def scode(data, length, key, shellcode): def code_sentinelle(jitter): jitter.run = False jitter.pc = 0 return True myjit = Machine("x86_32").jitter("tcc") myjit.init_stack() run_addr = 0x40000000 myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, shellcode) #myjit.jit.log_regs = True #myjit.jit.log_mn = True #myjit.jit.log_newbloc = True myjit.add_breakpoint(0x1337beef, code_sentinelle) myjit.vm.add_memory_page(0x10000000, PAGE_READ | PAGE_WRITE, data) #myjit.add_breakpoint(0x40000000, code_sentinelle) myjit.push_uint32_t(key) myjit.push_uint32_t(len(data)) myjit.push_uint32_t(0x10000000) myjit.push_uint32_t(0x1337beef) myjit.init_run(run_addr) myjit.continue_run() return myjit.cpu.get_mem(0x10000000,len(data))
def scode(data, length, key, shellcode): def code_sentinelle(jitter): jitter.run = False jitter.pc = 0 return True myjit = Machine("x86_32").jitter("tcc") myjit.init_stack() run_addr = 0x40000000 myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, shellcode) #myjit.jit.log_regs = True #myjit.jit.log_mn = True #myjit.jit.log_newbloc = True myjit.add_breakpoint(0x1337beef, code_sentinelle) myjit.vm.add_memory_page(0x10000000, PAGE_READ | PAGE_WRITE, data) #myjit.add_breakpoint(0x40000000, code_sentinelle) myjit.push_uint32_t(key) myjit.push_uint32_t(len(data)) myjit.push_uint32_t(0x10000000) myjit.push_uint32_t(0x1337beef) myjit.init_run(run_addr) myjit.continue_run() return myjit.cpu.get_mem(0x10000000, len(data))
class Asm_Test(object): run_addr = 0x0 def __init__(self, jitter_engine): self.myjit = Machine(self.arch_name).jitter(jitter_engine) self.myjit.init_stack() self.myjit.jit.log_regs = False self.myjit.jit.log_mn = False def test_init(self): pass def prepare(self): pass def __call__(self): self.prepare() self.asm() self.init_machine() self.test_init() self.run() self.check() def run(self): self.myjit.init_run(self.run_addr) self.myjit.continue_run() assert (self.myjit.pc == self.ret_addr) def asm(self): blocs, symbol_pool = parse_asm.parse_txt( mn_x86, self.arch_attrib, self.TXT, symbol_pool=self.myjit.ir_arch.symbol_pool) # fix shellcode addr symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0) s = StrPatchwork() patches = asmbloc.asm_resolve_final(mn_x86, blocs, symbol_pool) for offset, raw in patches.items(): s[offset] = raw s = str(s) self.assembly = s def check(self): raise NotImplementedError('abstract method')
class Asm_Test(object): run_addr = 0x0 def __init__(self, jitter_engine): self.myjit = Machine(self.arch_name).jitter(jitter_engine) self.myjit.init_stack() self.myjit.jit.log_regs = False self.myjit.jit.log_mn = False def test_init(self): pass def prepare(self): pass def __call__(self): self.prepare() self.asm() self.init_machine() self.test_init() self.run() self.check() def run(self): self.myjit.init_run(self.run_addr) self.myjit.continue_run() assert(self.myjit.pc == self.ret_addr) def asm(self): blocks, symbol_pool = parse_asm.parse_txt(mn_x86, self.arch_attrib, self.TXT, symbol_pool = self.myjit.ir_arch.symbol_pool) # fix shellcode addr symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0) s = StrPatchwork() patches = asmblock.asm_resolve_final(mn_x86, blocks, symbol_pool) for offset, raw in patches.items(): s[offset] = raw s = str(s) self.assembly = s def check(self): raise NotImplementedError('abstract method')
class Asm_Test(object): def __init__(self, jitter): self.myjit = Machine("mips32l").jitter(jitter) self.myjit.init_stack() self.myjit.jit.log_regs = False self.myjit.jit.log_mn = False def __call__(self): self.asm() self.run() self.check() def asm(self): blocs, symbol_pool = parse_asm.parse_txt( mn_mips32, 'l', self.TXT, symbol_pool=self.myjit.ir_arch.symbol_pool) # fix shellcode addr symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0) s = StrPatchwork() patches = asmbloc.asm_resolve_final(mn_mips32, blocs, symbol_pool) for offset, raw in patches.items(): s[offset] = raw s = str(s) self.assembly = s def run(self): run_addr = 0 self.myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, self.assembly) self.myjit.cpu.RA = 0x1337beef self.myjit.add_breakpoint(0x1337beef, lambda x: False) self.myjit.init_run(run_addr) self.myjit.continue_run() assert (self.myjit.pc == 0x1337beef) def check(self): raise NotImplementedError('abstract method')
class Asm_Test(object): def __init__(self): self.myjit = Machine("x86_32").jitter() self.myjit.init_stack() self.myjit.jit.log_regs = False self.myjit.jit.log_mn = False def __call__(self): self.asm() self.run() self.check() def asm(self): blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, self.TXT, symbol_pool = self.myjit.ir_arch.symbol_pool) # fix shellcode addr symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0) s = StrPatchwork() patches = asmbloc.asm_resolve_final(mn_x86, blocs[0], symbol_pool) for offset, raw in patches.items(): s[offset] = raw s = str(s) self.assembly = s def run(self): run_addr = 0 self.myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, self.assembly) self.myjit.push_uint32_t(0x1337beef) self.myjit.add_breakpoint(0x1337beef, lambda x:False) self.myjit.init_run(run_addr) self.myjit.continue_run() assert(self.myjit.pc == 0x1337beef) def check(self): raise NotImplementedError('abstract method')
class Asm_Test(object): def __init__(self, jitter): self.myjit = Machine("aarch64l").jitter(jitter) self.myjit.init_stack() def __call__(self): self.asm() self.run() self.check() def asm(self): blocks, loc_db = parse_asm.parse_txt(mn_aarch64, 'l', self.TXT, loc_db=self.myjit.ir_arch.loc_db) # fix shellcode addr loc_db.set_location_offset(loc_db.get_name_location("main"), 0x0) s = StrPatchwork() patches = asmblock.asm_resolve_final(mn_aarch64, blocks, loc_db) for offset, raw in patches.items(): s[offset] = raw self.assembly = str(s) def run(self): run_addr = 0 self.myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, self.assembly) self.myjit.cpu.LR = 0x1337beef self.myjit.add_breakpoint(0x1337beef, lambda x: False) self.myjit.init_run(run_addr) self.myjit.continue_run() assert (self.myjit.pc == 0x1337beef) def check(self): raise NotImplementedError('abstract method')
class Asm_Test(object): def __init__(self, jitter): self.myjit = Machine("mips32l").jitter(jitter) self.myjit.init_stack() def __call__(self): self.asm() self.run() self.check() def asm(self): blocks, loc_db = parse_asm.parse_txt(mn_mips32, 'l', self.TXT, loc_db=self.myjit.ir_arch.loc_db) # fix shellcode addr loc_db.set_location_offset(loc_db.get_name_location("main"), 0x0) s = StrPatchwork() patches = asmblock.asm_resolve_final(mn_mips32, blocks, loc_db) for offset, raw in patches.items(): s[offset] = raw s = str(s) self.assembly = s def run(self): run_addr = 0 self.myjit.vm.add_memory_page( run_addr, PAGE_READ | PAGE_WRITE, self.assembly) self.myjit.cpu.RA = 0x1337beef self.myjit.add_breakpoint(0x1337beef, lambda x: False) self.myjit.init_run(run_addr) self.myjit.continue_run() assert(self.myjit.pc == 0x1337beef) def check(self): raise NotImplementedError('abstract method')
execfile(filename) parser = ArgumentParser(description="x86 32 basic Jitter") parser.add_argument("filename", help="x86 32 shellcode filename") parser.add_argument("-j", "--jitter", help="Jitter engine. Possible values are : tcc (default), llvm", default="tcc") args = parser.parse_args() def code_sentinelle(jitter): jitter.run = False jitter.pc = 0 return True myjit = Machine("x86_32").jitter(args.jitter) myjit.init_stack() data = open(args.filename).read() run_addr = 0x40000000 myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, data) myjit.jit.log_regs = True myjit.jit.log_mn = True myjit.push_uint32_t(0x1337beef) myjit.add_breakpoint(0x1337beef, code_sentinelle) myjit.init_run(run_addr) myjit.continue_run()
parser.add_argument( "-j", "--jitter", help="Jitter engine. Possible values are : tcc (default), llvm", default="tcc") args = parser.parse_args() def code_sentinelle(jitter): jitter.run = False jitter.pc = 0 return True myjit = Machine("x86_32").jitter(args.jitter) myjit.init_stack() data = open(args.filename).read() run_addr = 0x40000000 myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, data) myjit.jit.log_regs = True myjit.jit.log_mn = True myjit.push_uint32_t(0x1337beef) myjit.add_breakpoint(0x1337beef, code_sentinelle) myjit.init_run(run_addr) myjit.continue_run() del (myjit)