admin/KingOfTheNOPs-CDP-Enable-BOF
1
0
Fork 0
mirror of https://github.com/KingOfTheNOPs/CDP-Enable-BOF synced 2026-06-29 08:59:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated signatures, helper scripts, and README

Browse Source
This commit is contained in:
Antero Guy
2026-05-06 15:34:05 -04:00
parent 2ee0311d5d
commit 5701acfdc5
6 changed files with 203 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
find_start_server.py
+24 -39
View File
@@ -14,16 +14,9 @@ sys.path.insert(0, str(ROOT))
from pe_signature_finder import analyze_symbols, format_bytes # type: ignore
KNOWN_START_SERVER_SIGNATURES = {
"msedge.dll": bytes.fromhex(
"41 57 41 56 41 54 56 57 55 53 48 83 EC 50 "
"44 89 CD 4C 89 C3 48 89 D7 48 89 CE 48 8B 05 9D"
),
"chrome.dll": bytes.fromhex(
"41 57 41 56 56 57 55 53 48 83 EC 48 "
"44 89 CD 4D 89 C6 48 89 D3 48 89 CE 48 8B 05 41"
),
}
def format_c_initializer(data: bytes) -> str:
return ", ".join(f"0x{b:02X}" for b in data)
def load_text_section(pe_path: Path):
@@ -48,25 +41,8 @@ def main():
args = parser.parse_args()
pe, _text_section, text_data = load_text_section(args.pe)
known_sig = KNOWN_START_SERVER_SIGNATURES.get(args.pe.name.lower())
if known_sig is None:
raise SystemExit(f"no built-in signature for {args.pe.name}; provide a PDB for ground truth")
pattern_hits = [m.start() for m in re.finditer(re.escape(known_sig), text_data)]
if len(pattern_hits) != 1:
raise SystemExit(f"expected exactly one StartRemoteDebuggingServer signature hit, got {len(pattern_hits)}")
matched_offset = pattern_hits[0]
matched_rva = _text_section.VirtualAddress + matched_offset
output = {
"binary": str(args.pe),
"signature_rva": f"0x{matched_rva:08X}",
"signature_va": f"0x{pe.OPTIONAL_HEADER.ImageBase + matched_rva:016X}",
"signature_length": len(known_sig),
"signature_hex": format_bytes(known_sig),
"text_hits": 1,
}
if args.pdb:
@@ -77,21 +53,30 @@ def main():
str(args.pdb),
"*StartRemoteDebuggingServer*",
min_sig=8,
max_sig=64,
max_sig=80,
)
)
good = [r for r in results if r.signature and r.match_count == 1]
if good:
result = good[0]
signature = result.signature
assert signature is not None
output["pdb"] = str(args.pdb)
output["symbol"] = result.symbol.name
output["pdb_rva"] = f"0x{result.symbol.rva:08X}"
output["pdb_va"] = f"0x{pe.OPTIONAL_HEADER.ImageBase + result.symbol.rva:016X}"
output["pdb_signature_hex"] = format_bytes(signature)
output["pdb_signature_text_hits"] = verify_unique(signature, text_data)
output["signature_matches_pdb_rva"] = matched_rva == result.symbol.rva
if not good:
raise SystemExit("failed to derive a unique StartRemoteDebuggingServer signature from the PDB")
result = good[0]
signature = result.signature
assert signature is not None
output["pdb"] = str(args.pdb)
output["symbol"] = result.symbol.name
output["signature_rva"] = f"0x{result.symbol.rva:08X}"
output["signature_va"] = f"0x{pe.OPTIONAL_HEADER.ImageBase + result.symbol.rva:016X}"
output["signature_length"] = len(signature)
output["signature_hex"] = format_bytes(signature)
output["signature_c_initializer"] = format_c_initializer(signature)
output["copy_to_code"] = (
"Use this for EDGE_START_SIG if analyzing msedge.dll, or CHROME_START_SIG if analyzing chrome.dll."
)
output["text_hits"] = verify_unique(signature, text_data)
else:
raise SystemExit("a matching PDB is required")
print(json.dumps(output, indent=2))