Python setup Examples

Example #1

            for ads, pg in pages:
                log("fsm", "ads 0x%x: %s" % (ads, pg))

    return True


##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.nr_cr3 = 5
vm.ads = {}

log.setup(info=True,
          fail=True,
          gdb=False,
          vm=True,
          brk=True,
          evt=False,
          fsm=(True, log.blue))

vm.attach()
vm.stop()

vm.cpu.filter_write_cr(3, wcr3)

log("info", "ready!")
vm.interact2(dict(globals(), **locals()))

Example #2

File: find_kmem.py Project: chubbymaggie/ramooflax_scripts

                    for p in ulst:
                        log("fkm", fmt % (a,ka,p,kp))

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.nr_cr3 = 1
vm.ads = {}
#keep track of every kernel physical pages
vm.kppg = defaultdict(list)

log.setup(info=True, fail=True,
          gdb=False, vm=True,
          brk=True,  evt=False,
          fkm=(True,log.blue))

vm.attach()
vm.stop()

vm.cpu.filter_write_cr(3, wcr3)

log("info", "ready!")
while len(vm.ads) < vm.nr_cr3:
    vm.resume()

vm.detach()
find_kmem(vm)

Example #3

File: set_active_process_linux.py Project: Trietptm-on-Coding-Algorithms/ramooflax_scripts

#!/usr/bin/env python
#
# We are looking for "argv[1]" running under debian
#
# We install the Linux26.find_process_filter on cr3 writes
# The framework will call our filter Before each write
#
import sys

from ramooflax.core import VM, CPUFamily, log
from ramooflax.utils import OSFactory, OSAffinity

# create logging for this script
log.setup(info=True, fail=True)

if len(sys.argv) < 2:
    log("fail", "gimme prog name")
    sys.exit(-1)

# Target process
process_name = sys.argv[1]

# Some offsets for debian 2.6.32-5-486 kernel
settings = {
    "thread_size": 8192,
    "comm": 540,
    "next": 240,
    "mm": 268,
    "pgd": 36
}
os = OSFactory(OSAffinity.Linux26, settings)

Example #4

#!/usr/bin/env python
#
# Enter interactive 'shell' mode
#
from ramooflax.core import VM, CPUFamily, log

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(all=True)

vm.run(dict(globals(), **locals()))

Example #5

File: sstep_disasm.py Project: chubbymaggie/ramooflax_scripts

#
# This script uses amoco engine (https://github.com/bdcht/amoco)
#
from amoco.arch.x86  import cpu_x86 as am
from ramooflax.core  import VM, CPUFamily, log
from ramooflax.utils import disassemble

def disasm_wrapper(addr, data):
    return am.disassemble(data, address=addr)

def sstep_disasm(vm):
    insns = disassemble(vm, disasm_wrapper, vm.cpu.code_location())
    print insns.split('\n')[0]
    return True

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True, gdb=False)

vm.attach()
vm.stop()
vm.cpu.filter_singlestep(sstep_disasm)

log("info", "\n####\n#### type: vm.singlestep()\n####\n")
vm.interact(dict(globals(), **locals()))
vm.detach()

Example #6

File: set_active_process_linux.py Project: chubbymaggie/ramooflax_scripts

#!/usr/bin/env python
#
# We are looking for "argv[1]" running under debian
#
# We install the Linux26.find_process_filter on cr3 writes
# The framework will call our filter Before each write
#
import sys

from ramooflax.core  import VM, CPUFamily, log
from ramooflax.utils import OSFactory, OSAffinity

# create logging for this script
log.setup(info=True, fail=True)

if len(sys.argv) < 2:
    log("fail", "gimme prog name")
    sys.exit(-1)

# Target process
process_name = sys.argv[1]

# Some offsets for debian 2.6.32-5-486 kernel
settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36}
os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter(process_name)

##
## Main
##
peer = "172.16.131.128:1337"

Example #7

File: gdt_idt.py Project: Trietptm-on-Coding-Algorithms/ramooflax_scripts

#!/usr/bin/env python
#
# Pretty print the GDT/IDT
#
import struct

from ramooflax.core import VM, CPUFamily, log
from ramooflax.utils import SegmentDescriptor, InterruptDescriptor

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True, gdb=False, vm=True, brk=True, evt=False)

# Retrieve 32 bits GDT/IDT content
vm.attach()
vm.stop()

gdt_sz = vm.cpu.sr.gdtr_limit + 1
gdt_mm = vm.mem.vread(vm.cpu.sr.gdtr_base, gdt_sz)

idt_sz = vm.cpu.sr.idtr_limit + 1
idt_mm = vm.mem.vread(vm.cpu.sr.idtr_base, idt_sz)

vm.detach()

