This commit is contained in:
Oscar Krause
2025-04-23 06:30:25 +02:00
parent 010b21ea6f
commit bae0af2e1d

View File

@@ -83,16 +83,26 @@ void cleanup(void)
fclose(gridd_filep); fclose(gridd_filep);
} }
void hexdump(uint8_t *buf, size_t size)
{
for (int i = 0; i < size; i++) {
if (i % 0x10 == 0)
printf("\n%04X: ", i);
printf("%02X ", buf[i]);
}
printf("\n");
}
int read_user_cert(size_t *user_ca_size) int read_user_cert(size_t *user_ca_size)
{ {
char *temp_buffer = (char *)malloc(*user_ca_size); char *temp_buffer = (char *)malloc(*user_ca_size);
assert(temp_buffer != NULL); assert(temp_buffer != NULL);
size_t number_bytes = fread((void *)temp_buffer, *user_ca_size - 1, 1, cert_fp); size_t status = fread((void *)temp_buffer, *user_ca_size - 1, 1, cert_fp);
assert(number_bytes > 0); assert(status > 0);
// Make it a valid string // Make it a valid string
temp_buffer[*user_ca_size] = 0; temp_buffer[*user_ca_size - 1] = 0;
// Basic checks that the input is a PEM // Basic checks that the input is a PEM
if (strstr(temp_buffer, PEM_BEGIN_CERTIFICATE) == NULL|| strstr(temp_buffer, PEM_END_CERTIFICATE) == NULL) if (strstr(temp_buffer, PEM_BEGIN_CERTIFICATE) == NULL|| strstr(temp_buffer, PEM_END_CERTIFICATE) == NULL)
@@ -138,8 +148,8 @@ int main(int argc, char *argv[])
gridd_data = (uint8_t *)malloc(gridd_fp_stats.st_size); gridd_data = (uint8_t *)malloc(gridd_fp_stats.st_size);
assert(gridd_data != NULL); assert(gridd_data != NULL);
size_t number_bytes = fread((void *)gridd_data, gridd_fp_stats.st_size, 1, gridd_filep); size_t status = fread((void *)gridd_data, gridd_fp_stats.st_size, 1, gridd_filep);
assert(number_bytes > 0); assert(status > 0);
// Parse the binary // Parse the binary
std::vector<uint8_t> gridd_vec(gridd_data, gridd_data + gridd_fp_stats.st_size); std::vector<uint8_t> gridd_vec(gridd_data, gridd_data + gridd_fp_stats.st_size);
@@ -216,8 +226,8 @@ int main(int argc, char *argv[])
uint64_t cert_xrefs_array = s_data->offset() + s_data->search(search_target_base_addr + cert_one_offset); uint64_t cert_xrefs_array = s_data->offset() + s_data->search(search_target_base_addr + cert_one_offset);
printf("Found the list of certificates at 0x%x.\n", cert_xrefs_array); printf("Found the list of certificates at 0x%x.\n", cert_xrefs_array);
// TODO: PEs have some mapping oddities, and this is off by a bit. Consider not confusing users. // PEs have some mapping oddities, and this is off by a bit. Don't confuse users.
printf("Erasing the dangling reference to the old certificate at 0x%x (Ignore for Windows daemon).\n", printf("Erasing the dangling reference to the old certificate at 0x%x (Expect offset for Windows daemon).\n",
*(uint64_t *)(gridd_data + cert_xrefs_array + sizeof(uint64_t)) - image_base); *(uint64_t *)(gridd_data + cert_xrefs_array + sizeof(uint64_t)) - image_base);
memset((void *)(gridd_data + cert_xrefs_array + sizeof(uint64_t)), 0, sizeof(uint64_t)); memset((void *)(gridd_data + cert_xrefs_array + sizeof(uint64_t)), 0, sizeof(uint64_t));