Example: Move asm's examples to a `asm` directory

9 files changed, 673 insertions, 0 deletions

diff --git a/example/asm/arm.py b/example/asm/arm.py
new file mode 100644
index 00000000..28af59fb
--- /dev/null
+++ b/example/asm/arm.py
@@ -0,0 +1,82 @@
+#! /usr/bin/env python
+from elfesteem.strpatchwork import StrPatchwork
+
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.arm.arch import mn_arm, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+from miasm2.core import asmbloc
+
+my_mn = mn_arm
+
+reg_and_id = dict(mn_arm.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+txt = '''
+main:
+  STMFD  SP!, {R4, R5, LR}
+  MOV    R0, mystr & 0xffff
+  ORR    R0, R0, mystr & 0xffff0000
+  MOV    R4, R0
+  MOV    R1, mystrend & 0xffff
+  ORR    R1, R1, mystrend & 0xffff0000
+xxx:
+  LDRB    R2, [PC, key-$]
+loop:
+  LDRB   R3, [R0]
+  EOR    R3, R3, R2
+  STRB   R3, [R0], 1
+  CMP    R0, R1
+  BNE    loop
+end:
+  MOV    R0, R4
+  LDMFD  SP!, {R4, R5, PC}
+key:
+.byte 0x11
+mystr:
+.string "test string"
+mystrend:
+.long 0
+'''
+
+blocs_b, symbol_pool_b = parse_asm.parse_txt(my_mn, "b", txt)
+blocs_l, symbol_pool_l = parse_asm.parse_txt(my_mn, "l", txt)
+
+
+# fix shellcode addr
+symbol_pool_b.set_offset(symbol_pool_b.getby_name("main"), 0x0)
+symbol_pool_l.set_offset(symbol_pool_l.getby_name("main"), 0x0)
+
+# graph sc####
+g = asmbloc.bloc2graph(blocs_l[0])
+open("graph.txt", "w").write(g)
+
+s_b = StrPatchwork()
+s_l = StrPatchwork()
+
+print "symbols"
+print symbol_pool_l
+# dont erase from start to shell code padading
+resolved_b, patches_b = asmbloc.asm_resolve_final(
+    my_mn, blocs_b[0], symbol_pool_b)
+resolved_l, patches_l = asmbloc.asm_resolve_final(
+    my_mn, blocs_l[0], symbol_pool_l)
+print patches_b
+
+for offset, raw in patches_b.items():
+    s_b[offset] = raw
+for offset, raw in patches_l.items():
+    s_l[offset] = raw
+
+open('demo_arm_b.bin', 'w').write(str(s_b))
+open('demo_arm_l.bin', 'w').write(str(s_l))
diff --git a/example/asm/arm_sc.py b/example/asm/arm_sc.py
new file mode 100644
index 00000000..83787f02
--- /dev/null
+++ b/example/asm/arm_sc.py
@@ -0,0 +1,62 @@
+#! /usr/bin/env python
+
+from pdb import pm
+
+from elfesteem.strpatchwork import StrPatchwork
+
+from miasm2.core import asmbloc
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.arm.arch import mn_arm, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+
+reg_and_id = dict(mn_arm.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+
+st = StrPatchwork()
+
+blocs, symbol_pool = parse_asm.parse_txt(mn_arm, 'l', '''
+main:
+    MOV R1, R0
+    MOV R2, 0x100
+    LDR R3, [PC, mykey1-$]
+loop:
+    ADD R2, R1, R2
+    ADD R1, R1, 1
+    LDR R3, [PC, mykey2-$]
+    CMP R1, R3
+    BEQ loop
+
+    ADD R0, R1, R2
+    BX LR
+mykey1:
+.long 0x1
+mykey2:
+.long 0x2
+''')
+
+# fix shellcode addr
+symbol_pool.set_offset(symbol_pool.getby_name("main"), 0)
+
+for b in blocs[0]:
+    print b
+
+resolved_b, patches = asmbloc.asm_resolve_final(
+    mn_arm, blocs[0], symbol_pool)
+print patches
+
+for offset, raw in patches.items():
+    st[offset] = raw
+
+open('arm_sc.bin', 'wb').write(str(st))
diff --git a/example/asm/armt.py b/example/asm/armt.py
new file mode 100644
index 00000000..f4ce6d2d
--- /dev/null
+++ b/example/asm/armt.py
@@ -0,0 +1,90 @@
+#! /usr/bin/env python
+
+from pdb import pm
+
+from elfesteem.strpatchwork import StrPatchwork
+
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.arm.arch import mn_armt, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+from miasm2.core import asmbloc
