Rizin
unix-like reverse engineering framework and cli tools
Macros | Functions
privkey-find.c File Reference
#include <rz_search.h>

Go to the source code of this file.

Macros

#define PRIVKEY_SEARCH_MIN_LENGTH   (1 + 1 + 4 + 1)
 
#define KEY_MAX_LEN   26000
 

Functions

static const ut8 * parse_next_field (const ut8 *start, ut32 *len)
 
static int check_fields (const ut8 *start)
 
RZ_API int rz_search_privkey_update (RzSearch *s, ut64 from, const ut8 *buf, int len)
 

Macro Definition Documentation

◆ KEY_MAX_LEN

#define KEY_MAX_LEN   26000

◆ PRIVKEY_SEARCH_MIN_LENGTH

#define PRIVKEY_SEARCH_MIN_LENGTH   (1 + 1 + 4 + 1)

Definition at line 15 of file privkey-find.c.

Function Documentation

◆ check_fields()

static int check_fields ( const ut8 *  start)
static

Definition at line 44 of file privkey-find.c.

44  {
45 #define KEY_MAX_LEN 26000
46  ut32 field_len = 0;
47  // Sequence field
48  const ut8 *ptr = parse_next_field(start, &field_len);
49  if (!field_len || field_len > KEY_MAX_LEN) {
50  return false;
51  }
52 
53  // Version field
54  ptr = parse_next_field(ptr, &field_len);
55  if (field_len != 1) {
56  return false;
57  }
58  ptr = ptr + field_len;
59  parse_next_field(ptr, &field_len);
60 
61  if (!field_len || field_len > KEY_MAX_LEN) {
62  return false;
63  }
64 
65  return true;
66 }
start
static static sync static getppid static getegid const char static filename char static len const char char static bufsiz static mask static vfork const void static prot static getpgrp const char static swapflags static arg static fd static protocol static who struct sockaddr static addrlen static backlog struct timeval struct timezone static tz const struct iovec static count static mode const void const struct sockaddr static tolen const char static pathname void static offset struct stat static buf void long static basep static whence static length const void static len static semflg const void static shmflg const struct timespec struct timespec static rem const char static group const void start
Definition: sflib.h:133
ut32
uint32_t ut32
Definition: demangler_util.h:31
ut8
uint8_t ut8
Definition: lh5801.h:11
KEY_MAX_LEN
#define KEY_MAX_LEN
parse_next_field
static const ut8 * parse_next_field(const ut8 *start, ut32 *len)
Definition: privkey-find.c:26

References KEY_MAX_LEN, parse_next_field(), and start.

Referenced by rz_search_privkey_update().

◆ parse_next_field()

static const ut8* parse_next_field ( const ut8 *  start,
ut32 *  len 
)
static

Definition at line 26 of file privkey-find.c.

26  {
27  *len = 0;
28  if (!(start[1] & 0x80)) {
29  *len = (ut32)start[1];
30  return start + 2;
31  } else {
32  int i;
33  const int lensize = start[1] & 0x7f;
34  for (i = 0; i < lensize; i++) {
35  *len = (*len << 8) | start[2 + i];
36  }
37  return start + 2 + lensize;
38  }
39 }
len
size_t len
Definition: 6502dis.c:15
i
lzma_index ** i
Definition: index.h:629

References i, len, and start.

Referenced by check_fields(), and rz_search_privkey_update().

◆ rz_search_privkey_update()

RZ_API int rz_search_privkey_update ( RzSearch *  s,
ut64  from,
const ut8 *  buf,
int  len 
)

Definition at line 71 of file privkey-find.c.

71  {
72  int i, k, max, index, t;
73  RzListIter *iter;
74  RzSearchKeyword *kw;
75  const size_t old_nhits = s->nhits;
76  const ut8 rsa_versionmarker[] = { 0x02, 0x01, 0x00, 0x02 };
77  const ut8 ecc_versionmarker[] = { 0x02, 0x01, 0x01, 0x04 };
78  const ut8 safecurves_versionmarker[] = { 0x02, 0x01, 0x00, 0x30 };
79 
80  if (len < PRIVKEY_SEARCH_MIN_LENGTH) {
81  return -1;
82  }
83 
84  rz_list_foreach (s->kws, iter, kw) {
85  // Iteration until the remaining length is too small to contain a key.
86  for (i = 2; i < len - PRIVKEY_SEARCH_MIN_LENGTH; i++) {
87  if (memcmp(buf + i, rsa_versionmarker, sizeof(rsa_versionmarker)) &&
88  memcmp(buf + i, ecc_versionmarker, sizeof(ecc_versionmarker)) &&
89  memcmp(buf + i, safecurves_versionmarker, sizeof(safecurves_versionmarker))) {
90  continue;
91  }
92 
93  index = -1;
94  // Going backward maximum up to 5 characters.
95  if (i < 5) {
96  max = i;
97  } else {
98  max = 5;
99  }
100  for (k = i - 2; k >= i - max; k--) {
101  if (buf[k] == 0x30) { // The sequence identifier is 0x30
102  index = k;
103  break;
104  }
105  }
106 
107  if (index == -1) {
108  continue;
109  }
110 
111  if (check_fields(buf + index)) {
112  parse_next_field(buf + index, &kw->keyword_length);
113  t = rz_search_hit_new(s, kw, from + index);
114  if (t > 1) {
115  return s->nhits - old_nhits;
116  }
117  }
118  }
119  }
120  return -1;
121 }
k
const char * k
Definition: dsignal.c:11
max
int max
Definition: enough.c:225
buf
voidpf void * buf
Definition: ioapi.h:138
check_fields
static int check_fields(const ut8 *start)
Definition: privkey-find.c:44
PRIVKEY_SEARCH_MIN_LENGTH
#define PRIVKEY_SEARCH_MIN_LENGTH
Definition: privkey-find.c:15
s
static RzSocket * s
Definition: rtr.c:28
rz_search_hit_new
RZ_API int rz_search_hit_new(RzSearch *s, RzSearchKeyword *kw, ut64 addr)
Definition: search.c:107
from
static struct sockaddr static addrlen static backlog const void static flags void struct sockaddr from
Definition: sfsocketcall.h:123
rz_list_iter_t
Definition: rz_list.h:13
rz_search_keyword_t
Definition: rz_search.h:34
rz_search_keyword_t::keyword_length
ut32 keyword_length
Definition: rz_search.h:37

References check_fields(), from, i, k, rz_search_keyword_t::keyword_length, len, max, parse_next_field(), PRIVKEY_SEARCH_MIN_LENGTH, rz_search_hit_new(), and s.

Referenced by rz_search_set_mode().