Assistance in Reverse engineering in house software installed, on a prior system in a

gdizzle · 07-10-2013, 11:46 PM

Hi I am trying to port in an in house developed application over from RHEL 4 32 bit to RHEL 6 32 bit, the application was in house developed and the developer is no longer with us.

I have migrated all application files and folders, user accounts and groups with correct permissions to the testbox. The application is was created in house and when each user logs in the application is launched by a .bash_profile in there home dir.

Code:

#------------------------------------
# additional procedures for users
#
if [ `id -gn` = "bms" ]
then
        umask 0000
        cd /applic/bms
        case `id -un` in
        phil)
                return 0
                ;;
        *)
                exec menu
                ;;
        esac
fi

If I am decoding this right it 's saying if the id group name = bms (yes the users are part of the bms group already) then it set's the umask of 0000 for the user environment, then the next statement is saying, if the user is (phil old developer) then return exit code 0, so he can ssh in without the program loading.

If anything else it will run the command "exec menu" then escape.

Interesting part is right now I cannot su - username (to one of the migrated accounts at current) because I get the error message:

-bash: exec: menu: not found

Was under the impression "menu" was a binary I realise it's a directory. I cd /applic/bms

file menu
menu: directory

I confirmed this on the old system and ran exec menu, and the program launched.

This program is run's terminal and looks to refer to txt files.

As expected since it's a folder, that somehow executes and launches the terminal application:

Debugging it can be an issue: most debuggers require a binary not a folder.

Code:

ltrace menu
ltrace: Can't open ELF file "menu"

gdb menu
menu: No such file or directory.

strace menu
strace: menu: command not found

ltrace menu
ltrace: Can't open ELF file "menu"

Here is an example of the application working on the exisiting server:

Code:

lsof -u testuser
COMMAND   PID   USER   FD   TYPE     DEVICE    SIZE      NODE NAME
sshd    32013 testuser  cwd    DIR        8,2    4096         2 /
sshd    32013 testuser  rtd    DIR        8,2    4096         2 /
sshd    32013 testuser  txt    REG        8,2  308912    670531 /usr/sbin/sshd
sshd    32013 testuser  mem    REG        8,2   14542    538256 /lib/libutil-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   63624    706624 /usr/lib/libz.so.1.2.1.2
sshd    32013 testuser  mem    REG        8,2  415188    705924 /usr/lib/libkrb5.so.3.2
sshd    32013 testuser  mem    REG        8,2    7004    538164 /lib/libcom_err.so.2.1
sshd    32013 testuser  mem    REG        8,2    5592    540277 /lib/security/pam_loginuid.so
sshd    32013 testuser  mem    REG        8,2    2912    540260 /lib/security/pam_deny.so
sshd    32013 testuser  mem    REG        8,2   49224    540300 /lib/security/pam_unix.so
sshd    32013 testuser  mem    REG        8,2    3220    540283 /lib/security/pam_permit.so
sshd    32013 testuser  mem    REG        8,2   18532    540274 /lib/security/pam_limits.so
sshd    32013 testuser  mem    REG        8,2  945152    540536 /lib/libcrypto.so.0.9.7a
sshd    32013 testuser  mem    REG        8,2 1454462    540315 /lib/tls/libc-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   17388    540296 /lib/security/pam_succeed_if.so
sshd    32013 testuser  mem    REG        8,2   82944    705565 /usr/lib/libgssapi_krb5.so.2.2
sshd    32013 testuser  mem    REG        8,2   15324    538182 /lib/libdl-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   95148    538195 /lib/libnsl-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   51004    538153 /lib/libaudit.so.0.0.0
sshd    32013 testuser  mem    REG        8,2   12160    540258 /lib/security/pam_cracklib.so
sshd    32013 testuser  mem    REG        8,2   79488    538240 /lib/libresolv-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   28504    706554 /usr/lib/libwrap.so.0.7.6
sshd    32013 testuser  mem    REG        8,2   32024    538230 /lib/libpam.so.0.77
sshd    32013 testuser  mem    REG        8,2    6696    540281 /lib/security/pam_nologin.so
sshd    32013 testuser  mem    REG        8,2   10756    540294 /lib/security/pam_stack.so
sshd    32013 testuser  mem    REG        8,2   10272    540261 /lib/security/pam_env.so
sshd    32013 testuser  mem    REG        8,2  136016    705684 /usr/lib/libk5crypto.so.3.0
sshd    32013 testuser  mem    REG        8,2   27191    538165 /lib/libcrypt-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   21280    538210 /lib/libnss_dns-2.3.4.so
sshd    32013 testuser  mem    REG        8,2  106397    538134 /lib/ld-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   45800    538213 /lib/libnss_files-2.3.4.so
sshd    32013 testuser  mem    REG        8,2   56336    540538 /lib/libselinux.so.1
sshd    32013 testuser  mem    REG        8,2   28488    705258 /usr/lib/libcrack.so.2.7
sshd    32013 testuser  DEL    REG        0,6         494195751 /dev/zero
sshd    32013 testuser  DEL    REG        0,6         494195436 /dev/zero
sshd    32013 testuser    0u   CHR        1,3              1734 /dev/null
sshd    32013 testuser    1u   CHR        1,3              1734 /dev/null
sshd    32013 testuser    2u   CHR        1,3              1734 /dev/null
sshd    32013 testuser    3u  IPv6  494195404               TCP testserver.domain.local:ssh->testclient.domain.local:49505 (ESTABLISHED)
sshd    32013 testuser    4u  unix 0xe009edc0         494195752 socket
sshd    32013 testuser    5r  FIFO        0,7         494195767 pipe
sshd    32013 testuser    6w  FIFO        0,7         494195767 pipe
sshd    32013 testuser    7u   CHR        5,2               548 /dev/ptmx
sshd    32013 testuser    8u   CHR        5,2               548 /dev/ptmx
sshd    32013 testuser    9u   CHR        5,2               548 /dev/ptmx
menu    32014 testuser  cwd    DIR        8,2   16384   1612514 /applic/bms
menu    32014 testuser  rtd    DIR        8,2    4096         2 /
menu    32014 testuser  txt    REG        8,2  364444   1613601 /applic/bms/obj/menu
menu    32014 testuser  mem    REG        8,2  106397    538134 /lib/ld-2.3.4.so
menu    32014 testuser  mem    REG        8,2 1454462    540315 /lib/tls/libc-2.3.4.so
menu    32014 testuser  mem    REG        8,2  178019    540317 /lib/tls/libm-2.3.4.so
menu    32014 testuser    0u   CHR     136,20                22 /dev/pts/20
menu    32014 testuser    1u   CHR     136,20                22 /dev/pts/20
menu    32014 testuser    2u   CHR     136,20                22 /dev/pts/20
menu    32014 testuser    3u   REG      253,0    4096   1933583 /data/bms/sy_cmp.idx
menu    32014 testuser    4u   REG      253,0    4008   1933582 /data/bms/sy_cmp.dat
menu    32014 testuser    5u   REG      253,0    4096   4030468 /data/bms/sy_usr.idx
menu    32014 testuser    6u   REG      253,0   42042   4030467 /data/bms/sy_usr.dat

The application does have specific environment variables to it which are not on the new system, however I cannot locate these environment variables in any .profile/.bash_profile/.bashrc/ or /etc/profile, /etc/bash_rc or /etc/bach_profile files on the current working server, so I am under the impression these are might be launched upon successful application launch.

I am throwing this question about by chance, any suggestions or ideas?

Any idea's about running exec on a directory that launches an application?

Thanks

cliffordw · 07-13-2013, 05:25 AM

Hi there,

From the lsof listing you posted, it looks like the menu might be in /applic/bms/obj/menu. You could probably confirm this on the old machine by su'ing to phil and running "which menu" or "whereis menu". Once you have confirmed the location, I'd recommend that you specify the full path name in the exec command in your .bash_profile, rather than relying on it being in your $PATH.