+
+my_mn = mn_armt
+
+reg_and_id = dict(mn_armt.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+txt = '''
+memcpy:
+     PUSH    {R0-R3, LR}
+     B       test_end
+loop:
+     LDRB    R3, [R1]
+     STRB    R3, [R0]
+     ADDS    R0, R0, 1
+     ADDS    R1, R1, 1
+     SUBS    R2, R2, 1
+test_end:
+     CMP     R2, 0
+     BNE     loop
+     POP     {R0-R3, PC}
+main:
+     PUSH    {LR}
+     SUB     SP, 0x100
+     MOV     R0, SP
+     ADD     R1, PC, mystr-$+6
+     MOV     R0, R0
+     EORS    R2, R2
+     ADDS    R2, R2, 0x4
+     BL      memcpy
+     ADD     SP, 0x100
+     POP     {PC}
+
+mystr:
+.string "toto"
+'''
+
+blocs_b, symbol_pool_b = parse_asm.parse_txt(my_mn, "b", txt)
+blocs_l, symbol_pool_l = parse_asm.parse_txt(my_mn, "l", txt)
+
+# fix shellcode addr
+symbol_pool_b.set_offset(symbol_pool_b.getby_name("main"), 0)
+symbol_pool_l.set_offset(symbol_pool_l.getby_name("main"), 0)
+
+# graph sc####
+g = asmbloc.bloc2graph(blocs_b[0])
+open("graph.txt", "w").write(g)
+
+s_b = StrPatchwork()
+s_l = StrPatchwork()
+
+print "symbols"
+print symbol_pool_b
+# dont erase from start to shell code padading
+resolved_b, patches_b = asmbloc.asm_resolve_final(
+    my_mn, blocs_b[0], symbol_pool_b)
+resolved__l, patches_l = asmbloc.asm_resolve_final(
+    my_mn, blocs_l[0], symbol_pool_l)
+print patches_b
+print patches_l
+
+
+
+for offset, raw in patches_b.items():
+    s_b[offset] = raw
+for offset, raw in patches_l.items():
+    s_l[offset] = raw
+
+open('demo_armt_b.bin', 'wb').write(str(s_b))
+open('demo_armt_l.bin', 'wb').write(str(s_l))
diff --git a/example/asm/box_x86_32.py b/example/asm/box_x86_32.py
new file mode 100644
index 00000000..def7af99
--- /dev/null
+++ b/example/asm/box_x86_32.py
@@ -0,0 +1,61 @@
+#! /usr/bin/env python
+from argparse import ArgumentParser
+from pdb import pm
+
+from elfesteem import pe_init
+
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.x86.arch import mn_x86, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+from miasm2.core import asmbloc
+
+parser = ArgumentParser("x86 32bits assembler")
+parser.add_argument("source", help="Source to assemble")
+args = parser.parse_args()
+
+pe = pe_init.PE()
+s_text = pe.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000)
+s_iat = pe.SHList.add_section(name="iat", rawsize=0x100)
+new_dll = [({"name": "USER32.dll",
+             "firstthunk": s_iat.addr}, ["MessageBoxA"])]
+pe.DirImport.add_dlldesc(new_dll)
+s_myimp = pe.SHList.add_section(name="myimp", rawsize=len(pe.DirImport))
+pe.DirImport.set_rva(s_myimp.addr)
+
+reg_and_id = dict(mn_x86.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+with open(args.source) as fstream:
+    source = fstream.read()
+
+blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, source)
+
+# fix shellcode addr
+symbol_pool.set_offset(symbol_pool.getby_name("main"), pe.rva2virt(s_text.addr))
+symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"),
+                       pe.DirImport.get_funcvirt('MessageBoxA'))
+pe.Opthdr.AddressOfEntryPoint = s_text.addr
+
+for bloc in blocs[0]:
+    print bloc
+
+resolved_b, patches = asmbloc.asm_resolve_final(
+    mn_x86, blocs[0], symbol_pool)
+print patches
+
+for offset, raw in patches.items():
+    pe.virt[offset] = raw
+
+output = args.source.replace(".S", ".bin")
+open(output, 'wb').write(str(pe))
diff --git a/example/asm/box_x86_32_enc.py b/example/asm/box_x86_32_enc.py
new file mode 100644
