Ejemplo n.º 1
0
def parse_args():
    # Parse arguments
    parser = ArgumentParser(description=
        'Reverse engineering for x86/ARM binaries. Generation of pseudo-C. '
        'Supported formats : ELF, PE. https://github.com/joelpx/reverse')
    parser.add_argument('filename', nargs='?', metavar='FILENAME')
    parser.add_argument('-nc', '--nocolor', action='store_true')
    parser.add_argument('-g', '--graph', action='store_true',
            help='Generate an html flow graph. See d3/index.html.')
    parser.add_argument('--nocomment', action='store_true',
            help="Don't print comments")
    parser.add_argument('--noandif', action='store_true',
            help="Print normal 'if' instead of 'andif'")
    parser.add_argument('--datasize', type=int, default=30, metavar='N',
            help='default 30, maximum of chars to display for strings or bytes array.')
    parser.add_argument('-x', '--entry', metavar='SYMBOLNAME|0xXXXXX|EP',
            help='default main. EP stands for entry point.')
    parser.add_argument('--vim', action='store_true',
            help='Generate syntax colors for vim')
    parser.add_argument('-s', '--symbols', action='store_true',
            help='Print all symbols')
    parser.add_argument('-c', '--calls', action='store_true',
            help='Print all calls which are in the section containing the address'
                 'given with -x.')
    parser.add_argument('--raw', metavar='x86|x64|arm',
            help='Consider the input file as a raw binary')
    parser.add_argument('--dump', action='store_true',
            help='Dump asm without decompilation')
    parser.add_argument('--lines', type=int, default=30, metavar='N',
            help='Max lines to dump')
    parser.add_argument('-i', '--interactive', action='store_true',
            help='Interactive mode')
    parser.add_argument('--symfile', metavar='FILENAME', type=FileType('r'),
            help=('Add user symbols for better readability of the analysis. '
            'Line format: ADDRESS_HEXA    SYMBOL_NAME'))
    parser.add_argument('-d', '--opt_debug', action='store_true')
    parser.add_argument('-ns', '--nosectionsname', action='store_true')

    args = parser.parse_args()

    ctx = Context()
    ctx.debug           = args.opt_debug
    ctx.print_andif     = not args.noandif
    ctx.color           = not args.nocolor
    ctx.comments        = not args.nocomment
    ctx.sectionsname    = not args.nosectionsname
    ctx.max_data_size   = args.datasize
    ctx.filename        = args.filename
    ctx.raw_type        = args.raw
    ctx.symfile         = args.symfile
    ctx.syms            = args.symbols
    ctx.calls           = args.calls
    ctx.entry           = args.entry
    ctx.dump            = args.dump
    ctx.vim             = args.vim
    ctx.interactive     = args.interactive
    ctx.lines           = args.lines
    ctx.graph           = args.graph
    return ctx
Ejemplo n.º 2
0
def reverse_file(filename, symbol, options):
    ctx = Context()
    ctx.sectionsname = False
    ctx.color = False
    ctx.filename = filename
    ctx.entry = symbol

    for o in options:
        if o == "--raw x86":
            ctx.raw_type = "x86"
        elif o == "--raw x64":
            ctx.raw_type = "x64"

    sio = StringIO()
    with redirect_stdout(sio):
        reverse(ctx)
    postfix = '{0}.rev'.format('' if symbol is None else '_' + symbol)
    with open(filename.replace('.bin', postfix)) as f:
        assert_equal(sio.getvalue(), f.read())
Ejemplo n.º 3
0
def parse_args():
    # Parse arguments
    parser = ArgumentParser(description=
        'Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. '
        'Supported formats : ELF, PE. More commands available in the interactive'
        ' mode.    https://github.com/joelpx/reverse')
    parser.add_argument('filename', nargs='?', metavar='FILENAME')
    parser.add_argument('-nc', '--nocolor', action='store_true')
    parser.add_argument('-g', '--graph', action='store_true',
            help='Generate an html flow graph. See d3/index.html.')
    parser.add_argument('--nocomment', action='store_true',
            help="Don't print comments")
    parser.add_argument('--noandif', action='store_true',
            help="Print normal 'if' instead of 'andif'")
    parser.add_argument('--datasize', type=int, default=30, metavar='N',
            help='default 30, maximum of chars to display for strings or bytes array.')
    parser.add_argument('-x', '--entry', metavar='SYMBOLNAME|0xXXXXX|EP',
            help='Pseudo-decompilation, default is main. EP stands for entry point.')
    parser.add_argument('--vim', action='store_true',
            help='Generate syntax colors for vim')
    parser.add_argument('-s', '--symbols', action='store_true',
            help='Print all symbols')
    parser.add_argument('-c', '--calls', metavar='SECTION_NAME', type=str,
            help='Print all calls which are in the given section')
    parser.add_argument('--sections', action='store_true',
            help='Print all sections')
    parser.add_argument('--dump', action='store_true',
            help='Dump asm without decompilation')
    parser.add_argument('-l', '--lines', type=int, default=30, metavar='N',
            help='Max lines used with --dump')
    parser.add_argument('--bytes', action='store_true',
            help='Print instruction bytes')
    parser.add_argument('-i', '--interactive', action='store_true',
            help='Interactive mode')
    parser.add_argument('--symfile', metavar='FILENAME', type=FileType('r'),
            help=('Add user symbols for better readability of the analysis. '
            'Line format: ADDRESS_HEXA    SYMBOL_NAME'))
    parser.add_argument('-d', '--opt_debug', action='store_true')
    parser.add_argument('-ns', '--nosectionsname', action='store_true')
    parser.add_argument('--raw', metavar='x86|x64|arm|mips|mips64',
            help='Consider the input file as a raw binary')
    parser.add_argument('--rawbase', metavar='0xXXXXX',
            help='Set base address of a raw file (default=0)')
    parser.add_argument('--rawbe', action='store_true',
            help='If not set it\'s in little endian')

