[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #10006 [Pluggable transport]: Build an obfs-flash PT bundle
#10006: Build an obfs-flash PT bundle
-------------------------------------+-------------------
Reporter: dcf | Owner: dcf
Type: task | Status: new
Priority: normal | Milestone:
Component: Pluggable transport | Version:
Resolution: | Keywords:
Actual Points: | Parent ID: #7167
Points: |
-------------------------------------+-------------------
Comment (by dcf):
GITNE on IRC suggested that it might help to set
[http://msdn.microsoft.com/en-
us/library/windows/desktop/ms684863%28v=vs.85%29.aspx#CREATE_NEW_PROCESS_GROUP
CREATE_NEW_PROCESS_GROUP] in
[https://gitweb.torproject.org/tor.git/blob/7578606a2265466bc4546f0d08b9dbdf427e7c1c:/src/common/util.c#l3750
Tor's call] to [http://msdn.microsoft.com/en-
us/library/windows/desktop/ms682425%28v=vs.85%29.aspx CreateProcess]. I
tested this by patching the binary (don't tell). Unfortunately, it didn't
seem to work.
Using the test bundle from https://people.torproject.org/~dcf/pt-
bundle/2.4.17-beta-2-obfs-flash20131025/, a partial disassembly of the
call to `CreateProcess` is
{{{
objdump -d tor.exe
55a179: c7 44 24 14 00 00 00 movl $0x0,0x14(%esp)
55a180: 00
55a181: c7 44 24 10 01 00 00 movl $0x1,0x10(%esp)
55a188: 00
55a189: c7 44 24 0c 00 00 00 movl $0x0,0xc(%esp)
55a190: 00
55a191: c7 44 24 08 00 00 00 movl $0x0,0x8(%esp)
55a198: 00
55a199: 8b 45 f0 mov -0x10(%ebp),%eax
55a19c: 89 44 24 04 mov %eax,0x4(%esp)
55a1a0: 8b 85 74 ff ff ff mov -0x8c(%ebp),%eax
55a1a6: 89 04 24 mov %eax,(%esp)
55a1a9: e8 42 06 05 00 call 5aa7f0 <_CreateProcessA@40>
}}}
The first line sets `dwCreationFlags`. I changed byte 1415039 of the file
from 00 to 02, so the disassembly becomes
{{{
objdump -d tor-hacked.exe
55a179: c7 44 24 14 00 02 00 movl $0x200,0x14(%esp)
55a180: 00
55a181: c7 44 24 10 01 00 00 movl $0x1,0x10(%esp)
55a188: 00
55a189: c7 44 24 0c 00 00 00 movl $0x0,0xc(%esp)
55a190: 00
55a191: c7 44 24 08 00 00 00 movl $0x0,0x8(%esp)
55a198: 00
55a199: 8b 45 f0 mov -0x10(%ebp),%eax
55a19c: 89 44 24 04 mov %eax,0x4(%esp)
55a1a0: 8b 85 74 ff ff ff mov -0x8c(%ebp),%eax
55a1a6: 89 04 24 mov %eax,(%esp)
55a1a9: e8 42 06 05 00 call 5aa7f0 <_CreateProcessA@40>
}}}
The resulting binaries are
{{{
sha256sum tor.exe tor-hacked.exe
30099504de82281adde709a537e7ffe600d8c72021c9af459730f103b1376502 tor.exe
5aedaba498852ba0728193ee36aca21bcdd3975e71aeaff45362d1766930f0af tor-
hacked.exe
}}}
I copied `tor-hacked.exe` over `tor.exe`, ran the bundle, and then exited
it. flashproxy-client.exe and obfsproxy.exe were still running.
I also tried `tor-hacked.exe` in combination with ''removing'' the
`CREATE_NEW_PROCESS_GROUP` flag [https://gitweb.torproject.org/pluggable-
transports/pyptlib.git/blob/471f02af7bc246d27088d41c90231a166a2b4f60:/pyptlib/util/subproc.py#l32
from subproc], supposing that maybe another new process group was
insulating the children from the parent. That didn't seem to have any
effect either.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10006#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs