diff options
| -rw-r--r-- | example/ida/graph_ir.py | 88 | ||||
| -rw-r--r-- | example/ida/symbol_exec.py | 125 | ||||
| -rw-r--r-- | example/ida/utils.py | 169 | ||||
| -rw-r--r-- | example/samples/x86_32_pop_esp.S | 18 | ||||
| -rw-r--r-- | miasm2/analysis/sandbox.py | 22 | ||||
| -rw-r--r-- | miasm2/arch/arm/jit.py | 27 | ||||
| -rw-r--r-- | miasm2/arch/x86/arch.py | 6 | ||||
| -rw-r--r-- | miasm2/arch/x86/jit.py | 58 | ||||
| -rw-r--r-- | miasm2/arch/x86/sem.py | 27 | ||||
| -rw-r--r-- | miasm2/expression/expression_helper.py | 30 | ||||
| -rw-r--r-- | miasm2/jitter/jitload.py | 39 | ||||
| -rw-r--r-- | miasm2/jitter/loader/pe.py | 9 | ||||
| -rw-r--r-- | miasm2/os_dep/win_api_x86_32.py | 2 | ||||
| -rw-r--r-- | test/expression/expression_helper.py | 44 | ||||
| -rw-r--r-- | test/test_all.py | 2 |
15 files changed, 461 insertions, 205 deletions
diff --git a/example/ida/graph_ir.py b/example/ida/graph_ir.py index 5f9aead6..a306eda5 100644 --- a/example/ida/graph_ir.py +++ b/example/ida/graph_ir.py @@ -16,44 +16,7 @@ from miasm2.analysis.machine import Machine from miasm2.analysis.data_analysis import intra_bloc_flow_raw, inter_bloc_flow from miasm2.analysis.data_analysis import intra_bloc_flow_symbexec - - -def expr2colorstr(ir_arch, e): - # print "XXX", e - if isinstance(e, ExprId): - s = str(e) - if e in ir_arch.arch.regs.all_regs_ids: - s = idaapi.COLSTR(s, idaapi.SCOLOR_REG) - elif isinstance(e, ExprInt): - s = str(e) - s = idaapi.COLSTR(s, idaapi.SCOLOR_NUMBER) - elif isinstance(e, ExprMem): - s = '@%d[%s]' % (e.size, expr2colorstr(ir_arch, e.arg)) - elif isinstance(e, ExprOp): - out = [] - for a in e.args: - s = expr2colorstr(ir_arch, a) - if isinstance(a, ExprOp): - s = "(%s)" % s - out.append(s) - if len(out) == 1: - s = "%s %s" % (e.op, str(out[0])) - else: - s = (" " + e.op + " ").join(out) - elif isinstance(e, ExprAff): - s = "%s = %s" % ( - expr2colorstr(ir_arch, e.dst), expr2colorstr(ir_arch, e.src)) - elif isinstance(e, ExprCond): - cond = expr2colorstr(ir_arch, e.cond) - src1 = expr2colorstr(ir_arch, e.src1) - src2 = expr2colorstr(ir_arch, e.src2) - s = "(%s?%s:%s)" % (cond, src1, src2) - elif isinstance(e, ExprSlice): - s = "(%s)[%d:%d]" % (expr2colorstr(ir_arch, e.arg), e.start, e.stop) - else: - s = str(e) - # print repr(s) - return s +from utils import guess_machine, expr2colorstr def color_irbloc(irbloc): @@ -63,7 +26,7 @@ def color_irbloc(irbloc): o.append(lbl) for i, expr in enumerate(irbloc.irs): for e in expr: - s = expr2colorstr(ir_arch, e) + s = expr2colorstr(ir_arch.arch.regs.all_regs_ids, e) s = idaapi.COLSTR(s, idaapi.SCOLOR_INSN) o.append(' %s' % s) o.append("") @@ -137,52 +100,7 @@ class GraphMiasmIR(GraphViewer): from miasm2.analysis.disasm_cb import guess_funcs, guess_multi_cb - -processor_name = GetLongPrm(INF_PROCNAME) -dis_engine = None -if processor_name == "metapc": - - # HACK: check 32/64 using INF_START_SP - max_size = GetLongPrm(INF_START_SP) - if max_size == 0x80: # TODO XXX check - machine = Machine("x86_16") - elif max_size == 0xFFFFFFFF: - machine = Machine("x86_32") - elif max_size == 0xFFFFFFFFFFFFFFFF: - machine = Machine("x86_64") - else: - raise ValueError('cannot guess 32/64 bit! (%x)' % max_size) -elif processor_name == "ARM": - # TODO ARM/thumb - # hack for thumb: set armt = True in globals :/ - # set bigendiant = True is bigendian - is_armt = globals().get('armt', False) - is_bigendian = globals().get('bigendian', False) - if is_armt: - if is_bigendian: - machine = Machine("armtb") - else: - machine = Machine("armtl") - else: - if is_bigendian: - machine = Machine("armb") - else: - machine = Machine("arml") - - from miasm2.analysis.disasm_cb import arm_guess_subcall, arm_guess_jump_table - guess_funcs.append(arm_guess_subcall) - guess_funcs.append(arm_guess_jump_table) - -elif processor_name == "msp430": - machine = Machine("msp430") -elif processor_name == "mipsl": - machine = Machine("mipsl") -elif processor_name == "mipsb": - machine = Machine("mipsb") -else: - print repr(processor_name) - raise NotImplementedError('not fully functional') - +machine = guess_machine() mn, dis_engine, ira = machine.mn, machine.dis_engine, machine.ira print "Arch", dis_engine diff --git a/example/ida/symbol_exec.py b/example/ida/symbol_exec.py new file mode 100644 index 00000000..c7aff5b5 --- /dev/null +++ b/example/ida/symbol_exec.py @@ -0,0 +1,125 @@ +import operator + +import idaapi +import idc +from miasm2.expression.expression_helper import Variables_Identifier +from miasm2.expression.expression import ExprAff + +from utils import expr2colorstr, translatorForm + + +class symbolicexec_t(idaapi.simplecustviewer_t): + + def add(self, key, value): + self.AddLine("%s = %s" % (expr2colorstr(self.machine.mn.regs.all_regs_ids, key), + expr2colorstr(self.machine.mn.regs.all_regs_ids, value))) + + def expand(self, linenum): + element = self.line2eq[linenum] + expanded = Variables_Identifier(element[1], + var_prefix="%s_v" % element[0]) + self.line2eq = self.line2eq[0:linenum] + \ + expanded.vars.items() + \ + [(element[0], expanded.equation)] + \ + self.line2eq[linenum + 1:] + + def print_lines(self): + self.ClearLines() + + for element in self.line2eq: + self.add(*element) + + self.Refresh() + + def translate_expr(self, line_nb): + element = self.line2eq[line_nb] + expr = ExprAff(*element) + form = translatorForm(expr) + form.Compile() + form.Execute() + + def Create(self, equations, machine, *args, **kwargs): + if not super(symbolicexec_t, self).Create(*args, **kwargs): + return False + + self.machine = machine + self.line2eq = sorted(equations.items(), key=operator.itemgetter(0)) + self.lines_expanded = set() + + self.print_lines() + + self.menu_expand = self.AddPopupMenu("Expand [E]") + self.menu_translate = self.AddPopupMenu("Translate [T]") + return True + + def OnPopupMenu(self, menu_id): + if menu_id == self.menu_expand: + self.expand(self.GetLineNo()) + self.print_lines() + if menu_id == self.menu_translate: + self.translate_expr(self.GetLineNo()) + return True + + def OnKeydown(self, vkey, shift): + # ESCAPE + if vkey == 27: + self.Close() + return True + # E (expand) + if vkey == 69: + self.OnPopupMenu(self.menu_expand) + # T (translate) + if vkey == 84: + self.OnPopupMenu(self.menu_translate) + return False + + +def symbolic_exec(): + from miasm2.analysis.machine import Machine + from miasm2.ir.symbexec import symbexec + from miasm2.core.bin_stream_ida import bin_stream_ida + + from utils import guess_machine + + bs = bin_stream_ida() + machine = guess_machine() + + mdis = machine.dis_engine(bs) + start, end = SelStart(), SelEnd() + + mdis.dont_dis = [end] + blocs = mdis.dis_multibloc(start) + ira = machine.ira() + for bloc in blocs: + ira.add_bloc(bloc) + + print "Run symbolic execution..." + sb = symbexec(ira, machine.mn.regs.regs_init) + sb.emul_ir_blocs(ira, start) + + modified = {} + for ident in sb.symbols.symbols_id: + if ident in sb.ir_arch.arch.regs.regs_init and \ + ident in sb.symbols.symbols_id and \ + sb.symbols.symbols_id[ident] == sb.ir_arch.arch.regs.regs_init[ident]: + continue + modified[ident] = sb.symbols.symbols_id[ident] + + for ident in sb.symbols.symbols_mem: + modified[sb.symbols.symbols_mem[ident][0]] = sb.symbols.symbols_mem[ident][1] + + + view = symbolicexec_t() + if