コード例 #1
0
ファイル: findref.py プロジェクト: commial/Sibyl
    def run(self):
        '''Main function that is in charge of running the test and return the result:
        true if the snapshot has recognized the function, false else.'''

        # TODO inherit from Replay
        jitter = self.machine.jitter(config.miasm_engine)

        vm_load_elf(jitter.vm, open(self.filename, "rb").read())

        # Init segment
        jitter.ir_arch.do_stk_segm = True
        jitter.ir_arch.do_ds_segm = True
        jitter.ir_arch.do_str_segm = True
        jitter.ir_arch.do_all_segm = True

        FS_0_ADDR = 0x7ff70000
        jitter.cpu.FS = 0x4
        jitter.cpu.set_segm_base(jitter.cpu.FS, FS_0_ADDR)
        jitter.vm.add_memory_page(FS_0_ADDR + 0x28, PAGE_READ,
                                  "\x42\x42\x42\x42\x42\x42\x42\x42",
                                  "Stack canary FS[0x28]")

        # Init the jitter with the snapshot
        self.use_snapshot(jitter)

        # Get the return address for our breakpoint
        return_addr = struct.unpack("P",
                                    jitter.vm.get_mem(jitter.cpu.RSP, 0x8))[0]
        jitter.add_breakpoint(return_addr, self.end_func)

        # Prepare the execution
        jitter.init_run(self.learned_addr)
        self.prepare_symbexec(jitter, return_addr)

        # Run the execution
        try:
            jitter.continue_run()
            assert jitter.run == False
        except AssertionError:
            if jitter.vm.get_exception() & EXCEPT_ACCESS_VIOL:
                self.replayexception += ["access violation"]
            elif jitter.vm.get_exception() & EXCEPT_DIV_BY_ZERO:
                self.replayexception += ["division by zero"]
            elif jitter.vm.get_exception() & EXCEPT_PRIV_INSN:
                self.replayexception += ["execution of private instruction"]
            elif jitter.vm.get_exception():
                self.replayexception += [
                    "exception no %i" % (jitter.vm.get_exception())
                ]
            else:
                raise
            self.isFuncFound = False

        # Rebuild references
        self.build_references()

        return self.isFuncFound
コード例 #2
0
ファイル: findref.py プロジェクト: serpilliere/Sibyl
    def run(self):
        '''Main function that is in charge of running the test and return the result:
        true if the snapshot has recognized the function, false else.'''

        # TODO inherit from Replay
        jitter = self.machine.jitter(config.miasm_engine)

        vm_load_elf(jitter.vm, open(self.filename, "rb").read())

        # Init segment
        jitter.ir_arch.do_stk_segm = True
        jitter.ir_arch.do_ds_segm = True
        jitter.ir_arch.do_str_segm = True
        jitter.ir_arch.do_all_segm = True

        FS_0_ADDR = 0x7ff70000
        jitter.cpu.FS = 0x4
        jitter.cpu.set_segm_base(jitter.cpu.FS, FS_0_ADDR)
        jitter.vm.add_memory_page(
            FS_0_ADDR + 0x28, PAGE_READ, "\x42\x42\x42\x42\x42\x42\x42\x42", "Stack canary FS[0x28]")

        # Init the jitter with the snapshot
        self.use_snapshot(jitter)

        # Get the return address for our breakpoint
        return_addr = struct.unpack("P", jitter.vm.get_mem(jitter.cpu.RSP,
                                                           0x8))[0]
        jitter.add_breakpoint(return_addr, self.end_func)

        # Prepare the execution
        jitter.init_run(self.learned_addr)
        self.prepare_symbexec(jitter, return_addr)

        # Run the execution
        try:
            jitter.continue_run()
            assert jitter.run == False
        except AssertionError:
            if jitter.vm.get_exception() & EXCEPT_ACCESS_VIOL:
                self.replayexception += ["access violation"]
            elif jitter.vm.get_exception() & EXCEPT_DIV_BY_ZERO:
                self.replayexception += ["division by zero"]
            elif jitter.vm.get_exception() & EXCEPT_PRIV_INSN:
                self.replayexception += ["execution of private instruction"]
            elif jitter.vm.get_exception():
                self.replayexception += ["exception no %i" % (jitter.vm.get_exception())]
            else:
                raise
            self.isFuncFound = False

        # Rebuild references
        self.build_references()

        return self.isFuncFound
コード例 #3
0
ファイル: replay.py プロジェクト: graux-pierre/Sibyl
    def run(self):
        '''Main function that is in charge of running the test and return the result:
        true if the snapshot has recognized the function, false else.'''

        # Retrieve miasm tools
        jitter = self.machine.jitter("gcc")

        vm_load_elf(jitter.vm, open(self.filename, "rb").read())

        # Init segment
        jitter.ir_arch.do_stk_segm = True
        jitter.ir_arch.do_ds_segm = True
        jitter.ir_arch.do_str_segm = True
        jitter.ir_arch.do_all_segm = True

        FS_0_ADDR = 0x7ff70000
        jitter.cpu.FS = 0x4
        jitter.cpu.set_segm_base(jitter.cpu.FS, FS_0_ADDR)
        jitter.vm.add_memory_page(FS_0_ADDR + 0x28, PAGE_READ,
                                  "\x42\x42\x42\x42\x42\x42\x42\x42",
                                  "Stack canary FS[0x28]")

        # Init the jitter with the snapshot
        self.use_snapshot(jitter)

        # Change the return address to our breakpoint
        jitter.vm.set_mem(jitter.cpu.RSP, struct.pack("P", 0x1337BEEF))
        # jitter.push_uint64_t(0x1337BEEF)
        jitter.add_breakpoint(0x1337BEEF, self.end_func)

        # Run the execution
        jitter.init_run(self.learned_addr)

        try:
            jitter.continue_run()
            assert jitter.run == False
        except AssertionError:
            if jitter.vm.get_exception() & EXCEPT_ACCESS_VIOL:
                self.replayexception += ["access violation"]
            elif jitter.vm.get_exception() & EXCEPT_DIV_BY_ZERO:
                self.replayexception += ["division by zero"]
            elif jitter.vm.get_exception() & EXCEPT_PRIV_INSN:
                self.replayexception += ["execution of private instruction"]
            else:
                self.replayexception += [
                    "exception no %i" % (jitter.vm.get_exception())
                ]
            self.isFuncFound = False

        return self.isFuncFound
コード例 #4
0
    def __init__(self, custom_methods, *args, **kwargs):
        from miasm2.jitter.loader.elf import vm_load_elf, preload_elf, libimp_elf
        from miasm2.os_dep import linux_stdlib
        methods = linux_stdlib.__dict__
        methods.update(custom_methods)

        super(OS_Linux, self).__init__(methods, *args, **kwargs)

        # Import manager
        self.libs = libimp_elf()

        with open(self.fname, "rb") as fstream:
            self.elf = vm_load_elf(self.jitter.vm,
                                   fstream.read(),
                                   name=self.fname,
                                   **kwargs)
        preload_elf(self.jitter.vm, self.elf, self.libs)

        self.entry_point = self.elf.Ehdr.entry

        # Library calls handler
        self.jitter.add_lib_handler(self.libs, methods)
        linux_stdlib.ABORT_ADDR = self.CALL_FINISH_ADDR

        # Arguments
        self.argv = [self.PROGRAM_PATH]
        if self.options.command_line:
            self.argv += self.options.command_line
        self.envp = self.options.environment_vars
コード例 #5
0
ファイル: sandbox.py プロジェクト: carolineLe/miasm
    def __init__(self, custom_methods, *args, **kwargs):
        from miasm2.jitter.loader.elf import vm_load_elf, preload_elf, libimp_elf
        from miasm2.os_dep import linux_stdlib
        methods = linux_stdlib.__dict__
        methods.update(custom_methods)

        super(OS_Linux, self).__init__(methods, *args, **kwargs)

        # Import manager
        self.libs = libimp_elf()

        with open(self.fname) as fstream:
            self.elf = vm_load_elf(self.jitter.vm, fstream.read(),
                                   name=self.fname, **kwargs)
        preload_elf(self.jitter.vm, self.elf, self.libs)

        self.entry_point = self.elf.Ehdr.entry

        # Library calls handler
        self.jitter.add_lib_handler(self.libs, methods)

        # Arguments
        self.argv = [self.PROGRAM_PATH]
        if self.options.command_line:
             self.argv += self.options.command_line
        self.envp = self.options.environment_vars
コード例 #6
0
    def do_trace(self):
        '''Run miasm and construct the trace'''

        self.trace = Trace()

        # Retrieve miasm tools
        machine = Machine(self.machine)
        jitter = machine.jitter("python")

        # Set the jitter to use our custom emulator
        jitter.jit.symbexec = CustomEmulatedSymbExec(jitter.cpu, jitter.vm,
                                                     jitter.jit.ir_arch, {})
        jitter.jit.symbexec.enable_emulated_simplifications()
        jitter.jit.symbexec.reset_regs()

        elf = vm_load_elf(jitter.vm, open(self.program, "rb").read())

        # Init segment
        jitter.ir_arch.do_stk_segm = True
        jitter.ir_arch.do_ds_segm = True
        jitter.ir_arch.do_str_segm = True
        jitter.ir_arch.do_all_segm = True

        FS_0_ADDR = 0x7ff70000
        jitter.cpu.FS = 0x4
        jitter.cpu.set_segm_base(jitter.cpu.FS, FS_0_ADDR)
        jitter.vm.add_memory_page(FS_0_ADDR + 0x28, PAGE_READ,
                                  "\x42\x42\x42\x42\x42\x42\x42\x42")

        # Init stack and push main args
        jitter.init_stack()
        jitter.push_uint64_t(1)
        jitter.vm.add_memory_page(0x800000, PAGE_READ, self.program)
        jitter.push_uint64_t(0x800000)
        jitter.push_uint64_t(0xDEADDEAD)

        jitter.add_breakpoint(0xDEADDEAD, self.end_do_trace)
        jitter.add_breakpoint(0x1337beef, self.end_func)
        jitter.add_breakpoint(self.address, self.begin_func)

        # Run the execution
        if self.main_address is None:
            jitter.init_run(elf.Ehdr.entry)
        else:
            jitter.init_run(self.main_address)

        for addr, info in jitter.vm.get_all_memory().iteritems():
            self.segments += [(addr, addr + info['size'])]

        jitter.continue_run()
        assert jitter.run == False
        return self.trace
コード例 #7
0
ファイル: miasm.py プロジェクト: cea-sec/Sibyl
    def do_trace(self):
        '''Run miasm and construct the trace'''

        self.trace = Trace()

        # Retrieve miasm tools
        machine = Machine(self.machine)
        jitter = machine.jitter("python")

        # Set the jitter to use our custom emulator
        jitter.jit.symbexec = CustomEmulatedSymbExec(
            jitter.cpu, jitter.vm, jitter.jit.ir_arch, {})
        jitter.jit.symbexec.enable_emulated_simplifications()
        jitter.jit.symbexec.reset_regs()

        elf = vm_load_elf(jitter.vm, open(self.program, "rb").read())

        # Init segment
        jitter.ir_arch.do_stk_segm = True
        jitter.ir_arch.do_ds_segm = True
        jitter.ir_arch.do_str_segm = True
        jitter.ir_arch.do_all_segm = True

        FS_0_ADDR = 0x7ff70000
        jitter.cpu.FS = 0x4
        jitter.cpu.set_segm_base(jitter.cpu.FS, FS_0_ADDR)
        jitter.vm.add_memory_page(
            FS_0_ADDR + 0x28, PAGE_READ, "\x42\x42\x42\x42\x42\x42\x42\x42")

