Exemple #1
0
  def __init__(self, process, mm):
    ip = process.getInstrPointer()
    fp = process.getFramePointer()

    self.module = FindModule(ip,mm)
    
    self.fp_type = RefinePType(Type("Ptr32",4), fp, process, mm)
 
    #print "fp:",hex(fp_type[1]), str(fp_type[0])
    if not process.no_frame_pointer: #str(self.fp_type[0]) == "SPtr32": 
      self.bt =  getBacktrace(process,max_args=0, max_depth=20)
    else: 
      self.bt = Backtrace()
    frames = []

    for i,frame in enumerate(self.bt.frames):
      r_type = RefinePType(Type("Ptr32",4), frame.ip, process, mm)
      frames.append(r_type)
      #print "ip:", str(r_type[0])
      if not (str(r_type[0])  == "GxPtr32"):
        break

      #if str(r_type[0]) == "DPtr32":
      #  break
     
     
    self.bt.frames = frames
    self.eip_type = RefinePType(Type("Ptr32",4), process.getInstrPointer(), process, mm)
Exemple #2
0
    def __init__(self, process, mm):
        ip = process.getInstrPointer()
        fp = process.getFramePointer()

        self.module = FindModule(ip, mm)

        self.fp_type = RefinePType(Type("Ptr32", 4), fp, process, mm)
        # print "fp:",hex(fp_type[1]), str(fp_type[0])
        if not process.no_frame_pointer:  # str(self.fp_type[0]) == "SPtr32":
            self.bt = getBacktrace(process, max_args=0, max_depth=20)
        else:
            self.bt = Backtrace()
        frames = []

        if CPU_X86_64:
            # detection of stack frame disabled, python-ptrace does not support
            # ...
            pass
        if CPU_I386:

            for i, frame in enumerate(self.bt.frames):
                print "frame", frame, hex(frame.ip)
                r_type = RefinePType(Type("Ptr32", 4), frame.ip, process, mm)
                frames.append(r_type)
                # print "ip:", str(r_type[0])
                if not (str(r_type[0]) == "GxPtr32"):
                    break

        self.bt.frames = frames
        self.eip_type = RefinePType(
            Type("Ptr32", 4), process.getInstrPointer(), process, mm)
Exemple #3
0
    def __init__(self, process, mm):
        self.name = "Abort"
        ip = process.getInstrPointer()

        self.bt = process.getBacktrace(max_args=0, max_depth=20)
        self.module = FindModule(ip, mm)
        # print self.bt, type(self.bt)
        frames = []

        if CPU_X86_64:
            # detection of stack frame disabled, python-ptrace does not support
            # ...
            pass
        if CPU_I386:

            for i, frame in enumerate(self.bt.frames):
                r_type = RefinePType(Type("Ptr32", 4), frame.ip, process, mm)
                frames.append(r_type)

                if str(r_type[0]) == "DPtr32":
                    break

        self.bt.frames = frames
        # print "frames",frames
        # print "self.bt.frames", self.bt.frames

        self.eip = RefinePType(Type("Ptr32", 4), ip, process, mm)
Exemple #4
0
  def __init__(self, name, process, mm): #_sifields = None):

    self.fields = dict()
    _sifields = process.getsiginfo()._sifields

    self.name = name

    if hasattr(_sifields, "_sigfault") and self.name == "SIGSEGV":
      self.fields["addr"] = RefinePType(Type("Ptr32",4), _sifields._sigfault._addr, process, mm)
Exemple #5
0
    def _detect_parameter_x86_64(self, ptype, index):

        if index > 4:
            return None

        reg = ["rdi", "rsi", "rdx", "rcx", "r8"][index]
        val = self.process.getreg(reg)

        # print "bs value", repr(bs), hex(bytes2word(bs))

        return RefinePType(GetPtype(ptype), val, self.process, self.mm)
Exemple #6
0
    def _detect_parameter_x86(self, ptype, offset):
        addr = self.process.getStackPointer() + offset
        bs = self.process.readBytes(addr, 4)

        #if CPU_X86_64:
        #  bs = bs + (4*'\00')

        #print "bs value", repr(bs), hex(bytes2word(bs))

        return RefinePType(GetPtype(ptype), bytes2word(bs), self.process,
                           self.mm)
Exemple #7
0
  def __init__(self, process, mm):
    self.name = "Abort"
    ip = process.getInstrPointer()

    self.bt =  process.getBacktrace(max_args=0, max_depth=20)
    self.module = FindModule(ip,mm)
    #print self.bt, type(self.bt)
    frames = []

    for i,frame in enumerate(self.bt.frames):
      r_type = RefinePType(Type("Ptr32",4), frame.ip, process, mm)
      frames.append(r_type)

      if str(r_type[0]) == "DPtr32":
        break
 
    self.bt.frames = frames
    #print "frames",frames
    #print "self.bt.frames", self.bt.frames
 
    self.eip = RefinePType(Type("Ptr32",4), ip, process, mm)
Exemple #8
0
 def DetectReturnValue(self, process):
   self.process = process
   self.retvalue = RefinePType(GetPtype(self.ret),process.getreg("eax"), self.process, self.mm)
Exemple #9
0
 def __DetectParam__(self, ptype, offset):
   addr = self.process.getreg("esp")+offset
   bytes = self.process.readBytes(addr, 4)
   return RefinePType(GetPtype(ptype),bytes2word(bytes), self.process, self.mm)
Exemple #10
0
 def __DetectRetAddr__(self):
   addr = self.process.getreg("esp")
   bytes = self.process.readBytes(addr, 4)
   return RefinePType(Type("Ptr32",4),bytes2word(bytes), self.process, self.mm)