for ads, pg in pages: log("fsm", "ads 0x%x: %s" % (ads, pg)) return True ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) vm.nr_cr3 = 5 vm.ads = {} log.setup(info=True, fail=True, gdb=False, vm=True, brk=True, evt=False, fsm=(True, log.blue)) vm.attach() vm.stop() vm.cpu.filter_write_cr(3, wcr3) log("info", "ready!") vm.interact2(dict(globals(), **locals()))
for p in ulst: log("fkm", fmt % (a,ka,p,kp)) ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) vm.nr_cr3 = 1 vm.ads = {} #keep track of every kernel physical pages vm.kppg = defaultdict(list) log.setup(info=True, fail=True, gdb=False, vm=True, brk=True, evt=False, fkm=(True,log.blue)) vm.attach() vm.stop() vm.cpu.filter_write_cr(3, wcr3) log("info", "ready!") while len(vm.ads) < vm.nr_cr3: vm.resume() vm.detach() find_kmem(vm)
#!/usr/bin/env python # # We are looking for "argv[1]" running under debian # # We install the Linux26.find_process_filter on cr3 writes # The framework will call our filter Before each write # import sys from ramooflax.core import VM, CPUFamily, log from ramooflax.utils import OSFactory, OSAffinity # create logging for this script log.setup(info=True, fail=True) if len(sys.argv) < 2: log("fail", "gimme prog name") sys.exit(-1) # Target process process_name = sys.argv[1] # Some offsets for debian 2.6.32-5-486 kernel settings = { "thread_size": 8192, "comm": 540, "next": 240, "mm": 268, "pgd": 36 } os = OSFactory(OSAffinity.Linux26, settings)
#!/usr/bin/env python # # Enter interactive 'shell' mode # from ramooflax.core import VM, CPUFamily, log ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) log.setup(all=True) vm.run(dict(globals(), **locals()))
# # This script uses amoco engine (https://github.com/bdcht/amoco) # from amoco.arch.x86 import cpu_x86 as am from ramooflax.core import VM, CPUFamily, log from ramooflax.utils import disassemble def disasm_wrapper(addr, data): return am.disassemble(data, address=addr) def sstep_disasm(vm): insns = disassemble(vm, disasm_wrapper, vm.cpu.code_location()) print insns.split('\n')[0] return True ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) log.setup(info=True, fail=True, gdb=False) vm.attach() vm.stop() vm.cpu.filter_singlestep(sstep_disasm) log("info", "\n####\n#### type: vm.singlestep()\n####\n") vm.interact(dict(globals(), **locals())) vm.detach()
#!/usr/bin/env python # # We are looking for "argv[1]" running under debian # # We install the Linux26.find_process_filter on cr3 writes # The framework will call our filter Before each write # import sys from ramooflax.core import VM, CPUFamily, log from ramooflax.utils import OSFactory, OSAffinity # create logging for this script log.setup(info=True, fail=True) if len(sys.argv) < 2: log("fail", "gimme prog name") sys.exit(-1) # Target process process_name = sys.argv[1] # Some offsets for debian 2.6.32-5-486 kernel settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36} os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter(process_name) ## ## Main ## peer = "172.16.131.128:1337"
#!/usr/bin/env python # # Pretty print the GDT/IDT # import struct from ramooflax.core import VM, CPUFamily, log from ramooflax.utils import SegmentDescriptor, InterruptDescriptor ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) log.setup(info=True, fail=True, gdb=False, vm=True, brk=True, evt=False) # Retrieve 32 bits GDT/IDT content vm.attach() vm.stop() gdt_sz = vm.cpu.sr.gdtr_limit + 1 gdt_mm = vm.mem.vread(vm.cpu.sr.gdtr_base, gdt_sz) idt_sz = vm.cpu.sr.idtr_limit + 1 idt_mm = vm.mem.vread(vm.cpu.sr.idtr_base, idt_sz) vm.detach() # Pretty print GDT/IDT content dts = (("-= GDT =-", SegmentDescriptor, gdt_mm, gdt_sz),
plst = ads.search_paddr(a) if len(plst) != 0: log("sads", "match for 0x%x" % a) for p in plst: log("sads", "%s" % p) ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) vm.ads = {} log.setup(info=True, fail=True, gdb=False, vm=True, brk=True, evt=False, sads=(True, log.green)) vm.attach() vm.stop() vm.cpu.filter_write_cr(3, wcr3) log("info", "ready!") vm.interact2(dict(globals(), **locals()))
# import sys from ramooflax.core import VM, CPUFamily, log from ramooflax.utils import SymTab, SymParser ## ## Main ## if len(sys.argv) < 2: print "give me 'system.map" sys.exit(1) peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) log.setup(info=True, fail=True, gdb=False, vm=True, brk=True, evt=False) # load kernel symbols vm.symbols = SymTab(SymParser().from_system_map(sys.argv[1])) vm.attach() vm.stop() print vm.symbols[vm.cpu.code_location()] log("info", "ready!") vm.interact2(dict(globals(), **locals()))
# We are looking for "break" running under debian # from ramooflax.core import VM, CPUFamily, log, Log from ramooflax.utils import OSFactory, OSAffinity # Some offsets for debian 2.6.32-5-486 kernel #settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36} # Some offsets for kernel 3.4.1 settings = {"thread_size":8192, "comm":0x1cc, "next":0xc0, "mm":0xc8, "pgd":0x24} os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter("break") # create logging for this script log.setup(info=(True,Log.blue), fail=(True,Log.red), brk=True, gdb=True, vm=True, evt=True) ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) vm.attach() vm.stop() vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr_base+4, 4, hook) while not vm.resume(): continue vm.cpu.breakpoints.remove(1)
ptb_addrs.append(p.addr) log("sads", "PGD/PTs : %s" % " ".join([hex(i) for i in ptb_addrs])) for a in ptb_addrs: plst = ads.search_paddr(a) if len(plst) != 0: log("sads", "match for 0x%x" % a) for p in plst: log("sads", "%s" % p) ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) vm.ads = {} log.setup(info=True, fail=True, gdb=False, vm=True, brk=True, evt=False, sads=(True,log.green)) vm.attach() vm.stop() vm.cpu.filter_write_cr(3, wcr3) log("info", "ready!") vm.interact2(dict(globals(), **locals()))
from amoco.arch.x86 import cpu_x86 as am from ramooflax.core import VM, CPUFamily, log from ramooflax.utils import disassemble def disasm_wrapper(addr, data): return am.disassemble(data, address=addr) def sstep_disasm(vm): insns = disassemble(vm, disasm_wrapper, vm.cpu.code_location()) print insns.split('\n')[0] return True ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) log.setup(info=True, fail=True, gdb=False) vm.attach() vm.stop() vm.cpu.filter_singlestep(sstep_disasm) log("info", "\n####\n#### type: vm.singlestep()\n####\n") vm.interact(dict(globals(), **locals())) vm.detach()
# Some offsets for kernel 3.4.1 settings = { "thread_size": 8192, "comm": 0x1cc, "next": 0xc0, "mm": 0xc8, "pgd": 0x24 } os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter("break") # create logging for this script log.setup(info=(True, Log.blue), fail=(True, Log.red), brk=True, gdb=True, vm=True, evt=True) ## ## Main ## peer = "172.16.131.128:1337" vm = VM(CPUFamily.Intel, peer) vm.attach() vm.stop() vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr_base + 4, 4, hook) while not vm.resume(): continue