def decompile(self):
self.is_dump = False
self.gph, pe_nb_new_syms = self.gctx.dis.get_graph(self.entry)
if self.gph is None:
error("capstone can't disassemble here")
return None
self.gph.simplify()
if self.gctx.db.loaded and pe_nb_new_syms:
self.gctx.db.modified = True
try:
self.gph.loop_detection(self.entry)
ast, correctly_ended = generate_ast(self)
if not correctly_ended:
debug__("Second try...")
self.gph.loop_detection(self.entry, True)
ast, _ = generate_ast(self)
self.ast = ast
except ExcIfelse as e:
error("can't have a ifelse here %x" % e.addr)
if self.gctx.interactive_mode:
return None
die()
o = self.gctx.libarch.output.Output(self)
o._ast(self.entry, ast)
self.output = o
return o
def __exec_save(self, args):
if self.gctx.dis is None:
error("load a file before")
return
self.gctx.db.save(self.rl.history)
print("database saved to", self.gctx.db.path)
self.gctx.db.modified = False
def __exec_save(self, args):
if self.gctx.dis is None:
error("load a file before")
return
self.gctx.db.save(self.rl.history)
print("database saved to", self.gctx.db.path)
self.gctx.db.modified = False
def decompile(self):
self.is_dump = False
self.gph, pe_nb_new_syms = self.gctx.dis.get_graph(self.entry)
if self.gph is None:
error("capstone can't disassemble here")
return None
self.gph.simplify()
if self.gctx.db.loaded and pe_nb_new_syms:
self.gctx.db.modified = True
try:
self.gph.loop_detection(self.entry)
ast, correctly_ended = generate_ast(self)
if not correctly_ended:
debug__("Second try...")
self.gph.loop_detection(self.entry, True)
ast, _ = generate_ast(self)
self.ast = ast
except ExcIfelse as e:
error("can't have a ifelse here %x" % e.addr)
if self.gctx.interactive_mode:
return None
die()
o = self.gctx.libarch.output.Output(self)
o._ast(self.entry, ast)
self.output = o
return o
def __exec_data(self, args):
if self.gctx.dis is None:
error("load a file before")
return
nb_lines = self.gctx.nb_lines
if len(args) <= 1:
self.gctx.entry = None
error("no address in parameter")
return
if len(args) == 3:
try:
nb_lines = int(args[2])
except:
pass
ctx = self.gctx.get_addr_context(args[1])
if ctx:
if args[0] == "da":
self.gctx.dis.dump_data_ascii(ctx, nb_lines)
elif args[0] == "db":
self.gctx.dis.dump_data(ctx, nb_lines, 1)
elif args[0] == "dw":
self.gctx.dis.dump_data(ctx, nb_lines, 2)
elif args[0] == "dd":
self.gctx.dis.dump_data(ctx, nb_lines, 4)
elif args[0] == "dq":
self.gctx.dis.dump_data(ctx, nb_lines, 8)
def __exec_data(self, args):
if self.gctx.dis is None:
error("load a file before")
return
nb_lines = self.gctx.nb_lines
if len(args) <= 1:
self.gctx.entry = None
error("no address in parameter")
return
if len(args) == 3:
try:
nb_lines = int(args[2])
except:
pass
ctx = self.gctx.get_addr_context(args[1])
if ctx:
if args[0] == "da":
self.gctx.dis.dump_data_ascii(ctx, nb_lines)
elif args[0] == "db":
self.gctx.dis.dump_data(ctx, nb_lines, 1)
elif args[0] == "dw":
self.gctx.dis.dump_data(ctx, nb_lines, 2)
elif args[0] == "dd":
self.gctx.dis.dump_data(ctx, nb_lines, 4)
elif args[0] == "dq":
self.gctx.dis.dump_data(ctx, nb_lines, 8)
def __exec_mips_set_gp(self, args):
try:
self.gctx.dis.mips_gp = int(args[1], 16)
self.db.mips_gp = self.gctx.dis.mips_gp
except:
error("bad address")
self.db.modified = True
def __exec_lrawmips64(self, args):
if self.check_db_modified():
return
if len(args) != 2:
error("filename required")
return
self.gctx.raw_type = "mips64"
if self.gctx.load_file(args[1]):
self.analyzer.set(self.gctx.dis, self.gctx.db)