Hope this helps.

Regards,

Clifford

gdizzle · 07-14-2013, 06:15 PM

Hi Clifford, Thanks for your reply,

Your on the money so far!

When I went onto the old machine and did a 'which menu'

Code:

[phil@prodsys1~]# which menu
/applic/bms/obj/menu

On the new machine, I modifies the .bash_profile of one of the users even tried as user phil, same error when i try:

Code:

exec /applic/bms/obj/menu

It attempts to launch the program. except I get this error.

Code:

+--------------< An error has occurred - call system supervisor >--------------+
≠                                                                              ≠
≠                                                                              ≠
≠               menu  : Open error on .//sy_cmp,code 002,z=-001                ≠
≠                                                                              ≠
≠                          No such file or directory                           ≠
≠                                                                              ≠
+------------------------ Press any key to continue ---------------------------+

On the new system:

Code:

strace /applic/bms/obj/menu

stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2183, ...}) = 0
ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL_TMR_TEMPO or TCGETA, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL_TMR_SOURCE or TCSETA, {B38400 opost isig icanon -echo ...}) = 0
ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon -echo ...}) = 0
ioctl(0, SNDCTL_TMR_SOURCE or TCSETA, {B38400 opost isig -icanon -echo ...}) = 0
fcntl64(0, F_GETFL)                     = 0x8002 (flags O_RDWR|O_LARGEFILE)
fcntl64(0, F_SETFL, O_RDWR|O_LARGEFILE) = 0
+--------------< An error has occurred - call system supervisor >) = 355-------+ 0
write(1, "\33(B\33[0;7m\33[14;17Hmenu  : Open er"..., 70                       ≠ory)
≠                                                                              ≠
≠               menu  : Open error on .//sy_cmp,code 002,z=-001) = 70          ≠
write(1, "\33(B\33[0;7m\33[16;28HNo such file or"..., 48                       ≠
≠                          No such file or directory) = 48                     ≠
write(1, "\33[18;26H\33(B\33[0;7;5m Press any ke"..., 52                       ≠8) = 38
+------------------------ Press any key to continue ) = 52---------------------+) = 723377\377\377\377\10\0@\0", 30) = 30
fcntl64(0, F_SETFL, O_RDWR|O_LARGEFILE) = 0---"..., 3550J\0L\0P\0W\0\377\377"..., 826) = 826
fstat64(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0= 1388
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7726000
read(0, "\1", 1)                        = 1
read(3, "\0", 1)                        = 1
read(3, "\377\377\0\0\7\0\16\0\25\0\34\0#\0*\0001\0008\0?\0F\0M\0T\0[\0b\0"..., 230) = 230
read(3, "\33[3;3~\0\33[3;4~\0\33[3;5~\0\33[3;6~\0\33[3;"..., 674) = 674

Did a quick google one:

Code:

fcntl64(0, F_SETFL, O_RDWR|O_LARGEFILE) = 0

, it looked to relate to mysql, however on the old system there is no mysqld instance, and there no instance of mysqld on the new system.

The below memory files already exist.

Code:

 ldd /applic/bms/obj/menu
        linux-gate.so.1 =>  (0x00115000)
        libm.so.6 => /lib/libm.so.6 (0x00677000)
        libc.so.6 => /lib/libc.so.6 (0x007d2000)
        /lib/ld-linux.so.2 (0x00631000)

On the old system if I as user phil:

Code:

exec /applic/bms/obj/menu
menu  :  Segmentation error caught. : I get this error,

Some how it looks to be executing another way, to bypass this error.

Thanks

Alderin · 07-31-2013, 01:16 PM

I have to ask, if he was your developer, did the source code get left behind as well?

