#7 Patching fails with latest Navicat 15.0.19

クローズ
1 年間 前vl77 によって開かれました · 10 コメント
vl771 年間 前 にコメントしました

While I have successfully compiled the binaries and used them with previous versions of Navicat, trying to patch the latest 15.0.19, it fails and core dumps.

./navicat-patcher /media/ext2/incoming/navicat RegPrivateKey.pem
**********************************************************
*       Navicat Patcher (Linux) by @DoubleLabyrinth      *
*                  Version: 1.0                          *
**********************************************************

Press ENTER to continue or Ctrl + C to abort.

[+] Try to open libcc.so ... Ok!

terminate called without an active exception
Aborted (core dumped)
While I have successfully compiled the binaries and used them with previous versions of Navicat, trying to patch the latest 15.0.19, it fails and core dumps. ``` ./navicat-patcher /media/ext2/incoming/navicat RegPrivateKey.pem ********************************************************** * Navicat Patcher (Linux) by @DoubleLabyrinth * * Version: 1.0 * ********************************************************** Press ENTER to continue or Ctrl + C to abort. [+] Try to open libcc.so ... Ok! terminate called without an active exception Aborted (core dumped) ```
DeltaFoX1 年間 前 にコメントしました

Confirm this issue on linux...

https://i.imgur.com/c1O7XQv.jpg

regards

Confirm this issue on linux... https://i.imgur.com/c1O7XQv.jpg regards
DeltaFoX1 年間 前 にコメントしました

libcc.so

https://mega.nz/file/eaJgAKpK#HxPGkXU950bUPF6wygoYm8p8n66r1mB2PtrOcfmkvVc

the problem appears to be in the part of the code at line 129 of the file: PatchSolution0.cpp on linee 129

l = snprintf(nullptr, 0,

                            asm_template, 
                            this->m_DisassemblyEngine.GetRegisterName(char_reg), 
                            this->m_DisassemblyEngine.GetRegisterName(lpsz_reg),
                            PatchMarkRva.value() + offsetof(PatchMarkType, Data)
                        );

specifically in the call of : PatchMarkRva.value()

can be confirm this?

libcc.so https://mega.nz/file/eaJgAKpK#HxPGkXU950bUPF6wygoYm8p8n66r1mB2PtrOcfmkvVc the problem appears to be in the part of the code at line 129 of the file: PatchSolution0.cpp on linee 129 l = snprintf(nullptr, 0, asm_template, this->m_DisassemblyEngine.GetRegisterName(char_reg), this->m_DisassemblyEngine.GetRegisterName(lpsz_reg), PatchMarkRva.value() + offsetof(PatchMarkType, Data) ); specifically in the call of : PatchMarkRva.value() can be confirm this?
Double Sine1 年間 前 にコメントしました
オーナー

I think that is because PatchMarkRva has not been given a value when code runs there. It seems the previous code

...
...
            {
                std::map<Elf64_Off, Elf64_Xword> SpaceMap{ { 0, m_Image.ElfSize() } };
                
                SearchFreeSpace(SpaceMap, m_Image);
                
                for (const auto& space : SpaceMap) {
                    bool found = false;
                    auto offset = space.first;
                    auto size = space.second;
                    
                    if (size >= sizeof(PatchMarkType)) {
                        for (size_t i = 0; i < m_Image.NumberOfElfProgramHeaders(); ++i) {
                            auto seg_hdr = m_Image.ElfProgramHeader(i);
                            if (seg_hdr->p_type == PT_LOAD && seg_hdr->p_offset + seg_hdr->p_filesz == offset) {
                                RefSegment = seg_hdr;
                                PatchMarkOffset = offset;
                                PatchMarkRva = m_Image.ConvertOffsetToRva(offset - 1) + 1;
                                found = true;
                                break;
                            }
                        }
                    }

                    if (found) {
                        break;
                    }
                }
            }
...
...

did not find free space to store our public key.

That would be a big problem. I need to figure out a new solution.

I think that is because `PatchMarkRva` has not been given a value when code runs there. It seems the previous code ```cpp ... ... { std::map<Elf64_Off, Elf64_Xword> SpaceMap{ { 0, m_Image.ElfSize() } }; SearchFreeSpace(SpaceMap, m_Image); for (const auto& space : SpaceMap) { bool found = false; auto offset = space.first; auto size = space.second; if (size >= sizeof(PatchMarkType)) { for (size_t i = 0; i < m_Image.NumberOfElfProgramHeaders(); ++i) { auto seg_hdr = m_Image.ElfProgramHeader(i); if (seg_hdr->p_type == PT_LOAD && seg_hdr->p_offset + seg_hdr->p_filesz == offset) { RefSegment = seg_hdr; PatchMarkOffset = offset; PatchMarkRva = m_Image.ConvertOffsetToRva(offset - 1) + 1; found = true; break; } } } if (found) { break; } } } ... ... ``` did not find free space to store our public key. That would be a big problem. I need to figure out a new solution.
DeltaFoX1 年間 前 にコメントしました

ok thank's for the info.

low space here :

https://i.imgur.com/seZLcir.jpg

this lib might be useful :

https://lief.quarkslab.com/

for Code injection?

Regards

ok thank's for the info. low space here : https://i.imgur.com/seZLcir.jpg this lib might be useful : https://lief.quarkslab.com/ for Code injection? Regards
vl771 年間 前 にコメントしました
ポスター

Any news on this one...?

Any news on this one...?
vl771 年間 前 にコメントしました
ポスター

Hey @doublesine, have you had the chance to look into this issue?

Hey @doublesine, have you had the chance to look into this issue?
DeltaFoX1 年間 前 にコメントしました

15.0.20 Online Work again..

15.0.20 Online Work again..
vl771 年間 前 にコメントしました
ポスター

Yeap, at least on Windows it works fine. I will test later on Linux.

Yeap, at least on Windows it works fine. I will test later on Linux.
DeltaFoX1 年間 前 にコメントしました

Already tested linux version work fine

Already tested linux version work fine
vl771 年間 前 にコメントしました
ポスター

Ok, version 15.0.19 was a failure, 15.0.20 for Linux and 15.0.18 for Windows are ok.

Closing this.

Ok, version 15.0.19 was a failure, 15.0.20 for Linux and 15.0.18 for Windows are ok. Closing this.
vl77 1 年間 前 に閉じられました
会話に参加するには サインイン してください。
ラベルなし
マイルストーンなし
担当者なし
3 参加者
読み込み中…
キャンセル
保存
まだコンテンツがありません