def __exec_lrawmips64(self, args):
if self.check_db_modified():
return
if len(args) != 2:
error("filename required")
return
self.gctx.raw_type = "mips64"
if self.gctx.load_file(args[1]):
self.analyzer.set(self.gctx.dis, self.gctx.db)
def __exec_lrawx86(self, args):
if self.check_db_modified():
return
if len(args) != 2:
error("filename required")
return
self.gctx.raw_type = "x86"
self.gctx.raw_big_endian = False
if self.gctx.load_file(args[1]):
self.analyzer.set(self.gctx.dis, self.gctx.db)
def __exec_xrefs(self, args):
if self.gctx.dis is None:
error("load a file before")
return
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
if ctx.entry not in self.gctx.dis.xrefs:
return
ctx.dump_xrefs().print()
def __exec_xrefs(self, args):
if self.gctx.dis is None:
error("load a file before")
return
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
if ctx.entry not in self.gctx.dis.xrefs:
return
ctx.dump_xrefs().print()
def __exec_sections(self, args):
if self.gctx.dis is None:
error("load a file before")
return
self.rl.print("NAME".ljust(20))
self.rl.print(" [ START - END - VIRTUAL_SIZE - RAW_SIZE ]\n")
for s in self.gctx.dis.binary.iter_sections():
s.print_header()
def __exec_v(self, args):
if self.gctx.dis is None:
error("load a file before")
return
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
o = ctx.dump_asm(NB_LINES_TO_DISASM)
if o is not None:
Visual(self.gctx, ctx, self.analyzer)
def __exec_sections(self, args):
if self.gctx.dis is None:
error("load a file before")
return
self.rl.print("NAME".ljust(20))
self.rl.print(" [ START - END - VIRTUAL_SIZE - RAW_SIZE ]\n")
for s in self.gctx.dis.binary.iter_sections():
s.print_header()
def __exec_v(self, args):
if self.gctx.dis is None:
error("load a file before")
return
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
o = ctx.dump_asm(NB_LINES_TO_DISASM)
if o is not None:
Visual(self.gctx, ctx, self.analyzer)
def __exec_lrawx86(self, args):
if self.check_db_modified():
return
if len(args) != 2:
error("filename required")
return
self.gctx.raw_type = "x86"
self.gctx.raw_big_endian = False
if self.gctx.load_file(args[1]):
self.analyzer.set(self.gctx.dis, self.gctx.db)
def __exec_load(self, args):
# TODO: kill the thread analyzer before loading a new file
if self.check_db_modified():
return
if len(args) != 2:
error("filename required")
return
self.gctx.raw_type = None
if self.gctx.load_file(args[1]):
self.rl.history = self.gctx.db.history
self.push_analyze_symbols()
def __exec_load(self, args):
# TODO: kill the thread analyzer before loading a new file
if self.check_db_modified():
return
if len(args) != 2:
error("filename required")
return
self.gctx.raw_type = None
if self.gctx.load_file(args[1]):
self.rl.history = self.gctx.db.history
self.push_analyze_symbols()
def __exec_mips_set_gp(self, args):
if self.gctx.dis is None:
error("load a file before")
return
try:
self.gctx.dis.mips_gp = int(args[1], 16)
self.gctx.db.mips_gp = self.gctx.dis.mips_gp
except:
error("bad address")
self.gctx.db.modified = True
def __exec_mips_set_gp(self, args):
if self.gctx.dis is None:
error("load a file before")
return
try:
self.gctx.dis.mips_gp = int(args[1], 16)
self.gctx.db.mips_gp = self.gctx.dis.mips_gp
except:
error("bad address")
self.gctx.db.modified = True
def exec_command(self, line):
args = shlex.split(line)
if args[0] not in self.COMMANDS:
error("unknown command")
return
c = self.COMMANDS[args[0]]
if len(args) - 1 > c.max_args:
error("%s takes max %d args" % (args[0], c.max_args))
return
if c.callback_exec is not None:
c.callback_exec(args)
def exec_command(self, line):
args = shlex.split(line)
if args[0] not in self.COMMANDS:
error("unknown command")
return
c = self.COMMANDS[args[0]]
if len(args)-1 > c.max_args:
error("%s takes max %d args" % (args[0], c.max_args))
return
if c.callback_exec is not None:
c.callback_exec(args)
def __exec_x(self, args):
if self.gctx.dis is None:
error("load a file before")
return
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
try:
o = ctx.decompile()
if o is not None:
o.print()
except:
traceback.print_exc()
def __exec_x(self, args):
if self.gctx.dis is None:
error("load a file before")
return
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
try:
o = ctx.decompile()
if o is not None:
o.print()
except:
traceback.print_exc()
def __exec_dump(self, args):
if self.gctx.dis is None:
error("load a file before")
return
nb_lines = self.gctx.nb_lines
if len(args) == 3:
try:
nb_lines = int(args[2])
except:
pass
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
ctx.dump_asm(nb_lines).print()
def __exec_dump(self, args):
if self.gctx.dis is None:
error("load a file before")
return
nb_lines = self.gctx.nb_lines
if len(args) == 3:
try:
nb_lines = int(args[2])
except:
pass
ad = None if len(args) == 1 else args[1]
ctx = self.gctx.get_addr_context(ad)
if ctx:
ctx.dump_asm(nb_lines).print()
def __exec_jmptable(self, args):
try:
inst_addr = int(args[1], 16)
table_addr = int(args[2], 16)
nb_entries = int(args[3])
entry_size = int(args[4])
except:
error("one parameter is invalid, be sure that addresses start with 0x")
return
if entry_size not in [2, 4, 8]:
error("error the entry size should be in [2, 4, 8]")
return
self.db.modified = True
self.api.create_jmptable(inst_addr, table_addr, entry_size, nb_entries)
def __exec_hexdump(self, args):
nb_lines = self.gctx.nb_lines
if len(args) <= 1:
self.gctx.entry = None
error("no address in parameter")
return
if len(args) == 3:
try:
nb_lines = int(args[2])
except:
pass
ctx = self.gctx.get_addr_context(args[1])
if ctx:
self.gctx.dis.hexdump(ctx, nb_lines)
def __exec_jmptable(self, args):
if self.gctx.dis is None:
error("load a file before")
return
try:
inst_addr = int(args[1], 16)
table_addr = int(args[2], 16)
nb_entries = int(args[3])
entry_size = int(args[4])
except:
error(
"one parameter is invalid, be sure that addresses start with 0x"
)
return
if entry_size not in [2, 4, 8]:
error("error the entry size should be in [2, 4, 8]")
return
self.gctx.db.modified = True
self.gctx.dis.add_jmptable(inst_addr, table_addr, entry_size,
nb_entries)
queue_wait_analyzer = Queue()
# Re-run the analyzer
func_id = self.gctx.dis.mem.get_func_id(inst_addr)
if func_id == -1:
self.analyzer.msg.put(
(inst_addr, False, True, queue_wait_analyzer))
else:
ad = self.gctx.dis.func_id[func_id]
self.analyzer.msg.put((ad, True, True, queue_wait_analyzer))
queue_wait_analyzer.get()
def __exec_jmptable(self, args):
if self.gctx.dis is None:
error("load a file before")
return
try:
inst_addr = int(args[1], 16)
table_addr = int(args[2], 16)
nb_entries = int(args[3])
entry_size = int(args[4])
except:
error(
"one parameter is invalid, be sure that addresses start with 0x"
)
return
if entry_size not in [2, 4, 8]:
error("error the entry size should be in [2, 4, 8]")
return
self.gctx.db.modified = True
self.gctx.dis.add_jmptable(inst_addr, table_addr, entry_size,
nb_entries)
