def kernel_stack(vm):
    sp0 = vm.mem.read_dword(vm.cpu.sr.tr_base + 4)
    ss3 = vm.mem.read_dword(sp0 - 4)
    sp3 = vm.mem.read_dword(sp0 - 8)
    cs3 = vm.mem.read_dword(sp0 - 16)

    off = vm.cpu.sr.gdtr_base + (cs3 & (~3))
    dsc = SegmentDescriptor(vm.mem.vread(off, 8))
    if dsc.dpl != 3:
        return False

    off = vm.cpu.sr.gdtr_base + (ss3 & (~3))
    dsc = SegmentDescriptor(vm.mem.vread(off, 8))
    sp3 = vm.cpu.linear(dsc.base, sp3)

    nm_sz = 100
    stack = (sp3 & PgMsk.addr) + 4096
    while True:
        try:
            vm.mem.translate(stack)
        except:
            break
        stack += 4096

    nm_addr = stack - nm_sz
    name = vm.mem.vread(nm_addr, nm_sz).strip('\x00').split('\x00')[-1]
    log("info", "[%s]" % (repr(name)))
    return False
Ejemplo n.º 2
0
    def __init__(self, vm, cr3):
        if vm.cpu.mode.pg != CPUMode.pg32:
            log("error", "paging mode not supported: %s" % vm.cpu.mode)
            raise ValueError

        self.pgd = PageDirectory(vm, cr3)
        self.map = Mapping(self.pgd)
def kernel_stack(vm):
    sp0 = vm.mem.read_dword(vm.cpu.sr.tr_base + 4)
    ss3 = vm.mem.read_dword(sp0 - 4)
    sp3 = vm.mem.read_dword(sp0 - 8)
    cs3 = vm.mem.read_dword(sp0 - 16)

    off = vm.cpu.sr.gdtr_base + (cs3 & (~3))
    dsc = SegmentDescriptor(vm.mem.vread(off, 8))
    if dsc.dpl != 3:
        return False

    off = vm.cpu.sr.gdtr_base + (ss3 & (~3))
    dsc = SegmentDescriptor(vm.mem.vread(off, 8))
    sp3 = vm.cpu.linear(dsc.base, sp3)

    nm_sz = 100
    stack = (sp3 & PgMsk.addr) + 4096
    while True:
        try:
            vm.mem.translate(stack)
        except:
            break
        stack += 4096

    nm_addr = stack - nm_sz
    name = vm.mem.vread(nm_addr, nm_sz).strip("\x00").split("\x00")[-1]
    log("info", "[%s]" % (repr(name)))
    return False
Ejemplo n.º 4
0
def on_write_cr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not vm.ads.has_key(cr3):
        vm.ads[cr3] = AddrSpace(vm, cr3)
        log("info", "added new cr3 0x%x to ads (#%d)" % (cr3, len(vm.ads)))
        #return True

    return False
def search_page(page, data):
    blob = vm.mem.pread(page.paddr, 4<<10)
    idx = blob.find(data)
    if idx == -1:
        return None

    log("info", "found data @ paddr 0x%x" % (page.paddr+idx))
    return page.paddr+idx
def on_write_cr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not vm.ads.has_key(cr3):
        vm.ads[cr3] = AddrSpace(vm, cr3)
        log("info", "added new cr3 0x%x to ads (#%d)" % (cr3, len(vm.ads)))
        #return True

    return False
Ejemplo n.º 7
0
    def __init__(self, val):
        self.raw = val
        self.p = val & PgMsk.present
        self.w = val & PgMsk.write
        self.u = val & PgMsk.user
        self.addr = val & PgMsk.addr

        log("paging", str(self))
Ejemplo n.º 8
0
def search_page(page, data):
    blob = vm.mem.pread(page.paddr, 4 << 10)
    idx = blob.find(data)
    if idx == -1:
        return None

    log("info", "found data @ paddr 0x%x" % (page.paddr + idx))
    return page.paddr + idx
Ejemplo n.º 9
0
def OSFactory(affinity, settings=None):
    if affinity == OSAffinity.Linux26:
        return Linux26(settings)
    elif affinity == OSAffinity.WinXP:
        return WinXP(settings)
    elif affinity == OSAffinity.Win7:
        return Win7(settings)

    log("error", "Unknown OS affinity")
    raise ValueError
Ejemplo n.º 10
0
def OSFactory(affinity, settings=None):
    if affinity == OSAffinity.Linux26:
        return Linux26(settings)
    elif affinity == OSAffinity.WinXP:
        return WinXP(settings)
    elif affinity == OSAffinity.Win7:
        return Win7(settings)

    log("error", "Unknown OS affinity")
    raise ValueError
Ejemplo n.º 11
0
    def __init__(self, vm, vaddr, paddr):
        self.addr = paddr

        log("paging", "PageTable reading physical page @ 0x%x" % paddr)

        self.raw = struct.unpack("<1024L", vm.mem.pread(paddr, 4<<10))
        self.pte = []

        for i in xrange(1024):
            self.pte.append(Pte(vaddr, self.raw[i]))
            vaddr += 4<<10
Ejemplo n.º 12
0
def find_kmem(vm):
    log("fkm", "Looking for kernel pages into user mappings")

    #check if they have another mapping with user privilege
    fmt = "U ads 0x%x match K ads 0x%x:\n (user) %s\n (krnl) %s"
    for klst in vm.kppg.itervalues():
        for ka, kp in klst:
            for a in vm.ads:
                ulst = vm.ads[a].search_paddr(kp.paddr, user=True)
                if len(ulst) != 0:
                    for p in ulst:
                        log("fkm", fmt % (a, ka, p, kp))
Ejemplo n.º 13
0
def find_kmem(vm):
    log("fkm", "Looking for kernel pages into user mappings")

    #check if they have another mapping with user privilege
    fmt = "U ads 0x%x match K ads 0x%x:\n (user) %s\n (krnl) %s"
    for klst in vm.kppg.itervalues():
        for ka,kp in klst:
            for a in vm.ads:
                ulst = vm.ads[a].search_paddr(kp.paddr,user=True)
                if len(ulst) != 0:
                    for p in ulst:
                        log("fkm", fmt % (a,ka,p,kp))
def wcr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not cr3:
        return False

    if not vm.ads.has_key(cr3):
        ads = AddrSpace(vm, cr3)
        vm.ads[cr3] = ads
        log("info", "added new cr3 0x%x to ads (%d)" % (cr3, len(vm.ads)))
        search_ads(ads)

    return False
Ejemplo n.º 15
0
    def __init__(self, vm, cr3):
        self.addr = cr3 & PgMsk.addr

        log("paging", "PageDirectory reading physical page @ 0x%x" % self.addr)

        self.raw = struct.unpack("<1024L", vm.mem.pread(self.addr, 4<<10))
        self.pde = []

        vaddr = 0
        for i in xrange(1024):
            self.pde.append(Pde(vm, vaddr, self.raw[i]))
            vaddr += 4<<20
Ejemplo n.º 16
0
def wcr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not cr3:
        return False

    if not vm.ads.has_key(cr3):
        ads = AddrSpace(vm, cr3)
        vm.ads[cr3] = ads
        log("info", "added new cr3 0x%x to ads (%d)" % (cr3, len(vm.ads)))
        search_ads(ads)

    return False
Ejemplo n.º 17
0
def wcr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not cr3:
        return False

    if not vm.ads.has_key(cr3):
        ads = AddrSpace(vm, cr3)
        vm.ads[cr3] = ads
        for p in ads.iter_pages(user=False):
            vm.kppg[p.paddr].append((cr3,p))
        log("info", "added new cr3 0x%x to ads (%d)" % (cr3, len(vm.ads)))

    return False
Ejemplo n.º 18
0
def wcr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not cr3:
        return False

    if not vm.ads.has_key(cr3):
        ads = AddrSpace(vm, cr3)
        vm.ads[cr3] = ads
        for p in ads.iter_pages(user=False):
            vm.kppg[p.paddr].append((cr3, p))
        log("info", "added new cr3 0x%x to ads (%d)" % (cr3, len(vm.ads)))

    return False
Ejemplo n.º 19
0
def wcr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not cr3:
        return False

    if not vm.ads.has_key(cr3):
        ads = AddrSpace(vm, cr3)
        vm.ads[cr3] = ads
        log("info", "added new cr3 0x%x to ads (%d)" % (cr3, len(vm.ads)))
    elif len(vm.ads) >= vm.nr_cr3:
        return find_shared(vm)

    return False
Ejemplo n.º 20
0
def wcr3(vm):
    cr3 = vm.cpu.sr.cr3 & PgMsk.addr
    if not cr3:
        return False

    if not vm.ads.has_key(cr3):
        ads = AddrSpace(vm, cr3)
        vm.ads[cr3] = ads
        log("info", "added new cr3 0x%x to ads (%d)" % (cr3, len(vm.ads)))
    elif len(vm.ads) >= vm.nr_cr3:
        return find_shared(vm)

    return False
Ejemplo n.º 21
0
    def __find_process(self, vm):
        kprcb    = vm.mem.read_dword(vm.cpu.sr.fs_base+self.__settings["kprcb"])
        kthread  = vm.mem.read_dword(kprcb+self.__settings["kthread"])
        eprocess = vm.mem.read_dword(kthread+self.__settings["eprocess"])

        while eprocess != 0:
            name = vm.mem.vread(eprocess+self.__settings["name"],16)
            log("os", "process %s" % name[:name.index('\x00')])
            if self.__pname in name:
                self.__pcr3 = vm.mem.read_dword(eprocess+self.__settings["cr3"])
                log("os", "cr3 %#x" % self.__pcr3)
                return True
            elif "Idle" in name:
                return False
            eprocess  = vm.mem.read_dword(eprocess+self.__settings["next"])
            eprocess -= self.__settings["next"]
        return False
Ejemplo n.º 22
0
    def __finish(self):
        if len(self.__symbols) == 1:
            return None

        log("symbols", "sorting symbols")
        self.__symbols.sort()

        log("symbols", "recompute size")
        for i in range(0,len(self.__symbols)):
            s = self.__symbols[i]
            s.prev = self.__symbols[(i-1)%len(self.__symbols)]
            s.next = self.__symbols[(i+1)%len(self.__symbols)]
            if s.size == 0:
                n = s.next
                s.size = n.addr - s.addr

        return self.__symbols
Ejemplo n.º 23
0
    def __find_process(self, vm):
        kprcb    = vm.mem.read_dword(vm.cpu.sr.fs_base+self.__settings["kprcb"])
        kthread  = vm.mem.read_dword(kprcb+self.__settings["kthread"])
        eprocess = vm.mem.read_dword(kthread+self.__settings["eprocess"])

        while eprocess != 0:
            name = vm.mem.vread(eprocess+self.__settings["name"],16)
            log("os", "process %s" % name[:name.index('\x00')])
            if self.__pname in name:
                self.__pcr3 = vm.mem.read_dword(eprocess+self.__settings["cr3"])
                log("os", "cr3 %#x" % self.__pcr3)
                return True
            elif "Idle" in name:
                return False
            eprocess  = vm.mem.read_dword(eprocess+self.__settings["next"])
            eprocess -= self.__settings["next"]
        return False
Ejemplo n.º 24
0
    def __finish(self):
        if len(self.__symbols) == 1:
            return None

        log("symbols", "sorting symbols")
        self.__symbols.sort()

        log("symbols", "recompute size")
        for i in range(0, len(self.__symbols)):
            s = self.__symbols[i]
            s.prev = self.__symbols[(i - 1) % len(self.__symbols)]
            s.next = self.__symbols[(i + 1) % len(self.__symbols)]
            if s.size == 0:
                n = s.next
                s.size = n.addr - s.addr

        return self.__symbols
Ejemplo n.º 25
0
    def __walk_process(self, vm, task):
        head = task
        while True:
            mm = vm.mem.read_dword(task+self.__settings["mm"])
            if mm != 0:
                comm = task+self.__settings["comm"]
                name = vm.mem.vread(comm, 15)
                pgd  = vm.mem.read_dword(mm+self.__settings["pgd"])
                log("os", "task %s" % name)
                if self.__pname in name:
                    self.__task = task
                    self.__pcr3 = pgd - 0xc0000000
                    log("os", "cr3 %#x" % self.__pcr3)
                    return True

