mirror of
https://github.com/cea-sec/miasm
synced 2026-06-21 13:48:18 +00:00
serpilliere
83 lines
1.7 KiB
Python
83 lines
1.7 KiB
Python
#! /usr/bin/env python
|
|
|
|
from miasm2.core.cpu import parse_ast
|
|
from miasm2.arch.arm.arch import mn_arm, base_expr, variable
|
|
from miasm2.core import parse_asm
|
|
from miasm2.expression.expression import *
|
|
from miasm2.core import asmbloc
|
|
from elfesteem.strpatchwork import StrPatchwork
|
|
|
|
my_mn = mn_arm
|
|
|
|
reg_and_id = dict(mn_arm.regs.all_regs_ids_byname)
|
|
|
|
|
|
def my_ast_int2expr(a):
|
|
return ExprInt32(a)
|
|
|
|
|
|
def my_ast_id2expr(t):
|
|
return reg_and_id.get(t, ExprId(t, size=32))
|
|
|
|
my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
|
|
base_expr.setParseAction(my_var_parser)
|
|
|
|
blocs, symbol_pool = parse_asm.parse_txt(my_mn, "arm", '''
|
|
main:
|
|
STMFD SP!, {R4, R5, LR}
|
|
MOV R0, mystr & 0xffff
|
|
ORR R0, R0, mystr & 0xffff0000
|
|
MOV R1, mystrend & 0xffff
|
|
ORR R1, R1, mystrend & 0xffff0000
|
|
xxx:
|
|
LDR R2, [PC, key-$]
|
|
LDR R6, [PC, test-$]
|
|
loop:
|
|
LDRB R3, [R0]
|
|
EOR R3, R3, R2
|
|
STRB R3, [R0], 1
|
|
CMP R0, R1
|
|
BNE loop
|
|
EOR R0, R0, R0
|
|
BNE end
|
|
EOR R1, R1, R1
|
|
EOR R2, R2, R2
|
|
EORGE R1, R1, R1
|
|
EORGE R2, R2, R2
|
|
ADDLTS R2, R2, R2
|
|
SUBEQ R2, R2, R2
|
|
end:
|
|
LDMFD SP!, {R4, R5, PC}
|
|
key:
|
|
.long 0x11223344
|
|
mystr:
|
|
.string "test string"
|
|
mystrend:
|
|
.long 0
|
|
test:
|
|
.long mystrend - key + 0x1122
|
|
''')
|
|
|
|
# fix shellcode addr
|
|
symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0)
|
|
|
|
for b in blocs[0]:
|
|
print b
|
|
# graph sc####
|
|
g = asmbloc.bloc2graph(blocs[0])
|
|
open("graph.txt", "w").write(g)
|
|
|
|
s = StrPatchwork()
|
|
|
|
print "symbols"
|
|
print symbol_pool
|
|
# dont erase from start to shell code padading
|
|
resolved_b, patches = asmbloc.asm_resolve_final(
|
|
my_mn, 'arm', blocs[0], symbol_pool)
|
|
print patches
|
|
|
|
for offset, raw in patches.items():
|
|
s[offset] = raw
|
|
|
|
open('demo_arm.bin', 'wb').write(str(s))
|