コード例 #1
0
def cafter(instruction):

    # movzx esi,BYTE PTR [rax]
    # RAX points on the user password
    if instruction.address == 0x400572:
        rsiId = getRegSymbolicID(IDREF.REG.RSI)
        convertExprToSymVar(rsiId, 64)

    # mov eax,DWORD PTR [rbp-0x4]
    # RAX must be equal to 0xad6d to win
    if instruction.address == 0x4005c5:
        print '[+] Please wait, computing in progress...'
        raxId = getRegSymbolicID(IDREF.REG.RAX)
        raxExpr = getFullExpression(getSymExpr(raxId).getAst())

        # We want printable characters
        expr = smt2lib.compound([
                 smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_0'), smt2lib.bv(96,  64))),
                 smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_0'), smt2lib.bv(123, 64))),
                 smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_1'), smt2lib.bv(96,  64))),
                 smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_1'), smt2lib.bv(123, 64))),
                 smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_2'), smt2lib.bv(96,  64))),
                 smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_2'), smt2lib.bv(123, 64))),
                 smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_3'), smt2lib.bv(96,  64))),
                 smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_3'), smt2lib.bv(123, 64))),
                 smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_4'), smt2lib.bv(96,  64))),
                 smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_4'), smt2lib.bv(123, 64))),
                 smt2lib.smtAssert(smt2lib.equal(raxExpr, smt2lib.bv(0xad6d, 64)))  # collision: (assert (= rax 0xad6d)
               ])

        # Get max 20 different models
        models = getModels(expr, 20)
        for model in models:
            print {k: "0x%x, '%c'" % (v, v) for k, v in model.items()}
コード例 #2
0
ファイル: crackme_xor_obfu.py プロジェクト: shadown/Triton
def cafter(instruction):

    print '%#x: %s' %(instruction.address, instruction.assembly)

    # [R:1]  0x400798: movsx eax, byte ptr [rcx+rax*1]  R:0x7fffb63d610a: 41 (0x41)
    # [W:8]  0x40079c: mov qword ptr [rbp-0x50], rax    W:0x7fffb63d52b0: 41 00 00 00 00 00 00 00 (0x41)
    # [R:8]  0x400891: mov rax, qword ptr [rbp-0x50]    R:0x7fffb63d52b0: 41 00 00 00 00 00 00 00 (0x41)
    if instruction.address == 0x400891:
        raxId = getRegSymbolicID(IDREF.REG.RAX)
        convertExprToSymVar(raxId, 64)

    if instruction.address == 0x400b69:
        zfId = getRegSymbolicID(IDREF.FLAG.ZF)
        zfExpr = getFullExpression(getSymExpr(zfId).ast)
        expr = smt2lib.compound([
                 smt2lib.smtAssert(smt2lib.bvugt(smt2lib.string('SymVar_0'), smt2lib.bv(96, 64))),    # printable char
                 smt2lib.smtAssert(smt2lib.bvult(smt2lib.string('SymVar_0'), smt2lib.bv(123, 64))),   # printable char
                 smt2lib.smtAssert(smt2lib.equal(zfExpr, smt2lib.bvtrue()))                           # (assert (= zf true)
               ])
        print getModel(expr)

    return