absolute; + left: 0; + top: 0; + width: 12%; + height: auto; +} + +.angeryCentering { + display: block; + margin: auto; +} + +.centering { + margin: auto; +} + +.centering img { + max-width: 100%; +} + +.cursedcentering { + margin: auto; +} + +.cursedcentering img { + max-height: 15em; + display: block; + margin: auto; +} diff --git a/content/pages/bangbangcon2021/slides.html b/content/pages/bangbangcon2021/slides.html new file mode 100644 index 0000000..8c6bb54 --- /dev/null +++ b/content/pages/bangbangcon2021/slides.html @@ -0,0 +1,179 @@ + + + + pwintln!() + + + + + + + + + + + diff --git a/content/pages/bangbangcon2021/unsafe Corro.svg b/content/pages/bangbangcon2021/unsafe Corro.svg new file mode 100644 index 0000000..bfaa515 --- /dev/null +++ b/content/pages/bangbangcon2021/unsafe Corro.svg @@ -0,0 +1,889 @@ + + + + + + + + + + + + + + + + + + + +image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +