mirror of
https://github.com/dobin/SuperMega
synced 2026-06-03 01:27:11 +00:00
Dobin
42 lines
1.3 KiB
Python
42 lines
1.3 KiB
Python
import shutil
|
|
from typing import List
|
|
import unittest
|
|
import logging
|
|
|
|
from model.exehost import ExeHost
|
|
from model.defs import *
|
|
from pe.pehelper import extract_code_from_exe_file
|
|
from utils import hexdump
|
|
from observer import observer
|
|
from model.defs import *
|
|
from pe.derbackdoorer import FunctionBackdoorer
|
|
from pe.superpe import SuperPe
|
|
|
|
|
|
class DerBackdoorerTest(unittest.TestCase):
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
observer.active = False
|
|
|
|
|
|
def test_function_backdoorer_exe(self):
|
|
shellcode = b"\x90" * 200
|
|
superpe = SuperPe(PATH_EXES + "iattest-full.exe")
|
|
function_backdoorer = FunctionBackdoorer(superpe, shellcode)
|
|
|
|
instr = function_backdoorer.find_suitable_instruction_addr(superpe.get_entrypoint(), 128, 5)
|
|
self.assertIsNotNone(instr)
|
|
self.assertEqual(instr.mnemonic, "jne")
|
|
self.assertEqual(instr.address, 0x1701)
|
|
|
|
|
|
def test_function_backdoorer_dll(self):
|
|
shellcode = b"\x90" * 200
|
|
superpe = SuperPe(PATH_EXES + "libbz2-1.dll")
|
|
function_backdoorer = FunctionBackdoorer(superpe, shellcode)
|
|
|
|
instr = function_backdoorer.find_suitable_instruction_addr(superpe.get_entrypoint(), 128, 5)
|
|
self.assertIsNotNone(instr)
|
|
self.assertEqual(instr.mnemonic, "jne")
|
|
self.assertEqual(instr.address, 0x1220)
|