/*
** quick simple program which will try to clean binary
** files which have been infected by the so-called
** Linux.Jac.8759 virus.
**
** some files get destroyed when infected by the virus
** and these can not be saved with this program...
**
** not exactly a text-book example of good coding,
** hehe, but at least it (should) work...
**
** ;Pp
** 
** by stringz / hologram!
** please mail me suggestions / fan mail etc to:
**
** ---> stringzz@hushmail.com <--- 
**
** now you can use your 7350 wares without the phear of
** being infected!!!
**
** (http://packetstorm.mirror.widexs.nl/removed/73501867)
**
** Thu Oct 31 03:01:52 CET 2002
*/

#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <elf.h>

/*
** function prototypes.
*/

void         setprogname (const char * s);
const char * getprogname (void);
void         die (const char * fmt, ...);
int          nprint (const char * fmt, ...);

int          elf_check (const char * binary, Elf32_Ehdr * ehdr);
Elf32_Phdr * locate_segment (Elf32_Word p_type, Elf32_Word p_flags);
Elf32_Shdr * locate_section (const char * section);

/*
** global variables.
*/

char * name = NULL;
char * mmapf;

struct stat filestats;

Elf32_Ehdr * ehdr;
Elf32_Phdr * phdr;
Elf32_Shdr * shdr;

enum { INFECTION_SIZE = 8759,
       PAGE_SIZE  = 4096
};

/*
** common helper functions.
*/

void
setprogname (const char * s)
{
  name = strdup (s);
}

const char *
getprogname (void)
{
  return name;
}

void
die (const char * fmt, ...)
{
    va_list ap;
    
    if (getprogname () != NULL)
	fprintf (stderr, "%s: ", getprogname ());
    
    va_start (ap, fmt);
    vfprintf (stderr, fmt, ap);
    va_end (ap);
    
    if (fmt[strlen (fmt) - 1] == ':')
	fprintf (stderr, " %s.\n", strerror (errno));
    
    fflush (NULL);
    exit (EXIT_FAILURE);
}

int
nprint (const char * fmt, ...)
{
    static unsigned int count = 1;
    va_list ap;
    int n;
    
    printf ("[%.2d] ", count++);
    
    va_start (ap, fmt);
    n = vprintf (fmt, ap);
    va_end (ap);
    
    fflush (stdout);
    return n;
}

/*
** elf specific functions.
*/

int
elf_check (const char * binary, Elf32_Ehdr * ehdr)
{
    if (strncmp (ehdr->e_ident, ELFMAG, SELFMAG)) {
        printf ("%s: File is not ELF.\n", binary);
	return -1;
    }
    
    switch (ehdr->e_type) {
    case ET_NONE:
        printf ("%s: no file type.\n", binary);
	return -1;
    case ET_REL:
        printf ("%s: relocatable file.\n", binary);
	return -1;
    case ET_DYN:
        printf ("%s: shared object file.\n", binary);
	return -1;
    case ET_CORE:
        printf ("%s: core file.\n", binary);
	return -1;
    }

    if (ehdr->e_type != ET_EXEC) {
        printf ("%s: not a executable file.\n", binary);
	return -1;
    }
    if (ehdr->e_machine != EM_386) {
        printf ("%s: not build for Intel 80386 architecture.\n", binary);
	return -1;
    }
    return 0;
}

Elf32_Phdr *
locate_segment (Elf32_Word p_type, Elf32_Word p_flags)
{
    Elf32_Phdr * phdr_tmp = phdr;
    int i;
    
    for (i = 0 ; i < ehdr->e_phnum ; i++, phdr_tmp++) {
	if (phdr_tmp->p_type  == p_type &&
	    phdr_tmp->p_flags == p_flags)
	    return phdr_tmp;
    }
    return NULL;
}

Elf32_Shdr *
locate_section (const char *section)
{
    Elf32_Shdr * shdr_tmp = shdr;
    const char * strt;
    int i;
    
    strt = mmapf + (shdr + ehdr->e_shstrndx)->sh_offset;
    
    for (i = 0 ; i < ehdr->e_shnum ; i++, shdr_tmp++) {
	if (shdr_tmp->sh_name != 0)
	    if (!strcmp (section, &strt[shdr_tmp->sh_name]))
		return shdr_tmp;
    }
    return NULL;
}

