Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
L
libplist
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
1
Issues
1
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
pwn
libplist
Commits
3955a281
Commit
3955a281
authored
Jan 19, 2017
by
Nikias Bassen
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
bplist: Use proper struct for binary plist trailer
parent
26061aac
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
31 additions
and
47 deletions
+31
-47
bplist.c
src/bplist.c
+31
-47
No files found.
src/bplist.c
View file @
3955a281
...
@@ -40,19 +40,20 @@
...
@@ -40,19 +40,20 @@
#include <node_iterator.h>
#include <node_iterator.h>
/* Magic marker and size. */
/* Magic marker and size. */
#define BPLIST_MAGIC
((uint8_t*)"bplist")
#define BPLIST_MAGIC
((uint8_t*)"bplist")
#define BPLIST_MAGIC_SIZE
6
#define BPLIST_MAGIC_SIZE
6
#define BPLIST_VERSION
((uint8_t*)"00")
#define BPLIST_VERSION
((uint8_t*)"00")
#define BPLIST_VERSION_SIZE
2
#define BPLIST_VERSION_SIZE
2
typedef
struct
__attribute__
((
packed
))
{
#define BPLIST_TRL_SIZE 26
uint8_t
unused
[
6
];
#define BPLIST_TRL_OFFSIZE_IDX 0
uint8_t
offset_size
;
#define BPLIST_TRL_PARMSIZE_IDX 1
uint8_t
ref_size
;
#define BPLIST_TRL_NUMOBJ_IDX 2
uint64_t
num_objects
;
#define BPLIST_TRL_ROOTOBJ_IDX 10
uint64_t
root_object_index
;
#define BPLIST_TRL_OFFTAB_IDX 18
uint64_t
offset_table_offset
;
}
bplist_trailer_t
;
enum
enum
{
{
...
@@ -179,13 +180,6 @@ static void byte_convert(uint8_t * address, size_t size)
...
@@ -179,13 +180,6 @@ static void byte_convert(uint8_t * address, size_t size)
)))); \
)))); \
})
})
#define be64dec(x) \
({ \
union plist_uint_ptr __up; \
__up.src = x; \
be64toh( get_unaligned(__up.u64ptr) ); \
})
#define get_needed_bytes(x) \
#define get_needed_bytes(x) \
( ((uint64_t)x) < (1ULL << 8) ? 1 : \
( ((uint64_t)x) < (1ULL << 8) ? 1 : \
( ((uint64_t)x) < (1ULL << 16) ? 2 : \
( ((uint64_t)x) < (1ULL << 16) ? 2 : \
...
@@ -701,17 +695,15 @@ static plist_t parse_bin_node_at_index(struct bplist_data *bplist, uint32_t node
...
@@ -701,17 +695,15 @@ static plist_t parse_bin_node_at_index(struct bplist_data *bplist, uint32_t node
PLIST_API
void
plist_from_bin
(
const
char
*
plist_bin
,
uint32_t
length
,
plist_t
*
plist
)
PLIST_API
void
plist_from_bin
(
const
char
*
plist_bin
,
uint32_t
length
,
plist_t
*
plist
)
{
{
char
*
trailer
=
NULL
;
bplist_trailer_t
*
trailer
=
NULL
;
uint8_t
offset_size
=
0
;
uint8_t
offset_size
=
0
;
uint8_t
dict
_size
=
0
;
uint8_t
ref
_size
=
0
;
uint64_t
num_objects
=
0
;
uint64_t
num_objects
=
0
;
uint64_t
root_object
=
0
;
uint64_t
root_object
=
0
;
uint64_t
offset_table_index
=
0
;
char
*
offset_table
=
NULL
;
char
*
offset_table
=
NULL
;
//first check we have enough data
//first check we have enough data
if
(
!
(
length
>=
BPLIST_MAGIC_SIZE
+
BPLIST_VERSION_SIZE
+
BPLIST_TRL_SIZE
))
if
(
!
(
length
>=
BPLIST_MAGIC_SIZE
+
BPLIST_VERSION_SIZE
+
sizeof
(
bplist_trailer_t
)
))
return
;
return
;
//check that plist_bin in actually a plist
//check that plist_bin in actually a plist
if
(
memcmp
(
plist_bin
,
BPLIST_MAGIC
,
BPLIST_MAGIC_SIZE
)
!=
0
)
if
(
memcmp
(
plist_bin
,
BPLIST_MAGIC
,
BPLIST_MAGIC_SIZE
)
!=
0
)
...
@@ -721,14 +713,13 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
...
