Ejemplo n.º 1
0
def print_disassembly(oid, disasm, comments, f_breaks, start, stop, height=default_height):
    if not disasm:
        return
    if isinstance(disasm, dict):
        keys = disasm.keys()
        keys.sort()
        h=1
        if not stop:
            stop = disasm[keys[-1]]["addr"]
        for k in keys:
            addr = disasm[k]["addr"]
            if addr < start or addr > stop:
                continue
            
            if addr in f_breaks:
                for m in f_breaks[addr]:
                    print "******** ", m, " ********"
                    
            print hex(addr), " :  ", instruction_to_string(disasm[k]),
            if comments and k in comments:
                print "  :  ", comments[k]
            else:
                print
                    
            if not h % height: # Only show <height> lines at a time
                if raw_input().strip().lower().startswith("q"):
                    break
            h+=1
            
    elif isinstance(disasm, list):
        h = 1
        for insn in disasm:
            addr = insn["addr"]
            offset = convert_rva_offset(oid, addr)
            if (not stop or ( addr >= start and addr <= stop)) and insn:
                print hex(addr), " :  ", instruction_to_string(insn),
                if comments and offset in comments:
                    print "  :  ", comments[offset]
                else:
                    print
            if not h % height: # Only show <height> lines at a time
                if raw_input().strip().lower().startswith("q"):
                    break
            h+=1
Ejemplo n.º 2
0
def add_labels(y, n, labels, disassm, color=False):
    l = []
    s = ""
    if disassm:
        for i in xrange(y,n):
            if i in disassm:
                l.append(instruction_to_string(disassm[i]))    
        if l and color:
            s = " | " + myshell.colorize(" : ".join(l), "magenta")
        elif l: 
            s = " | " + " : ".join(l)
    
    l = []
    for label in labels: # List of dictionaries
        l.extend([l.append(label[i]) for i in xrange(y,n) if i in labels])
                
    if l:
        s += " # " + ", ".join(l)
        
    return s
Ejemplo n.º 3
0
    def create_display_strings(self, oid):
        data = api.get_field('files', oid, 'data')
        self.offsets = []
        self.lengths = {}
        self.features = defaultdict(str)
        self.hex_strs = {}
        self.ascii_strs = {}
        self.auto_annotations = {}
        self.user_comments = {}
        
        self.header = api.get_field('object_header', oid, 'header')

        instructions = api.get_field('disassembly', oid, 'insns')
        if instructions:
            self.offsets.extend(instructions.keys())
            for offset, instruction in instructions.items():
                instruction_string = re_lib.instruction_to_string(instruction)
                if len(self.features[offset]) > 0:
                    self.features[offset] += '  ::  %s' % instruction_string
                else:
                    self.features[offset] = instruction_string
                length = instruction['len']
                self.lengths[offset] = length
                current_offset = offset
                while length > 8:
                    self.lengths[current_offset] = 8
                    current_offset +=8
                    self.offsets.append(current_offset)
                    self.features[current_offset] = ' "" '
                    length -= 8
                    self.lengths[current_offset] = length

        header_fields = api.get_field('pe_parse', oid, 'offsets')
        if header_fields:
            self.offsets.extend(header_fields.keys())
            for offset, field in header_fields.items():
                field_lengths = []
                field_strings = []
                if isinstance(field, list):
                    for element in field:
                        field_lengths.append(element['len'])
                        field_strings.append(element['string'])
                else:
                    field_lengths.append(field['len'])
                    field_strings.append(field['string'])
                field_length = min(field_lengths)
                field_string = ' :: '.join(field_strings)
                if len(self.features[offset]) > 0:
                    self.features[offset] += '  ::  %s' % field_string
                else:
                    self.features[offset] = field_string
                self.lengths[offset] = field_length
                current_offset = offset
                while field_length > 8:
                    self.lengths[current_offset] = 8
                    current_offset +=8
                    self.offsets.append(current_offset)
                    self.features[current_offset] += ' "" '
                    field_length -= 8
                    self.lengths[current_offset] = field_length

        # add an offset and feature for end-of-file
        self.offsets.append(len(data))
        self.features[len(data)] += " EOF"
        self.lengths[len(data)] = 0

        # consolidate and sort the offset list
        self.offsets = list(set(self.offsets))
        self.offsets.sort()

        # add offsets and empty features for sections without any other feature
        index = 0
        new_offsets = []
        for offset in self.offsets:
            while offset > index:
                if offset - index > 8:
                    self.lengths[index] = 8
                else:
                    self.lengths[index] = offset - index
                self.features[index] = ''
                new_offsets.append(index)
                index += self.lengths[index]
            index = offset + self.lengths[offset]
        self.offsets.extend(new_offsets)

        # consolidate and sort the offset list
        self.offsets = list(set(self.offsets))
        self.offsets.sort()

        
        # add basic auto generated features
        call_map = api.retrieve('map_calls', oid)
        
        functions = api.retrieve('function_extract', oid)
        function_offsets = {}

        if functions:
            for f in functions:
                function_offsets[self.header.get_offset(functions[f]['start'])] = "**** %s ****"%functions[f]['name']
            
        # create hex and ascii strings for each offset
        previous_offset = 0
        for offset in self.offsets:
            length = self.lengths[offset]
            self.hex_strs[offset] = self.build_hex_str(data[offset:offset+length])
            self.ascii_strs[offset] = self.build_ascii_str(data[offset:offset+length])
            if call_map and offset in call_map['internal_functions']:
                self.auto_annotations[offset] = call_map['internal_functions'][offset]
            elif call_map and offset in call_map['system_calls']:
                self.auto_annotations[offset] = call_map['system_calls'][offset]
            elif offset in function_offsets:
                self.auto_annotations[offset] = function_offsets[offset]
            else:
                self.auto_annotations[offset] = ""
            self.user_comments[offset] = ""