class Asm_Test(object): run_addr = 0x0 def __init__(self, jitter_engine): self.myjit = Machine(self.arch_name).jitter(jitter_engine) self.myjit.init_stack() def test_init(self): pass def prepare(self): pass def __call__(self): self.prepare() self.asm() self.init_machine() self.test_init() self.run() self.check() def run(self): self.myjit.init_run(self.run_addr) self.myjit.continue_run() assert (self.myjit.pc == self.ret_addr) def asm(self): blocks, loc_db = parse_asm.parse_txt(mn_x86, self.arch_attrib, self.TXT, loc_db=self.myjit.ir_arch.loc_db) # fix shellcode addr loc_db.set_location_offset(loc_db.get_name_location("main"), 0x0) s = StrPatchwork() patches = asmblock.asm_resolve_final(mn_x86, blocks, loc_db) for offset, raw in viewitems(patches): s[offset] = raw s = bytes(s) self.assembly = s def check(self): raise NotImplementedError('abstract method')
class Asm_Test(object): run_addr = 0x0 def __init__(self, jitter_engine): self.myjit = Machine(self.arch_name).jitter(jitter_engine) self.myjit.init_stack() def test_init(self): pass def prepare(self): pass def __call__(self): self.prepare() self.asm() self.init_machine() self.test_init() self.run() self.check() def run(self): self.myjit.init_run(self.run_addr) self.myjit.continue_run() assert(self.myjit.pc == self.ret_addr) def asm(self): blocks, loc_db = parse_asm.parse_txt(mn_x86, self.arch_attrib, self.TXT, loc_db = self.myjit.ir_arch.loc_db) # fix shellcode addr loc_db.set_location_offset(loc_db.get_name_location("main"), 0x0) s = StrPatchwork() patches = asmblock.asm_resolve_final(mn_x86, blocks, loc_db) for offset, raw in viewitems(patches): s[offset] = raw s = bytes(s) self.assembly = s def check(self): raise NotImplementedError('abstract method')
class Asm_Test(object): def __init__(self, jitter): self.myjit = Machine("mips32l").jitter(jitter) self.myjit.init_stack() def __call__(self): self.asm() self.run() self.check() def asm(self): blocks, loc_db = parse_asm.parse_txt(mn_mips32, 'l', self.TXT, loc_db=self.myjit.ir_arch.loc_db) # fix shellcode addr loc_db.set_location_offset(loc_db.get_name_location("main"), 0x0) s = StrPatchwork() patches = asmblock.asm_resolve_final(mn_mips32, blocks, loc_db) for offset, raw in viewitems(patches): s[offset] = raw s = bytes(s) self.assembly = s def run(self): run_addr = 0 self.myjit.vm.add_memory_page( run_addr, PAGE_READ | PAGE_WRITE, self.assembly) self.myjit.cpu.RA = 0x1337beef self.myjit.add_breakpoint(0x1337beef, lambda x: False) self.myjit.init_run(run_addr) self.myjit.continue_run() assert(self.myjit.pc == 0x1337beef) def check(self): raise NotImplementedError('abstract method')
from pdb import pm parser = ArgumentParser(description="x86 32 basic Jitter") parser.add_argument("filename", help="x86 32 shellcode filename") parser.add_argument("-j", "--jitter", help="Jitter engine (default is 'gcc')", default="gcc") args = parser.parse_args() def code_sentinelle(jitter): jitter.run = False jitter.pc = 0 return True myjit = Machine("x86_32").jitter(args.jitter) myjit.init_stack() data = open(args.filename, 'rb').read() run_addr = 0x40000000 myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, data) myjit.set_trace_log() myjit.push_uint32_t(0x1337beef) myjit.add_breakpoint(0x1337beef, code_sentinelle) myjit.init_run(run_addr) myjit.continue_run()
run_addr = 0x40000000 myjit.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, data) # Sentinelle called on terminate def code_sentinelle(jitter): jitter.running = False jitter.pc = 0 return True myjit.push_uint32_t(0x1337beef) myjit.add_breakpoint(0x1337beef, code_sentinelle) # Run myjit.init_run(run_addr) myjit.continue_run() # Check end assert myjit.running is False # Check resulting state / accessors assert myjit.cpu.EAX == 0 assert myjit.cpu.ECX == 4 # Check eval_expr eax = ExprId("RAX", 64)[:32] imm0, imm4, imm4_64 = ExprInt(0, 32), ExprInt(4, 32), ExprInt(4, 64) memdata = ExprMem(ExprInt(run_addr, 32), len(data) * 8) assert myjit.eval_expr(eax) == imm0 ## Due to ExprAssign construction, imm4 is "promoted" to imm4_64