@@ -721,14 +713,13 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
return
;
return
;
//now parse trailer
//now parse trailer
trailer
=
(
char
*
)
(
plist_bin
+
(
length
-
BPLIST_TRL_SIZE
));
trailer
=
(
bplist_trailer_t
*
)(
plist_bin
+
(
length
-
sizeof
(
bplist_trailer_t
)
));
offset_size
=
trailer
[
BPLIST_TRL_OFFSIZE_IDX
];
offset_size
=
trailer
->
offset_size
;
dict_size
=
trailer
[
BPLIST_TRL_PARMSIZE_IDX
];
ref_size
=
trailer
->
ref_size
;
num_objects
=
be64dec
(
trailer
+
BPLIST_TRL_NUMOBJ_IDX
);
num_objects
=
be64toh
(
trailer
->
num_objects
);
root_object
=
be64dec
(
trailer
+
BPLIST_TRL_ROOTOBJ_IDX
);
root_object
=
be64toh
(
trailer
->
root_object_index
);
offset_table_index
=
be64dec
(
trailer
+
BPLIST_TRL_OFFTAB_IDX
);
offset_table
=
(
char
*
)(
plist_bin
+
be64toh
(
trailer
->
offset_table_offset
));
offset_table
=
(
char
*
)
(
plist_bin
+
offset_table_index
);
if
(
num_objects
==
0
)
if
(
num_objects
==
0
)
return
;
return
;
...
@@ -752,7 +743,7 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
...
@@ -752,7 +743,7 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
bplist
.
data
=
plist_bin
;
bplist
.
data
=
plist_bin
;
bplist
.
size
=
length
;
bplist
.
size
=
length
;
bplist
.
num_objects
=
num_objects
;
bplist
.
num_objects
=
num_objects
;
bplist
.
dict_size
=
dict
_size
;
bplist
.
dict_size
=
ref
_size
;
bplist
.
offset_size
=
offset_size
;
bplist
.
offset_size
=
offset_size
;
bplist
.
offset_table
=
offset_table
;
bplist
.
offset_table
=
offset_table
;
bplist
.
level
=
0
;
bplist
.
level
=
0
;
...
@@ -1142,8 +1133,7 @@ PLIST_API void plist_to_bin(plist_t plist, char **plist_bin, uint32_t * length)
...
@@ -1142,8 +1133,7 @@ PLIST_API void plist_to_bin(plist_t plist, char **plist_bin, uint32_t * length)
uint64_t
i
=
0
;
uint64_t
i
=
0
;
uint8_t
*
buff
=
NULL
;
uint8_t
*
buff
=
NULL
;
uint64_t
*
offsets
=
NULL
;
uint64_t
*
offsets
=
NULL
;
uint8_t
pad
[
6
]
=
{
0
,
0
,
0
,
0
,
0
,
0
};
bplist_trailer_t
trailer
;
uint8_t
trailer
[
BPLIST_TRL_SIZE
];
//for string
//for string
long
len
=
0
;
long
len
=
0
;
long
items_read
=
0
;
long
items_read
=
0
;
...
@@ -1265,21 +1255,15 @@ PLIST_API void plist_to_bin(plist_t plist, char **plist_bin, uint32_t * length)
...
@@ -1265,21 +1255,15 @@ PLIST_API void plist_to_bin(plist_t plist, char **plist_bin, uint32_t * length)
free
(
offsetbuff
);
free
(
offsetbuff
);
}
}
//experimental pad to reflect apple's files
byte_array_append
(
bplist_buff
,
pad
,
6
);
//setup trailer
//setup trailer
num_objects
=
be64toh
(
num_objects
);
memset
(
trailer
.
unused
,
'\0'
,
sizeof
(
trailer
.
unused
));
root_object
=
be64toh
(
root_object
);
trailer
.
offset_size
=
offset_size
;
offset_table_index
=
be64toh
(
offset_table_index
);
trailer
.
ref_size
=
dict_param_size
;
trailer
.
num_objects
=
be64toh
(
num_objects
);
memcpy
(
trailer
+
BPLIST_TRL_OFFSIZE_IDX
,
&
offset_size
,
sizeof
(
uint8_t
));
trailer
.
root_object_index
=
be64toh
(
root_object
);
memcpy
(
trailer
+
BPLIST_TRL_PARMSIZE_IDX
,
&
dict_param_size
,
sizeof
(
uint8_t
));
trailer
.
offset_table_offset
=
be64toh
(
offset_table_index
);
memcpy
(
trailer
+
BPLIST_TRL_NUMOBJ_IDX
,
&
num_objects
,
sizeof
(
uint64_t
));
memcpy
(
trailer
+
BPLIST_TRL_ROOTOBJ_IDX
,
&
root_object
,
sizeof
(
uint64_t
));
byte_array_append
(
bplist_buff
,
&
trailer
,
sizeof
(
bplist_trailer_t
));
memcpy
(
trailer
+
BPLIST_TRL_OFFTAB_IDX
,
&
offset_table_index
,
sizeof
(
uint64_t
));
byte_array_append
(
bplist_buff
,
trailer
,
BPLIST_TRL_SIZE
);
//duplicate buffer
//duplicate buffer
*
plist_bin
=
(
char
*
)
malloc
(
bplist_buff
->
len
);
*
plist_bin
=
(
char
*
)
malloc
(
bplist_buff
->
len
);
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment