Ejemplo n.º 1
0
    def decompile(self):
        self.is_dump = False
        self.gph, pe_nb_new_syms = self.gctx.dis.get_graph(self.entry)

        if self.gph is None:
            error("capstone can't disassemble here")
            return None
        self.gph.simplify()

        if self.gctx.db.loaded and pe_nb_new_syms:
            self.gctx.db.modified = True
        
        try:
            self.gph.loop_detection(self.entry)
            ast, correctly_ended = generate_ast(self)
            if not correctly_ended:
                debug__("Second try...")
                self.gph.loop_detection(self.entry, True)
                ast, _ = generate_ast(self)

            self.ast = ast
        except ExcIfelse as e:
            error("can't have a ifelse here     %x" % e.addr)
            if self.gctx.interactive_mode:
                return None
            die()

        o = self.gctx.libarch.output.Output(self)
        o._ast(self.entry, ast)
        self.output = o
        return o
Ejemplo n.º 2
0
    def decompile(self):
        self.is_dump = False
        self.gph, pe_nb_new_syms = self.gctx.dis.get_graph(self.entry)

        if self.gph is None:
            error("capstone can't disassemble here")
            return None
        self.gph.simplify()

        if self.gctx.db.loaded and pe_nb_new_syms:
            self.gctx.db.modified = True

        try:
            self.gph.loop_detection(self.entry)
            ast, correctly_ended = generate_ast(self)
            if not correctly_ended:
                debug__("Second try...")
                self.gph.loop_detection(self.entry, True)
                ast, _ = generate_ast(self)

            self.ast = ast
        except ExcIfelse as e:
            error("can't have a ifelse here     %x" % e.addr)
            if self.gctx.interactive_mode:
                return None
            die()

        o = self.gctx.libarch.output.Output(self)
        o._ast(self.entry, ast)
        self.output = o
        return o
Ejemplo n.º 3
0
    def load_file(self, filename=None):
        if filename is None:
            filename = self.filename

        if not os.path.exists(filename):
            error("file {self.filename} doesn't exist".format(self=self))
            if self.interactive_mode:
               return False
            die()

        if not os.path.isfile(filename):
            error("this is not a file".format(self=self))
            if self.interactive_mode:
               return False
            die()

        self.db = Database()
        self.db.load(filename)

        if self.raw_base != 0:
            self.db.raw_base = self.raw_base

        if self.raw_type is not None:
            self.db.raw_type = self.raw_type

        if self.raw_big_endian is not None:
            self.db.raw_is_big_endian = self.raw_big_endian

        if self.db.loaded:
            self.raw_base = self.db.raw_base
            self.raw_type = self.db.raw_type
            self.raw_big_endian = self.db.raw_is_big_endian

        try:
            dis = Disassembler(filename, self.raw_type,
                               self.raw_base, self.raw_big_endian,
                               self.db)
        except ExcArch as e:
            error("arch %s is not supported" % e.arch)
            if self.interactive_mode:
                return False
            die()
        except ExcFileFormat:
            error("the file is not PE or ELF binary")
            if self.interactive_mode:
                return False
            die()
        except ExcPEFail as e:
            error(str(e.e))
            error("it seems that there is a random bug in pefile, you shoul retry.")
            error("please report here https://github.com/joelpx/reverse/issues/16")
            if self.interactive_mode:
                return False
            die()

        self.dis = dis
        self.libarch = dis.load_arch_module()

        return True
Ejemplo n.º 4
0
def console_entry():
    gctx = GlobalContext()
    gctx.parse_args()

    if gctx.color and lib.colors.VERSION < lib.colors.CURR_VERSION:
        info("There is a new version of custom_colors.py. If you did any")
        info("modifications you can delete it. Otherwise you can copy it")
        info("somewhere, run again your command then merge the file at hand.")
        die()

    if gctx.interactive_mode:
        from reverse.lib.ui.console import Console
        i = Console(gctx)

    elif gctx.filename is not None:
        if not gctx.load_file():
            die()

        if gctx.list_sections:
            for s in gctx.dis.binary.iter_sections():
                s.print_header()
            sys.exit(0)

        if gctx.syms:
            gctx.dis.print_symbols(gctx.sectionsname)
            sys.exit(0)

        ctx = gctx.get_addr_context(gctx.entry)

        if ctx is None:
            sys.exit(0)

        if gctx.do_dump:
            ctx.dump_asm(gctx.nb_lines).print()
            sys.exit(0)

        o = ctx.decompile()

        if gctx.graph:
            ctx.gph.dot_graph(gctx.dis.jmptables)

        if o is not None:
            if gctx.vim:
                base = os.path.basename(gctx.filename) + "_" + gctx.entry
                # re-assign if no colors
                gctx.libarch.process_ast.assign_colors(ctx, ctx.ast)
                gctx.color = False
                generate_vim_syntax(ctx, base + ".vim")
                sys.stdout = open(base + ".rev", "w+")

            o.print()

            if gctx.vim:
                print("run :  vim {0}.rev -S {0}.vim".format(base),
                      file=sys.stderr)
Ejemplo n.º 5
0
def console_entry():
    gctx = GlobalContext()
    gctx.parse_args()

    if gctx.color and lib.colors.VERSION < lib.colors.CURR_VERSION:
        info("There is a new version of custom_colors.py. If you did any")
        info("modifications you can delete it. Otherwise you can copy it")
        info("somewhere, run again your command then merge the file at hand.")
        die()

    if gctx.interactive_mode:
        from reverse.lib.ui.console import Console
        i = Console(gctx)

    elif gctx.filename is not None:
        if not gctx.load_file():
            die()

        if gctx.list_sections:
            for s in gctx.dis.binary.iter_sections():
                s.print_header()
            sys.exit(0)

        if gctx.syms:
            gctx.dis.print_symbols(gctx.sectionsname)
            sys.exit(0)

        ctx = gctx.get_addr_context(gctx.entry)

        if ctx is None:
            sys.exit(0)

        if gctx.do_dump:
            ctx.dump_asm(gctx.nb_lines).print()
            sys.exit(0)

        o = ctx.decompile()

        if gctx.graph:
            ctx.gph.dot_graph(gctx.dis.jmptables)

        if o is not None:
            if gctx.vim:
                base = os.path.basename(gctx.filename) + "_" + gctx.entry
                # re-assign if no colors
                gctx.libarch.process_ast.assign_colors(ctx, ctx.ast)
                gctx.color = False
                generate_vim_syntax(ctx, base + ".vim")
                sys.stdout = open(base + ".rev", "w+")

            o.print()

            if gctx.vim:
                print("run :  vim {0}.rev -S {0}.vim".format(base), file=sys.stderr)
Ejemplo n.º 6
0
    def load_file(self, filename=None):
        if filename is None:
            filename = self.filename

        if not os.path.exists(filename):
            error("file {self.filename} doesn't exist".format(self=self))
            if self.interactive_mode:
                return False
            die()

        if not os.path.isfile(filename):
            error("this is not a file".format(self=self))
            if self.interactive_mode:
                return False
            die()

        self.db = Database()
        self.db.load(filename)

        try:
            dis = Disassembler(filename, self.raw_type, self.raw_base,
                               self.raw_big_endian, self.db)
        except ExcArch as e:
            error("arch %s is not supported" % e.arch)
            if self.interactive_mode:
                return False
            die()
        except ExcFileFormat:
            error("the file is not PE or ELF binary")
            if self.interactive_mode:
                return False
            die()
        except ExcPEFail as e:
            error(str(e.e))
            error(
                "it seems that there is a random bug in pefile, you shoul retry."
            )
            error(
                "please report here https://github.com/joelpx/reverse/issues/16"
            )
            if self.interactive_mode:
                return False
            die()

        self.dis = dis
        self.libarch = dis.load_arch_module()

        return True
Ejemplo n.º 7
0
    def init_address(self, entry):
        if isinstance(entry, int):
            self.entry = entry
            return True

        if entry == "EP":
            self.entry = self.gctx.dis.binary.get_entry_point()
            return True

        if entry is None:
            if self.gctx.raw_type is not None:
                self.entry = 0
                return True

            self.entry = self.gctx.db.symbols.get("main", None) or \
                         self.gctx.db.symbols.get("_main", None)

            if self.entry is None:
                error("symbol main or _main not found")
                if self.gctx.interactive_mode:
                    return False
                die()
            return True

