示例#1
0
    def test_GetCurrentDirectory(self):

        # DWORD WINAPI GetCurrentDirectory(size, buf)

        # Test with a buffer long enough
        addr = 0x80000
        size = len(winapi.winobjs.cur_dir) + 1
        jit.vm.add_memory_page(addr, PAGE_READ | PAGE_WRITE, b"\x00" * (size),
                               "")
        jit.push_uint32_t(addr)  # buf
        jit.push_uint32_t(size)  # size
        jit.push_uint32_t(0)  # @return
        winapi.kernel32_GetCurrentDirectoryA(jit)
        dir_ = get_win_str_a(jit, addr)
        size_ret = jit.cpu.EAX
        self.assertEqual(len(dir_), size_ret)

        # Test with a buffer too small
        jit.vm.set_mem(addr, b"\xFF" * size)
        jit.push_uint32_t(addr)  # buf
        jit.push_uint32_t(5)  # size
        jit.push_uint32_t(0)  # @return
        winapi.kernel32_GetCurrentDirectoryA(jit)
        size_ret = jit.cpu.EAX
        self.assertEqual(len(dir_) + 1, size_ret)
        dir_short = get_win_str_a(jit, addr)
        self.assertEqual(dir_short, dir_[:4])
示例#2
0
def xxx_fopen(jitter):
    '''
    #include <stdio.h>

    FILE *fopen(const char *path, const char *mode);
    '''
    global my_FILE_ptr
    ret_addr, args = jitter.func_args_systemv(['path', 'mode'])
    fname = get_win_str_a(jitter, args.path)
    FILE_to_info[my_FILE_ptr] = FInfo(fname, open(fname, "rb"))
    my_FILE_ptr += 1
    return jitter.func_ret_stdcall(ret_addr, my_FILE_ptr - 1)
示例#3
0
    def test_msvcrt_sprintf(self):
        def alloc_str(s):
            s += b"\x00"
            ptr = heap.alloc(jit, len(s))
            jit.vm.set_mem(ptr, s)
            return ptr
        fmt  = alloc_str(b"'%s' %d")
        str_ = alloc_str(b"coucou")
        buf = heap.alloc(jit,1024)

        jit.push_uint32_t(1111)
        jit.push_uint32_t(str_)
        jit.push_uint32_t(fmt)
        jit.push_uint32_t(buf)
        jit.push_uint32_t(0) # ret_ad
        winapi.msvcrt_sprintf(jit)
        ret = get_win_str_a(jit, buf)
        self.assertEqual(ret, "'coucou' 1111")
示例#4
0
def xxx_fopen_symb(dse):
    regs = dse.ir_arch.arch.regs
    fname_addr = dse.eval_expr(regs.RDI)
    mode = dse.eval_expr(regs.RSI)
    assert fname_addr.is_int()
    assert mode.is_int()
    fname = get_win_str_a(dse.jitter, int(fname_addr))
    ret_addr = ExprInt(dse.jitter.get_stack_arg(0), regs.RIP.size)

    assert len(FILE_to_info_symb) == 0
    ret_value = FILE_stream
    FILE_to_info_symb[ret_value] = SymbolicFile(fname)

    dse.update_state({
        regs.RSP:
        dse.eval_expr(regs.RSP + ExprInt(8, regs.RSP.size)),
        dse.ir_arch.IRDst:
        ret_addr,
        regs.RIP:
        ret_addr,
        regs.RAX:
        ret_value,
    })
示例#5
0
def xxx_puts_symb(dse):
    string = get_win_str_a(dse.jitter, dse.jitter.cpu.RDI)
    raise FinishOn(string)