# TODO: it will be better to start from the beginning of the function
# end-function may differ.
# Re-run the analyzer
self.analyzer.msg.put((inst_addr, False, None))
def __exec_jmptable(self, args):
if self.gctx.dis is None:
error("load a file before")
return
try:
inst_addr = int(args[1], 16)
table_addr = int(args[2], 16)
nb_entries = int(args[3])
entry_size = int(args[4])
except:
error("one parameter is invalid, be sure that addresses start with 0x")
return
if entry_size not in [2, 4, 8]:
error("error the entry size should be in [2, 4, 8]")
return
self.gctx.db.modified = True
self.gctx.dis.add_jmptable(inst_addr, table_addr, entry_size, nb_entries)
queue_wait_analyzer = Queue()
# Re-run the analyzer
func_id = self.gctx.dis.mem.get_func_id(inst_addr)
if func_id == -1:
self.analyzer.msg.put((inst_addr, False, True, queue_wait_analyzer))
else:
ad = self.gctx.dis.func_id[func_id]
self.analyzer.msg.put((ad, True, True, queue_wait_analyzer))
queue_wait_analyzer.get()
def init_address(self, entry):
if isinstance(entry, int):
self.entry = entry
return True
if entry == "EP":
self.entry = self.gctx.dis.binary.get_entry_point()
return True
if entry is None:
if self.gctx.raw_type is not None:
self.entry = 0
return True
self.entry = self.gctx.db.symbols.get("main", None) or \
self.gctx.db.symbols.get("_main", None)
if self.entry is None:
error("symbol main or _main not found")
if self.gctx.interactive_mode:
return False
die()
return True
is_hexa = entry.startswith("0x")
if not is_hexa and self.gctx.api.is_reserved_prefix(entry):
entry = entry[entry.index("_") + 1:]
is_hexa = True
if is_hexa:
try:
self.entry = int(entry, 16)
except:
error("bad hexa string %s" % entry)
if self.gctx.interactive_mode:
return False
die()
return True
self.entry = self.gctx.db.demangled.get(entry, None) or \
self.gctx.db.symbols.get(entry, None) or \
self.gctx.dis.binary.section_names.get(entry, None)
if self.entry is None:
error("symbol %s not found" % entry)
if self.gctx.interactive_mode:
return False
die()
return True
def init_address(self, entry):
if isinstance(entry, int):
self.entry = entry
return True
if entry == "EP":
self.entry = self.gctx.dis.binary.get_entry_point()
return True
if entry is None:
if self.gctx.raw_type is not None:
self.entry = 0
return True
self.entry = self.gctx.db.symbols.get("main", None) or \
self.gctx.db.symbols.get("_main", None)
if self.entry is None:
error("symbol main or _main not found")
if self.gctx.interactive_mode:
return False
die()
return True
is_hexa = entry.startswith("0x")
if not is_hexa and self.gctx.api.is_reserved_prefix(entry):
entry = entry[entry.index("_") + 1:]
is_hexa = True
if is_hexa:
try:
self.entry = int(entry, 16)
except:
error("bad hexa string %s" % entry)
if self.gctx.interactive_mode:
return False
die()
return True
self.entry = self.gctx.db.demangled.get(entry, None) or \
self.gctx.db.symbols.get(entry, None) or \
self.gctx.dis.binary.section_names.get(entry, None)
if self.entry is None:
error("symbol %s not found" % entry)
if self.gctx.interactive_mode:
return False
die()
return True
def init_address(self, entry):
if isinstance(entry, int):
self.entry = entry
return True
if entry == "EP":
self.entry = self.gctx.dis.binary.get_entry_point()
return True
if entry is None:
if self.gctx.raw_type is not None:
self.entry = 0
return True
self.entry = self.gctx.dis.binary.symbols.get("main", None) or self.gctx.dis.binary.symbols.get(
"_main", None
)
if self.entry is None:
error("symbol main or _main not found")
if self.gctx.interactive_mode:
return False
die()
return True
is_hexa = entry.startswith("0x")
if not is_hexa and entry[:4] in RESERVED_PREFIX:
entry = entry[4:]
is_hexa = True
if is_hexa:
try:
self.entry = int(entry, 16)
except:
error("bad hexa string %s" % entry)
if self.gctx.interactive_mode:
return False
die()
return True
self.entry = self.gctx.dis.binary.symbols.get(entry, None) or self.gctx.dis.binary.section_names.get(
entry, None
)
if self.entry is None:
error("symbol %s not found" % entry)
if self.gctx.interactive_mode:
return False
die()
return True
def __exec_jmptable(self, args):
if self.gctx.dis is None:
error("load a file before")
return
try:
inst_addr = int(args[1], 16)
table_addr = int(args[2], 16)
nb_entries = int(args[3])
entry_size = int(args[4])
except:
error("one parameter is invalid, be sure that addresses start with 0x")
return
if entry_size not in [2, 4, 8]:
error("error the entry size should be in [2, 4, 8]")
return
self.gctx.db.modified = True
self.gctx.dis.add_jmptable(inst_addr, table_addr, entry_size, nb_entries)