    args = parser.parse_args()

    ctx = Context()
    ctx.debug           = args.opt_debug
    ctx.print_andif     = not args.noandif
    ctx.color           = not args.nocolor
    ctx.comments        = not args.nocomment
    ctx.sectionsname    = not args.nosectionsname
    ctx.max_data_size   = args.datasize
    ctx.filename        = args.filename
    ctx.raw_type        = args.raw
    ctx.raw_base        = args.rawbase
    ctx.symfile         = args.symfile
    ctx.syms            = args.symbols
    ctx.calls_in_section = args.calls
    ctx.entry           = args.entry
    ctx.dump            = args.dump
    ctx.vim             = args.vim
    ctx.interactive     = args.interactive
    ctx.lines           = args.lines
    ctx.graph           = args.graph
    ctx.raw_big_endian  = args.rawbe
    ctx.list_sections   = args.sections
    ctx.print_bytes     = args.bytes

    if ctx.raw_base is not None:
        if ctx.raw_base.startswith("0x"):
            ctx.raw_base = int(ctx.raw_base, 16)
        else:
            error("--rawbase must in hex format")
            die()
    else:
        ctx.raw_base = 0

    return ctx
Ejemplo n.º 4
0
def parse_args():
    # Parse arguments
    parser = ArgumentParser(
        description=
        'Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. '
        'Supported formats : ELF, PE. More commands available in the interactive'
        ' mode.    https://github.com/joelpx/reverse')
    parser.add_argument('filename', nargs='?', metavar='FILENAME')
    parser.add_argument('-nc', '--nocolor', action='store_true')
    parser.add_argument('-g',
                        '--graph',
                        action='store_true',
                        help='Generate an html flow graph. See d3/index.html.')
    parser.add_argument('--nocomment',
                        action='store_true',
                        help="Don't print comments")
    parser.add_argument('--noandif',
                        action='store_true',
                        help="Print normal 'if' instead of 'andif'")
    parser.add_argument(
        '--datasize',
        type=int,
        default=30,
        metavar='N',
        help=
        'default 30, maximum of chars to display for strings or bytes array.')
    parser.add_argument(
        '-x',
        '--entry',
        metavar='SYMBOLNAME|0xXXXXX|EP',
        help='Pseudo-decompilation, default is main. EP stands for entry point.'
    )
    parser.add_argument('--vim',
                        action='store_true',
                        help='Generate syntax colors for vim')
    parser.add_argument('-s',
                        '--symbols',
                        action='store_true',
                        help='Print all symbols')
    parser.add_argument('-c',
                        '--calls',
                        metavar='SECTION_NAME',
                        type=str,
                        help='Print all calls which are in the given section')
    parser.add_argument('--sections',
                        action='store_true',
                        help='Print all sections')
    parser.add_argument('--dump',
                        action='store_true',
                        help='Dump asm without decompilation')
    parser.add_argument('-l',
                        '--lines',
                        type=int,
                        default=30,
                        metavar='N',
                        help='Max lines used with --dump')
    parser.add_argument('--bytes',
                        action='store_true',
                        help='Print instruction bytes')
    parser.add_argument('-i',
                        '--interactive',
                        action='store_true',
                        help='Interactive mode')
    parser.add_argument('-d', '--opt_debug', action='store_true')
    parser.add_argument('-ns', '--nosectionsname', action='store_true')
    parser.add_argument('--raw',
                        metavar='x86|x64|arm|mips|mips64',
                        help='Consider the input file as a raw binary')
    parser.add_argument('--rawbase',
                        metavar='0xXXXXX',
                        help='Set base address of a raw file (default=0)')
    parser.add_argument('--rawbe',
                        action='store_true',
                        help='If not set it\'s in little endian')

