def dump_data_ascii(self, ctx, lines): N = 128 # read by block of 128 bytes ad = ctx.entry s = self.binary.get_section(ad) print(hex(ad)) s.print_header() l = 0 ascii_str = [] ad_str = -1 while l < lines: buf = s.read(ad, N) if not buf: break i = 0 while i < len(buf): if ad > s.end: return j = i while j < len(buf): c = buf[j] if c not in BYTES_PRINTABLE_SET: break if ad_str == -1: ad_str = ad ascii_str.append(c) j += 1 if c != 0 and j == len(buf): ad += j - i break if c == 0 and len(ascii_str) >= 2: if self.is_label(ad_str): print(color_symbol(self.get_symbol(ad_str))) print_no_end(color_addr(ad_str)) print_no_end( color_string("\"" + "".join(map(get_char, ascii_str)) + "\"")) print(", 0") ad += j - i i = j else: if self.is_label(ad): print(color_symbol(self.get_symbol(ad))) print_no_end(color_addr(ad)) print("0x%.2x " % buf[i]) ad += 1 i += 1 ad_str = -1 ascii_str = [] l += 1 if l >= lines: return
def dump_data_ascii(self, ctx, lines): N = 128 # read by block of 128 bytes ad = ctx.entry s = self.binary.get_section(ad) print(hex(ad)) s.print_header() l = 0 ascii_str = [] ad_str = -1 while l < lines: buf = s.read(ad, N) if not buf: break i = 0 while i < len(buf): if ad > s.end: return j = i while j < len(buf): c = buf[j] if c not in BYTES_PRINTABLE_SET: break if ad_str == -1: ad_str = ad ascii_str.append(c) j += 1 if c != 0 and j == len(buf): ad += j - i break if c == 0 and len(ascii_str) >= 2: if self.is_label(ad_str): print(color_symbol(self.get_symbol(ad_str))) print_no_end(color_addr(ad_str)) print_no_end(color_string( "\"" + "".join(map(get_char, ascii_str)) + "\"")) print(", 0") ad += j - i i = j else: if self.is_label(ad): print(color_symbol(self.get_symbol(ad))) print_no_end(color_addr(ad)) print("0x%.2x " % buf[i]) ad += 1 i += 1 ad_str = -1 ascii_str = [] l += 1 if l >= lines: return
def dump_data_ascii(self, ctx, lines): N = 128 # read by block of 128 bytes addr = ctx.entry_addr s_name, s_start, s_end = self.binary.get_section_meta(ctx.entry_addr) self.print_section_meta(s_name, s_start, s_end) l = 0 ascii_str = [] addr_str = -1 while l < lines: buf = self.binary.section_stream_read(addr, N) if not buf: break i = 0 while i < len(buf): if addr > s_end: return j = i while j < len(buf): c = buf[j] if c not in BYTES_PRINTABLE_SET: break if addr_str == -1: addr_str = addr ascii_str.append(c) j += 1 if c != 0 and j == len(buf): addr += j - i break if c == 0 and len(ascii_str) >= 2: print_no_end(color_addr(addr_str)) print_no_end( color_string("\"" + "".join(map(get_char, ascii_str)) + "\"")) print(", 0") addr += j - i i = j else: print_no_end(color_addr(addr)) print("0x%.2x " % buf[i]) addr += 1 i += 1 addr_str = -1 ascii_str = [] l += 1 if l >= lines: return
def dump_data_ascii(self, ctx, lines): N = 128 # read by block of 128 bytes addr = ctx.entry_addr s_name, s_start, s_end = self.binary.get_section_meta(ctx.entry_addr) self.print_section_meta(s_name, s_start, s_end) l = 0 ascii_str = [] addr_str = -1 while l < lines: buf = self.binary.section_stream_read(addr, N) if not buf: break i = 0 while i < len(buf): if addr >= s_end: return j = i while j < len(buf): c = buf[j] if c not in BYTES_PRINTABLE_SET: break if addr_str == -1: addr_str = addr ascii_str.append(c) j += 1 if c != 0 and j == len(buf): addr += j - i break if c == 0 and len(ascii_str) >= 2: print_no_end(color_addr(addr_str)) print_no_end(color_string( "\"" + "".join(map(get_char, ascii_str)) + "\"")) print(", 0") addr += j - i i = j else: print_no_end(color_addr(addr)) print("0x%.2x " % buf[i]) addr += 1 i += 1 addr_str = -1 ascii_str = [] l += 1 if l >= lines: return
def print_symbols(self, print_sections, sym_filter=None, only_func=False): if sym_filter is not None: sym_filter = sym_filter.lower() if sym_filter[0] == "-": invert_match = True sym_filter = sym_filter[1:] else: invert_match = False total = 0 # TODO: race condition with the analyzer for sy in list(self.binary.symbols): addr, ty = self.binary.symbols[sy] if only_func and ty != SYM_FUNC: continue if sym_filter is None or \ (invert_match and sym_filter not in sy.lower()) or \ (not invert_match and sym_filter in sy.lower()): if sy: section = self.binary.get_section(addr) print_no_end(color_addr(addr) + " " + sy) if print_sections and section is not None: print_no_end(" (" + color_section(section.name) + ")") print() total += 1 print("Total:", total)
