#define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #define PATTERN "\xeb\x1f\x4f\x53\x46\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \ "\x20\x20\x20\x20\x20\xb8" int main (int argc, char **argv) { int fd; char *ptr, *ptr2, *ptr3; struct stat st; Elf32_Ehdr *elf; if (argc != 2) { printf("Usage: %s \n\n", argv[0]); exit(EXIT_FAILURE); } printf("%s: ", argv[1]); fd = open(argv[1], O_RDWR); if (fd < 0) { printf("open: %s\n", strerror(errno)); exit(EXIT_FAILURE); } fstat(fd, &st); ptr = mmap(NULL, st.st_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); if (ptr == MAP_FAILED) { printf("mmap: %s\n", strerror(errno)); exit(EXIT_FAILURE); } if (memcmp(ptr, ELFMAG, SELFMAG)) { printf("Not an ELF file.\n"); exit(EXIT_FAILURE); } elf = (Elf32_Ehdr *) ptr; ptr2 = memmem(ptr, st.st_size, PATTERN, strlen(PATTERN)); if (!ptr2) { printf("Pattern not found!\n"); exit(EXIT_SUCCESS); } ptr3 = memmem(ptr2+1, st.st_size - (ptr2-ptr), PATTERN, strlen(PATTERN)); if (ptr3) { printf("Pattern found twice! Repair manually!\n"); exit(EXIT_FAILURE); } printf("Found Pattern - "); memset(ptr2, 0, strlen(PATTERN)); ptr2 += strlen(PATTERN); printf("Entry point: m: 0x%08x; o: 0x%p - done.\n", elf->e_entry, *((void **)(ptr2))); memcpy(ptr+24, ptr2, 4); munmap(ptr, st.st_size); close(fd); exit(EXIT_SUCCESS); }