index 00000000..ec4d70ea
--- /dev/null
+++ b/example/asm/box_x86_32_enc.py
@@ -0,0 +1,104 @@
+#! /usr/bin/env python
+from pdb import pm
+
+from elfesteem import pe_init
+
+from miasm2.core import asmbloc
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.x86.arch import mn_x86, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+
+pe = pe_init.PE()
+s_text = pe.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000)
+s_iat = pe.SHList.add_section(name="iat", rawsize=0x100)
+new_dll = [({"name": "USER32.dll",
+             "firstthunk": s_iat.addr}, ["MessageBoxA"])]
+pe.DirImport.add_dlldesc(new_dll)
+s_myimp = pe.SHList.add_section(name="myimp", rawsize=len(pe.DirImport))
+pe.DirImport.set_rva(s_myimp.addr)
+
+reg_and_id = dict(mn_x86.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, '''
+main:
+    CALL cipher_code
+    CALL msgbox_encrypted_start
+    CALL cipher_code
+    RET
+
+cipher_code:
+    PUSH EBP
+    MOV  EBP, ESP
+
+    LEA  ESI, DWORD PTR [msgbox_encrypted_start]
+    LEA  EDI, DWORD PTR [msgbox_encrypted_stop]
+
+loop:
+    XOR  BYTE PTR [ESI], 0x42
+    INC  ESI
+    CMP  ESI, EDI
+    JBE  loop
+
+    MOV  ESP, EBP
+    POP  EBP
+    RET
+
+msgbox_encrypted_start:
+    PUSH 0
+    PUSH title
+    PUSH msg
+    PUSH 0
+    CALL DWORD PTR [ MessageBoxA ]
+    RET
+.dontsplit
+msgbox_encrypted_stop:
+.long 0
+
+title:
+.string "Hello!"
+msg:
+.string "World!"
+''')
+
+
+# fix shellcode addr
+symbol_pool.set_offset(symbol_pool.getby_name("main"), pe.rva2virt(s_text.addr))
+symbol_pool.set_offset(symbol_pool.getby_name_create(
+    "MessageBoxA"), pe.DirImport.get_funcvirt('MessageBoxA'))
+pe.Opthdr.AddressOfEntryPoint = s_text.addr
+
+for b in blocs[0]:
+    print b
+
+print "symbols"
+print symbol_pool
+
+resolved_b, patches = asmbloc.asm_resolve_final(
+    mn_x86, blocs[0], symbol_pool)
+print patches
+
+ad_start = symbol_pool.getby_name_create("msgbox_encrypted_start").offset
+ad_stop = symbol_pool.getby_name_create("msgbox_encrypted_stop").offset
+
+# cipher code
+new_patches = dict(patches)
+for ad, val in patches.items():
+    if ad_start <= ad < ad_stop:
+        new_patches[ad] = "".join([chr(ord(x) ^ 0x42) for x in val])
+
+for offset, raw in new_patches.items():
+    pe.virt[offset] = raw
+
+open('box_x86_32_enc.bin', 'wb').write(str(pe))
diff --git a/example/asm/box_x86_64.py b/example/asm/box_x86_64.py
new file mode 100644
index 00000000..44aca56e
--- /dev/null
+++ b/example/asm/box_x86_64.py
@@ -0,0 +1,67 @@
+#! /usr/bin/env python
+from pdb import pm
+
+from elfesteem import pe_init
+
+from miasm2.core import asmbloc
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.x86.arch import mn_x86, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+
+e = pe_init.PE(wsize=64)
+s_text = e.SHList.add_section(name="text", addr=0x1000, rawsize=0x1000)
+s_iat = e.SHList.add_section(name="iat", rawsize=0x100)
+new_dll = [({"name": "USER32.dll",
+             "firstthunk": s_iat.addr}, ["MessageBoxA"])]
+e.DirImport.add_dlldesc(new_dll)
+s_myimp = e.SHList.add_section(name="myimp", rawsize=len(e.DirImport))
+e.DirImport.set_rva(s_myimp.addr)
+
+reg_and_id = dict(mn_x86.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt64(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=64))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 64, '''
+main:
+    MOV R9, 0x0
+    MOV R8, title
+    MOV RDX, msg
+    MOV RCX, 0x0
+    MOV RAX, QWORD PTR [ MessageBoxA ]
+    CALL RAX
+    RET
+
+title:
+.string "Hello!"