            task = self.__next_task(vm, task)
            if task == head:
                return False
Ejemplo n.º 26
0
    def __walk_process(self, vm, task):
        head = task
        while True:
            mm = vm.mem.read_dword(task+self.__settings["mm"])
            if mm != 0:
                comm = task+self.__settings["comm"]
                name = vm.mem.vread(comm, 15)
                pgd  = vm.mem.read_dword(mm+self.__settings["pgd"])
                log("os", "task %s" % name)
                if self.__pname in name:
                    self.__task = task
                    self.__pcr3 = pgd - 0xc0000000
                    log("os", "cr3 %#x" % self.__pcr3)
                    return True

            task = self.__next_task(vm, task)
            if task == head:
                return False
Ejemplo n.º 27
0
def search_ads(ads):
    log("sads", "Searching PGD/PTs mapping into address space 0x%x" % ads.pgd.addr)

    ptb_addrs = [ads.pgd.addr]
    for p in ads.iter_pagetables():
        ptb_addrs.append(p.addr)

    log("sads", "PGD/PTs : %s" % " ".join([hex(i) for i in ptb_addrs]))
    for a in ptb_addrs:
        plst = ads.search_paddr(a)
        if len(plst) != 0:
            log("sads", "match for 0x%x" % a)
            for p in plst:
                log("sads", "%s" % p)
def search_ads(ads):
    log("sads",
        "Searching PGD/PTs mapping into address space 0x%x" % ads.pgd.addr)

    ptb_addrs = [ads.pgd.addr]
    for p in ads.iter_pagetables():
        ptb_addrs.append(p.addr)

    log("sads", "PGD/PTs : %s" % " ".join([hex(i) for i in ptb_addrs]))
    for a in ptb_addrs:
        plst = ads.search_paddr(a)
        if len(plst) != 0:
            log("sads", "match for 0x%x" % a)
            for p in plst:
                log("sads", "%s" % p)
Ejemplo n.º 29
0
def find_shared(vm):
    log("fsm", "Find shared pages accross address spaces")

    vm.all_pages = defaultdict(list)
    for a in vm.ads:
        for p in vm.ads[a].iter_pages(user=True):
            vm.all_pages[p.paddr].append((a,p))

    for addr,pages in vm.all_pages.iteritems():
        if len(pages) > 1:
            log("fsm", "match for 0x%x" % addr)
            for ads,pg in pages:
                log("fsm", "ads 0x%x: %s" % (ads,pg))

    return True
Ejemplo n.º 30
0
def find_shared(vm):
    log("fsm", "Find shared pages accross address spaces")

    vm.all_pages = defaultdict(list)
    for a in vm.ads:
        for p in vm.ads[a].iter_pages(user=True):
            vm.all_pages[p.paddr].append((a, p))

    for addr, pages in vm.all_pages.iteritems():
        if len(pages) > 1:
            log("fsm", "match for 0x%x" % addr)
            for ads, pg in pages:
                log("fsm", "ads 0x%x: %s" % (ads, pg))

    return True
from amoco.arch.x86 import cpu_x86 as am
from ramooflax.core import VM, CPUFamily, log
from ramooflax.utils import disassemble


def disasm_wrapper(addr, data):
    return am.disassemble(data, address=addr)


def sstep_disasm(vm):
    insns = disassemble(vm, disasm_wrapper, vm.cpu.code_location())
    print insns.split('\n')[0]
    return True


##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True, gdb=False)

vm.attach()
vm.stop()
vm.cpu.filter_singlestep(sstep_disasm)

log("info", "\n####\n#### type: vm.singlestep()\n####\n")
vm.interact(dict(globals(), **locals()))
vm.detach()
Ejemplo n.º 32
0
#!/usr/bin/env python
#
# Filter on CPUID=4
#
from ramooflax.core import VM, CPUFamily, log


def cpuid_hook(vm):
    log("info", "cpuid(1) = 0x%x 0x%x 0x%x 0x%x" % (vm.cpu.gpr.eax, vm.cpu.gpr.ebx, vm.cpu.gpr.ecx, vm.cpu.gpr.edx))
    return False