not view.Create(modified, machine, + "Symbolic Execution - 0x%x to 0x%x" % (start, end)): + return + + view.Show() + +idaapi.CompileLine('static key_F3() { RunPythonStatement("symbolic_exec()"); }') +idc.AddHotkey("F3", "key_F3") + +print "=" * 50 +print """Available commands: + symbolic_exec() - F3: Symbolic execution of current selection +""" diff --git a/example/ida/utils.py b/example/ida/utils.py new file mode 100644 index 00000000..8b9dcf6a --- /dev/null +++ b/example/ida/utils.py @@ -0,0 +1,169 @@ +import idaapi +from idc import * + +from miasm2.analysis.machine import Machine +from miasm2.ir.translators import Translator +import miasm2.expression.expression as m2_expr + + +def guess_machine(): + "Return an instance of Machine corresponding to the IDA guessed processor" + + processor_name = GetLongPrm(INF_PROCNAME) + + if processor_name == "metapc": + + # HACK: check 32/64 using INF_START_SP + max_size = GetLongPrm(INF_START_SP) + if max_size == 0x80: # TODO XXX check + machine = Machine("x86_16") + elif max_size == 0xFFFFFFFF: + machine = Machine("x86_32") + elif max_size == 0xFFFFFFFFFFFFFFFF: + machine = Machine("x86_64") + else: + raise ValueError('cannot guess 32/64 bit! (%x)' % max_size) + elif processor_name == "ARM": + # TODO ARM/thumb + # hack for thumb: set armt = True in globals :/ + # set bigendiant = True is bigendian + is_armt = globals().get('armt', False) + is_bigendian = globals().get('bigendian', False) + if is_armt: + if is_bigendian: + machine = Machine("armtb") + else: + machine = Machine("armtl") + else: + if is_bigendian: + machine = Machine("armb") + else: + machine = Machine("arml") + + from miasm2.analysis.disasm_cb import arm_guess_subcall, arm_guess_jump_table + guess_funcs.append(arm_guess_subcall) + guess_funcs.append(arm_guess_jump_table) + + elif processor_name == "msp430": + machine = Machine("msp430") + elif processor_name == "mipsl": + machine = Machine("mipsl") + elif processor_name == "mipsb": + machine = Machine("mipsb") + else: + print repr(processor_name) + raise NotImplementedError('not fully functional') + + return machine + + +def expr2colorstr(regs_ids, expr): + """Colorize an Expr instance for IDA + @regs_ids: list of ExprId corresponding to available registers + @expr: Expr instance to colorize + """ + + if isinstance(expr, m2_expr.ExprId): + s = str(expr) + if expr in regs_ids: + s = idaapi.COLSTR(s, idaapi.SCOLOR_REG) + elif isinstance(expr, m2_expr.ExprInt): + s = str(expr) + s = idaapi.COLSTR(s, idaapi.SCOLOR_NUMBER) + elif isinstance(expr, m2_expr.ExprMem): + s = '%s[%s]' % (idaapi.COLSTR('@' + str(expr.size), + idaapi.SCOLOR_RPTCMT), + expr2colorstr(regs_ids, expr.arg)) + elif isinstance(expr, m2_expr.ExprOp): + out = [] + for a in expr.args: + s = expr2colorstr(regs_ids, a) + if isinstance(a, m2_expr.ExprOp): + s = "(%s)" % s + out.append(s) + if len(out) == 1: + s = "%s %s" % (expr.op, str(out[0])) + else: + s = (" " + expr.op + " ").join(out) + elif isinstance(expr, m2_expr.ExprAff): + s = "%s = %s" % ( + expr2colorstr(regs_ids, expr.dst), expr2colorstr(regs_ids, expr.src)) + elif isinstance(expr, m2_expr.ExprCond): + cond = expr2colorstr(regs_ids, expr.cond) + src1 = expr2colorstr(regs_ids, expr.src1) + src2 = expr2colorstr(regs_ids, expr.src2) + s = "(%s?