admin/cea-sec-miasm
1
0
Fork 0
mirror of https://github.com/cea-sec/miasm synced 2026-06-21 13:48:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Example/ASM: Test the x86_64 example

Browse Source
This commit is contained in:
Camille Mougey
2015-01-23 12:33:38 +01:00
parent c98879f0c1
commit a5f035142c
2 changed files with 9 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
example/asm/box_x86_64.py
-67
View File
@@ -1,67 +0,0 @@
#! /usr/bin/env python
from pdb import pm
from elfesteem import pe_init
from miasm2.core import asmbloc
from miasm2.core.cpu import parse_ast
from miasm2.arch.x86.arch import mn_x86, base_expr
from miasm2.core import parse_asm
import miasm2.expression.expression as m2_expr
e = pe_init.PE(wsize=64)
s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000)
s_iat = e.SHList.add_section(name="iat", rawsize=0x100)
new_dll = [({"name": "USER32.dll",
"firstthunk": s_iat.addr}, ["MessageBoxA"])]
e.DirImport.add_dlldesc(new_dll)
s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport))
e.DirImport.set_rva(s_myimp.addr)
reg_and_id = dict(mn_x86.regs.all_regs_ids_byname)
def my_ast_int2expr(a):
return m2_expr.ExprInt64(a)
def my_ast_id2expr(t):
return reg_and_id.get(t, m2_expr.ExprId(t, size=64))
my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
base_expr.setParseAction(my_var_parser)
blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 64, '''
main:
MOV R9, 0x0
MOV R8, title
MOV RDX, msg
MOV RCX, 0x0
MOV RAX, QWORD PTR [ MessageBoxA ]
CALL RAX
RET
title:
.string "Hello!"
msg:
.string "World!"
''')
# fix shellcode addr
symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr))
symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"),
e.DirImport.get_funcvirt('MessageBoxA'))
e.Opthdr.AddressOfEntryPoint = s_text.addr
for b in blocs[0]:
print b
resolved_b, patches = asmbloc.asm_resolve_final(
mn_x86, blocs[0], symbol_pool,
max_offset=0xFFFFFFFFFFFFFFFF)
print patches
for offset, raw in patches.items():
e.virt[offset] = raw
open('box_x86_64.bin', 'wb').write(str(e))
test/test_all.py
+9 -6
View File
@@ -116,11 +116,6 @@ class ExampleShellcode(ExampleAssembler):
testset += ExampleShellcode(['x86_32', 'x86_32_manip_ptr.S', "demo_x86_32.bin"])
test_armb = ExampleShellcode(["armb", "arm_simple.S", "demo_arm_b.bin"])
test_arml = ExampleShellcode(["arml", "arm_simple.S", "demo_arm_l.bin"])
test_armtb = ExampleShellcode(["armtb", "armt.S", "demo_armt_b.bin"])
test_armtl = ExampleShellcode(["armtl", "armt.S", "demo_armt_l.bin"])
test_box = {}
test_box_names = ["mod", "mod_self", "repmod", "simple", "enc"]
for source in test_box_names:
@@ -131,9 +126,15 @@ for source in test_box_names:
test_box[source] = ExampleShellcode(args)
testset += test_box[source]
test_armb = ExampleShellcode(["armb", "arm_simple.S", "demo_arm_b.bin"])
test_arml = ExampleShellcode(["arml", "arm_simple.S", "demo_arm_l.bin"])
test_armtb = ExampleShellcode(["armtb", "armt.S", "demo_armt_b.bin"])
test_armtl = ExampleShellcode(["armtl", "armt.S", "demo_armt_l.bin"])
test_msp430 = ExampleShellcode(["msp430", "msp430.S", "msp430_sc.bin"])
test_mips32b = ExampleShellcode(["mips32b", "mips32.S", "mips32_sc_b.bin"])
test_mips32l = ExampleShellcode(["mips32l", "mips32.S", "mips32_sc_l.bin"])
test_x86_64 = ExampleShellcode(["x86_64", "x86_64.S", "demo_x86_64.bin",
"--PE"])
testset += test_armb
testset += test_arml
@@ -142,7 +143,7 @@ testset += test_armtl
testset += test_msp430
testset += test_mips32b
testset += test_mips32l
testset += test_x86_64
class ExampleDisassembler(Example):
"""Disassembler examples specificities:
@@ -188,6 +189,8 @@ testset += ExampleDisasmFull(["mips32l", Example.get_sample("mips32_sc_l.bin"),
"0"], depends=[test_mips32l])
testset += ExampleDisasmFull(["mips32b", Example.get_sample("mips32_sc_b.bin"),
"0"], depends=[test_mips32b])
testset += ExampleDisasmFull(["x86_64", Example.get_sample("demo_x86_64.bin"),
"0x401000"], depends=[test_x86_64])
## Expression