# TODO: it will be better to start from the beginning of the function
# end-function may differ.
# Re-run the analyzer
self.analyzer.msg.put((inst_addr, False, None))
def __exec_sym(self, args):
if self.gctx.dis is None:
error("load a file before")
return
if len(args) == 1:
self.gctx.dis.print_symbols(self.gctx.sectionsname)
return
if args[1][0] == "|":
if len(args) == 2 or len(args) > 3:
error("bad arguments (warn: need spaces between |)")
return
self.gctx.dis.print_symbols(self.gctx.sectionsname, args[2])
return
if len(args) > 3:
error("bad arguments")
return
if len(args) == 2:
error("an address is required to save the symbol")
return
if not args[2].startswith("0x"):
error("the address should starts with 0x")
return
if args[1].startswith("loc_"):
error("loc_ is a reserved prefix")
return
# Save new symbol
try:
if self.gctx.dis.has_reserved_prefix(args[1]):
error("this is a reserved prefix")
return
addr = int(args[2], 16)
self.gctx.db.modified = True
self.gctx.dis.add_symbol(addr, args[1])
except:
error("there was an error when creating a symbol")
def __exec_functions(self, args):
if self.gctx.dis is None:
error("load a file before")
return
self.gctx.dis.print_functions()
def load_file(self, filename=None):
if filename is None:
filename = self.filename
if not os.path.exists(filename):
error("file {self.filename} doesn't exist".format(self=self))
if self.interactive_mode:
return False
die()
if not os.path.isfile(filename):
error("this is not a file".format(self=self))
if self.interactive_mode:
return False
die()
self.db = Database()
self.db.load(filename)
if self.raw_base != 0:
self.db.raw_base = self.raw_base
if self.raw_type is not None:
self.db.raw_type = self.raw_type
if self.raw_big_endian is not None:
self.db.raw_is_big_endian = self.raw_big_endian
if self.db.loaded:
self.raw_base = self.db.raw_base
self.raw_type = self.db.raw_type
self.raw_big_endian = self.db.raw_is_big_endian
try:
dis = Disassembler(filename, self.raw_type,
self.raw_base, self.raw_big_endian,
self.db)
except ExcArch as e:
error("arch %s is not supported" % e.arch)
if self.interactive_mode:
return False
die()
except ExcFileFormat:
error("the file is not PE or ELF binary")
if self.interactive_mode:
return False
die()
except ExcPEFail as e:
error(str(e.e))
error("it seems that there is a random bug in pefile, you shoul retry.")
error("please report here https://github.com/joelpx/reverse/issues/16")
if self.interactive_mode:
return False
die()
self.dis = dis
self.libarch = dis.load_arch_module()
return True
def __exec_functions(self, args):
if self.gctx.dis is None:
error("load a file before")
return
self.gctx.dis.print_functions()
def parse_args(self):
parser = ArgumentParser(
description="Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. "
"Supported formats : ELF, PE. More commands available in the interactive"
" mode. https://github.com/joelpx/reverse"
)
parser.add_argument("filename", nargs="?", metavar="FILENAME")
parser.add_argument("-nc", "--nocolor", action="store_true")
parser.add_argument("-g", "--graph", action="store_true", help="Generate a file graph.dot.")
parser.add_argument("--noandif", action="store_true", help="Print normal 'if' instead of 'andif'")
parser.add_argument(
"--datasize",
type=int,
default=30,
metavar="N",
help="default 30, maximum of chars to display for strings or bytes array.",
)
parser.add_argument(
"-x",
"--entry",
metavar="SYMBOLNAME|0xXXXXX|EP",
help="Pseudo-decompilation, default is main. EP stands for entry point.",
)
parser.add_argument("--vim", action="store_true", help="Generate syntax colors for vim")
parser.add_argument("-s", "--symbols", action="store_true", help="Print all symbols")
parser.add_argument("--sections", action="store_true", help="Print all sections")
parser.add_argument("--dump", action="store_true", help="Dump asm without decompilation")
parser.add_argument("-l", "--lines", type=int, default=30, metavar="N", help="Max lines used with --dump")
parser.add_argument("--bytes", action="store_true", help="Print instruction bytes")
parser.add_argument("-i", "--interactive", action="store_true", help="Interactive mode")
parser.add_argument("-d", "--opt_debug", action="store_true")
parser.add_argument("-ns", "--nosectionsname", action="store_true")
parser.add_argument("--raw", metavar="x86|x64|arm|mips|mips64", help="Consider the input file as a raw binary")
parser.add_argument("--rawbase", metavar="0xXXXXX", help="Set base address of a raw file (default=0)")
parser.add_argument("--rawbe", action="store_true", help="If not set it's in little endian")