##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True)

vm.attach()
vm.stop()

vm.cpu.filter_cpuid(cpuid_hook, 1)

log("info", "ramooflax ready!")
vm.interact2(dict(globals(), **locals()))
Ejemplo n.º 33
0
def hypercall(vm):
    log("info", "hypercall")
    return True
Ejemplo n.º 34
0
def sstep(vm):
    log("info", "sstep")
    print disasm(vm)
    return False
Ejemplo n.º 35
0
def cpuid_hook(vm):
    log("info", "cpuid(1) = 0x%x 0x%x 0x%x 0x%x" % (vm.cpu.gpr.eax, vm.cpu.gpr.ebx, vm.cpu.gpr.ecx, vm.cpu.gpr.edx))
    return False
Ejemplo n.º 36
0
def pf_hook(vm):
    log("info", "Page Fault @ %#x" % vm.cpu.gpr.pc)
    return True
Ejemplo n.º 37
0
 def __start(self):
     log("symbols", "loading symbols")
#!/usr/bin/env python
#
# read msr 0x1b = APIC_BASE
#
from ramooflax.core import VM, CPUFamily, log

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True)

vm.attach()
vm.stop()

vm.cpu.msr.read(0x1b)
log("info", "MSR(APIC_BASE) = 0x%x 0x%x" % (vm.cpu.msr.eax, vm.cpu.msr.edx))

vm.detach()
Ejemplo n.º 39
0
def hypercall(vm):
    log("info", "hypercall")
    return True
Ejemplo n.º 40
0
def show_page(ads, vaddr):
    pg = get_page(ads, vaddr)
    log("info", "%s" % pg)
Ejemplo n.º 41
0
def sstep(vm):
    log("info", "sstep")
    print disasm(vm)
    return False
#
# We are looking for "argv[1]" running under debian
#
# We install the Linux26.find_process_filter on cr3 writes
# The framework will call our filter Before each write
#
import sys

from ramooflax.core  import VM, CPUFamily, log
from ramooflax.utils import OSFactory, OSAffinity

# create logging for this script
log.setup(info=True, fail=True)

if len(sys.argv) < 2:
    log("fail", "gimme prog name")
    sys.exit(-1)

# Target process
process_name = sys.argv[1]

# Some offsets for debian 2.6.32-5-486 kernel
settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36}
os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter(process_name)

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)
Ejemplo n.º 43
0
            for ads, pg in pages:
                log("fsm", "ads 0x%x: %s" % (ads, pg))

    return True


##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.nr_cr3 = 5
vm.ads = {}

log.setup(info=True,
          fail=True,
          gdb=False,
          vm=True,
          brk=True,
          evt=False,
          fsm=(True, log.blue))

vm.attach()
vm.stop()

vm.cpu.filter_write_cr(3, wcr3)

log("info", "ready!")
vm.interact2(dict(globals(), **locals()))
Ejemplo n.º 44
0
#
# This script uses amoco engine (https://github.com/bdcht/amoco)
#
from amoco.arch.x86  import cpu_x86 as am
from ramooflax.core  import VM, CPUFamily, log
from ramooflax.utils import disassemble

def disasm_wrapper(addr, data):
    return am.disassemble(data, address=addr)

def sstep_disasm(vm):
    insns = disassemble(vm, disasm_wrapper, vm.cpu.code_location())
    print insns.split('\n')[0]
    return True

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True, gdb=False)

vm.attach()
vm.stop()
vm.cpu.filter_singlestep(sstep_disasm)

log("info", "\n####\n#### type: vm.singlestep()\n####\n")
vm.interact(dict(globals(), **locals()))
vm.detach()
Ejemplo n.º 45
0
# Print eip on raised page fault
def pf_hook(vm):
    log("info", "Page Fault @ %#x" % vm.cpu.gpr.pc)
    return True

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, hook)

while not vm.resume():
    continue

vm.cpu.release_write_cr(3)
vm.cpu.set_active_cr3(os.get_process_cr3(), True, OSAffinity.Linux26)

vm.cpu.filter_exception(CPUException.page_fault, pf_hook)
vm.cpu.lbr.enable()

vm.resume()

log("info", vm.cpu.gpr)
log("info", vm.cpu.lbr)

vm.detach()
#
# We are looking for "argv[1]" running under debian
#
# We install the Linux26.find_process_filter on cr3 writes
# The framework will call our filter Before each write
#
import sys

from ramooflax.core import VM, CPUFamily, log
from ramooflax.utils import OSFactory, OSAffinity