        is_hexa = entry.startswith("0x")

        if not is_hexa and self.gctx.api.is_reserved_prefix(entry):
            entry = entry[entry.index("_") + 1:]
            is_hexa = True

        if is_hexa:
            try:
                self.entry = int(entry, 16)
            except:
                error("bad hexa string %s" % entry)
                if self.gctx.interactive_mode:
                    return False
                die()
            return True

        self.entry = self.gctx.db.demangled.get(entry, None) or \
                     self.gctx.db.symbols.get(entry, None) or \
                     self.gctx.dis.binary.section_names.get(entry, None)

        if self.entry is None:
            error("symbol %s not found" % entry)
            if self.gctx.interactive_mode:
                return False
                die()

        return True
Ejemplo n.º 8
0
    def init_address(self, entry):
        if isinstance(entry, int):
            self.entry = entry
            return True

        if entry == "EP":
            self.entry = self.gctx.dis.binary.get_entry_point()
            return True

        if entry is None:
            if self.gctx.raw_type is not None:
                self.entry = 0
                return True

            self.entry = self.gctx.dis.binary.symbols.get("main", None) or self.gctx.dis.binary.symbols.get(
                "_main", None
            )

            if self.entry is None:
                error("symbol main or _main not found")
                if self.gctx.interactive_mode:
                    return False
                die()
            return True

        is_hexa = entry.startswith("0x")

        if not is_hexa and entry[:4] in RESERVED_PREFIX:
            entry = entry[4:]
            is_hexa = True

        if is_hexa:
            try:
                self.entry = int(entry, 16)
            except:
                error("bad hexa string %s" % entry)
                if self.gctx.interactive_mode:
                    return False
                die()
            return True

        self.entry = self.gctx.dis.binary.symbols.get(entry, None) or self.gctx.dis.binary.section_names.get(
            entry, None
        )
        if self.entry is None:
            error("symbol %s not found" % entry)
            if self.gctx.interactive_mode:
                return False
                die()

        return True
Ejemplo n.º 9
0
    def init_address(self, entry):
        if isinstance(entry, int):
            self.entry = entry
            return True

        if entry == "EP":
            self.entry = self.gctx.dis.binary.get_entry_point()
            return True

        if entry is None:
            if self.gctx.raw_type is not None:
                self.entry = 0
                return True

            self.entry = self.gctx.db.symbols.get("main", None) or \
                         self.gctx.db.symbols.get("_main", None)

            if self.entry is None:
                error("symbol main or _main not found")
                if self.gctx.interactive_mode:
                    return False
                die()
            return True

        is_hexa = entry.startswith("0x")

        if not is_hexa and self.gctx.api.is_reserved_prefix(entry):
            entry = entry[entry.index("_") + 1:]
            is_hexa = True

        if is_hexa:
            try:
                self.entry = int(entry, 16)
            except:
                error("bad hexa string %s" % entry)
                if self.gctx.interactive_mode:
                    return False
                die()
            return True

        self.entry = self.gctx.db.demangled.get(entry, None) or \
                     self.gctx.db.symbols.get(entry, None) or \
                     self.gctx.dis.binary.section_names.get(entry, None)

        if self.entry is None:
            error("symbol %s not found" % entry)
            if self.gctx.interactive_mode:
                return False
                die()

