for p in ulst:
log("fkm", fmt % (a,ka,p,kp))
##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)
vm.nr_cr3 = 1
vm.ads = {}
#keep track of every kernel physical pages
vm.kppg = defaultdict(list)
log.setup(info=True, fail=True,
gdb=False, vm=True,
brk=True, evt=False,
fkm=(True,log.blue))
vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, wcr3)
log("info", "ready!")
while len(vm.ads) < vm.nr_cr3:
vm.resume()
vm.detach()
find_kmem(vm)
vm.cpu.set_active_cr3(os.get_process_cr3(), affinity=OSAffinity.Linux26)
log("info", "found break process")
#
# Breakpoints handling
#
#1
vm.cpu.breakpoints.remove()
vm.cpu.breakpoints.add_insn(0x804844b)
vm.cpu.breakpoints.add_insn(0x804846b, lambda x:False)
while vm.resume():
continue
if vm.cpu.gpr.pc != 0x804846b:
log("fail", "failure 1")
vm.detach(leave=True)
log("info", "done 1")
#2
vm.cpu.breakpoints.remove()
vm.cpu.breakpoints.add_insn(0x8048483)
vm.resume()
vm.singlestep()
if vm.cpu.gpr.pc != 0x8048485:
log("fail", "failure 2")
vm.detach(leave=True)
log("info", "done 2")
#3
process_name = sys.argv[1]
# Some offsets for debian 2.6.32-5-486 kernel
settings = {
"thread_size": 8192,
"comm": 540,
"next": 240,
"mm": 268,
"pgd": 36
}
os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter(process_name)
##
## Main
##
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)
vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, hook)
while not vm.resume():
continue
vm.cpu.release_write_cr(3)
vm.cpu.set_active_cr3(os.get_process_cr3(), True, OSAffinity.Linux26)
log("info", "active cr3 installed for %#x" % os.get_process_cr3())
vm.detach()
vm.cpu.set_active_cr3(os.get_process_cr3(), affinity=OSAffinity.Linux26)
log("info", "found break process")
#
# Breakpoints handling
#
#1
vm.cpu.breakpoints.remove()
vm.cpu.breakpoints.add_insn(0x804844b)
vm.cpu.breakpoints.add_insn(0x804846b, lambda x: False)
while vm.resume():
continue
if vm.cpu.gpr.pc != 0x804846b:
log("fail", "failure 1")
vm.detach(leave=True)
log("info", "done 1")
#2
vm.cpu.breakpoints.remove()
vm.cpu.breakpoints.add_insn(0x8048483)
vm.resume()
vm.singlestep()
if vm.cpu.gpr.pc != 0x8048485:
log("fail", "failure 2")
vm.detach(leave=True)
log("info", "done 2")
#3
