Binary patching/hacking VM process

We are continuing our journey as an evil KVM administrator who wants to mess with a tenants virtual machines.

This time we will modify a binary execution code path by changing machine code opcodes in a running process!

Let’s image a simple C program, that looks like this:

This short code will show "You are a superuser!" if our UID is 0 or 666 and in all other cases it will show "You are not that super".

After compiling and executing the code, you will see the following output:

Let’s disassemble check_priv function to understand what is going on under the hood:

• callq 0x400510 <getuid@plt>: here we are calling a getuid function – the result of this function is stored at EAX register;
• mov %eax,-0x4(%rbp): in here we are storing the EAX register value at memory offset, pointed by RBP, minus 4 bytes;
• cmpl $0x0,-0x4(%rbp): this is comparing "0″ and a value on a memory offset we used earlier to store the result from getuid function;
• je 0x400635 <check_priv+31>: if the compared values are equal – jump to the 31th byte of this function;
• cmpl $0x29a,-0x4(%rbp): now compare 0x29a (666) with the memory offset we used earlier to store the result from getuid function ;
• jne 0x40063c <check_priv+38>: if they are not equal – jump to the 38th byte of the function ;
• mov $0x0,%eax: store value "0″ on the return registry;
• jmp 0x400641 <check_priv+43>: jump to byte 43 of this function;
• mov $0xffffffff,%eax: set value "-1″ on the return registry;
• leaveq: Prepares the stack for leaving a function
• retq: return from the function

As you can see, depending on the jump instructions, the return registry is either set with value 0 or with value -1. We want it to be set always to value "0″.

When this would be possible? There’s an awesome instruction called NOP – it basically means: "do nothing and check next byte".

So we would like our code to look like this in the assembly:

The binary code of our function looks right now like this: "55 48 89 e5 48 83 ec 10 e8 ed fe ff3 7d fc 00 74 09 81 7d fc 9a 02 00 00 75 07 b8 00 00 00 00 eb 05 b8 ff ff ff ff c9 c3″

As an evil KVM administrator, I could find this piece of code running inside a VM:

Now we can try to modify binary this part of the memory to change execution path of our program:

By doing this, I jumped 13 bytes further than the beginning of my function and I added 18 NOP instructions, to jump directly to offset @31 and force my function to return desired value!

On my victim machine I will immediately see the desired output:

And that’s it! We have changed the assembly of our program to do what we wanted 🙂

Stay tuned for more!