def dump_data(self, ctx, lines, size_word): s = self.binary.get_section(ctx.entry_addr) s.print_header() ad = ctx.entry_addr for w in self.read_array(ctx.entry_addr, lines, size_word, s): if ad in self.binary.reverse_symbols: print(color_symbol(self.binary.reverse_symbols[ad][0])) print_no_end(color_addr(ad)) print_no_end("0x%.2x" % w) section = self.binary.get_section(w) if section is not None: print_no_end(" (") print_no_end(color_section(section.name)) print_no_end(")") if size_word >= 4 and w in self.binary.reverse_symbols: print_no_end(" ") print_no_end( color_symbol(self.binary.reverse_symbols[w][0])) ad += size_word print()
def print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) if prefix == "# ": if self.ctx.comments: print_comment_no_end(prefix, tab) print_no_end(color_addr(i.address)) self.print_bytes(i, True) print_comment(get_inst_str()) return if i.address in self.ctx.all_fused_inst: return if self.is_symbol(i.address): print_tabbed_no_end("", tab) self.print_symbol(i.address) print() modified = self.__print_inst(i, tab, prefix) if i.address in INTERN_COMMENTS: print_no_end(color_intern_comment(" ; ")) print_no_end(color_intern_comment(INTERN_COMMENTS[i.address])) if modified and self.ctx.comments: print_comment_no_end(" # " + get_inst_str()) print()
def print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) if prefix == "# ": if self.ctx.comments: print_comment_no_end(prefix, tab) print_no_end(color_addr(i.address)) print_comment(get_inst_str()) return if i.address in self.ctx.all_fused_inst: return if i.address != self.ctx.addr and \ i.address in self.ctx.dis.binary.reverse_symbols: print_tabbed_no_end("", tab) self.print_symbol(i.address) print() modified = self.__print_inst(i, tab, prefix) if i.address in INTERN_COMMENTS: print_no_end(color_intern_comment(" ; ")) print_no_end(color_intern_comment(INTERN_COMMENTS[i.address])) if modified and self.ctx.comments: print_comment_no_end(" # " + get_inst_str()) print()
def print_symbols(self, print_sections, sym_filter=None): if sym_filter is not None: sym_filter = sym_filter.lower() if sym_filter[0] == "-": invert_match = True sym_filter = sym_filter[1:] else: invert_match = False total = 0 # TODO: race condition with the analyzer ? for sy in list(self.binary.symbols): ad = self.binary.symbols[sy] if sym_filter is None or \ (invert_match and sym_filter not in sy.lower()) or \ (not invert_match and sym_filter in sy.lower()): if sy: section = self.binary.get_section(ad) print_no_end(color_addr(ad) + " " + sy) if print_sections and section is not None: print_no_end(" (" + color_section(section.name) + ")") print() total += 1 print("Total:", total)
def print(self, o, tab=0): o.print_commented_jump(self.orig_jump, self.fused_inst, tab) if self.prefetch is not None: o.print_inst(self.prefetch, tab) print_tabbed_no_end(color_keyword("if "), tab) o.print_if_cond(self.cond_id, self.fused_inst) print_no_end(color_keyword(" goto ")) print(color_addr(self.addr_jump, False))
def print_functions(self): total = 0 # TODO: race condition with the analyzer ? for ad in list(self.functions): print(color_addr(ad) + " " + self.get_symbol(ad)) total += 1 print("Total:", total)
def print_rep_end(): nonlocal tab if i.prefix[0] in REP_PREFIX: print() print_tabbed_no_end(color_addr(i.address), tab) print("rcx--") if i.prefix[0] == X86_PREFIX_REPNE: print_tabbed_no_end(color_keyword("if"), tab) print_no_end(" (!Z) ") print(color_keyword("break")) tab -= 1 print_tabbed_no_end("}", tab)
def print_symbols(self, print_sections, sym_filter=None): if sym_filter is not None: sym_filter = sym_filter.lower() for addr in self.binary.reverse_symbols: sy = self.binary.reverse_symbols[addr] if sym_filter is None or sym_filter in sy.lower(): sec_name, _ = self.binary.is_address(addr) print_no_end(color_addr(addr) + " " + color_symbol("<" + sy + ">")) if print_sections and sec_name is not None: print_no_end(" (" + color_section(sec_name) + ")") print()
def print_symbols(self, print_sections, sym_filter=None): if sym_filter is not None: sym_filter = sym_filter.lower() for addr in self.binary.reverse_symbols: sy = self.binary.reverse_symbols[addr] if sym_filter is None or sym_filter in sy.lower(): sec_name, _ = self.binary.is_address(addr) if sy: print_no_end(color_addr(addr) + " " + sy) if print_sections and sec_name is not None: print_no_end(" (" + color_section(sec_name) + ")") print()
def print_symbols(self, print_sections, sym_filter=None): if sym_filter is not None: sym_filter = sym_filter.lower() if sym_filter[0] == "-": invert_match = True sym_filter = sym_filter[1:] else: invert_match = False for sy in self.binary.symbols: addr = self.binary.symbols[sy] if sym_filter is None or \ (invert_match and sym_filter not in sy.lower()) or \ (not invert_match and sym_filter in sy.lower()): if sy: section = self.binary.get_section(addr) print_no_end(color_addr(addr) + " " + sy) if print_sections and section is not None: print_no_end(" (" + color_section(section.name) + ")") print()
def dump_data(self, ctx, lines, size_word): s_name, s_start, s_end = self.binary.get_section_meta(ctx.entry_addr) self.print_section_meta(s_name, s_start, s_end) ad = ctx.entry_addr for w in self.read_array(ctx.entry_addr, lines, size_word): if ad in self.binary.reverse_symbols: print(color_symbol(self.binary.reverse_symbols[ad])) print_no_end(color_addr(ad)) print_no_end("0x%.2x" % w) sec_name, is_data = self.binary.is_address(w) if sec_name is not None: print_no_end(" (") print_no_end(color_section(sec_name)) print_no_end(")") if size_word >= 4 and w in self.binary.reverse_symbols: print_no_end(" ") print_no_end(color_symbol(self.binary.reverse_symbols[w])) ad += size_word print()
def dump_data(self, ctx, lines, size_word): ad = ctx.entry s = self.binary.get_section(ad) s.print_header() for w in self.read_array(ad, lines, size_word, s): if self.is_label(ad): print(color_symbol(self.get_symbol(ad))) print_no_end(color_addr(ad)) print_no_end("0x%.2x" % w) section = self.binary.get_section(w) if section is not None: print_no_end(" (") print_no_end(color_section(section.name)) print_no_end(")") if size_word >= 4 and self.is_label(w): print_no_end(" ") print_no_end(color_symbol(self.get_symbol(w))) ad += size_word print()
def dump_data(self, ctx, lines, size_word): s = self.binary.get_section(ctx.entry_addr) s.print_header() ad = ctx.entry_addr for w in self.read_array(ctx.entry_addr, lines, size_word, s): if ad in self.binary.reverse_symbols: print(color_symbol(self.binary.reverse_symbols[ad][0])) print_no_end(color_addr(ad)) print_no_end("0x%.2x" % w) section = self.binary.get_section(w) if section is not None: print_no_end(" (") print_no_end(color_section(section.name)) print_no_end(")") if size_word >= 4 and w in self.binary.reverse_symbols: print_no_end(" ") print_no_end(color_symbol(self.binary.reverse_symbols[w][0])) ad += size_word print()
def dump_data(self, ctx, lines): N = 128 addr = ctx.entry_addr s_name, s_start, s_end = self.binary.get_section_meta(ctx.entry_addr) self.print_section_meta(s_name, s_start, s_end) addr_ascii_str = -1 ascii_str = [] l = 0 is_new_line = True while l < lines: buf = self.binary.section_stream_read(addr, N) if not buf: break i = 0 while i < len(buf): c = buf[i] if c in BYTES_PRINTABLE_SET: if addr_ascii_str == -1: addr_ascii_str = addr ascii_str.append(c) addr += 1 i += 1 continue stack_char = [] if addr_ascii_str != -1: if c == 0 and len(ascii_str) >= 2: if not is_new_line: print() l += 1 if l >= lines: return print_no_end(color_addr(addr_ascii_str)) print_no_end(color_string("\"" + "".join(map(get_char, ascii_str)) + "\"")) print(", 0") is_new_line = True l += 1 if l >= lines: return ascii_str = [] addr_ascii_str = -1 addr += 1 i += 1 continue stack_char = ascii_str i -= len(ascii_str) addr -= len(ascii_str) stack_char.append(c) for c in stack_char: if is_new_line: print_no_end(color_addr(addr)) elif addr % 4 == 0 and addr != ctx.entry_addr: print() is_new_line = True l += 1 if l >= lines: return print_no_end(color_addr(addr)) print_no_end("%.2x " % c) addr += 1 i += 1 is_new_line = False ascii_str = [] addr_ascii_str = -1 if not is_new_line: print()
def print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) if isinstance(i, NopInst): return if isinstance(i, PseudoInst): for i2 in i.real_inst: self.print_inst(i2, tab, "# ") print_tabbed_no_end(color_addr(i.real_inst[0].address), tab) print(i.pseudo) return if prefix == "# ": if self.ctx.comments: print_comment_no_end(prefix, tab) print_no_end(color_addr(i.address)) self.print_bytes(i, True) print_comment(get_inst_str()) return if i.address in self.ctx.all_fused_inst: return if self.is_symbol(i.address): print_tabbed_no_end("", tab) self.print_symbol(i.address) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_bytes(i) if is_ret(i): print(color_retcall(get_inst_str())) return if is_call(i): print_no_end(color_retcall(i.mnemonic) + " ") self.print_operand(i, 0, hexa=True) print() return # Here we can have conditional jump with the option --dump if is_jump(i): print_no_end(i.mnemonic + " ") if i.operands[-1].type != MIPS_OP_IMM: print_no_end(i.op_str) if is_uncond_jump(i) and self.ctx.comments and not self.ctx.dump: print_comment_no_end(" # STOPPED") print() return for num in range(len(i.operands)-1): self.print_operand(i, num) print_no_end(", ") addr = i.operands[-1].value.imm if addr in self.ctx.addr_color: print(color(hex(addr), self.ctx.addr_color[addr])) else: print(hex(addr)) return modified = False if i.id in LD_CHECK: self.print_operand(i, 0) print_no_end(" = (") print_no_end(color_type(LD_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 1) modified = True elif i.id in ST_CHECK: self.print_operand(i, 1) print_no_end(" = (") print_no_end(color_type(ST_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 0) modified = True elif i.id in INST_CHECK: if i.id == MIPS_INS_LUI: print_no_end("(load upper) ") self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) elif i.id == MIPS_INS_MOVE: self.print_operand(i, 0) print_no_end(" = ") if i.operands[1].value.reg == MIPS_REG_ZERO: print_no_end("0") else: self.print_operand(i, 1) else: self.print_operand(i, 0) if i.operands[0].type == i.operands[1].type == MIPS_OP_REG and \ i.operands[0].value.reg == i.operands[1].value.reg: print_no_end(" " + inst_symbol(i) + "= ") else: print_no_end(" = ") self.print_operand(i, 1) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 2) modified = True else: print_no_end("%s " % i.mnemonic) if len(i.operands) > 0: modified = self.print_operand(i, 0) k = 1 while k < len(i.operands): print_no_end(", ") modified |= self.print_operand(i, k) k += 1 if modified and self.ctx.comments: print_comment_no_end(" # " + get_inst_str()) print()
def dump_data(self, ctx, lines, size_word): _, mode = self.binary.get_arch() if mode & self.capstone.CS_MODE_BIG_ENDIAN: endian = ">" else: endian = "<" if size_word == 1: unpack_str = endian + "B" elif size_word == 2: unpack_str = endian + "H" elif size_word == 4: unpack_str = endian + "L" elif size_word == 8: unpack_str = endian + "Q" N = size_word * 64 addr = ctx.entry_addr s_name, s_start, s_end = self.binary.get_section_meta(ctx.entry_addr) self.print_section_meta(s_name, s_start, s_end) l = 0 while l < lines: buf = self.binary.section_stream_read(addr, N) if not buf: break i = 0 while i < len(buf): b = buf[i:i + size_word] if addr >= s_end: return if len(b) != size_word: for c in buf: print_no_end(color_addr(addr)) print("0x%.2x" % c) return if addr in self.binary.reverse_symbols: print(color_symbol(self.binary.reverse_symbols[addr])) print_no_end(color_addr(addr)) w = struct.unpack(unpack_str, b)[0] print_no_end("0x%.2x" % w) sec_name, is_data = self.binary.is_address(w) if sec_name is not None and \ sec_name not in [".comment", ".shstrtab"]: print_no_end(" (") print_no_end(color_section(sec_name)) print_no_end(")") if size_word >= 4 and w in self.binary.reverse_symbols: print_no_end(" ") print_no_end(color_symbol(self.binary.reverse_symbols[w])) print() addr += size_word i += size_word l += 1 if l >= lines: return
def print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) if prefix == "# ": if self.ctx.comments: print_comment_no_end(prefix, tab) print_no_end(color_addr(i.address)) print_comment(get_inst_str()) return if i.address in self.ctx.all_fused_inst: return if i.address != self.ctx.addr and \ i.address in self.ctx.dis.binary.reverse_symbols: print_tabbed_no_end("", tab) self.print_symbol(i.address) print() print_tabbed_no_end(color_addr(i.address), tab) if is_ret(i): print(color_retcall(get_inst_str())) return if is_call(i): print_no_end(color_retcall(i.mnemonic) + " ") self.print_operand(i, 0, hexa=True) print() return # Here we can have conditional jump with the option --dump if is_jump(i): if i.operands[0].type != ARM_OP_IMM: print_no_end(i.mnemonic + " ") print_no_end(i.op_str) if is_uncond_jump(i) and self.ctx.comments: print_comment_no_end(" # STOPPED") print() return try: addr = i.operands[0].value.imm print(i.mnemonic + " " + color(hex(addr), self.ctx.addr_color[addr])) except KeyError: print(i.mnemonic + " " + hex(addr)) return modified = False if i.id in LDR_CHECK: self.print_operand(i, 0) print_no_end(" = (") print_no_end(color_type(LDR_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 1) modified = True elif i.id in STR_CHECK: self.print_operand(i, 1) print_no_end(" = (") print_no_end(color_type(STR_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 0) modified = True elif i.id in INST_CHECK: self.print_operand(i, 0) if i.id == ARM_INS_CMP: print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) else: print_no_end(" = ") self.print_operand(i, 1) if len(i.operands) == 3: print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 2) modified = True else: print_no_end("%s " % i.mnemonic) if len(i.operands) > 0: modified = self.print_operand(i, 0) k = 1 while k < len(i.operands): print_no_end(", ") modified |= self.print_operand(i, k) k += 1 if i.update_flags and i.id != ARM_INS_CMP and i.id != ARM_INS_TST: print_no_end(color_type(" (FLAGS)")) if modified and self.ctx.comments: print_comment_no_end(" # " + get_inst_str()) print()
def print(self, o, tab=0): print_tabbed_no_end(color_keyword("goto "), tab) print(color_addr(self.addr_jump, False))
def print_bad(self, addr, tab=0): print_tabbed_no_end(color_addr(addr), tab) print("(bad)")
def print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) if isinstance(i, NopInst): return if isinstance(i, PseudoInst): for i2 in i.real_inst: self.print_inst(i2, tab, "# ") print_tabbed_no_end(color_addr(i.real_inst[0].address), tab) print(i.pseudo) return if prefix == "# ": if self.ctx.comments: print_comment_no_end(prefix, tab) print_no_end(color_addr(i.address)) self.print_bytes(i, True) print_comment(get_inst_str()) return if i.address in self.ctx.all_fused_inst: return if self.is_symbol(i.address): print_tabbed_no_end("", tab) self.print_symbol(i.address) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_bytes(i) if is_ret(i): print(color_retcall(get_inst_str())) return if is_call(i): print_no_end(color_retcall(i.mnemonic) + " ") self.print_operand(i, 0, hexa=True) print() return # Here we can have conditional jump with the option --dump if is_jump(i): print_no_end(i.mnemonic + " ") if i.operands[-1].type != MIPS_OP_IMM: print_no_end(i.op_str) if is_uncond_jump( i) and self.ctx.comments and not self.ctx.dump: print_comment_no_end(" # STOPPED") print() return for num in range(len(i.operands) - 1): self.print_operand(i, num) print_no_end(", ") addr = i.operands[-1].value.imm if addr in self.ctx.addr_color: print(color(hex(addr), self.ctx.addr_color[addr])) else: print(hex(addr)) return modified = False if i.id in LD_CHECK: self.print_operand(i, 0) print_no_end(" = (") print_no_end(color_type(LD_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 1) modified = True elif i.id in ST_CHECK: self.print_operand(i, 1) print_no_end(" = (") print_no_end(color_type(ST_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 0) modified = True elif i.id in INST_CHECK: if i.id == MIPS_INS_LUI: print_no_end("(load upper) ") self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) elif i.id == MIPS_INS_MOVE: self.print_operand(i, 0) print_no_end(" = ") if i.operands[1].value.reg == MIPS_REG_ZERO: print_no_end("0") else: self.print_operand(i, 1) else: self.print_operand(i, 0) if i.operands[0].type == i.operands[1].type == MIPS_OP_REG and \ i.operands[0].value.reg == i.operands[1].value.reg: print_no_end(" " + inst_symbol(i) + "= ") else: print_no_end(" = ") self.print_operand(i, 1) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 2) modified = True else: print_no_end("%s " % i.mnemonic) if len(i.operands) > 0: modified = self.print_operand(i, 0) k = 1 while k < len(i.operands): print_no_end(", ") modified |= self.print_operand(i, k) k += 1 if modified and self.ctx.comments: print_comment_no_end(" # " + get_inst_str()) print()
def __print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) print_tabbed_no_end(color_addr(i.address), tab) self.print_bytes(i) if is_ret(i): print_no_end(color_retcall(get_inst_str())) return if is_call(i): print_no_end(color_retcall(i.mnemonic) + " ") self.print_operand(i, 0, hexa=True) return # Here we can have conditional jump with the option --dump if is_jump(i): if i.operands[0].type != X86_OP_IMM: print_no_end(i.mnemonic + " ") self.print_operand(i, 0) if is_uncond_jump( i) and self.ctx.comments and not self.ctx.dump: print_comment_no_end(" # STOPPED") return try: addr = i.operands[0].value.imm print_no_end(i.mnemonic + " " + color(hex(addr), self.ctx.addr_color[addr])) except KeyError: print_no_end(i.mnemonic + " " + hex(addr)) return modified = False if i.id in INST_CHECK: if (i.id == X86_INS_OR and i.operands[1].type == X86_OP_IMM and i.operands[1].value.imm == -1): self.print_operand(i, 0) print_no_end(" = -1") elif (i.id == X86_INS_AND and i.operands[1].type == X86_OP_IMM and i.operands[1].value.imm == 0): self.print_operand(i, 0) print_no_end(" = 0") elif (all(op.type == X86_OP_REG for op in i.operands) and len(set(op.value.reg for op in i.operands)) == 1 and i.id == X86_INS_XOR): self.print_operand(i, 0) print_no_end(" = 0") elif i.id == X86_INS_INC or i.id == X86_INS_DEC: self.print_operand(i, 0) print_no_end(inst_symbol(i)) elif i.id == X86_INS_LEA: self.print_operand(i, 0) print_no_end(" = &(") self.print_operand(i, 1) print_no_end(")") elif i.id == X86_INS_IMUL: if len(i.operands) == 3: self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) print_no_end(" " + inst_symbol(i).rstrip('=') + " ") self.print_operand(i, 2) elif len(i.operands) == 2: self.print_operand(i, 0) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) elif len(i.operands) == 1: sz = i.operands[0].size if sz == 1: print_no_end("ax = al * ") elif sz == 2: print_no_end("dx:ax = ax * ") elif sz == 4: print_no_end("edx:eax = eax * ") elif sz == 8: print_no_end("rdx:rax = rax * ") self.print_operand(i, 0) else: self.print_operand(i, 0) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) modified = True elif i.id == X86_INS_CDQE: print_no_end("rax = eax") modified = True elif i.id == X86_INS_IDIV: print_no_end('eax = edx:eax / ') self.print_operand(i, 0) print_no_end('; edx = edx:eax % ') self.print_operand(i, 0) modified = True elif i.id == X86_INS_MUL: lut = { 1: ("al", "ax"), 2: ("ax", "dx:ax"), 4: ("eax", "edx:eax"), 8: ("rax", "rdx:rax") } src, dst = lut[i.operands[0].size] print_no_end('{0} = {1} * '.format(dst, src)) self.print_operand(i, 0) modified = True elif i.id == X86_INS_NOT: self.print_operand(i, 0) print_no_end(' ^= -1') modified = True elif i.id == X86_INS_SCASB and i.prefix[0] == X86_PREFIX_REPNE: print_no_end('while (') self.print_operand(i, 1) print_no_end(' != ') self.print_operand(i, 0) print_no_end(') { ') self.print_operand(i, 1, show_deref=False) print_no_end('++; cx--; } ') self.print_operand(i, 1, show_deref=False) print_no_end('++; cx--;') modified = True else: print_no_end("%s " % i.mnemonic) if len(i.operands) > 0: modified = self.print_operand(i, 0) k = 1 while k < len(i.operands): print_no_end(", ") modified |= self.print_operand(i, k) k += 1 return modified
def __print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) print_tabbed_no_end(color_addr(i.address), tab) if is_ret(i): print_no_end(color_retcall(get_inst_str())) return if is_call(i): print_no_end(color_retcall(i.mnemonic) + " ") self.print_operand(i, 0, hexa=True) return # Here we can have conditional jump with the option --dump if is_jump(i): if i.operands[0].type != X86_OP_IMM: print_no_end(i.mnemonic + " ") self.print_operand(i, 0) if is_uncond_jump(i) and self.ctx.comments: print_comment_no_end(" # STOPPED") return try: addr = i.operands[0].value.imm print_no_end(i.mnemonic + " " + color(hex(addr), self.ctx.addr_color[addr])) except KeyError: print_no_end(i.mnemonic + " " + hex(addr)) return modified = False if i.id in INST_CHECK: if (i.id == X86_INS_OR and i.operands[1].type == X86_OP_IMM and i.operands[1].value.imm == -1): self.print_operand(i, 0) print_no_end(" = -1") elif (i.id == X86_INS_AND and i.operands[1].type == X86_OP_IMM and i.operands[1].value.imm == 0): self.print_operand(i, 0) print_no_end(" = 0") elif (all(op.type == X86_OP_REG for op in i.operands) and len(set(op.value.reg for op in i.operands)) == 1 and i.id == X86_INS_XOR): self.print_operand(i, 0) print_no_end(" = 0") elif i.id == X86_INS_INC or i.id == X86_INS_DEC: self.print_operand(i, 0) print_no_end(inst_symbol(i)) elif i.id == X86_INS_LEA: self.print_operand(i, 0) print_no_end(" = &(") self.print_operand(i, 1) print_no_end(")") elif i.id == X86_INS_IMUL: if len(i.operands) == 3: self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) print_no_end(" " + inst_symbol(i).rstrip('=') + " ") self.print_operand(i, 2) elif