def main(): try: # e.g. /path/to/asadbg/asadb.json dbname = os.environ["ASADBG_DB"] except: logmsg("You need to define ASADBG_DB first") sys.exit() if ida_helper.get_idb_name() == "lina": logmsg("Hunting lina...") main_lina(dbname) elif ida_helper.get_idb_name() == "lina_monitor": logmsg("Hunting lina_monitor...") main_lina_monitor(dbname) elif ida_helper.get_idb_name() == "libc.so": logmsg("Hunting libc...") main_libc(dbname) else: logmsg("ERROR: Unsupported filename") # This allows us to cleanly exit IDA upon completion if "DO_EXIT" in os.environ: # XXX - Was Exit(1) idc.qexit(1)
###################### libc ###################### ################################################## def main_libc(): # We currently only rely on __libc_free, which is exported pass print("[+] Done") ################################################## ###################### main ###################### ################################################## if __name__ == '__main__': if ida_helper.get_idb_name() == "lina": logmsg("Analyzing lina...") main_lina() elif ida_helper.get_idb_name() == "lina_monitor": logmsg("Analyzing lina_monitor...") main_lina_monitor() elif ida_helper.get_idb_name() == "libc.so": logmsg("Analyzing libc...") main_libc() else: logmsg("ERROR: Unsupported filename") # Note that this script is called automatically from the command line # Consequently, we cannot call sys.exit(), otherwise the temporary files # (.id0, .id1, etc.) will not packed and nothing is saved into the .idb. # This allows us to cleanly exit IDA upon completion
import sys import json import pathlib script_args = len(idc.ARGV) print("script_args", script_args) if script_args > 0: ida_auto.auto_wait() current_dir = str(pathlib.Path(__file__).parent.resolve()) sys.path.append(current_dir + "\\idahunt\\") import ida_helper idb_name = ida_helper.get_idb_name() hvcall_dict = {} hvcall_dict_unknown = {} # hvcall_file_path = current_dir + "\\hvcalls_dict.json" hvcall_dir_saving = current_dir + "\\hvcalls_json_files\\" hvcall_unknown_dir_saving = hvcall_dir_saving + "\\unknown\\" if not os.path.exists(hvcall_dir_saving): os.makedirs(hvcall_dir_saving) if not os.path.exists(hvcall_unknown_dir_saving): os.makedirs(hvcall_unknown_dir_saving)
def extract_hvcalls(): # # winhvr.sys, winhv.sys # if (g_idb_name == "winhvr.sys") or (g_idb_name == "winhv.sys"): find_hvcall_by_aux_function_name( 'WinHvpSimplePoolHypercall_CallViaMacro', 1, "decompile") find_hvcall_by_aux_function_name('WinHvpRangeRepHypercall', 0, "decompile") find_hvcall_by_aux_function_name('WinHvpSpecialListRepHypercall', 0, "decompile") # # securekernel.exe, securekernella57.exe # if (g_idb_name == "securekernel.exe") or (g_idb_name == "securekernella57.exe"): find_hvcall_by_aux_function_name('ShvlpInitiateFastHypercall', 0, "decompile") find_hvcall_by_aux_function_name('ShvlpInitiateRepListHypercall', 0, "decompile") # # ntoskrnl.exe, ntkrla57.exe # if (g_idb_name == "ntoskrnl.exe") or (g_idb_name == "ntkrla57.exe"): find_hvcall_by_aux_function_name('HvcallFastExtended', 0, "decompile") find_hvcall_by_aux_function_name('HvcallInitiateHypercall', 0, "decompile") print_hvcall(g_hvcall_dict, False) print("saving g_hvcall_dict to json ...") fv = get_file_version() # # if you copy idb from another place you can have error with pathM which are stored in idb file # filename = g_hvcall_dir_saving + ida_helper.get_idb_name( ) + "_" + fv + ".json" hvcall_dict = str_key_to_int_with_sorting(g_hvcall_dict) save_dict_to_file(filename, hvcall_dict) # # save file with uknown hypercalls # if len(g_hvcall_dict_unknown) > 0: unknown_filename = g_hvcall_unknown_dir_saving + "unknown_" + ida_helper.get_idb_name( ) + "_" + fv + ".json" save_dict_to_file(unknown_filename, g_hvcall_dict_unknown) print( "hvcalls with unknown result of analysis - need manual analysis") print_hvcall(g_hvcall_dict_unknown, True) print("g_hvcall_dict lenght:", len(g_hvcall_dict)) print("g_hvcall_dict_unknown lenght:", len(g_hvcall_dict_unknown)) print("db file:", ida_nalt.get_input_file_path()) print("idb", g_idb_name)
# # directories for searching and saving # g_hvcall_dir_saving = g_current_dir + "\\hvcalls_json_files\\" g_hvcall_unknown_dir_saving = g_hvcall_dir_saving + "\\unknown\\" # # import Idahunt module # sys.path.append(g_current_dir + "\\idahunt\\") import ida_helper g_idb_name = ida_helper.get_idb_name() g_hvcall_dict = {} g_hvcall_dict_unknown = {} g_hvcall_dict_unknown_index = 0 # hvcall_file_path = g_current_dir + "\\hvcalls_dict.json" if not os.path.exists(g_hvcall_dir_saving): os.makedirs(g_hvcall_dir_saving) if not os.path.exists(g_hvcall_unknown_dir_saving): os.makedirs(g_hvcall_unknown_dir_saving) def save_dict_to_file(file_path, t_dict):