%s:%s)" % (cond, src1, src2) + elif isinstance(expr, m2_expr.ExprSlice): + s = "(%s)[%s:%s]" % (expr2colorstr(regs_ids, expr.arg), + idaapi.COLSTR(str(expr.start), + idaapi.SCOLOR_RPTCMT), + idaapi.COLSTR(str(expr.stop), + idaapi.SCOLOR_RPTCMT)) + elif isinstance(expr, m2_expr.ExprCompose): + s = "{" + s += ", ".join(["%s, %s, %s" % (expr2colorstr(regs_ids, subexpr), + idaapi.COLSTR(str(start), + idaapi.SCOLOR_RPTCMT), + idaapi.COLSTR(str(stop), + idaapi.SCOLOR_RPTCMT)) + for subexpr, start, stop in expr.args]) + s += "}" + else: + s = str(expr) + + return s + + +class translatorForm(idaapi.Form): + """Translator Form. + + Offer a ComboBox with available languages (ie. IR translators) and the + corresponding translation.""" + + flags = (idaapi.Form.MultiLineTextControl.TXTF_FIXEDFONT | \ + idaapi.Form.MultiLineTextControl.TXTF_READONLY) + + def __init__(self, expr): + "@expr: Expr instance" + + # Init + self.languages = list(Translator.available_languages()) + self.expr = expr + + # Initial translation + text = Translator.to_language(self.languages[0]).from_expr(self.expr) + + # Create the Form + idaapi.Form.__init__(self, r"""STARTITEM 0 +Python Expression +{FormChangeCb} +<Language:{cbLanguage}> +<Translation:{result}> +""", { + 'result': idaapi.Form.MultiLineTextControl(text=text, + flags=translatorForm.flags), + 'cbLanguage': idaapi.Form.DropdownListControl( + items=self.languages, + readonly=True, + selval=0), + 'FormChangeCb': idaapi.Form.FormChangeCb(self.OnFormChange), + }) + + def OnFormChange(self, fid): + if fid == self.cbLanguage.id: + # Display the Field (may be hide) + self.ShowField(self.result, True) + + # Translate the expression + dest_lang = self.languages[self.GetControlValue(self.cbLanguage)] + try: + text = Translator.to_language(dest_lang).from_expr(self.expr) + except Exception, error: + self.ShowField(self.result, False) + return -1 + + # Update the form + self.SetControlValue(self.result, + idaapi.textctrl_info_t(text=str(text), + flags=translatorForm.flags)) + return 1 diff --git a/example/samples/x86_32_pop_esp.S b/example/samples/x86_32_pop_esp.S new file mode 100644 index 00000000..4115a522 --- /dev/null +++ b/example/samples/x86_32_pop_esp.S @@ -0,0 +1,18 @@ +main: + MOV EAX, ESP + CALL test + MOV ESP, EAX + PUSH 0 + PUSH title + PUSH msg + PUSH 0 + CALL DWORD PTR [ MessageBoxA ] + RET + +test: + POP ESP + JMP ESP +title: +.string "Hello!" +msg: +.string "World!" diff --git a/miasm2/analysis/sandbox.py b/miasm2/analysis/sandbox.py index ca6dcfe6..22bd2094 100644 --- a/miasm2/analysis/sandbox.py +++ b/miasm2/analysis/sandbox.py @@ -160,8 +160,11 @@ class OS_Win(OS): def __init__(self, custom_methods, *args, **kwargs): from miasm2.jitter.loader.pe import vm_load_pe, vm_load_pe_libs, preload_pe, libimp_pe + from miasm2.os_dep import win_api_x86_32 + methods = win_api_x86_32.__dict__ + methods.update(custom_methods) - super(OS_Win, self).__init__(custom_methods, *args, **kwargs) + super(OS_Win, self).__init__(methods, *args, **kwargs) # Import manager libs = libimp_pe() @@ -187,7 +190,7 @@ class OS_Win(OS): preload_pe(self.jitter.vm, self.pe, libs) # Library calls handler - self.jitter.add_lib_handler(libs, custom_methods) + self.jitter.add_lib_handler(libs, methods) # Manage SEH if self.options.use_seh: @@ -217,8 +220,11 @@ class OS_Linux(OS): def __init__(self, custom_methods, *args, **kwargs): from miasm2.jitter.loader.elf import vm_load_elf, preload_elf, libimp_elf + from miasm2.os_dep import linux_stdlib + methods = linux_stdlib.__dict__ + methods.update(custom_methods) - super(OS_Linux, self).__init__(custom_methods, *args, **kwargs) + super(OS_Linux, self).__init__(methods, *args, **kwargs) # Import manager self.libs = libimp_elf() @@ -230,12 +236,16 @@ class OS_Linux(OS): self.entry_point = self.elf.Ehdr.entry # Library calls handler - self.jitter.add_lib_handler(self.libs, custom_methods) + self.jitter.add_lib_handler(self.libs, methods) class OS_Linux_str(OS): def __init__(self, custom_methods, *args, **kwargs): from miasm2.jitter.loader.elf import libimp_elf - super(OS_Linux_str, self).__init__(custom_methods, *args, **kwargs) + from miasm2.os_dep import linux_stdlib + methods = linux_stdlib.__dict__ + methods.update(custom_methods) + + super(OS_Linux_str, self).__init__(methods, *args, **kwargs) # Import manager libs = libimp_elf() @@ -246,7 +256,7 @@ class OS_Linux_str(OS): self.jitter.vm.add_memory_page(self.options.load_base_addr, PAGE_READ | PAGE_WRITE, data) # Library calls handler - self.jitter.add_lib_handler(libs, custom_methods) + self.jitter.add_lib_handler(libs, methods) @classmethod def update_parser(cls, parser): diff --git a/miasm2/arch/arm/jit.py b/miasm2/arch/arm/jit.py index d089bafb..8803725e 100644 --- a/miasm2/arch/arm/jit.py +++ b/miasm2/arch/arm/jit.py @@ -58,33 +58,6 @@ class jitter_arml(jitter): arg = self.get_stack_arg(n-4) return arg - def add_lib_handler(self, libs, user_globals=None): - """Add a function to handle libs call with breakpoints - @libs: libimp instance - @user_globals: dictionnary for defined user function - """ - if user_globals is None: - user_globals = {} - - from miasm2.os_dep import linux_stdlib - - def handle_lib(jitter): - fname = libs.fad2cname[jitter.pc] - if fname in user_globals: - f = user_globals[fname] - elif fname in linux_stdlib.__dict__: - f = linux_stdlib.__dict__[fname] - else: - log.debug('%s' % repr(fname)) - raise ValueError('unknown api', hex(jitter.pop_uint32_t()), repr(fname)) - f(jitter) - jitter.pc = getattr(jitter.cpu, jitter.ir_arch.pc.name) - return True - - for f_addr in libs.fad2cname: - self.add_breakpoint(f_addr, handle_lib) - - def init_run(self, *args, **kwargs): jitter.init_run(self, *args, **kwargs) self.cpu.PC = self.pc diff --git a/miasm2/arch/x86/arch.py b/miasm2/arch/x86/arch.py index 85356468..e75c22a9 100644 --- a/miasm2/arch/x86/arch.py +++ b/miasm2/arch/x86/arch.py @@ -20,8 +20,10 @@ conditional_branch = ["JO", "JNO", "JB", "JAE", "JZ", "JNZ", "JBE", "JA", "JS", "JNS", "JPE", "JNP", #"L", "NL", "NG", "G"] - "JL", "JGE", "JLE", "JG"] -unconditional_branch = ['JMP'] + "JL", "JGE", "JLE", "JG", + "JCXZ", "JECXZ", "JRCXZ"] + +unconditional_branch = ['JMP', 'JMPF'] f_isad = "AD" f_s08 = "S08" diff --git a/miasm2/arch/x86/jit.py b/miasm2/arch/x86/jit.py index 36afcce5..08bac4db 100644 --- a/miasm2/arch/x86/jit.py +++ b/miasm2/arch/x86/jit.py @@ -106,32 +106,6 @@ class jitter_x86_32(jitter): self.cpu.EIP = ret_addr self.cpu.EAX = ret_value - def add_lib_handler(self, libs, user_globals=None): - """Add a function to handle libs call with breakpoints - @libs: libimp instance - @user_globals: dictionnary for defined user function - """ - if user_globals is None: - user_globals = {} - - from miasm2.os_dep import win_api_x86_32 - - def handle_lib(jitter): - fname = libs.fad2cname[jitter.pc] - if fname in user_globals: - f = user_globals[fname] - elif fname in win_api_x86_32.__dict__: - f = win_api_x86_32.__dict__[fname] - else: - log.debug('%s' % repr(fname)) - raise ValueError('unknown api', hex(jitter.pop_uint32_t()), repr(fname)) - f(jitter) - jitter.pc = getattr(jitter.cpu, jitter.ir_arch.pc.name) - return True - - for f_addr in libs.fad2cname: - self.add_breakpoint(f_addr, handle_lib) - def init_run(self, *args, **kwargs): jitter.init_run(self, *args, **kwargs) self.cpu.EIP = self.pc @@ -165,10 +139,6 @@ class jitter_x86_64(jitter): x = upck64(self.vm.get_mem(self.cpu.RSP + 8 * n, 8)) return x - def init_run(self, *args, **kwargs): - jitter.init_run(self, *args, **kwargs) - self.cpu.RIP = self.pc - def func_args_stdcall(self, n_args): args_regs = ['RCX', 'RDX', 'R8', 'R9'] ret_ad = self.pop_uint64_t() @@ -207,28 +177,6 @@ class jitter_x86_64(jitter): self.cpu.RAX = ret_value return True - def add_lib_handler(self, libs, user_globals=None): - """Add a function to handle libs call with breakpoints - @libs: libimp instance - @user_globals: dictionnary for defined user function - """ - if user_globals is None: - user_globals = {} - - from miasm2.os_dep import win_api_x86_32 - - def handle_lib(jitter): - fname = libs.fad2cname[jitter.pc] - if fname in user_globals: - f = user_globals[fname] - elif fname in win_api_x86_32.__dict__: - f = win_api_x86_32.__dict__[fname] - else: - log.debug('%s' % repr(fname)) - raise ValueError('unknown api', hex(jitter.pop_uint64_t()), repr(fname)) - f(jitter) - jitter.pc = getattr(jitter.cpu, jitter.ir_arch.pc.name) - return True - - for f_addr in libs.fad2cname: - self.add_breakpoint(f_addr, handle_lib) + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.RIP = self.pc diff --git a/miasm2/arch/x86/sem.py b/miasm2/arch/x86/sem.py index 22e8c276..36d8e618 100644 --- a/miasm2/arch/x86/sem.py +++ b/miasm2/arch/x86/sem.py @@ -635,7 +635,9 @@ def pop(ir, instr, a): if not s in [16, 32, 64]: raise ValueError('bad size stacker!') new_esp = mRSP[instr.mode][:s] + ExprInt_fromsize(s, off / 8) - e.append(ExprAff(mRSP[instr.mode][:s], new_esp)) + # don't generate ESP incrementation on POP ESP + if a != ir.sp: + e.append(ExprAff(mRSP[instr.mode][:s], new_esp)) # XXX FIX XXX for pop [esp] if isinstance(a, ExprMem): a = a.replace_expr({mRSP[instr.mode]: new_esp}) @@ -1821,16 +1823,16 @@ def fucomip(ir, instr, a, b): def fcomp(ir, instr, a, b = None): - dst, e, extra = fcom(ir, instr, a, b) + e, extra = fcom(ir, instr, a, b) e += float_pop() e += set_float_cs_eip(instr) - return dst, e, extra + return e, extra def ficomp(ir, instr, a, b = None): - dst, e, extra = ficom(ir, instr, a, b) + e, extra = ficom(ir, instr, a, b) e += float_pop() e += set_float_cs_eip(instr) - return dst, e, extra + return e, extra def fld(ir, instr, a): @@ -1872,9 +1874,9 @@ def fst(ir, instr, a): def fstp(ir, instr, a): - dst, e, extra = fst(ir, instr, a) + e, extra = fst(ir, instr, a) e += float_pop(a) - return dst, e, extra + return e, extra def fist(ir, instr, a): @@ -1885,9 +1887,9 @@ def fist(ir, instr, a): return e, [] def fistp(ir, instr, a): - dst, e, extra = fist(ir, instr, a) + e, extra = fist(ir, instr, a) e += float_pop(a) - return dst, e, extra + return e, extra def fist(ir, instr, a): e = [] @@ -1910,9 +1912,9 @@ def fild(ir, instr, a): src = ExprOp('int_%.2d_to_double' % a.size, a) e = [] e += set_float_cs_eip(instr) - dst, e_fld, extra = fld(ir, instr, src) + e_fld, extra = fld(ir, instr, src) e += e_fld - return dst, e, extra + return e, extra def fldz(ir, instr): @@ -2003,6 +2005,9 @@ def fnstenv(ir, instr, a): ]) s = instr.mode + # The behaviour in 64bit is identical to 64 bit + # This will truncate addresses + s = min(32, s) ad = ExprMem(a.arg, size=16) e.append(ExprAff(ad, float_control)) ad = ExprMem(a.arg + ExprInt_from(a.arg, s / 8 * 1), size=16) diff --git a/miasm2/expression/expression_helper.py b/miasm2/expression/expression_helper.py index 2f0bd4e7..825cad60 100644 --- a/miasm2/expression/expression_helper.py +++ b/miasm2/expression/expression_helper.py @@ -17,7 +17,6 @@ # # Expressions manipulation functions -import re import itertools import collections import random @@ -210,16 +209,20 @@ class Variables_Identifier(object): - original expression with variables translated """ - var_identifier = re.compile("v\d+") + # Attribute used to distinguish created variables from original ones + is_var_ident = "is_var_ident" - def __init__(self, expr): + def __init__(self, expr, var_prefix="v"): """Set the expression @expr to handle and launch variable identification - process""" + process + @expr: Expr instance + @var_prefix: (optional) prefix of the variable name, default is 'v'""" # Init self.var_indice = itertools.count() self.var_asked = set() self._vars = {} # VarID -> Expr + self.var_prefix = var_prefix # Launch recurrence self.find_variables_rec(expr) @@ -254,9 +257,13 @@ class Variables_Identifier(object): ## Build initial needs for var_id, var_expr in self._vars.iteritems(): + ### Handle corner cases while using Variable Identifier on an + ### already computed equation needs[var_id] = [var_name for var_name in var_expr.get_r(mem_read=True) - if self.is_var_identifier(var_name)] + if self.is_var_identifier(var_name) and \ + var_name in todo and \ + var_name != var_id] ## Build order list while todo: @@ -268,7 +275,6 @@ class Variables_Identifier(object): # A dependency is not met all_met = False break - if not all_met: continue @@ -282,12 +288,12 @@ class Variables_Identifier(object): @classmethod def is_var_identifier(cls, expr): - "Return True iff expr seems to be a variable identifier" + "Return True iff @expr is a variable identifier" if not isinstance(expr, m2_expr.ExprId): return False - match = cls.var_identifier.match(expr.name) - return match is not None and match.group(0) == expr.name + return hasattr(expr, cls.is_var_ident) and \ + getattr(expr, cls.is_var_ident) == True def find_variables_rec(self, expr): """Recursive method called by find_variable to expand @expr. @@ -301,8 +307,10 @@ class Variables_Identifier(object): if (expr not in self._vars.values()): # Create var - identifier = m2_expr.ExprId("v%s" % self.var_indice.next(), - size = expr.size) + identifier = m2_expr.ExprId("%s%s" % (self.var_prefix, + self.var_indice.next()), + size = expr.size) + setattr(identifier, self.__class__.is_var_ident, True) self._vars[identifier] = expr # Recursion stop case diff --git a/miasm2/jitter/jitload.py b/miasm2/jitter/jitload.py index c297ba50..0405b46d 100644 --- a/miasm2/jitter/jitload.py +++ b/miasm2/jitter/jitload.py @@ -40,8 +40,10 @@ class CallbackHandler(object): self.callbacks = {} # Key -> [callback list] def add_callback(self, name, callback): - "Add a callback to the key 'name'" - self.callbacks[name] = self.callbacks.get(name, []) + [callback] + """Add a callback to the key @name, iff the @callback isn't already + assigned to it""" + if callback not in self.callbacks.get(name, []): + self.callbacks[name] = self.callbacks.get(name, []) + [callback] def set_callback(self, name, *args): "Set the list of callback for key 'name'" @@ -351,3 +353,36 @@ class jitter: """Set an unicode string in memory""" s = "\x00".join(list(s)) + '\x00' * 3 self.vm.set_mem(addr, s) + + @staticmethod + def handle_lib(jitter): + """Resolve the name of the function which cause the handler call. Then + call the corresponding handler from users callback. + """ + fname = jitter.libs.fad2cname[jitter.pc] + if fname in jitter.user_globals: + func = jitter.user_globals[fname] + else: + log.debug('%s' % repr(fname)) + raise ValueError('unknown api', hex(jitter.pc), repr(fname)) + func(jitter) + jitter.pc = getattr(jitter.cpu, jitter.ir_arch.pc.name) + return True + + def handle_function(self, f_addr): + """Add a brakpoint which will trigger the function handler""" + self.add_breakpoint(f_addr, self.handle_lib) + + def add_lib_handler(self, libs, user_globals=None): + """Add a function to handle libs call with breakpoints + @libs: libimp instance + @user_globals: dictionnary for defined user function + """ + if