        # Init stack and push main args
        jitter.init_stack()
        jitter.push_uint64_t(1)
        jitter.vm.add_memory_page(0x800000, PAGE_READ, self.program)
        jitter.push_uint64_t(0x800000)
        jitter.push_uint64_t(0xDEADDEAD)

        jitter.add_breakpoint(0xDEADDEAD, self.end_do_trace)
        jitter.add_breakpoint(0x1337beef, self.end_func)
        jitter.add_breakpoint(self.address, self.begin_func)

        # Run the execution
        if self.main_address is None:
            jitter.init_run(elf.Ehdr.entry)
        else:
            jitter.init_run(self.main_address)

        jitter.continue_run()
        assert jitter.run == False
        return self.trace
コード例 #8
0
ファイル: sandbox.py プロジェクト: 8l/miasm
    def __init__(self, custom_methods, *args, **kwargs):
        from miasm2.jitter.loader.elf import vm_load_elf, preload_elf

        super(OS_Linux, self).__init__(custom_methods, *args, **kwargs)

        # Import manager
        libs = libimp()
        self.libs = libs

        elf = vm_load_elf(self.jitter.vm, self.fname)
        self.elf = elf
        preload_elf(self.jitter.vm, elf, libs)

        # Library calls handler
        self.jitter.add_lib_handler(libs, custom_methods)
コード例 #9
0
ファイル: binary.py プロジェクト: Lukas-Dresel/miasm
    def parse(self, data, vm=None):
        from miasm2.jitter.loader.elf import vm_load_elf, guess_arch
        from elfesteem import elf_init

        # Parse signature
        if not data.startswith('\x7fELF'):
            raise ContainerSignatureException()

        # Build executable instance
        try:
            if vm is not None:
                self._executable = vm_load_elf(vm, data)
            else:
                self._executable = elf_init.ELF(data)
        except Exception, error:
            raise ContainerParsingException('Cannot read ELF: %s' % error)
コード例 #10
0
ファイル: binary.py プロジェクト: simudream/miasm
    def parse(self, data, vm=None):
        from miasm2.jitter.loader.elf import vm_load_elf, guess_arch
        from elfesteem import elf_init

        # Parse signature
        if not data.startswith('\x7fELF'):
            raise ContainerSignatureException()

        # Build executable instance
        try:
            if vm is not None:
                self._executable = vm_load_elf(vm, data)
            else:
                self._executable = elf_init.ELF(data)
        except Exception, error:
            raise ContainerParsingException('Cannot read ELF: %s' % error)
コード例 #11
0
ファイル: sandbox.py プロジェクト: wflk/miasm
    def __init__(self, custom_methods, *args, **kwargs):
        from miasm2.jitter.loader.elf import vm_load_elf, preload_elf, libimp_elf
        from miasm2.os_dep import linux_stdlib
        methods = linux_stdlib.__dict__
        methods.update(custom_methods)

        super(OS_Linux, self).__init__(methods, *args, **kwargs)

        # Import manager
        self.libs = libimp_elf()

        with open(self.fname) as fstream:
            self.elf = vm_load_elf(self.jitter.vm, fstream.read(), **kwargs)
        preload_elf(self.jitter.vm, self.elf, self.libs)

        self.entry_point = self.elf.Ehdr.entry

        # Library calls handler
        self.jitter.add_lib_handler(self.libs, methods)
コード例 #12
0
ファイル: sandbox.py プロジェクト: 0xDEC0DE8/miasm
    def __init__(self, custom_methods, *args, **kwargs):
        from miasm2.jitter.loader.elf import vm_load_elf, preload_elf, libimp_elf
        from miasm2.os_dep import linux_stdlib
        methods = linux_stdlib.__dict__
        methods.update(custom_methods)

        super(OS_Linux, self).__init__(methods, *args, **kwargs)

        # Import manager
        self.libs = libimp_elf()

        with open(self.fname) as fstream:
            self.elf = vm_load_elf(self.jitter.vm, fstream.read(), **kwargs)
        preload_elf(self.jitter.vm, self.elf, self.libs)

        self.entry_point = self.elf.Ehdr.entry

        # Library calls handler
        self.jitter.add_lib_handler(self.libs, methods)