len(i.operands) == 2: self.print_operand(i, 0) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) elif len(i.operands) == 1: sz = i.operands[0].size if sz == 1: print_no_end("ax = al * ") elif sz == 2: print_no_end("dx:ax = ax * ") elif sz == 4: print_no_end("edx:eax = eax * ") elif sz == 8: print_no_end("rdx:rax = rax * ") self.print_operand(i, 0) else: self.print_operand(i, 0) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) modified = True elif i.id == X86_INS_CDQE: print_no_end("rax = eax") modified = True elif i.id == X86_INS_IDIV: print_no_end('eax = edx:eax / ') self.print_operand(i, 0) print_no_end('; edx = edx:eax % ') self.print_operand(i, 0) modified = True elif i.id == X86_INS_MUL: lut = {1: ("al", "ax"), 2: ("ax", "dx:ax"), 4: ("eax", "edx:eax"), 8: ("rax", "rdx:rax")} src, dst = lut[i.operands[0].size] print_no_end('{0} = {1} * '.format(dst, src)) self.print_operand(i, 0) modified = True elif i.id == X86_INS_NOT: self.print_operand(i, 0) print_no_end(' ^= -1') modified = True elif i.id == X86_INS_SCASB and i.prefix[0] == X86_PREFIX_REPNE: print_no_end('while (') self.print_operand(i, 1) print_no_end(' != ') self.print_operand(i, 0) print_no_end(') { ') self.print_operand(i, 1, show_deref=False) print_no_end('++; cx--; } ') self.print_operand(i, 1, show_deref=False) print_no_end('++; cx--;') modified = True else: print_no_end("%s " % i.mnemonic) if len(i.operands) > 0: modified = self.print_operand(i, 0) k = 1 while k < len(i.operands): print_no_end(", ") modified |= self.print_operand(i, k) k += 1 return modified
def print_addr(addr, tab=-1, print_colon=True): if tab == -1: print_no_end(color_addr(addr, print_colon)) else: print_tabbed_no_end(color_addr(addr, print_colon), tab)
def print_addr_if_needed(self, i, tab): if i.address in self.ctx.addr_color: print_tabbed_no_end(color_addr(i.address), tab)
def print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) if prefix == "# ": if self.ctx.comments: print_comment_no_end(prefix, tab) print_no_end(color_addr(i.address)) self.print_bytes(i, True) print_comment(get_inst_str()) return if i.address in self.ctx.all_fused_inst: return if self.is_symbol(i.address): print_tabbed_no_end("", tab) self.print_symbol(i.address) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_bytes(i) if is_ret(i): print(color_retcall(get_inst_str())) return if is_call(i): print_no_end(color_retcall(i.mnemonic) + " ") self.print_operand(i, 0, hexa=True) print() return # Here we can have conditional jump with the option --dump if is_jump(i): if i.operands[0].type != ARM_OP_IMM: print_no_end(i.mnemonic + " ") print_no_end(i.op_str) if is_uncond_jump( i) and self.ctx.comments and not self.ctx.dump: print_comment_no_end(" # STOPPED") print() return try: addr = i.operands[0].value.imm print(i.mnemonic + " " + color(hex(addr), self.ctx.addr_color[addr])) except KeyError: print(i.mnemonic + " " + hex(addr)) return modified = False if i.id in LDR_CHECK: self.print_operand(i, 0) print_no_end(" = (") print_no_end(color_type(LDR_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 1) modified = True elif i.id in STR_CHECK: self.print_operand(i, 1) print_no_end(" = (") print_no_end(color_type(STR_TYPE[i.id])) print_no_end(") ") self.print_operand(i, 0) modified = True elif i.id in INST_CHECK: self.print_operand(i, 0) if i.id == ARM_INS_CMP: print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) else: print_no_end(" = ") self.print_operand(i, 1) if len(i.operands) == 3: print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 2) modified = True else: print_no_end("%s " % i.mnemonic) if len(i.operands) > 0: modified = self.print_operand(i, 0) k = 1 while k < len(i.operands): print_no_end(", ") modified |= self.print_operand(i, k) k += 1 if i.update_flags and i.id != ARM_INS_CMP and i.id != ARM_INS_TST: print_no_end(color_type(" (FLAGS)")) if modified and self.ctx.comments: print_comment_no_end(" # " + get_inst_str()) print()
