def bytes_without_jmp(self):
"""
Clear all jump instructions.
jmp -> nop
jxx -> nop
call xxx -> push ret_addr
"""
buf = ''
from miasm2.arch.x86.arch import mn_x86
from miasm2.arch.x86.arch import conditional_branch
from miasm2.arch.x86.arch import unconditional_branch
from miasm2.expression.expression import ExprInt
branch_name = conditional_branch + unconditional_branch
call_name = ['CALL']
for ins in self.instructions:
ins_x86 = mn_x86.dis(ins.bytes, 32)
if ins_x86.name in branch_name:
buf += '\x90' # NOP
elif ins_x86.name in call_name:
ret_addr = ExprInt(ins.addr + ins.size, 32)
ins_x86.args = [ret_addr]
ins_x86.name = 'PUSH'
buf += mn_x86.asm(ins_x86)[0]
else:
buf += ins.bytes
return buf
def compute(ir, mode, asm, inputstate={}, debug=False):
instr = mn.fromstring(asm, mode)
code = mn.asm(instr)[0]
instr = mn.dis(code, mode)
instr.offset = inputstate.get(EIP, 0)
interm = ir()
interm.add_instr(instr)
return symb_exec(interm, inputstate, debug)
def compute(ir, mode, asm, inputstate={}, debug=False):
instr = mn.fromstring(asm, mode)
code = mn.asm(instr)[0]
instr = mn.dis(code, mode)
instr.offset = inputstate.get(EIP, 0)
interm = ir()
interm.add_instr(instr)
return symb_exec(interm, inputstate, debug)
def compute(ir, mode, asm, inputstate={}, debug=False):
loc_db = LocationDB()
instr = mn.fromstring(asm, loc_db, mode)
code = mn.asm(instr)[0]
instr = mn.dis(code, mode)
instr.offset = inputstate.get(EIP, 0)
ir_arch = ir(loc_db)
ircfg = ir_arch.new_ircfg()
lbl = ir_arch.add_instr_to_ircfg(instr, ircfg)
return symb_exec(lbl, ir_arch, ircfg, inputstate, debug)
from miasm2.arch.x86.arch import mn_x86
from miasm2.arch.x86.regs import *
l = mn_x86.fromstring('MOV EAX, EBX', 32)
print "instruction:", l
print "arg:", l.args[0]
x = mn_x86.asm(l)
print x
l.args[0] = EDX
y = mn_x86.asm(l)
print y
print mn_x86.dis(y[0], 32)
from miasm2.arch.x86.arch import mn_x86
from miasm2.expression.expression import get_rw
CODE = raw_input('enter opcode: ').decode('hex')
#instr = mn_x86.fromstring(INSTR, 32)
instr = mn_x86.dis(CODE, 32)
r, w = get_rw(instr.args)
print "reads: %s" % ', '.join([str(x) for x in r])
print "writes: %s" % ', '.join([str(x) for x in w])
'''
for op in instr.args:
print op.is_mem()
'''
from miasm2.analysis.machine import Machine
shellcode = open('test.bin', 'rb').read()
machine = Machine('x86_32')
jitter = machine.jitter(jit_type='python')
jitter.init_stack()
jitter.vm.add_memory_page(0x401000, 1 | 2, shellcode)
jitter.jit.log_regs = True
jitter.jit.log_mn = True
jitter.init_run(0x401000)
jitter.continue_run()