/*
 */

int
main (int argc, char ** argv)
{
    Elf32_Phdr * text, * data, * dyn;
    Elf32_Shdr * data_sec;
    const  char * binary;
    char * outfile;
    int    fd;
    int    i, n;
    size_t left;

    if (argc < 2)
	die ("USAGE: %s <ph1l3>\n", argv[0]);

    setprogname ("vaccine");
    nprint ("attempting to clean binary: %s.\n", argv[1]);
    puts ("------------------------------------------\n");

    n = access (binary = argv[1], R_OK);
    if (n < 0)
	die ("%s:", binary);

    n = stat (binary, &filestats);
    if (n < 0)
	die ("%s: stat failed:", binary);
    
    fd = open (binary, O_RDONLY);
    if (fd < 0)
	die ("%s: open failed:", binary);

    mmapf = mmap (NULL, filestats.st_size, PROT_READ
		  | PROT_WRITE, MAP_PRIVATE, fd, 0);
    if (mmapf == MAP_FAILED)
	die ("%s: mmap failed:", binary);
    close (fd);

    n = elf_check (binary, ehdr = (Elf32_Ehdr *) mmapf);
    if (n < 0) {
	printf ("exiting ...\n");
	exit (EXIT_SUCCESS);
    }

    phdr = (Elf32_Phdr *) (mmapf + ehdr->e_phoff);
    shdr = (Elf32_Shdr *) (mmapf + ehdr->e_shoff);

    text = locate_segment (PT_LOAD, PF_R | PF_X);
    data = locate_segment (PT_LOAD, PF_R | PF_W);
    dyn  = locate_segment (PT_DYNAMIC, PF_R | PF_W);

    if (text == NULL)
	die ("couldn't find text segment!?\n");
    if (data == NULL)
	die ("couldn't find data segment!?\n");
    if (dyn  == NULL)
	die ("couldn't find dyn  segment!?\n");

    /** is binary infected? **/

    if (ehdr->e_entry == (text->p_vaddr + text->p_memsz - PAGE_SIZE)
	&& ehdr->e_ident[EI_PAD + 1] == '\x02')
	nprint ("file is infected with Linux.Jac.8759.\n\n");
    else {
	nprint ("file is not infected with Linux.Jac.8759.\n");
	exit (EXIT_SUCCESS);
    }

    nprint ("cleaning ELF Header.\n");

    /* leave infection mark to justify the vaccine name? :P */
#if 1
    bzero (&ehdr->e_ident[EI_PAD], EI_NIDENT - EI_PAD);
#endif
    /* set's ehdr->e_entry to point to the beginning
    ** of _start initialization code.
    */

    ehdr->e_entry = (locate_section (".text"))->sh_addr;
    ehdr->e_shoff -= PAGE_SIZE;

    nprint ("cleaning Program Headers.\n");

    text->p_filesz -= PAGE_SIZE;
    text->p_memsz  -= PAGE_SIZE;
    data->p_offset -= PAGE_SIZE;
    dyn->p_offset  -= PAGE_SIZE;

    nprint ("cleaning Section Headers.\n");

    data_sec = locate_section (".data");
    if (data_sec == NULL)
	die ("couldn't find .data section?!\n");

    for (i = 0 ; i < ehdr->e_shnum ; i++, shdr++) {
	if (data_sec->sh_offset <= shdr->sh_offset)
	    shdr->sh_offset -= PAGE_SIZE;
    }

    /** even more dirty code, you are hereby warned... */

    outfile = malloc (strlen (binary) + 7);
    if (outfile == NULL)
	die ("malloc failed:");

    strcat (strcpy (outfile, binary), ".clean");
    
    fd = open (outfile, O_WRONLY | O_CREAT | O_TRUNC, filestats.st_mode);
    if (fd < 0)
	die ("open failed:");

    n = write (fd, mmapf, text->p_offset + text->p_filesz);
    if (n != (text->p_offset + text->p_filesz))
	die ("write failed:");

    nprint ("removing virus code.\n\n");

    left = filestats.st_size - (text->p_offset + text->p_filesz);
    left -= PAGE_SIZE;

    n = write (fd, mmapf + text->p_offset + text->p_filesz + PAGE_SIZE,
	       (left - (INFECTION_SIZE - PAGE_SIZE)));
    if (n != (left - (INFECTION_SIZE - PAGE_SIZE)))
	die ("write failed:");

    close (fd);
    munmap (mmapf, filestats.st_size);

    nprint ("cleaned file -> %s.\n", outfile);
    exit (EXIT_SUCCESS);
}