+msg:
+.string "World!"
+''')
+
+# fix shellcode addr
+symbol_pool.set_offset(symbol_pool.getby_name("main"), e.rva2virt(s_text.addr))
+symbol_pool.set_offset(symbol_pool.getby_name_create("MessageBoxA"),
+                       e.DirImport.get_funcvirt('MessageBoxA'))
+e.Opthdr.AddressOfEntryPoint = s_text.addr
+
+for b in blocs[0]:
+    print b
+
+resolved_b, patches = asmbloc.asm_resolve_final(
+    mn_x86, blocs[0], symbol_pool,
+    max_offset=0xFFFFFFFFFFFFFFFF)
+print patches
+
+for offset, raw in patches.items():
+    e.virt[offset] = raw
+
+open('box_x86_64.bin', 'wb').write(str(e))
diff --git a/example/asm/mips32.py b/example/asm/mips32.py
new file mode 100644
index 00000000..fc050f1f
--- /dev/null
+++ b/example/asm/mips32.py
@@ -0,0 +1,67 @@
+#! /usr/bin/env python
+from pdb import pm
+
+from elfesteem.strpatchwork import StrPatchwork
+
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.mips32.arch import mn_mips32, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+from miasm2.core import asmbloc
+
+reg_and_id = dict(mn_mips32.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+
+st_l = StrPatchwork()
+st_b = StrPatchwork()
+
+txt = '''
+main:
+    ADDIU      A0, ZERO, 0x10
+    ADDIU      A1, ZERO, 0
+loop:
+    ADDIU      A1, A1, 0x1
+    BNE        A0, ZERO, loop
+    ADDIU      A0, A0, 0xFFFFFFFF
+
+    ADDIU      A2, A2, 0x1
+    MOVN       A1, ZERO, ZERO
+    JR         RA
+    ADDIU      A2, A2, 0x1
+'''
+
+blocs_b, symbol_pool_b = parse_asm.parse_txt(mn_mips32, "b", txt)
+blocs_l, symbol_pool_l = parse_asm.parse_txt(mn_mips32, "l", txt)
+
+# fix shellcode addr
+symbol_pool_b.set_offset(symbol_pool_b.getby_name("main"), 0)
+symbol_pool_l.set_offset(symbol_pool_l.getby_name("main"), 0)
+
+for b in blocs_b[0]:
+    print b
+
+resolved_b, patches_b = asmbloc.asm_resolve_final(
+    mn_mips32, blocs_b[0], symbol_pool_b)
+resolved_l, patches_l = asmbloc.asm_resolve_final(
+    mn_mips32, blocs_l[0], symbol_pool_l)
+print patches_b
+print patches_l
+
+for offset, raw in patches_b.items():
+    st_b[offset] = raw
+for offset, raw in patches_l.items():
+    st_l[offset] = raw
+
+open('mips32_sc_b.bin', 'wb').write(str(st_l))
+open('mips32_sc_l.bin', 'wb').write(str(st_l))
diff --git a/example/asm/msp430_sc.py b/example/asm/msp430_sc.py
new file mode 100644
index 00000000..de488803
--- /dev/null
+++ b/example/asm/msp430_sc.py
@@ -0,0 +1,52 @@
+#! /usr/bin/env python
+from pdb import pm
+
+from elfesteem.strpatchwork import StrPatchwork
+
+from miasm2.core import asmbloc