# create logging for this script
log.setup(info=True, fail=True)

if len(sys.argv) < 2:
    log("fail", "gimme prog name")
    sys.exit(-1)

# Target process
process_name = sys.argv[1]

# Some offsets for debian 2.6.32-5-486 kernel
settings = {
    "thread_size": 8192,
    "comm": 540,
    "next": 240,
    "mm": 268,
    "pgd": 36
}
os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter(process_name)
Ejemplo n.º 47
0
#!/usr/bin/env python
#
# Filter on CPUID=4
#
from ramooflax.core  import VM, CPUFamily, log

def cpuid_hook(vm):
    log("info", "cpuid(1) = 0x%x 0x%x 0x%x 0x%x" % \
            (vm.cpu.gpr.eax,vm.cpu.gpr.ebx,vm.cpu.gpr.ecx,vm.cpu.gpr.edx))
    return False

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True)

vm.attach()
vm.stop()

vm.cpu.filter_cpuid(cpuid_hook, 1)

log("info", "ramooflax ready!")
vm.interact2(dict(globals(), **locals()))
Ejemplo n.º 48
0
def cpuid_hook(vm):
    log("info", "cpuid(1) = 0x%x 0x%x 0x%x 0x%x" % \
            (vm.cpu.gpr.eax,vm.cpu.gpr.ebx,vm.cpu.gpr.ecx,vm.cpu.gpr.edx))
    return False
# We are looking for "argv[1]" running under windows 7
#
# We install a filter on cr3 writes
# On each write, the vmm gives us control
# before the write operation
#
import sys

from ramooflax.core  import VM, CPUFamily, log
from ramooflax.utils import OSFactory, OSAffinity

# create logging for this script
log.setup(info=True, fail=True)

if len(sys.argv) < 2:
    log("fail", "gimme prog name")
    sys.exit(-1)

# Target process
process_name = sys.argv[1]

# Some offsets for Windows 7 Premium FR 32 bits
settings = {"kprcb":0x20, "kthread":4,
            "eprocess":0x150, "name":0x16c,
            "cr3":0x18, "next":0xb8}

os = OSFactory(OSAffinity.Win7, settings)
hook = os.find_process_filter(process_name)

##
## Main
Ejemplo n.º 50
0
                    for p in ulst:
                        log("fkm", fmt % (a,ka,p,kp))

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.nr_cr3 = 1
vm.ads = {}
#keep track of every kernel physical pages
vm.kppg = defaultdict(list)

log.setup(info=True, fail=True,
          gdb=False, vm=True,
          brk=True,  evt=False,
          fkm=(True,log.blue))

vm.attach()
vm.stop()

vm.cpu.filter_write_cr(3, wcr3)

log("info", "ready!")
while len(vm.ads) < vm.nr_cr3:
    vm.resume()

vm.detach()
find_kmem(vm)
Ejemplo n.º 51
0
 def __start(self):
     log("symbols", "loading symbols")
##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.attach()
vm.stop()
vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr_base+4, 4, hook)

while not vm.resume():
    continue

vm.cpu.breakpoints.remove(1)
vm.cpu.set_active_cr3(os.get_process_cr3(), affinity=OSAffinity.Linux26)
log("info", "found break process")

#
# Breakpoints handling
#

#1
vm.cpu.breakpoints.remove()
vm.cpu.breakpoints.add_insn(0x804844b)
vm.cpu.breakpoints.add_insn(0x804846b, lambda x:False)
while vm.resume():
    continue
if vm.cpu.gpr.pc != 0x804846b:
    log("fail", "failure 1")
    vm.detach(leave=True)
Ejemplo n.º 53
0
##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.attach()
vm.stop()
vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr_base + 4, 4, hook)

while not vm.resume():
    continue

vm.cpu.breakpoints.remove(1)
vm.cpu.set_active_cr3(os.get_process_cr3(), affinity=OSAffinity.Linux26)
log("info", "found break process")

#
# Breakpoints handling
#

#1
vm.cpu.breakpoints.remove()
vm.cpu.breakpoints.add_insn(0x804844b)
vm.cpu.breakpoints.add_insn(0x804846b, lambda x: False)
while vm.resume():
    continue
if vm.cpu.gpr.pc != 0x804846b:
    log("fail", "failure 1")
    vm.detach(leave=True)