        return True
Ejemplo n.º 10
0
    def parse_args(self):
        parser = ArgumentParser(
            description=
            'Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. '
            'Supported formats : ELF, PE. More commands available in the interactive'
            ' mode.    https://github.com/joelpx/reverse')
        parser.add_argument('filename', nargs='?', metavar='FILENAME')
        parser.add_argument('-nc', '--nocolor', action='store_true')
        parser.add_argument('-g',
                            '--graph',
                            action='store_true',
                            help='Generate a file graph.dot.')
        parser.add_argument('--noandif',
                            action='store_true',
                            help="Print normal 'if' instead of 'andif'")
        parser.add_argument(
            '--datasize',
            type=int,
            default=30,
            metavar='N',
            help=
            'default 30, maximum of chars to display for strings or bytes array.'
        )
        parser.add_argument(
            '-x',
            '--entry',
            metavar='SYMBOLNAME|0xXXXXX|EP',
            help=
            'Pseudo-decompilation, default is main. EP stands for entry point.'
        )
        parser.add_argument('--vim',
                            action='store_true',
                            help='Generate syntax colors for vim')
        parser.add_argument('-s',
                            '--symbols',
                            action='store_true',
                            help='Print all symbols')
        parser.add_argument('--sections',
                            action='store_true',
                            help='Print all sections')
        parser.add_argument('--dump',
                            action='store_true',
                            help='Dump asm without decompilation')
        parser.add_argument('-l',
                            '--lines',
                            type=int,
                            default=30,
                            metavar='N',
                            help='Max lines used with --dump')
        parser.add_argument('--bytes',
                            action='store_true',
                            help='Print instruction bytes')
        parser.add_argument('-i',
                            '--interactive',
                            action='store_true',
                            help='Interactive mode')
        parser.add_argument('-d', '--opt_debug', action='store_true')
        parser.add_argument('-ns', '--nosectionsname', action='store_true')
        parser.add_argument('--raw',
                            metavar='x86|x64|arm|mips|mips64',
                            help='Consider the input file as a raw binary')
        parser.add_argument('--rawbase',
                            metavar='0xXXXXX',
                            help='Set base address of a raw file (default=0)')
        parser.add_argument('--rawbe',
                            action='store_true',
                            help='If not set it\'s in little endian')

        args = parser.parse_args()

        self.debug = args.opt_debug
        self.print_andif = not args.noandif
        self.color = not args.nocolor
        self.sectionsname = not args.nosectionsname
        self.max_data_size = args.datasize
        self.filename = args.filename
        self.raw_type = args.raw
        self.raw_base = args.rawbase
        self.syms = args.symbols
        self.entry = args.entry
        self.do_dump = args.dump
        self.vim = args.vim
        self.interactive_mode = args.interactive
        self.nb_lines = args.lines
        self.graph = args.graph
        self.raw_big_endian = args.rawbe
        self.list_sections = args.sections
        self.print_bytes = args.bytes

        if self.raw_base is not None:
            try:
                self.raw_base = int(self.raw_base, 16)
            except:
                error("--rawbase must be in hex format")
                die()
        else:
            self.raw_base = 0
Ejemplo n.º 11
0
    def parse_args(self):
        parser = ArgumentParser(description=
            'Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. '
            'Supported formats : ELF, PE. More commands available in the interactive'
            ' mode.    https://github.com/joelpx/reverse')
        parser.add_argument('filename', nargs='?', metavar='FILENAME')
        parser.add_argument('-nc', '--nocolor', action='store_true')
        parser.add_argument('-g', '--graph', action='store_true',
                help='Generate a file graph.dot.')
        parser.add_argument('--noandif', action='store_true',
                help="Print normal 'if' instead of 'andif'")
        parser.add_argument('--datasize', type=int, default=30, metavar='N',
                help='default 30, maximum of chars to display for strings or bytes array.')
        parser.add_argument('-x', '--entry', metavar='SYMBOLNAME|0xXXXXX|EP',
                help='Pseudo-decompilation, default is main. EP stands for entry point.')
        parser.add_argument('--vim', action='store_true',
                help='Generate syntax colors for vim')
        parser.add_argument('-s', '--symbols', action='store_true',
                help='Print all symbols')
        parser.add_argument('--sections', action='store_true',
                help='Print all sections')
        parser.add_argument('--dump', action='store_true',
                help='Dump asm without decompilation')
        parser.add_argument('-l', '--lines', type=int, default=30, metavar='N',
                help='Max lines used with --dump')
        parser.add_argument('--nbytes', type=int, default=0, metavar='N',
                help='Print n bytes.')
        parser.add_argument('-i', '--interactive', action='store_true',
                help='Interactive mode')
        parser.add_argument('-d', '--opt_debug', action='store_true')
        parser.add_argument('-ns', '--nosectionsname', action='store_true')
        parser.add_argument('--raw', metavar='x86|x64|arm|mips|mips64',
                help='Consider the input file as a raw binary')
        parser.add_argument('--rawbase', metavar='0xXXXXX',
                help='Set base address of a raw file (default=0)')
        parser.add_argument('--rawbe', action='store_true',
                help='If not set it\'s in little endian')
        parser.add_argument('-na', '--noautoanalyzer', action='store_true',
                help='Disable analysis on the entry point / symbols and don\'t scan memmory. You can force it with the command push_analyze_symbols.')

