racerxdl / shim_with_unprotect.c

// For RTLD_NEXT #define _GNU_SOURCE #include <stdio.h> #include <dlfcn.h> #include <stdlib.h> #include <string.h> #include <sys/mman.h> #include <stdint.h> static FILE *(*real_fopen)(const char *, const char *) = NULL; #define SEARCH_TOKEN_SIZE 6 char mySearchToken[SEARCH_TOKEN_SIZE] = "That's"; void *searchData(char *data, int len, void *start, void *end) { void *i; for(i = start; i < end; i += 1) { if (memcmp(i, data, len) == 0 && i != (void *)data) { return i; } } return NULL; } FILE * fopen ( const char * filename, const char * mode ) { printf("HUEBR, GIBE DATA PLOS, OR I REPORT U HUEHUE\n"); printf("MI NO LIK U FIL, MI UPEN HUE.TXT\n"); return real_fopen("hue.txt", "w"); } void unprotectPage(uint64_t addr) { mprotect((void*)(addr-(addr%4096)),4096,PROT_READ|PROT_WRITE|PROT_EXEC); } void __attribute__((constructor)) initialize(void) { real_fopen = dlsym(RTLD_NEXT, "fopen"); if (real_fopen == NULL) { printf("What? We couldn't find our fopen!!!!\n"); exit(255); // This will crash the program since it isn't expecting to exit in the constructor } void *addr = searchData(mySearchToken, SEARCH_TOKEN_SIZE, (void *)0x400040, (void*)0x400800 ); // Thats for 64 bit. printf("Token Addr: %p\n", addr); unprotectPage((uint64_t)(addr)); printf("Unprotected!\n"); ((char *)addr)[0] = 'Z'; }