#!/usr/bin/env python from ramooflax import VM, CPUFamily # # Main # vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm.attach() vm.stop() vm.cpu.del_active_cr3() vm.detach()
os = Utils.create_os(OSAffinity.Linux26, settings)
hook = os.find_process_filter("prog")
Utils.info = True
#
# Print eip on raised page fault
#
def pf_hook(vm):
print "Page Fault @ %#x" % (vm.cpu.gpr.pc)
return True
#
# Main
#
vm = VM(CPUFamily.AMD, "192.168.254.254:1234")
vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, hook)
while not vm.resume():
continue
vm.cpu.release_write_cr(3)
vm.cpu.set_active_cr3(os.get_process_cr3(), True, OSAffinity.Linux26)
vm.cpu.filter_exception(CPUException.page_fault, pf_hook)
vm.cpu.lbr.enable()
vm.resume()
# Target process
process_name = sys.argv[1]
# Some offsets for debian 2.6.32-5-486 kernel
settings = {
"thread_size": 8192,
"comm": 540,
"next": 240,
"mm": 268,
"pgd": 36
}
os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter(process_name)
#
# Main
#
#vm = VM(CPUFamily.AMD, "192.168.254.254:1234")
vm = VM(CPUFamily.Intel, "172.16.131.128:1337")
vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, hook)
while not vm.resume():
continue
vm.cpu.release_write_cr(3)
log("info", "success: %#x" % os.get_process_cr3())
vm.detach()
#
# This script uses amoco engine (https://github.com/bdcht/amoco)
#
from ramooflax import VM, Utils, CPUFamily
from amoco.arch.x86 import cpu_x86 as am
Utils.debug = True
def sstep_disasm(vm):
code_loc = vm.cpu.code_location()
code_bytes = vm.mem.vread(code_loc, 15)
print "(%dbit) pc = %#x | %s" % (vm.cpu.mode,code_loc,code_bytes.encode('hex'))
print am.disassemble(code_bytes, address=code_loc)
return True
#
# Main
#
#peer = "192.168.254.254:1234"
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)
vm.attach()
vm.stop()
vm.cpu.breakpoints.filter(None, sstep_disasm)
print "\n####\n#### type: vm.singlestep()\n####\n"
vm.interact(dict(globals(), **locals()))
vm.detach()
#!/usr/bin/env python # # Enter interactive 'shell' mode # from ramooflax import VM, Utils, CPUFamily, OSAffinity Utils.debug = True #vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm = VM(CPUFamily.Intel, "172.16.131.128:1337") vm.run(dict(globals(), **locals()))
# We are looking for "break" running under debian
#
from ramooflax import VM, Utils, CPUFamily, OSAffinity
# Some offsets for debian 2.6.32-5-486 kernel
settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36}
os = Utils.create_os(OSAffinity.Linux26, settings)
hook = os.find_process_filter("break")
Utils.info = True
#Utils.debug = True
#
# Main
#
vm = VM(CPUFamily.AMD, "192.168.254.254:1234")
vm.attach()
vm.stop()
vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr+4, 4, hook)
while not vm.resume():
continue
vm.cpu.breakpoints.remove(1)
vm.cpu.set_active_cr3(os.get_process_cr3(), affinity=OSAffinity.Linux26)
print "found break process"
#
# Breakpoints handling
#
#
from ramooflax import VM, CPUFamily, log, disassemble
from amoco.arch.x86 import cpu_x86 as am
# create logging for this script
log.setup(info=True, fail=True)
def disasm_wrapper(addr, data):
return am.disassemble(data, address=addr)
def sstep_disasm(vm):
insns = disassemble(vm, disasm_wrapper, vm.cpu.code_location())
print insns.split('\n')[0]
return True
#
# Main
#
vm = VM(CPUFamily.Intel, "172.16.131.128:1337")
vm.attach()
vm.stop()
vm.cpu.breakpoints.filter(None, sstep_disasm)
log("info", "\n####\n#### type: vm.singlestep()\n####\n")
vm.interact(dict(globals(), **locals()))
vm.detach()