def test_reversers(self):
# order of resolution should be
# FieldReverser
# DoubleLinkedListReverser
# PointerFieldReverser
# TypeReverser
struct_d = self._context.get_record_for_address(self.offset)
sig_1 = struct_d.get_signature_text()
# print '1.', self._v(struct_d)
# try to find some logical constructs.
doublelink = reversers.DoubleLinkedListReverser(self.memory_handler)
doublelink.reverse()
sig_2 = struct_d.get_signature_text()
# print '2.', self._v(struct_d)
# no double linked list in here
self.assertEqual('', sig_2)
# decode bytes contents to find basic types.
fr = dsa.FieldReverser(self.memory_handler)
fr.reverse()
sig_3 = struct_d.get_signature_text()
# print '3.', self._v(struct_d)
#self.assertEqual(sig_3, 'P8P8P8z24i8z40i8z8i8z40i8z8i8z40i8z8i8z40i8z8i8z40i8z8i8z40i8z8i8z40i8z8i8z40i8z8i8z40i8z8i8z40i8z8i8z8i8z8i8z8i8z8i8z8i8z8i8z8i8z8i8z8P8P8P8P8P8P8P8P8P8P8P8P8u40P8P8P8P8P8P8P8P8P8P8i8P8T14u2z16P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z8P8z16P8')
# identify pointer relation between allocators
pfr = pointertypes.PointerFieldReverser(self.memory_handler)
pfr.reverse()
sig_4 = struct_d.get_signature_text()
# print '4.', self._v(struct_d)
#logging.getLogger("reversers").setLevel(logging.DEBUG)
# aggregate field of same type in an array
## FIXME very very long.
#afr = reversers.ArrayFieldsReverser(self._context)
#afr.reverse()
#sig_5 = struct_d.get_signature_text()
# print '5.', self._v(struct_d)
tr = signature.TypeReverser(self.memory_handler)
tr.reverse()
sig_6 = struct_d.get_signature_text()
# print '6.', self._v(struct_d)
# print "tr._similarities", tr._similarities
for a, b in tr._similarities:
# print self._context.get_record_for_address(a).to_string()
# print self._context.get_record_for_address(b).to_string()
#import code
#code.interact(local=locals())
pass
def test_doublelink(self):
rev = signature.TypeReverser(self.memory_handler)
# interesting records
# SIG:T4i4P4P4i4z12
# struct_bbf78 struct_a6518 struct_cca28
# list goes from 0xccd28, 0xccd00 to 0x98268
#_record = self._context.get_record_for_address(0xccd28)
_record = self._context.get_record_for_address(0xccd00)
print _record.to_string()
_record.set_reverse_level(10)
rev.reverse_context(self._context)
print _record.to_string()
pass
def test_doublelink(self):
# we need a basic reversing first - see this UT class setUP
rev = signature.TypeReverser(self.memory_handler)
# interesting records
# SIG:T4i4P4P4i4z12
# struct_bbf78 struct_a6518 struct_cca28
# list goes from 0xccd28, 0xccd00 to 0x98268
#_record = self._context.get_record_for_address(0xccd28)
_record = self._context.get_record_for_address(0xccd00)
print("Before:")
print(_record.to_string())
_record.set_reverse_level(10)
rev.reverse_context(self._context)
print("After:")
print(_record.to_string())
pass
def test_reverse_heap(self):
#ctx = reversers.reverse_heap(self.memory_handler, zeus_856_svchost_exe.known_heaps[0][0])
struct_d = self._context.get_record_for_address(self.offset)
struct_d.reset()
sig_1 = struct_d.get_signature_text()
# print '1.', self._v(struct_d)
#self.assertEqual(sig_1, 'P4P4P4P4P4P4P4i4z4i4i4z8P4P4z8P4i4u16z4i4z4P4P4P4P4z64P4P4P4P4P4P4P4i4z4i4i4z8P4P4z8P4i4u16z4i4z4P4P4P4P4z64P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z8272P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z180u4z176')
# decode bytes contents to find basic types.
fr = dsa.FieldReverser(self.memory_handler)
fr.reverse()
sig_2 = struct_d.get_signature_text()
# print '2.', self._v(struct_d)
# no double linked list in here
#self.assertEqual(sig_2, 'P4P4P4P4P4P4P4i4z4i4i4z8P4P4z8P4i4u16z4i4z4P4P4P4P4z64P4P4P4P4P4P4P4i4z4i4i4z8P4P4z8P4i4u16z4i4z4P4P4P4P4z64P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z8272P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z180u4z176')
# print struct_d.to_string()
#import code
#code.interact(local=locals())
# try to find some logical constructs.
doublelink = reversers.DoubleLinkedListReverser(self.memory_handler)
doublelink.reverse()
#self.assertEqual(doublelink.found, 12)
sig_3 = struct_d.get_signature_text()
# print '3.', self._v(struct_d)
#self.assertEqual(sig_3, 'P4P4P4P4P4P4P4i4z4i4i4z8P4P4z8P4i4u16z4i4z4P4P4P4P4z64P4P4P4P4P4P4P4i4z4i4i4z8P4P4z8P4i4u16z4i4z4P4P4P4P4z64P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z8272P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z176P4u4z180u4z176')
# print struct_d.to_string()
#import code
#code.interact(local=locals())
# identify pointer relation between allocators
pfr = pointertypes.PointerFieldReverser(self.memory_handler)
pfr.reverse()
sig_4 = struct_d.get_signature_text()
# print '4.', self._v(struct_d)
# print struct_d.to_string()
#import code
#code.interact(local=locals())
# aggregate field of same type in an array
#afr = reversers.ArrayFieldsReverser(self._context)
#afr.reverse()
#sig_5 = struct_d.get_signature_text()
# print '5.', self._v(struct_d)
# print struct_d.to_string()
#import code
#code.interact(local=locals())
tr = signature.TypeReverser(self.memory_handler)
tr.reverse()
sig_6 = struct_d.get_signature_text()
# print '6.', self._v(struct_d)
# print "tr._similarities", tr._similarities
for a, b in tr._similarities:
# print self._context.get_record_for_address(a).to_string()
# print self._context.get_record_for_address(b).to_string()
#import code
#code.interact(local=locals())
pass