/*
 * 0x4553 - ElectronicSouls - 0x4553 
 * search in a binary or core dump for a user supplied string and get the exact location in memory.
 * idea is based on sectorx's segment.c which is much better, but this was made for fun and works well so wtf :)
 */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <elf.h>


void Header(int fd) 
{
     Elf32_Ehdr ehdr;
     lseek(fd,0,SEEK_SET);

     read(fd,&ehdr,sizeof(Elf32_Ehdr));

     fprintf(stderr,"ELF Binary Header:\n");
     fprintf(stderr,"ident..:  %s\n",ehdr.e_ident);
     fprintf(stderr,"type...: ");

     switch (ehdr.e_type){
      case 2:
      printf("Executable\n");
      break;
      case 4:
      printf("Core\n");
      break;
      default:
      printf("Invalid File!\n");
      exit(1);
      break; 
     }
     fprintf(stderr,"\n");
}

int main(int argc, char *argv[])
{	
	struct stat st_str;

	Elf32_Ehdr *elf_hdr;
	Elf32_Phdr *p_hdr;

	char *file_buf;
	
	int fd = 0,
	     i = 0,
	     e = 0,
	     s;

        fprintf(stderr,"\n[MemLocate]\n");

	if(argc<3) {
	   fprintf(stderr, "%s [core] [string]\n", argv[0]);
	   return(-1);
	}

	if((fd=open(argv[1],O_RDONLY))<0) {
	    fprintf(stderr, "Unable to open file!\n");
	    return(-1);
	}

        fprintf(stderr,"%s has a valid format!\n",argv[1]);
        fprintf(stderr,"trying to locate string: %s\n\n",argv[2]); 

        fstat(fd,&st_str); 

        file_buf=(char *)malloc(st_str.st_size);     
	memset(file_buf,0,st_str.st_size);

	if (read(fd,file_buf,st_str.st_size)<0) {
            fprintf(stderr, "error! read() failed..\n");
	    free(file_buf);
	    close(fd);

	    return(-1);
	}

	elf_hdr = (Elf32_Ehdr *)file_buf;
        Header(fd);

	for (i=0; i < elf_hdr->e_phnum; i++) 
        {
		p_hdr = (Elf32_Phdr *)
                        (file_buf+elf_hdr->e_phoff+(i*elf_hdr->e_phentsize));

                for (e = p_hdr->p_offset; 
                     e < p_hdr->p_offset+p_hdr->p_filesz; 
                     e++)

	        if(!strncmp(file_buf+e,argv[2],strlen(argv[2]))){

                fprintf(stderr, "[String found at: 0x%08x]\n", 
                       ((p_hdr->p_vaddr+e) - p_hdr->p_offset));
                }
	}

        fprintf(stderr,"\n");

	free(file_buf);

	close(fd);

exit(0);
}