在C程序中嵌入二进制文件

Question

I am trying to write a program in C that would be able to call certain binaries (ex. lsof, netstat) with options. The purpose of this program is to collect forensic data from a computer, while at the same time this program should not use the binaries of the computer under analysis as they might be compromised. As a result it is required the certified/uncompromised binaries (ex. lsof, netstat -antpu etc) already to be embedded in a C program or to be called by the C program stored in a usb drive for example.

1. Having for example the binary of the "ls" command I created an object file using the linker as follows:

    $ ld -s -r -b binary -o testls.o bin-x86-2.4/ls

2. Using the following command I extracted the following entry points from the object file

    $ nm testls.o

    000000000007a0dc D _binary_bin_x86_2_4_ls_end
    000000000007a0dc A _binary_bin_x86_2_4_ls_size
    0000000000000000 D _binary_bin_x86_2_4_ls_start

3. The next step would be to call the "function" from the main program with some options that I might need for example "ls -al". Thus I made a C program to call the entry point of the object file.

4. Then I compiled the program with the following gcc options

    gcc -Wall -static testld.c testls.o -o testld

This is the main program:

#include <stdio.h>

extern int _binary_bin_x86_2_4_ls_start();

int main(void)  
{
    _binary_bin_x86_2_4_ls_start();
    return 0;
}

When I run the program I am getting a segmentation fault. I checked the entry points using the objdump in the testld program and the linking seems to be successful. Why then I am getting a segmentation fault? I still need also to call "ls" with options. How I could do this, ie call the "function" with the arguments "-al".

Thank you.

Answer 1

The ELF header of a binary isn't a function. You can't call it. If you could (like in some ancient binary formats) it would be a really bad idea because it would never return.

If you want to run another program midstream do this:

int junk;
pid_t pid;
if (!(pid = fork())) {
    execl("ls", "/bin/ls", ...); /* this results in running ls in current directory which is probably what you want but maybe you need to adjust */
    _exit(3);
}
if (pid > 0) waitpid(pid, &junk, 0);

Error handling omitted for brevity.

In your case, you should ship your own copies of your binaries alongside your program.