        args = parser.parse_args()

        self.debug           = args.opt_debug
        self.print_andif     = not args.noandif
        self.color           = not args.nocolor
        self.sectionsname    = not args.nosectionsname
        self.max_data_size   = args.datasize
        self.filename        = args.filename
        self.raw_type        = args.raw
        self.raw_base        = args.rawbase
        self.syms            = args.symbols
        self.entry           = args.entry
        self.do_dump         = args.dump
        self.vim             = args.vim
        self.interactive_mode = args.interactive
        self.nb_lines        = args.lines
        self.graph           = args.graph
        self.raw_big_endian  = args.rawbe
        self.list_sections   = args.sections
        self.autoanalyzer    = not args.noautoanalyzer

        if args.nbytes == 0:
            self.nbytes = 4
            self.print_bytes = False
        else:
            self.nbytes = int(args.nbytes)
            self.print_bytes = True

        if self.raw_base is not None:
            try:
                self.raw_base = int(self.raw_base, 16)
            except:
                error("--rawbase must be in hex format")
                die()
        else:
            self.raw_base = 0
Ejemplo n.º 12
0
    def parse_args(self):
        parser = ArgumentParser(
            description="Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. "
            "Supported formats : ELF, PE. More commands available in the interactive"
            " mode.    https://github.com/joelpx/reverse"
        )
        parser.add_argument("filename", nargs="?", metavar="FILENAME")
        parser.add_argument("-nc", "--nocolor", action="store_true")
        parser.add_argument("-g", "--graph", action="store_true", help="Generate a file graph.dot.")
        parser.add_argument("--noandif", action="store_true", help="Print normal 'if' instead of 'andif'")
        parser.add_argument(
            "--datasize",
            type=int,
            default=30,
            metavar="N",
            help="default 30, maximum of chars to display for strings or bytes array.",
        )
        parser.add_argument(
            "-x",
            "--entry",
            metavar="SYMBOLNAME|0xXXXXX|EP",
            help="Pseudo-decompilation, default is main. EP stands for entry point.",
        )
        parser.add_argument("--vim", action="store_true", help="Generate syntax colors for vim")
        parser.add_argument("-s", "--symbols", action="store_true", help="Print all symbols")
        parser.add_argument("--sections", action="store_true", help="Print all sections")
        parser.add_argument("--dump", action="store_true", help="Dump asm without decompilation")
        parser.add_argument("-l", "--lines", type=int, default=30, metavar="N", help="Max lines used with --dump")
        parser.add_argument("--bytes", action="store_true", help="Print instruction bytes")
        parser.add_argument("-i", "--interactive", action="store_true", help="Interactive mode")
        parser.add_argument("-d", "--opt_debug", action="store_true")
        parser.add_argument("-ns", "--nosectionsname", action="store_true")
        parser.add_argument("--raw", metavar="x86|x64|arm|mips|mips64", help="Consider the input file as a raw binary")
        parser.add_argument("--rawbase", metavar="0xXXXXX", help="Set base address of a raw file (default=0)")
        parser.add_argument("--rawbe", action="store_true", help="If not set it's in little endian")

        args = parser.parse_args()

        self.debug = args.opt_debug
        self.print_andif = not args.noandif
        self.color = not args.nocolor
        self.sectionsname = not args.nosectionsname
        self.max_data_size = args.datasize
        self.filename = args.filename
        self.raw_type = args.raw
        self.raw_base = args.rawbase
        self.syms = args.symbols
        self.entry = args.entry
        self.do_dump = args.dump
        self.vim = args.vim
        self.interactive_mode = args.interactive
        self.nb_lines = args.lines
        self.graph = args.graph
        self.raw_big_endian = args.rawbe
        self.list_sections = args.sections
        self.print_bytes = args.bytes

        if self.raw_base is not None:
            try:
                self.raw_base = int(self.raw_base, 16)
            except:
                error("--rawbase must be in hex format")
                die()
        else:
            self.raw_base = 0