args = parser.parse_args()
self.debug = args.opt_debug
self.print_andif = not args.noandif
self.color = not args.nocolor
self.sectionsname = not args.nosectionsname
self.max_data_size = args.datasize
self.filename = args.filename
self.raw_type = args.raw
self.raw_base = args.rawbase
self.syms = args.symbols
self.entry = args.entry
self.do_dump = args.dump
self.vim = args.vim
self.interactive_mode = args.interactive
self.nb_lines = args.lines
self.graph = args.graph
self.raw_big_endian = args.rawbe
self.list_sections = args.sections
self.print_bytes = args.bytes
if self.raw_base is not None:
try:
self.raw_base = int(self.raw_base, 16)
except:
error("--rawbase must be in hex format")
die()
else:
self.raw_base = 0
def parse_args(self):
parser = ArgumentParser(description=
'Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. '
'Supported formats : ELF, PE. More commands available in the interactive'
' mode. https://github.com/joelpx/reverse')
parser.add_argument('filename', nargs='?', metavar='FILENAME')
parser.add_argument('-nc', '--nocolor', action='store_true')
parser.add_argument('-g', '--graph', action='store_true',
help='Generate a file graph.dot.')
parser.add_argument('--noandif', action='store_true',
help="Print normal 'if' instead of 'andif'")
parser.add_argument('--datasize', type=int, default=30, metavar='N',
help='default 30, maximum of chars to display for strings or bytes array.')
parser.add_argument('-x', '--entry', metavar='SYMBOLNAME|0xXXXXX|EP',
help='Pseudo-decompilation, default is main. EP stands for entry point.')
parser.add_argument('--vim', action='store_true',
help='Generate syntax colors for vim')
parser.add_argument('-s', '--symbols', action='store_true',
help='Print all symbols')
parser.add_argument('--sections', action='store_true',
help='Print all sections')
parser.add_argument('--dump', action='store_true',
help='Dump asm without decompilation')
parser.add_argument('-l', '--lines', type=int, default=30, metavar='N',
help='Max lines used with --dump')
parser.add_argument('--nbytes', type=int, default=0, metavar='N',
help='Print n bytes.')
parser.add_argument('-i', '--interactive', action='store_true',
help='Interactive mode')
parser.add_argument('-d', '--opt_debug', action='store_true')
parser.add_argument('-ns', '--nosectionsname', action='store_true')
parser.add_argument('--raw', metavar='x86|x64|arm|mips|mips64',
help='Consider the input file as a raw binary')
parser.add_argument('--rawbase', metavar='0xXXXXX',
help='Set base address of a raw file (default=0)')
parser.add_argument('--rawbe', action='store_true',
help='If not set it\'s in little endian')
parser.add_argument('-na', '--noautoanalyzer', action='store_true',
help='Disable analysis on the entry point / symbols and don\'t scan memmory. You can force it with the command push_analyze_symbols.')
args = parser.parse_args()
self.debug = args.opt_debug
self.print_andif = not args.noandif
self.color = not args.nocolor
self.sectionsname = not args.nosectionsname
self.max_data_size = args.datasize
self.filename = args.filename
self.raw_type = args.raw
self.raw_base = args.rawbase
self.syms = args.symbols
self.entry = args.entry
self.do_dump = args.dump
self.vim = args.vim
self.interactive_mode = args.interactive
self.nb_lines = args.lines
self.graph = args.graph
self.raw_big_endian = args.rawbe
self.list_sections = args.sections
self.autoanalyzer = not args.noautoanalyzer
if args.nbytes == 0:
self.nbytes = 4
self.print_bytes = False
else:
self.nbytes = int(args.nbytes)
self.print_bytes = True
if self.raw_base is not None:
try:
self.raw_base = int(self.raw_base, 16)
except:
error("--rawbase must be in hex format")
die()
else:
self.raw_base = 0
def load_file(self, filename=None):
if filename is None:
filename = self.filename
if not os.path.exists(filename):
error("file {self.filename} doesn't exist".format(self=self))
if self.interactive_mode:
return False
die()
if not os.path.isfile(filename):
error("this is not a file".format(self=self))
if self.interactive_mode:
return False
die()
self.db = Database()
self.db.load(filename)
try:
dis = Disassembler(filename, self.raw_type, self.raw_base,
self.raw_big_endian, self.db)
except ExcArch as e:
error("arch %s is not supported" % e.arch)
if self.interactive_mode:
return False
die()
except ExcFileFormat:
error("the file is not PE or ELF binary")
if self.interactive_mode:
return False
die()
except ExcPEFail as e:
error(str(e.e))
error(
"it seems that there is a random bug in pefile, you shoul retry."