I noticed that the application you are working on is in "/applic/bms/obj/", is there a corresponding "/applic/bms/src/"? Or, in the home directory structure of user 'phil'?

That said, the error looks to be something more like a missing file than a database, possibly something stored in the connecting user's home directory as a hidden file or directory.

Mostly theorizing here, though.

gdizzle · 07-31-2013, 07:45 PM

Hi Alderin yes there is a

Code:

/applic/bms/src/

with 949 files, I would not even know where to begin with this...

Alderin · 07-31-2013, 09:40 PM

That sounds to me like great news. If this folder is copied over to the new system, you might (might) be able to run 'make' and 'make install' and have everything magically work again. I can't stress quite enough to make sure this folder is backed up first.

Even if that doesn't work, having the source code available allows you to find someone who knows that language, even if it is a contractor or freelancer, to get you on your feet again. All you have to do is determine what kind of project it is. Python? C/C++? Perl? Php?

If you post a directory listing I'm sure we could help with that part at least.

Hope this helps!

gdizzle · 08-01-2013, 05:32 PM

Thanks for your help Alderin.

I was in denial thinking this wasn't compiled on the system, I am under the impression it's C/C++.

The ./configure or make or make install had no luck.

I have uploaded a directory listing of the files.

Thanks.

Alderin · 08-01-2013, 05:47 PM

Wow. Honestly it looks like the .c files there may have been generated by some other tool. Sadly, I don't recognize the files enough to say what tool. The generated c files may have a tool signature at the top of the file, something like "Generated by X", or you may be able to see in one of the ".note" or ".notes" files.

One last thought: is "menu" (in src) a binary file or an executable text file (script)?

astrogeek · 08-01-2013, 05:55 PM

Just a guess, but it looks to me as if many of those could be data files written by another application.

There are a few dot-C files there, but nothing that obviously looks likely to be program source.

If you have someone local that you would trust with the data, you might have them look at a few of the files to see what type they may be.

Or, if you would care to post a few lines from the start of a few selected files, how about these...

ajfix
apcode1,...2,...3
ar14.c
ar25.xml
cb00

Those might provide some valuable insight, but be aware that they might expose business data.

gdizzle · 08-01-2013, 06:08 PM

file menu
menu: ASCII C program text

Menu is a text program and inside looks to be C code. here is a small snippet of ajfix

Code:

less ajfix

dump(v=n,e=v)
name ajfix
save obj/ajfix

title =no
title Fix cred

*------------------------------------------------------------------
*       files & templates
*------------------------------------------------------------------
file zu fdes/sy_usr
file zc fdes/sy_cmp
file za fdes/cp_cal
file pj fdes/ap_jnl

*------------------------------------------------------------------
*       data definitions
*------------------------------------------------------------------
call    define
call    call/define

I am really not at liberty to expose any code as it' business application, if you can give me an example of what functions or variables or something that can give an example to showing how it's compiled so I can compile it on the new system that would be good.

Thanks for your help so far Alderin / astrogeek.

astrogeek · 08-01-2013, 06:58 PM

Quote:

Originally Posted by gdizzle

I am really not at liberty to expose any code as it' business application, if you can give me an example of what functions or variables or something that can give an example to showing how it's compiled so I can compile it on the new system that would be good.

Sure, I thought as much.

The main point I think you need to get to is to figure out whether it is actually a compiled language or possibly something like a Python script, or possibly a scripted wrapper for some other application.

But after re-reading the thread a couple more times, I think that you may need to be a little more circumspect about the PATH. The being explicit on the menu path may not be enough. The error you are getting about the sy_cmp file is a good indicator.

So you might want to add /applic and /data to your path variable and see what happens next.

Overall, is it possible for you to compare the original system runtime path and the new path and make any obvious adjustments.

gdizzle · 08-07-2013, 06:07 PM

Hi sorry for the delay, It's been a flat out week.... I have been advised to drop this project for now as there are bigger things on my plate. Thanks for your time in troubleshooting.