Пример #1
0
os = Utils.create_os(OSAffinity.Linux26, settings)
hook = os.find_process_filter("prog")

Utils.info = True

#
# Print eip on raised page fault
#
def pf_hook(vm):
    print "Page Fault @ %#x" % (vm.cpu.gpr.pc)
    return True

#
# Main
#
vm = VM(CPUFamily.AMD, "192.168.254.254:1234")

vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, hook)

while not vm.resume():
    continue

vm.cpu.release_write_cr(3)
vm.cpu.set_active_cr3(os.get_process_cr3(), True, OSAffinity.Linux26)

vm.cpu.filter_exception(CPUException.page_fault, pf_hook)
vm.cpu.lbr.enable()

vm.resume()
Пример #2
0
#
# This script uses amoco engine (https://github.com/bdcht/amoco)
#
from ramooflax import VM, Utils, CPUFamily
from amoco.arch.x86 import cpu_x86 as am

Utils.debug = True

def sstep_disasm(vm):
    code_loc = vm.cpu.code_location()
    code_bytes = vm.mem.vread(code_loc, 15)
    print "(%dbit) pc = %#x | %s" % (vm.cpu.mode,code_loc,code_bytes.encode('hex'))

    print am.disassemble(code_bytes, address=code_loc)
    return True

#
# Main
#
#peer = "192.168.254.254:1234"
peer = "172.16.131.128:1337"
vm = VM(CPUFamily.Intel, peer)

vm.attach()
vm.stop()
vm.cpu.breakpoints.filter(None, sstep_disasm)

print "\n####\n#### type: vm.singlestep()\n####\n"
vm.interact(dict(globals(), **locals()))
vm.detach()
Пример #3
0
# Target process
process_name = sys.argv[1]

# Some offsets for debian 2.6.32-5-486 kernel
settings = {
    "thread_size": 8192,
    "comm": 540,
    "next": 240,
    "mm": 268,
    "pgd": 36
}
os = OSFactory(OSAffinity.Linux26, settings)
hook = os.find_process_filter(process_name)

#
# Main
#
#vm = VM(CPUFamily.AMD, "192.168.254.254:1234")
vm = VM(CPUFamily.Intel, "172.16.131.128:1337")

vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, hook)

while not vm.resume():
    continue

vm.cpu.release_write_cr(3)
log("info", "success: %#x" % os.get_process_cr3())
vm.detach()
Пример #4
0
    log("fail", "gimme prog name")
    sys.exit(-1)

# Target process
process_name = sys.argv[1]

# Some offsets for Windows 7 Premium FR 32 bits
settings = {"kprcb":0x20, "kthread":4,
            "eprocess":0x150, "name":0x16c,
            "cr3":0x18, "next":0xb8}

os = OSFactory(OSAffinity.Win7, settings)
hook = os.find_process_filter(process_name)

#
# Main
#
#vm = VM(CPUFamily.AMD, "192.168.254.254:1234")
vm = VM(CPUFamily.AMD, "172.16.131.128:1337")

vm.attach()
vm.stop()
vm.cpu.filter_write_cr(3, hook)

while not vm.resume():
    continue

vm.cpu.release_write_cr(3)
log("info", "success: %#x" % os.get_process_cr3())
vm.detach()