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.msp430.arch import mn_msp430, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+
+reg_and_id = dict(mn_msp430.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+
+st = StrPatchwork()
+
+blocs, symbol_pool = parse_asm.parse_txt(mn_msp430, None, '''
+main:
+    mov.w      0x10, R10
+    mov.w      0x0, R11
+loop:
+    add.w      1, R11
+    sub.w      1, R10
+    jnz        loop
+    mov.w      @SP+, PC
+''')
+
+# fix shellcode addr
+symbol_pool.set_offset(symbol_pool.getby_name("main"), 0)
+
+for b in blocs[0]:
+    print b
+
+resolved_b, patches = asmbloc.asm_resolve_final(
+    mn_msp430, blocs[0], symbol_pool)
+print patches
+
+for offset, raw in patches.items():
+    st[offset] = raw
+
+open('msp430_sc.bin', 'wb').write(str(st))
diff --git a/example/asm/x86.py b/example/asm/x86.py
new file mode 100644
index 00000000..d877ceaa
--- /dev/null
+++ b/example/asm/x86.py
@@ -0,0 +1,88 @@
+#! /usr/bin/env python
+
+from miasm2.core.cpu import parse_ast
+from miasm2.arch.x86.arch import mn_x86, base_expr
+from miasm2.core import parse_asm
+import miasm2.expression.expression as m2_expr
+from miasm2.core import asmbloc
+from elfesteem.strpatchwork import StrPatchwork
+
+reg_and_id = dict(mn_x86.regs.all_regs_ids_byname)
+
+
+def my_ast_int2expr(a):
+    return m2_expr.ExprInt32(a)
+
+
+def my_ast_id2expr(t):
+    return reg_and_id.get(t, m2_expr.ExprId(t, size=32))
+
+my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
+base_expr.setParseAction(my_var_parser)
+
+blocs, symbol_pool = parse_asm.parse_txt(mn_x86, 32, '''
+main:
+   PUSH EBP
+   MOV  EBP, ESP
+   SUB  ESP, 0x100
+   MOV  EAX, 0x1337
+   ; test ptr manip
+   LEA  ESI, DWORD PTR [mystr^toto]
+   CALL toto
+mystr:
+.string "test string"
+ toto:
+   POP  EDI
+
+   PUSH EDI
+   ; test scasb
+   XOR  EAX, EAX
+   XOR  ECX, ECX
+   DEC  ECX
+   REPNE SCASB
+   NOT  ECX
+   DEC  ECX
+
+   ; test movsb
+   POP  ESI
+   LEA  EDI, DWORD PTR [EBP-0x100]
+   REPE  MOVSB
+
+   ; test float
+   PUSH 0
+   FLD1
+   FLD1
+   FADD ST, ST(1)
+   FIST  DWORD PTR [ESP]
+   POP  EAX
+
+   ; test cond mnemo
+   NOP
+   NOP
+   CMOVZ EAX, EBX
+   ; test shr
+   NOP
+   SHR EAX, 1
+   NOP
+   NOP
+   SHR EAX, CL
+   NOP
+
+   MOV  ESP, EBP
+   POP  EBP
+   RET
+
+
+''')
+
+# fix shellcode addr
+symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x0)
+s = StrPatchwork()
+resolved_b, patches = asmbloc.asm_resolve_final(
+    mn_x86, blocs[0], symbol_pool)
+for offset, raw in patches.items():
+    s[offset] = raw
+
+print patches
+
+open('demo_x86_32.bin', 'wb').write(str(s))