mirror of
https://github.com/cea-sec/miasm
synced 2026-06-21 13:48:18 +00:00
serpilliere
121 lines
3.0 KiB
Python
121 lines
3.0 KiB
Python
import os
|
|
from elfesteem import *
|
|
from miasm.tools.pe_helper import *
|
|
from miasm.tools import seh_helper
|
|
import inspect
|
|
from miasm.core import asmbloc
|
|
from miasm.core import parse_asm
|
|
from miasm.tools.to_c_helper import *
|
|
from elfesteem import pe
|
|
import cProfile
|
|
import code
|
|
import sys
|
|
from miasm.tools import nux_api
|
|
|
|
|
|
# test sandboxing pp100_05ad9efbc4b0c16f243
|
|
|
|
fname = sys.argv[1]
|
|
e = elf_init.ELF(open(fname, 'rb').read())
|
|
in_str = bin_stream_vm()
|
|
vm_init_regs()
|
|
init_memory_page_pool_py()
|
|
init_code_bloc_pool_py()
|
|
|
|
codenat_tcc_init()
|
|
|
|
filename = os.environ.get('PYTHONSTARTUP')
|
|
if filename and os.path.isfile(filename):
|
|
execfile(filename)
|
|
|
|
vm_load_elf(e)
|
|
|
|
runtime_lib, lib_dyn_funcs = preload_elf(e, patch_vm_imp = True, lib_base_ad = 0x77700000)
|
|
lib_dyn_ad2name = dict([(x[1], x[0]) for x in lib_dyn_funcs.items()])
|
|
dyn_func = {}
|
|
|
|
|
|
stack_base_ad = 0x1230000
|
|
stack_size = 0x10000
|
|
vm_add_memory_page(stack_base_ad, PAGE_READ|PAGE_WRITE, "\x00"*stack_size)
|
|
dump_memory_page_pool_py()
|
|
|
|
|
|
try:
|
|
ep = e.sh.symtab.symbols['main'].value
|
|
except:
|
|
ep = e.Ehdr.entry
|
|
|
|
ptr_esp = stack_base_ad+stack_size-0x1000
|
|
vm_set_mem(ptr_esp, "/home/toto\x00")
|
|
ptr_arg0 = ptr_esp
|
|
ptr_esp -=0x100
|
|
ptr_args = ptr_esp
|
|
vm_set_mem(ptr_args, struct.pack('LL', ptr_arg0, 0))
|
|
|
|
regs = vm_get_gpreg()
|
|
regs['eip'] = ep
|
|
regs['esp'] = ptr_esp
|
|
vm_set_gpreg(regs)
|
|
dump_gpregs_py()
|
|
|
|
vm_push_uint32_t(ptr_args)
|
|
vm_push_uint32_t(1)
|
|
vm_push_uint32_t(0x1337beef)
|
|
|
|
dump_memory_page_pool_py()
|
|
|
|
symbol_pool = asmbloc.asm_symbol_pool()
|
|
|
|
my_eip = ep
|
|
|
|
|
|
known_blocs = {}
|
|
code_blocs_mem_range = []
|
|
|
|
|
|
log_regs = True
|
|
log_mn = log_regs
|
|
must_stop = False
|
|
def run_bin(my_eip, known_blocs, code_blocs_mem_range):
|
|
global log_regs, log_mn
|
|
last_blocs = [None for x in xrange(10)]
|
|
cpt = 0
|
|
while True:
|
|
#dyn lib funcs
|
|
if my_eip in runtime_lib.fad2cname:
|
|
fname = runtime_lib.fad2cname[my_eip]
|
|
if not fname in nux_api.__dict__:
|
|
raise ValueError('unknown api', (hex(vm_pop_uint32_t()), hex(my_eip), fname, hex(cpt)))
|
|
nux_api.__dict__[fname]()
|
|
regs = vm_get_gpreg()
|
|
my_eip = regs['eip']
|
|
|
|
continue
|
|
|
|
|
|
if not my_eip in known_blocs:
|
|
last_blocs.pop(0)
|
|
last_blocs.append(my_eip)
|
|
updt_bloc_emul(known_blocs, in_str, my_eip, symbol_pool, code_blocs_mem_range, log_regs = log_regs, log_mn = log_mn)
|
|
vm_reset_exception()
|
|
|
|
|
|
try:
|
|
my_eip = vm_exec_blocs(my_eip, known_blocs)
|
|
except KeyboardInterrupt:
|
|
must_stop = True
|
|
py_exception = vm_get_exception()
|
|
if py_exception:
|
|
print hex(my_eip)
|
|
if py_exception & EXCEPT_CODE_AUTOMOD:
|
|
print 'automod code'
|
|
dump_gpregs_py()
|
|
known_blocs, code_blocs_mem_range = updt_automod_code(known_blocs)
|
|
else:
|
|
print "unknown exception", py_exception
|
|
break
|
|
|
|
print "start run"
|
|
run_bin(my_eip, known_blocs, code_blocs_mem_range)
|