def get_syscall(krnl):
i = 2 if krnl.guest64 else 0
i += 1 if krnl.kpti else 0
try:
pattern = r2functions.get_pattern_signature(
krnl.robj.read_bytes(f"pdb.{syscalls[i]}", 128),
krnl.robj.info.bin.bits)
except LookupError as e:
print(f"Failed to find syscall from {syscalls[i]}", file=sys.stderr)
raise e
print(f"{' ' * 0}---")
print(f"{' ' * 0}-")
print(f"{' ' * 4}!syscall_pattern")
print(
f"{' ' * 4}id: [ {'SYSCALL_SIG_FLAG_KPTI,' if krnl.kpti else ''} IG_GUEST_WINDOWS ]"
)
print(
f"{' ' * 4}flags: [ {'LOC_SYSCALL' if krnl.guest64 else 'LOC_SYSENTER'} ]"
)
print(f"{' ' * 4}pattern: !code_pattern")
print(f"{' ' * 8}code:")
get_function_pattern(pattern)
def get_function(krnl, name):
try:
pattern = r2functions.get_pattern_signature(
krnl.robj.read_bytes(f"pdb.{name}", 128), krnl.robj.info.bin.bits)
section = krnl.robj.section(f"pdb.{name}").name
except LookupError as e:
print(
f"Will ignore exception ({str(e)}) for {name} as it may not be present",
file=sys.stderr)
return
print(f"{' ' * 0}---")
print(f"{' ' * 0}!intro_update_win_function")
print(f"{' ' * 0}name: {name}")
print(f"{' ' * 0}guest64: {krnl.guest64}")
print(f"{' ' * 0}patterns:")
print(f"{' ' * 4}-")
print(f"{' ' * 8}!intro_update_win_pattern")
print(f"{' ' * 8}section_hint: {section}")
print(f"{' ' * 8}min_ver: {krnl.ntbuildnumber}")
print(f"{' ' * 8}max_ver: {krnl.ntbuildnumber}")
print(f"{' ' * 8}pattern: !code_pattern")
print(f"{' ' * 12}code:")
get_function_pattern(pattern)
def get_function(krnl, function):
name = function.name
args = next((a for a in (function.args64 if krnl.guest64 else function.args32) if a.minver <= krnl.ntbuildnumber), None)
try:
pattern = r2functions.get_pattern_signature(krnl.robj.read_bytes(f"pdb.{name}", 128), krnl.robj.info.bin.bits)
section = krnl.robj.section(f"pdb.{name}").name
except LookupError as e:
print(f"Will ignore exception ({str(e)}) for {name} as it may not be present", file=sys.stderr)
return
print(f"{' ' * 0}---")
print(f"{' ' * 0}!intro_update_win_function")
print(f"{' ' * 0}name: {name}")
print(f"{' ' * 0}guest64: {krnl.guest64}")
if args is not None:
print(f"{' ' * 0}arguments:")
print(f"{' ' * 4}-")
print(f"{' ' * 8}!intro_update_win_args")
print(f"{' ' * 8}min_ver: {krnl.ntbuildnumber}")
print(f"{' ' * 8}max_ver: {krnl.ntbuildnumber}")
print(f"{' ' * 8}args:")
for a in args.list:
print(f"{' ' * 12}- {a}")
print(f"{' ' * 0}patterns:")
print(f"{' ' * 4}-")
print(f"{' ' * 8}!intro_update_win_pattern")
print(f"{' ' * 8}section_hint: {section}")
print(f"{' ' * 8}min_ver: {krnl.ntbuildnumber}")
print(f"{' ' * 8}max_ver: {krnl.ntbuildnumber}")
print(f"{' ' * 8}pattern: !code_pattern")
print(f"{' ' * 12}code:")
get_function_pattern(pattern)