示例#1
0
def test_run_func_x86():
    emu = Emulator(ARCH_X86)

    seg = emu.mem.allocate(0x20)
    emu.mem.write_code(
        seg.address, """
        mov eax, [esp + 4]
        mov ecx, [esp + 8]
        add eax, ecx
        ret
    """)
    emu.allocate_stack()

    emu.stack.push(1)
    emu.stack.push(5)
    value = emu.run_function(seg.address)
    assert value == 6
    assert emu.sp == emu.mem.segments.stack.end - 12

    emu.reset_sp()
    emu.stack.push(8)
    emu.stack.push(-1)
    value = emu.run_function(seg.address)
    assert value == 7
    assert emu.sp == emu.mem.segments.stack.end - 12
示例#2
0
def test_alloc_stack(emu: Emulator):
    emu.allocate_stack(0x1000)

    assert emu.sp in emu.mem.segments.stack

    emu.stack[0] = 0xDEAD
    assert emu.stack[0] == 0xDEAD
示例#3
0
文件: stack.py 项目: giltom/megastone
from megastone import Emulator, ARCH_X86, HOOK_STOP

emu = Emulator(ARCH_X86)
emu.allocate_stack(0x1000)
start_seg = emu.mem.allocate(0x1000)
func_seg = emu.mem.allocate(0x1000)

emu.mem.write_code(
    start_seg.address, f"""
    push 1
    push 2
    call 0x{func_seg.address:X}
    {'nop;'*20}
""")

emu.mem.write_code(func_seg.address, f"""
    mov eax, 700
    ret
""")


def func_hook(emu: Emulator):
    print(hex(emu.sp), emu.get_curr_insn()
          )  #since this opcode never runs, the trace func isn't called
    return emu.stack[1] + emu.stack[2]


emu.replace_function(func_seg.address, func_hook)
emu.add_code_hook(lambda e: print(hex(e.sp), e.get_curr_insn()))
emu.add_code_hook(HOOK_STOP, start_seg.address + 0x10)