def data_output(self):
"""
Save data sections to files
"""
self.process(self.locations)
self.process(self.data_labels, True)
self.gotexternals()
if len(self.rodata_list) != 0:
l, s = self.rodata_list[0]
self.rodata_list[0] = ('s_dummy:\n' + l, s)
dataalign = '\n.align 16' if ELF_utils.elf_64() else (
'\n.align 2' if ELF_utils.elf_arm() else '')
self.rodata_list.insert(0, ('.section .rodata' + dataalign, ''))
self.got_list.insert(0, ('.section .got', ''))
self.data_list.insert(0, ('.section .data' + dataalign, ''))
self.bss_list.insert(0, ('.section .bss' + dataalign, ''))
def createout(l):
l = filter(lambda e: len(e[0]) + len(e[1]) > 0, l)
return '\n'.join(map(lambda e: e[0] + e[1], l))
with open('final_data.s', 'a') as f:
f.write(createout(self.rodata_list) + '\n')
f.write('\n' + createout(self.data_list) + '\n')
f.write('\n' + createout(self.got_list) + '\n')
f.write('\n' + createout(self.bss_list) + '\n')
def picprocess64(filepath):
"""
PC relative operations in x86 64 bit code
typical instruction disassembled by objdump like this
4005c9: 48 8b 05 58 08 20 00 mov 0x200858(%rip),%rax # 600e28 <__libc_start_main@plt+0x200a28>
should be rewritten in this format
4005c9: ................... mov S_0x600e28(%rip), %rax
:param filepath: path to target executable
"""
if not ELF_utils.elf_64(): return
with open(filepath + '.temp') as f:
lines = f.readlines()
pat = re.compile(r'0x[0-9a-f]+\(%rip\)')
for i in xrange(len(lines)):
l = lines[i]
if "#" in l:
m = pat.search(l)
if m:
items = l.split('#')
des = items[1].split()[0]
sub = m.group(0)
sub1 = "0x" + des + "(%rip)"
l = items[0]
l = l.replace(sub, sub1)
lines[i] = l + "\n"
with open(filepath + '.temp', 'w') as f:
f.writelines(lines)
"""
Templates for gfree return address encryption and frame cookie
"""
import config
from disasm import Types
from utils.ail_utils import ELF_utils, set_loc, get_loc
if ELF_utils.elf_64():
# x86_64
cslab = Types.Label(config.gfree_cookiestackvar + '@tpoff')
returnenc = [
Types.DoubleInstr(('pushq', Types.RegClass('rax'), None, False)),
Types.TripleInstr(('movq', Types.RegClass('rax'),
Types.Label(config.gfree_xorkeyvar), None, False)),
Types.TripleInstr(('xorq', Types.BinOP_PLUS(
(Types.RegClass('rsp'), 8)), Types.RegClass('rax'), None, False)),
Types.DoubleInstr(('popq', Types.RegClass('rax'), None, False)),
]
framecookiehead = [
Types.DoubleInstr(('pushq', Types.RegClass('rax'), None, False)),
Types.DoubleInstr(('pushq', Types.RegClass('rbx'), None, False)),
Types.TripleInstr(('addq', Types.SegRef(
('fs', cslab)), Types.Normal(1), None, False)),
Types.TripleInstr(
('movq', Types.RegClass('rbx'), Types.SegRef(
('fs', cslab)), None, False)),
Types.TripleInstr(