    args = parser.parse_args()

    ctx = Context()
    ctx.debug = args.opt_debug
    ctx.print_andif = not args.noandif
    ctx.color = not args.nocolor
    ctx.comments = not args.nocomment
    ctx.sectionsname = not args.nosectionsname
    ctx.max_data_size = args.datasize
    ctx.filename = args.filename
    ctx.raw_type = args.raw
    ctx.raw_base = args.rawbase
    ctx.syms = args.symbols
    ctx.calls_in_section = args.calls
    ctx.entry = args.entry
    ctx.dump = args.dump
    ctx.vim = args.vim
    ctx.interactive = args.interactive
    ctx.lines = args.lines
    ctx.graph = args.graph
    ctx.raw_big_endian = args.rawbe
    ctx.list_sections = args.sections
    ctx.print_bytes = args.bytes

    if ctx.raw_base is not None:
        if ctx.raw_base.startswith("0x"):
            ctx.raw_base = int(ctx.raw_base, 16)
        else:
            error("--rawbase must in hex format")
            die()
    else:
        ctx.raw_base = 0

    return ctx
Ejemplo n.º 5
0
def parse_args():
    # Parse arguments
    parser = ArgumentParser(
        description=
        'Reverse engineering for x86/ARM binaries. Generation of pseudo-C. '
        'Supported formats : ELF, PE. https://github.com/joelpx/reverse')
    parser.add_argument('filename', nargs='?', metavar='FILENAME')
    parser.add_argument('-nc', '--nocolor', action='store_true')
    parser.add_argument('-g',
                        '--graph',
                        action='store_true',
                        help='Generate an html flow graph. See d3/index.html.')
    parser.add_argument('--nocomment',
                        action='store_true',
                        help="Don't print comments")
    parser.add_argument('--noandif',
                        action='store_true',
                        help="Print normal 'if' instead of 'andif'")
    parser.add_argument(
        '--datasize',
        type=int,
        default=30,
        metavar='N',
        help=
        'default 30, maximum of chars to display for strings or bytes array.')
    parser.add_argument('-x',
                        '--entry',
                        metavar='SYMBOLNAME|0xXXXXX|EP',
                        help='default main. EP stands for entry point.')
    parser.add_argument('--vim',
                        action='store_true',
                        help='Generate syntax colors for vim')
    parser.add_argument('-s',
                        '--symbols',
                        action='store_true',
                        help='Print all symbols')
    parser.add_argument(
        '-c',
        '--calls',
        action='store_true',
        help='Print all calls which are in the section containing the address '
        'given with -x.')
    parser.add_argument('--raw',
                        metavar='x86|x64|arm',
                        help='Consider the input file as a raw binary')
    parser.add_argument('--dump',
                        action='store_true',
                        help='Dump asm without decompilation')
    parser.add_argument('--lines',
                        type=int,
                        default=30,
                        metavar='N',
                        help='Max lines to dump')
    parser.add_argument('-i',
                        '--interactive',
                        action='store_true',
                        help='Interactive mode')
    parser.add_argument(
        '--symfile',
        metavar='FILENAME',
        type=FileType('r'),
        help=('Add user symbols for better readability of the analysis. '
              'Line format: ADDRESS_HEXA    SYMBOL_NAME'))
    parser.add_argument('-d', '--opt_debug', action='store_true')
    parser.add_argument('-ns', '--nosectionsname', action='store_true')

    args = parser.parse_args()

    ctx = Context()
    ctx.debug = args.opt_debug
    ctx.print_andif = not args.noandif
    ctx.color = not args.nocolor
    ctx.comments = not args.nocomment
    ctx.sectionsname = not args.nosectionsname
    ctx.max_data_size = args.datasize
    ctx.filename = args.filename
    ctx.raw_type = args.raw
    ctx.symfile = args.symfile
    ctx.syms = args.symbols
    ctx.calls = args.calls
    ctx.entry = args.entry
    ctx.dump = args.dump
    ctx.vim = args.vim
    ctx.interactive = args.interactive
    ctx.lines = args.lines
    ctx.graph = args.graph
    return ctx