Skip to content

Commit

Permalink
Speed up strace detection on Linux
Browse files Browse the repository at this point in the history
This commit also includes gopkg/v2
  • Loading branch information
rafael-santiago committed Aug 22, 2021
1 parent d769227 commit f4a8e4a
Show file tree
Hide file tree
Showing 13 changed files with 870 additions and 25 deletions.
21 changes: 9 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@ as an ``anti-debugging`` stuff.
- [``Aegis`` from ``Go``](#aegis-from-go)
- [``wait4debug`` on ``Go``](#wait4debug-on-go)
- [What about a ``Gopher Gorgon``?](#what-about-a-gopher-gorgon)
- [Contributors](#contributors)

## How can I build it?

Expand Down Expand Up @@ -76,6 +75,14 @@ black-beard@QueensAnneRevenge:~/src/aegis/src# _
If all has occurred fine during your build, ``aegis`` library was built at ``../lib`` sub-directory. Additionaly,
test has ran and all samples was built at ``../samples`` sub-directory.

In order to skip tests you must invoke ``Hefesto`` with the option ``--no-tests``:

```
black-beard@QueensAnneRevenge:~/src/aegis/src# hefesto --no-tests
(...)
black-beard@QueensAnneRevenge:~/src/aegis/src# _
```

[``Back``](#contents)

### Poor man's build by using ``make``
Expand Down Expand Up @@ -406,7 +413,7 @@ After you will define in your ``go.mod`` the following:

```
(...)
replace github.com/rafael-santiago/aegis/gopkg => github.com/rafael-santiago/aegis/gopkg/v1
replace github.com/rafael-santiago/aegis/gopkg => github.com/rafael-santiago/aegis/gopkg/v2
(...)
```

Expand Down Expand Up @@ -535,13 +542,3 @@ func main() {
The program will run until detecting a debugger be attached or being asked for gracefully exiting through a ``ctrl + C``.

[``Back``](#contents)

## Contributors

The following table lists all project's contributors until now.

| **GitHub profile** | **Who** | **Contact** | **Contributions** |
|:------------------------------:|:-----------------------|:---------------------------:|:-----------------------------------------------------------------------:|
|[<img src="https://github.com/rafael-santiago.png" width=60 height=60>](https://github.com/rafael-santiago)|Rafael Santiago|``/dev/null``|Initial idea, ``C library``, initial ``cgo-bind``, current maintainer.|

[``Back``](#contents)
11 changes: 11 additions & 0 deletions RELNOTES.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,17 @@

Rafael
--
v2 [git-tag: 'v2']

Features:

- Improvement for Linux on detecting strace.
- Adding --no-tests build option.

Bugfixes:

- None!

v1 [git-tag: 'v1']

Features:
Expand Down
1 change: 1 addition & 0 deletions doc/todo.txt
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
x (A) Speed up strace detection on Linux. +Core,+Improvement
x (B) Run go fmt over all go sources. +Core,+Housekeeping
x (B) Document go sources. +Core,+Documentation
x (A) Implement tests for gopkg. +Core,+Test
Expand Down
93 changes: 93 additions & 0 deletions gopkg/v2/aegis.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
// package aegis gathers all constants, types and functions related to libaegis cgo bind.
// --
// Copyright (c) 2020, Rafael Santiago
// All rights reserved.
//
// This source code is licensed under the BSD-style license found in the
// LICENSE file in the root directory of this source tree.
//
package aegis

/*
#cgo CFLAGS: -I../../src -DCGO=1
#include <aegis.h>
#include <aegis.c>
#if defined(__linux__)
# include <native/linux/aegis_native.c>
#elif defined(__FreeBSD__)
# include <native/freebsd/aegis_native.c>
#elif defined(__NetBSD__)
# include <native/netbsd/aegis_native.c>
#elif defined(__OpenBSD__)
# include <native/openbsd/aegis_native.c>
#elif defined(_WIN32)
# include <native/windows/aegis_native.c>
#endif
*/
import "C"
import (
"os"
"time"
)

// AegisGorgonExitFunc defines the type of exit oracle function called by Aegis' anti-debugging gorgon.
type AegisGorgonExitFunc func(args interface{}) bool

// AegisGorgonOnDebuggerFunc defines the type of OnDebugger functions that will be triggered by Aegis' during a debugging
// attempting.
type AegisGorgonOnDebuggerFunc func(args interface{})

// HasDebugger is a Go wrapper for aegis_has_debugger() from libaegis. HasDebugger returns true is a debugger is
// detected otherwise (guess what?) false.
func HasDebugger() bool {
return (C.aegis_has_debugger() == 1)
}

// SetGorgon is a Go native implementation of aegis_set_gorgon(). This function installs a goroutine responsible for watching
// out a debugging attempt. The argument exitFunc is a function that verifies if it is time to gracefully exiting. Its
// arguments is the 'generic' argument exitFuncArgs. The argument onDebuggerFunc is a function that takes some action when a
// debugger is detected. Its arguments is the 'generic' argument onDebuggerFuncArgs. When onDebuggerFunc is nil Aegis will
// use its internal default onDebuggerFunc (defaultOnDebugger).
func SetGorgon(exitFunc AegisGorgonExitFunc, exitFuncArgs interface{},
onDebuggerFunc AegisGorgonOnDebuggerFunc, onDebuggerFuncArgs interface{}) {
var onDebugger AegisGorgonOnDebuggerFunc

if onDebuggerFunc != nil {
onDebugger = onDebuggerFunc
} else {
onDebugger = defaultOnDebugger
}

gorgonRoutine := func(exitFunc AegisGorgonExitFunc,
exitFuncArgs interface{},
onDebuggerFunc AegisGorgonOnDebuggerFunc,
onDebuggerFuncArgs interface{}, done chan bool) {
var stop bool = false
for !stop {
if C.aegis_has_debugger() == 1 {
// INFO(Rafael): There is no way to know what user is intending on doing on OnDebugger.
// Anyway, on sane anti-debugging mitigations we need to exit process.
// Since we are probably exiting here (in a panic situation), there is no
// problem on leaking this go routine, but for conscience's sake let's try
// to exit more gracefully as possible.
defer onDebugger(onDebuggerFuncArgs)
stop = true
}
if !stop && exitFunc != nil {
stop = exitFunc(exitFuncArgs)
}
time.Sleep(1 * time.Nanosecond)
}
done <- true
}

done := make(chan bool, 1)

go gorgonRoutine(exitFunc, exitFuncArgs, onDebugger, onDebuggerFuncArgs, done)
<-done
}

// defaultOnDebugger is the internal Aegis onDebuggerFunc. It is rather gross, being only about an os.Exit(1) and period.
func defaultOnDebugger(args interface{}) {
os.Exit(1)
}
Loading

0 comments on commit f4a8e4a

Please sign in to comment.