)
error(
"please report here https://github.com/joelpx/reverse/issues/16"
)
if self.interactive_mode:
return False
die()
self.dis = dis
self.libarch = dis.load_arch_module()
return True
def __exec_sym(self, args):
if self.gctx.dis is None:
error("load a file before")
return
if len(args) == 1:
self.gctx.dis.print_symbols(self.gctx.sectionsname)
return
if args[1][0] == "|":
if len(args) == 2 or len(args) > 3:
error("bad arguments (warn: need spaces between |)")
return
self.gctx.dis.print_symbols(self.gctx.sectionsname, args[2])
return
if len(args) > 3:
error("bad arguments")
return
if len(args) == 2:
error("an address is required to save the symbol")
return
if not args[2].startswith("0x"):
error("the address should starts with 0x")
return
if args[1].startswith("loc_"):
error("loc_ is a reserved prefix")
return
# Save new symbol
try:
addr = int(args[2], 16)
self.gctx.db.modified = True
self.gctx.dis.add_symbol(addr, args[1])
except:
error("there was an error when creating a symbol")
def parse_args(self):
parser = ArgumentParser(
description=
'Reverse engineering for x86/ARM/MIPS binaries. Generation of pseudo-C. '
'Supported formats : ELF, PE. More commands available in the interactive'
' mode. https://github.com/joelpx/reverse')
parser.add_argument('filename', nargs='?', metavar='FILENAME')
parser.add_argument('-nc', '--nocolor', action='store_true')
parser.add_argument('-g',
'--graph',
action='store_true',
help='Generate a file graph.dot.')
parser.add_argument('--noandif',
action='store_true',
help="Print normal 'if' instead of 'andif'")
parser.add_argument(
'--datasize',
type=int,
default=30,
metavar='N',
help=
'default 30, maximum of chars to display for strings or bytes array.'
)
parser.add_argument(
'-x',
'--entry',
metavar='SYMBOLNAME|0xXXXXX|EP',
help=
'Pseudo-decompilation, default is main. EP stands for entry point.'
)
parser.add_argument('--vim',
action='store_true',
help='Generate syntax colors for vim')
parser.add_argument('-s',
'--symbols',
action='store_true',
help='Print all symbols')
parser.add_argument('--sections',
action='store_true',
help='Print all sections')
parser.add_argument('--dump',
action='store_true',
help='Dump asm without decompilation')
parser.add_argument('-l',
'--lines',
type=int,
default=30,
metavar='N',
help='Max lines used with --dump')
parser.add_argument('--bytes',
action='store_true',
help='Print instruction bytes')
parser.add_argument('-i',
'--interactive',
action='store_true',
help='Interactive mode')
parser.add_argument('-d', '--opt_debug', action='store_true')
parser.add_argument('-ns', '--nosectionsname', action='store_true')
parser.add_argument('--raw',
metavar='x86|x64|arm|mips|mips64',
help='Consider the input file as a raw binary')
parser.add_argument('--rawbase',
metavar='0xXXXXX',
help='Set base address of a raw file (default=0)')
parser.add_argument('--rawbe',
action='store_true',
help='If not set it\'s in little endian')
args = parser.parse_args()
self.debug = args.opt_debug
self.print_andif = not args.noandif
self.color = not args.nocolor
self.sectionsname = not args.nosectionsname
self.max_data_size = args.datasize
self.filename = args.filename
self.raw_type = args.raw
self.raw_base = args.rawbase
self.syms = args.symbols
self.entry = args.entry
self.do_dump = args.dump
self.vim = args.vim
self.interactive_mode = args.interactive
self.nb_lines = args.lines
self.graph = args.graph
self.raw_big_endian = args.rawbe
self.list_sections = args.sections
self.print_bytes = args.bytes
if self.raw_base is not None:
try:
self.raw_base = int(self.raw_base, 16)
except:
error("--rawbase must be in hex format")
die()
else:
self.raw_base = 0
