def bytes_without_jmp(self):
"""
Clear all jump instructions.
jmp -> nop
jxx -> nop
call xxx -> push ret_addr
"""
buf = ''
from miasm2.arch.x86.arch import mn_x86
from miasm2.arch.x86.arch import conditional_branch
from miasm2.arch.x86.arch import unconditional_branch
from miasm2.expression.expression import ExprInt
branch_name = conditional_branch + unconditional_branch
call_name = ['CALL']
for ins in self.instructions:
ins_x86 = mn_x86.dis(ins.bytes, 32)
if ins_x86.name in branch_name:
buf += '\x90' # NOP
elif ins_x86.name in call_name:
ret_addr = ExprInt(ins.addr + ins.size, 32)
ins_x86.args = [ret_addr]
ins_x86.name = 'PUSH'
buf += mn_x86.asm(ins_x86)[0]
else:
buf += ins.bytes
return buf
def compute(ir, mode, asm, inputstate={}, debug=False):
instr = mn.fromstring(asm, mode)
code = mn.asm(instr)[0]
instr = mn.dis(code, mode)
instr.offset = inputstate.get(EIP, 0)
interm = ir()
interm.add_instr(instr)
return symb_exec(interm, inputstate, debug)
def compute(ir, mode, asm, inputstate={}, debug=False):
instr = mn.fromstring(asm, mode)
code = mn.asm(instr)[0]
instr = mn.dis(code, mode)
instr.offset = inputstate.get(EIP, 0)
interm = ir()
interm.add_instr(instr)
return symb_exec(interm, inputstate, debug)
def compute(ir, mode, asm, inputstate={}, debug=False):
loc_db = LocationDB()
instr = mn.fromstring(asm, loc_db, mode)
code = mn.asm(instr)[0]
instr = mn.dis(code, mode)
instr.offset = inputstate.get(EIP, 0)
ir_arch = ir(loc_db)
ircfg = ir_arch.new_ircfg()
lbl = ir_arch.add_instr_to_ircfg(instr, ircfg)
return symb_exec(lbl, ir_arch, ircfg, inputstate, debug)
from miasm2.arch.x86.arch import mn_x86
from miasm2.arch.x86.regs import *
l = mn_x86.fromstring('MOV EAX, EBX', 32)
print "instruction:", l
print "arg:", l.args[0]
x = mn_x86.asm(l)
print x
l.args[0] = EDX
y = mn_x86.asm(l)
print y
print mn_x86.dis(y[0], 32)
# Minimalist Symbol Exec example
from miasm2.core.bin_stream import bin_stream_str
from miasm2.arch.x86.arch import mn_x86
from miasm2.arch.x86.ira import ir_a_x86_32
from miasm2.arch.x86.regs import all_regs_ids, all_regs_ids_init
from miasm2.ir.symbexec import symbexec
from miasm2.arch.x86.disasm import dis_x86_32 as dis_engine
import miasm2.expression.expression as m2_expr
l = mn_x86.fromstring("MOV EAX, EBX", 32)
asm = mn_x86.asm(l)[0]
bin_stream = bin_stream_str(asm)
mdis = dis_engine(bin_stream)
disasm = mdis.dis_multibloc(0)
ir = ir_a_x86_32(mdis.symbol_pool)
for bbl in disasm: ir.add_bloc(bbl)
symbols_init = {}
for i, r in enumerate(all_regs_ids):
symbols_init[r] = all_regs_ids_init[i]
symb = symbexec(ir, symbols_init)
block = ir.get_bloc(0)
cur_addr = symb.emulbloc(block)
assert(symb.symbols[m2_expr.ExprId("EAX")] == symbols_init[m2_expr.ExprId("EBX")])
print 'modified registers:'
symb.dump_id()