def __print_inst(self, i, tab=0, prefix=""): def get_inst_str(): nonlocal i return "%s %s" % (i.mnemonic, i.op_str) def print_rep_begin(): nonlocal tab if i.prefix[0] in REP_PREFIX: print_tabbed_no_end(color_keyword("while"), tab) # TODO: for 16 and 32 bits print_no_end(" (!rcx)") print(") {") tab += 1 def print_rep_end(): nonlocal tab if i.prefix[0] in REP_PREFIX: print() print_tabbed_no_end(color_addr(i.address), tab) print("rcx--") if i.prefix[0] == X86_PREFIX_REPNE: print_tabbed_no_end(color_keyword("if"), tab) print_no_end(" (!Z) ") print(color_keyword("break")) tab -= 1 print_tabbed_no_end("}", tab) print_rep_begin() print_tabbed_no_end(color_addr(i.address), tab) self.print_bytes(i) if is_ret(i): print_no_end(color_retcall(get_inst_str())) return if is_call(i): print_no_end(color_retcall(i.mnemonic) + " ") self.print_operand(i, 0, hexa=True) return # Here we can have conditional jump with the option --dump if is_jump(i): if i.operands[0].type != X86_OP_IMM: print_no_end(i.mnemonic + " ") self.print_operand(i, 0) if is_uncond_jump(i) and self.ctx.comments and not self.ctx.dump: print_comment_no_end(" # STOPPED") return try: addr = i.operands[0].value.imm print_no_end(i.mnemonic + " " + color(hex(addr), self.ctx.addr_color[addr])) except KeyError: print_no_end(i.mnemonic + " " + hex(addr)) return modified = False if i.id in INST_CHECK: if (i.id == X86_INS_OR and i.operands[1].type == X86_OP_IMM and i.operands[1].value.imm == -1): self.print_operand(i, 0) print_no_end(" = -1") elif (i.id == X86_INS_AND and i.operands[1].type == X86_OP_IMM and i.operands[1].value.imm == 0): self.print_operand(i, 0) print_no_end(" = 0") elif (all(op.type == X86_OP_REG for op in i.operands) and len(set(op.value.reg for op in i.operands)) == 1 and i.id == X86_INS_XOR): self.print_operand(i, 0) print_no_end(" = 0") elif i.id == X86_INS_INC or i.id == X86_INS_DEC: self.print_operand(i, 0) print_no_end(inst_symbol(i)) elif i.id == X86_INS_LEA: self.print_operand(i, 0) print_no_end(" = &(") self.print_operand(i, 1) print_no_end(")") elif i.id == X86_INS_MOVZX: self.print_operand(i, 0) print_no_end(" = (zero ext) ") self.print_operand(i, 1) elif i.id == X86_INS_IMUL: if len(i.operands) == 3: self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) print_no_end(" " + inst_symbol(i).rstrip('=') + " ") self.print_operand(i, 2) elif len(i.operands) == 2: self.print_operand(i, 0) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) elif len(i.operands) == 1: sz = i.operands[0].size if sz == 1: print_no_end("ax = al * ") elif sz == 2: print_no_end("dx:ax = ax * ") elif sz == 4: print_no_end("edx:eax = eax * ") elif sz == 8: print_no_end("rdx:rax = rax * ") self.print_operand(i, 0) else: self.print_operand(i, 0) print_no_end(" " + inst_symbol(i) + " ") self.print_operand(i, 1) modified = True elif i.id == X86_INS_CDQE: print_no_end("rax = eax") modified = True elif i.id == X86_INS_IDIV: print_no_end('eax = edx:eax / ') self.print_operand(i, 0) print_no_end('; edx = edx:eax % ') self.print_operand(i, 0) modified = True elif i.id == X86_INS_MUL: lut = {1: ("al", "ax"), 2: ("ax", "dx:ax"), 4: ("eax", "edx:eax"), 8: ("rax", "rdx:rax")} src, dst = lut[i.operands[0].size] print_no_end('{0} = {1} * '.format(dst, src)) self.print_operand(i, 0) modified = True elif i.id == X86_INS_NOT: self.print_operand(i, 0) print_no_end(' ^= -1') modified = True elif i.id in INST_SCAS: self.print_operand(i, 0) print_no_end(" cmp ") self.print_operand(i, 1) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_operand(i, 1, show_deref=False) print_no_end(" += D") modified = True elif i.id in INST_STOS: self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_operand(i, 0, show_deref=False) print_no_end(" += D") modified = True elif i.id in INST_LODS: self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_operand(i, 1, show_deref=False) print_no_end(" += D") modified = True elif i.id in INST_CMPS: self.print_operand(i, 0) print_no_end(" cmp ") self.print_operand(i, 1) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_operand(i, 0, show_deref=False) print(" += D") print_tabbed_no_end(color_addr(i.address), tab) self.print_operand(i, 1, show_deref=False) print_no_end("' += D") modified = True elif i.id in INST_MOVS: self.print_operand(i, 0) print_no_end(" = ") self.print_operand(i, 1) print() print_tabbed_no_end(color_addr(i.address), tab) self.print_operand(i, 0, show_deref=False) print(" += D") print_tabbed_no_end(color_addr(i.address), tab) self.print_operand(i, 1, show_deref=False) print_no_end(" += D") modified = True else: print_no_end("%s " % i.mnemonic) if len(i.operands) > 0: modified = self.print_operand(i, 0) k = 1 while k < len(i.operands): print_no_end(", ") modified |= self.print_operand(i, k) k += 1 print_rep_end() return modified