How the Hell is possible to use the HASH value in a more useful situation?

For example, masking some data inside your code (i.e. a crypto key or some kind of default values).

Download, unpack and buildyaadt.2.01.tgz

$ tar xvzf yaadt.2.01.tgz yaadt.2/ yaadt.2/md5.c yaadt.2/hiddenyzer.c yaadt.2/hiddenvalues.c yaadt.2/md5.h yaadt.2/hidden.h  $ cd yaadt.2  $ # BUILD  $ gcc hiddenvalues.c md5.c -o hiddenvalues  $ gcc hiddenyzer.c   md5.c -o hiddenyzer

Considernig the previous LINKER explaination, my idea is based on the HASH of the whole RO area.
Deepening the analysis of this (hiddenvalues) file.

$   objdump -h hiddenvalues hiddenvalues:     file format elf32-i386 Sections: Idx Name          Size      VMA       LMA       File off  Algn   0 .interp       00000013  08048154  08048154  00000154  2**0                   CONTENTS, ALLOC, LOAD, READONLY, DATA   1 .note.ABI-tag 00000020  08048168  08048168  00000168  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA   2 .hash         0000002c  08048188  08048188  00000188  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA   3 .gnu.hash     00000020  080481b4  080481b4  000001b4  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA   4 .dynsym       00000060  080481d4  080481d4  000001d4  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA   5 .dynstr       00000051  08048234  08048234  00000234  2**0                   CONTENTS, ALLOC, LOAD, READONLY, DATA   6 .gnu.version  0000000c  08048286  08048286  00000286  2**1                   CONTENTS, ALLOC, LOAD, READONLY, DATA   7 .gnu.version_r 00000020  08048294  08048294  00000294  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA   8 .rel.dyn      00000008  080482b4  080482b4  000002b4  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA   9 .rel.plt      00000020  080482bc  080482bc  000002bc  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA  10 .init         00000017  080482dc  080482dc  000002dc  2**2                   CONTENTS, ALLOC, LOAD, READONLY, CODE  11 .plt          00000050  080482f4  080482f4  000002f4  2**2                   CONTENTS, ALLOC, LOAD, READONLY, CODE  12 .text         00001094  08048350  08048350  00000350  2**4                   CONTENTS, ALLOC, LOAD, READONLY, CODE  13 .fini         0000001c  080493e4  080493e4  000013e4  2**2                   CONTENTS, ALLOC, LOAD, READONLY, CODE  14 .rodata       000000a0  08049400  08049400  00001400  2**5                   CONTENTS, ALLOC, LOAD, READONLY, DATA  15 .eh_frame     00000004  080494a0  080494a0  000014a0  2**2                   CONTENTS, ALLOC, LOAD, READONLY, DATA  16 .ctors        00000008  0804af0c  0804af0c  00001f0c  2**2                   CONTENTS, ALLOC, LOAD, DATA  17 .dtors        00000008  0804af14  0804af14  00001f14  2**2                   CONTENTS, ALLOC, LOAD, DATA  18 .jcr          00000004  0804af1c  0804af1c  00001f1c  2**2                   CONTENTS, ALLOC, LOAD, DATA  19 .dynamic      000000d0  0804af20  0804af20  00001f20  2**2                   CONTENTS, ALLOC, LOAD, DATA  20 .got          00000004  0804aff0  0804aff0  00001ff0  2**2                   CONTENTS, ALLOC, LOAD, DATA  21 .got.plt      0000001c  0804aff4  0804aff4  00001ff4  2**2                   CONTENTS, ALLOC, LOAD, DATA  22 .data         00000024  0804b010  0804b010  00002010  2**2                   CONTENTS, ALLOC, LOAD, DATA  23 .bss          00000004  0804b034  0804b034  00002034  2**2                   ALLOC  24 .comment      00000130  00000000  00000000  00002034  2**0                   CONTENTS, READONLY

so:

Starting File Offset  :                 0x00000154  Starting VMA Area     :                 0x08048154                                                                     Incredible isn't it? Size File Area        :  0x000014a0  -  0x00000154  +  0x00000004  =  0x00001350  Size VMZ Area         :  0x080494a0  -  0x08048154  +  0x00000004  =  0x00001350

How my tool works?

In both hiddenyzer and hiddenvalues executables we use the common initialized struct:
This struct is used in:
hiddenvalues as default message value and pointer marker for the MD5 checksum.
hiddenyzer as default marker useful to find the message offset inside hiddenvalues file.

More or less this is the working procedure of hiddenyzer


Execute it: (colors are manually added)

$ # THIS SCRIPT EXTRACT THE READ_ONLY VMA MEMORY FROM THE ELF EXECUTABLE  $ # AND USE THESE VALUES AS hiddenyzer INPUT PARAMETERS  $ objdump -h hiddenvalues | grep -e interp -e eh_frame \    | awk '{print "0x" $3 " 0x" 0x$4 " 0x" 0x$6}' | xargs \    | awk '{print strtonum($2) " " strtonum($3) " " strtonum($6) - strtonum($3) + strtonum($4)}' \    | xargs ./hiddenyzer hiddenvalues ;  Hiddenyzer:   SRC File: hiddenvalues   Outfile:  hiddenvalues.hid read 11272 MD5 = 1c46f25976ffc65934a269c144c6639c hiddenizerator found at: 0x0000201c  $ ls -l total 112 -rw-r--r--  1 root root  2014 Feb 22 17:13 hidden.h -rwxr-xr-x  1 root root 11272 Feb 23 08:07 hiddenvalues -rw-r--r--  1 root root  2746 Feb 22 17:13 hiddenvalues.c -rwxr-xr-x  1 root root 11272 Feb 23 08:07 hiddenvalues.hid -rwxr-xr-x  1 root root 16112 Feb 23 08:07 hiddenyzer -rw-r--r--  1 root root  6633 Feb 22 17:12 hiddenyzer.c -rw-r--r--  1 root root 11096 Feb 22 16:32 md5.c -rw-r--r--  1 root root  2984 Feb 22 16:32 md5.h

An Hexdump of the two executables can show the results of the previous operation: (colors are manually added)

0 -> 0x00000001  1 -> 0x00000002  2 -> 0x00000003  3 -> 0x00000004 Mmmmmmm Interesting!!!