mirror of
https://github.com/dobin/SuperMega
synced 2026-06-03 01:27:11 +00:00
Dobin
49 lines
1.9 KiB
Python
49 lines
1.9 KiB
Python
from typing import List
|
|
import unittest
|
|
|
|
from model.defs import *
|
|
from utils import hexdump
|
|
from observer import observer
|
|
from model.defs import *
|
|
from pe.derbackdoorer import FunctionBackdoorer, DEPTH_OPTIONS
|
|
from pe.superpe import SuperPe
|
|
|
|
|
|
class DerBackdoorerTest(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
observer.active = False
|
|
|
|
|
|
def test_function_backdoorer_exe(self):
|
|
superpe = SuperPe(PATH_EXES + "iattest-full.exe")
|
|
function_backdoorer = FunctionBackdoorer(superpe, depth_option=DEPTH_OPTIONS.LEVEL1)
|
|
|
|
addr = function_backdoorer.find_suitable_instruction_addr(superpe.get_entrypoint())
|
|
self.assertEqual(addr, 0x1304)
|
|
|
|
trampoline_compiled, _, trampoline_reloc_offset = function_backdoorer.get_trampoline(addr, 0x11223344)
|
|
self.assertEqual(trampoline_compiled[0], 0x48)
|
|
self.assertEqual(trampoline_compiled[2], 0x44)
|
|
self.assertEqual(trampoline_compiled[3], 0x33)
|
|
self.assertEqual(trampoline_compiled[4], 0x22)
|
|
self.assertEqual(trampoline_compiled[5], 0x51)
|
|
self.assertEqual(trampoline_compiled[6], 0x01)
|
|
self.assertEqual(trampoline_compiled[10], 0xff)
|
|
self.assertEqual(trampoline_reloc_offset, 2)
|
|
|
|
|
|
def test_function_backdoorer_dll(self):
|
|
superpe = SuperPe(PATH_EXES + "libbz2-1.dll")
|
|
function_backdoorer = FunctionBackdoorer(superpe)
|
|
|
|
addr = function_backdoorer.find_suitable_instruction_addr(superpe.get_entrypoint())
|
|
self.assertEqual(addr, 0x135D)
|
|
|
|
trampoline_compiled, _, trampoline_reloc_offset = function_backdoorer.get_trampoline(addr, 0x11223344)
|
|
self.assertEqual(trampoline_compiled[0], 0x48)
|
|
self.assertEqual(trampoline_compiled[2], 0x44)
|
|
self.assertEqual(trampoline_compiled[3], 0x33)
|
|
self.assertEqual(trampoline_compiled[6], 0x02)
|
|
self.assertEqual(trampoline_compiled[10], 0xff)
|
|
self.assertEqual(trampoline_reloc_offset, 2) |