This project is targeted to (but not limited to) analyze seccomp sandbox in CTF pwn challenges. Some features might be CTF-specific, but still useful for analyzing seccomp in real-case.
Features
Dump – Automatically dump seccomp-bpf from execution file(s).
Fix wrong decompilation on same jump target optimization by @david942j in #248
Don’t raise error on long direct jump by @david942j in #249
Installation
$ gem install seccomp-tools
Use
$ seccomp-tools --help # Usage: seccomp-tools [--version] [--help] <command> [<options>] # # List of commands: # # asm Seccomp bpf assembler. # disasm Disassemble seccomp bpf. # dump Automatically dump seccomp bpf from execution file(s). # emu Emulate seccomp rules. # # See 'seccomp-tools <command> --help' to read about a specific subcommand.
$ seccomp-tools dump --help # dump - Automatically dump seccomp bpf from execution file(s). # # Usage: seccomp-tools dump [exec] [options] # -c, --sh-exec <command> Executes the given command (via sh). # Use this option if want to pass arguments or do pipe things to the execution file. # e.g. use `-c "./bin > /dev/null"` to dump seccomp without being mixed with stdout. # -f, --format FORMAT Output format. FORMAT can only be one of <disasm|raw|inspect>. # Default: disasm # -l, --limit LIMIT Limit the number of calling "prctl(PR_SET_SECCOMP)". # The target process will be killed whenever its calling times reaches LIMIT. # Default: 1 # -o, --output FILE Output result into FILE instead of stdout. # If multiple seccomp syscalls have been invoked (see --limit), # results will be written to FILE, FILE_1, FILE_2.. etc. # For example, "--output out.bpf" and the output files are out.bpf, out_1.bpf, ...
dump
Dump the seccomp bpf from an execution file. This work is done by the ptrace syscall.
NOTICE: beware of the execution file will be executed.
disasm
Disassemble the seccomp from raw bpf.
asm
Assemble the seccomp rules into raw bytes. Very useful when one wants to write custom seccomp rules.
Supports labels for jumping and use syscall names directly. See example below.
$ seccomp-tools asm # asm - Seccomp bpf assembler. # # Usage: seccomp-tools asm IN_FILE [options] # -o, --output FILE Output result into FILE instead of stdout. # -f, --format FORMAT Output format. FORMAT can only be one of <inspect|raw|c_array|c_source|assembly>. # Default: inspect # -a, --arch ARCH Specify architecture. # Supported architectures are <amd64|i386>.
# Input file for asm $ cat spec/data/libseccomp.asm # # check if arch is X86_64 # A = arch # A == ARCH_X86_64 ? next : dead # A = sys_number # A >= 0x40000000 ? dead : next # A == write ? ok : next # A == close ? ok : next # A == dup ? ok : next # A == exit ? ok : next # return ERRNO(5) # ok: # return ALLOW # dead: # return KILL
