# With the LBR, we can see that we come from "from" # from ramooflax import VM, CPUFamily, OSFactory, OSAffinity, CPUException, log # create logging for this script log.setup(info=True, fail=True) # Some offsets for debian 2.6.32-5-486 kernel settings = { "thread_size": 8192, "comm": 540, "next": 240, "mm": 268, "pgd": 36 } os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter("prog") # # Print eip on raised page fault # def pf_hook(vm): log("info", "Page Fault @ %#x" % vm.cpu.gpr.pc) return True # # Main # vm = VM(CPUFamily.AMD, "192.168.254.254:1234")
if len(sys.argv) < 2: log("fail", "gimme prog name") sys.exit(-1) # Target process process_name = sys.argv[1] # Some offsets for debian 2.6.32-5-486 kernel settings = { "thread_size": 8192, "comm": 540, "next": 240, "mm": 268, "pgd": 36 } os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter(process_name) # # Main # #vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm = VM(CPUFamily.Intel, "172.16.131.128:1337") vm.attach() vm.stop() vm.cpu.filter_write_cr(3, hook) while not vm.resume(): continue
# create logging for this script log.setup(info=True, fail=True) if len(sys.argv) < 2: log("fail", "gimme prog name") sys.exit(-1) # Target process process_name = sys.argv[1] # Some offsets for Windows 7 Premium FR 32 bits settings = {"kprcb":0x20, "kthread":4, "eprocess":0x150, "name":0x16c, "cr3":0x18, "next":0xb8} os = OSFactory(OSAffinity.Win7, settings) hook = os.find_process_filter(process_name) # # Main # #vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm = VM(CPUFamily.AMD, "172.16.131.128:1337") vm.attach() vm.stop() vm.cpu.filter_write_cr(3, hook) while not vm.resume(): continue
#!/usr/bin/env python # # We are looking for "break" running under debian # from ramooflax import VM, CPUFamily, OSFactory, OSAffinity, log # Some offsets for debian 2.6.32-5-486 kernel settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36} os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter("break") # create logging for this script log.setup(info=True, fail=True) # # Main # vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm.attach() vm.stop() vm.cpu.breakpoints.add_data_w(vm.cpu.sr.tr+4, 4, hook) while not vm.resume(): continue vm.cpu.breakpoints.remove(1) vm.cpu.set_active_cr3(os.get_process_cr3(), affinity=OSAffinity.Linux26) log("foo", "found break process") #
# to = 0x0000000000000000 # to_excp = 0x00000000c103d8bc # from = 0x00000000080483d7 # # We see that eip = 0, without LBR we can't detect # where the #PF has been triggered # With the LBR, we can see that we come from "from" # from ramooflax import VM, CPUFamily, OSFactory, OSAffinity, CPUException, log # create logging for this script log.setup(info=True, fail=True) # Some offsets for debian 2.6.32-5-486 kernel settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36} os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter("prog") # # Print eip on raised page fault # def pf_hook(vm): log("info", "Page Fault @ %#x" % vm.cpu.gpr.pc) return True # # Main # vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm.attach()
from ramooflax import VM, CPUFamily, OSFactory, OSAffinity, log import sys # create logging for this script log.setup(info=True, fail=True) if len(sys.argv) < 2: log("fail", "gimme prog name") sys.exit(-1) # Target process process_name = sys.argv[1] # Some offsets for debian 2.6.32-5-486 kernel settings = {"thread_size":8192, "comm":540, "next":240, "mm":268, "pgd":36} os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter(process_name) # # Main # vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm.attach() vm.stop() vm.cpu.filter_write_cr(3, hook) while not vm.resume(): continue vm.cpu.release_write_cr(3)
if len(sys.argv) < 2: log("fail", "gimme prog name") sys.exit(-1) # Target process process_name = sys.argv[1] # Some offsets for debian 2.6.32-5-486 kernel settings = { "thread_size": 8192, "comm": 540, "next": 240, "mm": 268, "pgd": 36 } os = OSFactory(OSAffinity.Linux26, settings) hook = os.find_process_filter(process_name) # # Main # vm = VM(CPUFamily.AMD, "192.168.254.254:1234") vm.attach() vm.stop() vm.cpu.filter_write_cr(3, hook) while not vm.resume(): continue vm.cpu.release_write_cr(3)