# Pretty print GDT/IDT content
dts = (("-= GDT =-", SegmentDescriptor, gdt_mm, gdt_sz),

Example #8

File: pgd_mem.py Project: Trietptm-on-Coding-Algorithms/ramooflax_scripts

        plst = ads.search_paddr(a)
        if len(plst) != 0:
            log("sads", "match for 0x%x" % a)
            for p in plst:
                log("sads", "%s" % p)


##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.ads = {}

log.setup(info=True,
          fail=True,
          gdb=False,
          vm=True,
          brk=True,
          evt=False,
          sads=(True, log.green))

vm.attach()
vm.stop()

vm.cpu.filter_write_cr(3, wcr3)

log("info", "ready!")
vm.interact2(dict(globals(), **locals()))

Example #9

File: system_map.py Project: chubbymaggie/ramooflax_scripts

#
import sys

from ramooflax.core   import VM, CPUFamily, log
from ramooflax.utils  import SymTab, SymParser

##
## Main
##
if len(sys.argv) < 2:
    print "give me 'system.map"
    sys.exit(1)

peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True,
          gdb=False, vm=True,
          brk=True,  evt=False)

# load kernel symbols
vm.symbols = SymTab(SymParser().from_system_map(sys.argv[1]))

vm.attach()
vm.stop()

print vm.symbols[vm.cpu.code_location()]

log("info", "ready!")
vm.interact2(dict(globals(), **locals()))

Example #10

File: break_process_linux.py Project: chubbymaggie/ramooflax_scripts

# We are looking for "break" running under debian
#
from ramooflax.core  import VM, CPUFamily, log, Log
from ramooflax.utils import OSFactory, OSAffinity

# Some offsets for debian 2.6.32-5-486 kernel
#settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36}

# Some offsets for kernel 3.4.1
settings = {"thread_size":8192, "comm":0x1cc, "next":0xc0, "mm":0xc8, "pgd":0x24}

os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter("break")

# create logging for this script
log.setup(info=(True,Log.blue), fail=(True,Log.red),
          brk=True, gdb=True, vm=True, evt=True)

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.attach()
vm.stop()
vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr_base+4, 4, hook)

while not vm.resume():
    continue

vm.cpu.breakpoints.remove(1)

Example #11

File: pgd_mem.py Project: chubbymaggie/ramooflax_scripts

        ptb_addrs.append(p.addr)

    log("sads", "PGD/PTs : %s" % " ".join([hex(i) for i in ptb_addrs]))
    for a in ptb_addrs:
        plst = ads.search_paddr(a)
        if len(plst) != 0:
            log("sads", "match for 0x%x" % a)
            for p in plst:
                log("sads", "%s" % p)

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.ads = {}

log.setup(info=True, fail=True,
          gdb=False, vm=True,
          brk=True,  evt=False,
          sads=(True,log.green))

vm.attach()
vm.stop()

vm.cpu.filter_write_cr(3, wcr3)

log("info", "ready!")
vm.interact2(dict(globals(), **locals()))

Example #12

File: sstep_disasm.py Project: Trietptm-on-Coding-Algorithms/ramooflax_scripts

from amoco.arch.x86 import cpu_x86 as am
from ramooflax.core import VM, CPUFamily, log
from ramooflax.utils import disassemble


def disasm_wrapper(addr, data):
    return am.disassemble(data, address=addr)


def sstep_disasm(vm):
    insns = disassemble(vm, disasm_wrapper, vm.cpu.code_location())
    print insns.split('\n')[0]
    return True


##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

log.setup(info=True, fail=True, gdb=False)

vm.attach()
vm.stop()
vm.cpu.filter_singlestep(sstep_disasm)

log("info", "\n####\n#### type: vm.singlestep()\n####\n")
vm.interact(dict(globals(), **locals()))
vm.detach()

Example #13

# Some offsets for kernel 3.4.1
settings = {
    "thread_size": 8192,
    "comm": 0x1cc,
    "next": 0xc0,
    "mm": 0xc8,
    "pgd": 0x24
}

os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter("break")

# create logging for this script
log.setup(info=(True, Log.blue),
          fail=(True, Log.red),
          brk=True,
          gdb=True,
          vm=True,
          evt=True)

##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.attach()
vm.stop()
vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr_base + 4, 4, hook)

while not vm.resume():
    continue