示例#1
0
文件: two.py 项目: tonsuper/star_
import operator, sys
import cPickle as pickle
from goo import *
import dmini

dmini.init(sys.argv[1], True)

data = pickle.load(open(sys.argv[2], 'rb'))
rop = data['segment']
rop_address = data['rop_address']
stack_size = rop_address - 0x1000
linkedit_size = 0x10000
linkedit_address = data['init_sp'] - linkedit_size

rop_relocs = []
if isinstance(data['initializer'], reloc):
    initializer = pointed(I(data['initializer'].value))
    rop_relocs.append(linkedit_address + pointer(initializer))
else:
    initializer = pointed(I(data['initializer']))


def func(value, addr):
    rop_relocs.append(addr)
    return value


reloc_handlers[3] = func

rop = simplify(rop, rop_address)
示例#2
0
文件: two.py 项目: 0xDEC0DE8/star_
import operator, sys
import cPickle as pickle
from goo import *
import dmini

dmini.init(sys.argv[1], True)

data = pickle.load(open(sys.argv[2], 'rb'))
rop = data['segment']
rop_address = data['rop_address']
stack_size = rop_address - 0x1000
linkedit_size = 0x10000
linkedit_address = data['init_sp'] - linkedit_size

rop_relocs = []
if isinstance(data['initializer'], reloc):
    initializer = pointed(I(data['initializer'].value))
    rop_relocs.append(linkedit_address + pointer(initializer))
else:
    initializer = pointed(I(data['initializer']))


def func(value, addr):
    rop_relocs.append(addr)
    return value
reloc_handlers[3] = func

rop = simplify(rop, rop_address)

PROT_READ, PROT_WRITE, PROT_EXECUTE = 1, 2, 4
示例#3
0
debugging = True
result_for = None

def dbg_result():
    global result_for
    if debugging:
        if result_for is None:
            result_for = ptr('Result for %s was %08x\n', True)
        result, resultp = stackunkpair()
        store_r0_to(resultp)
        back = sys._getframe().f_back

        funcall('_fprintf', dmini.cur.sym('___stderrp'), result_for, ptr('%s:%d' % (back.f_code.co_filename, back.f_lineno), True), result, load_r0=True)

dmini.init(kernfile, False)

sysent = dmini.cur.find('- 00 10 86 00') + 4

code_addr = 0x80000400
def my_ls(binary, sym):
    if sym == '_chgproccnt':
        # I'm lazy, make this strref later
        result = dmini.cur.find('+ f0 b5 03 af 2d e9 00 0d .. .. .. .. 05 46 8a 46 4f f0 00 08')
        print hex(result)
        return result
weirdfile = dmini.Connection(kcode, rw=True).relocate(dmini.cur, code_addr, my_ls).nth_segment(0).data()[:-8]
count = 0
stuff = ''
while True:
    namelen = patchfp.read(4)