user_globals is None: + user_globals = {} + + self.libs = libs + self.user_globals = user_globals + + for f_addr in libs.fad2cname: + self.handle_function(f_addr) diff --git a/miasm2/jitter/loader/pe.py b/miasm2/jitter/loader/pe.py index 6b19fc16..0b63583d 100644 --- a/miasm2/jitter/loader/pe.py +++ b/miasm2/jitter/loader/pe.py @@ -164,8 +164,9 @@ def vm_load_pe(vm, fdata, align_s=True, load_hdr=True, **kargs): # Update min and max addresses if min_addr is None or section.addr < min_addr: min_addr = section.addr - if max_addr is None or section.addr + section.size > max_addr: - max_addr = section.addr + max(section.size, len(section.data)) + max_section_len = max(section.size, len(section.data)) + if max_addr is None or section.addr + max_section_len > max_addr: + max_addr = section.addr + max_section_len min_addr = pe.rva2virt(min_addr) max_addr = pe.rva2virt(max_addr) @@ -179,8 +180,8 @@ def vm_load_pe(vm, fdata, align_s=True, load_hdr=True, **kargs): # Copy each sections content in memory for section in pe.SHList: - log.debug('Map 0x%x bytes to 0x%x' % (len(s.data), pe.rva2virt(s.addr))) - vm.set_mem(pe.rva2virt(s.addr), str(s.data)) + log.debug('Map 0x%x bytes to 0x%x' % (len(section.data), pe.rva2virt(section.addr))) + vm.set_mem(pe.rva2virt(section.addr), str(section.data)) return pe diff --git a/miasm2/os_dep/win_api_x86_32.py b/miasm2/os_dep/win_api_x86_32.py index a4c07e59..0996d616 100644 --- a/miasm2/os_dep/win_api_x86_32.py +++ b/miasm2/os_dep/win_api_x86_32.py @@ -954,7 +954,7 @@ def kernel32_GetProcAddress(jitter): else: ad = 0 ad = winobjs.runtime_dll.lib_get_add_func(libbase, fname) - + jitter.add_breakpoint(ad, jitter.handle_lib) jitter.func_ret_stdcall(ret_ad, ad) diff --git a/test/expression/expression_helper.py b/test/expression/expression_helper.py index 3ff6f5da..514a9a51 100644 --- a/test/expression/expression_helper.py +++ b/test/expression/expression_helper.py @@ -30,11 +30,55 @@ class TestExpressionExpressionHelper(unittest.TestCase): # Test the result new_expr = vi.equation + ## Force replace in the variable dependency order for var_id, var_value in reversed(vi.vars.items()): new_expr = new_expr.replace_expr({var_id: var_value}) self.assertEqual(exprf, new_expr) + # Test prefix + vi = Variables_Identifier(exprf, var_prefix="prefix_v") + + ## Use __str__ + print vi + + ## Test the result + new_expr = vi.equation + ### Force replace in the variable dependency order + for var_id, var_value in reversed(vi.vars.items()): + new_expr = new_expr.replace_expr({var_id: var_value}) + self.assertEqual(exprf, new_expr) + + # Test an identify on an expression already containing identifier + vi = Variables_Identifier(exprf) + vi2 = Variables_Identifier(vi.equation) + + ## Test the result + new_expr = vi2.equation + ### Force replace in the variable dependency order + for var_id, var_value in reversed(vi2.vars.items()): + new_expr = new_expr.replace_expr({var_id: var_value}) + self.assertEqual(vi.equation, new_expr) + + ## Corner case: each sub var depends on itself + mem1 = m2_expr.ExprMem(ebx, size=32) + mem2 = m2_expr.ExprMem(mem1, size=32) + cst2 = m2_expr.ExprInt32(-1) + expr_mini = ((eax ^ mem2 ^ cst2) & (mem2 ^ (eax + mem2)))[31:32] + + ## Build + vi = Variables_Identifier(expr_mini) + vi2 = Variables_Identifier(vi.equation) + + ## Test the result + new_expr = vi2.equation + ### Force replace in the variable dependency order + for var_id, var_value in reversed(vi2.vars.items()): + new_expr = new_expr.replace_expr({var_id: var_value}) + self.assertEqual(vi.equation, new_expr) + + + if __name__ == '__main__': testcase = TestExpressionExpressionHelper testsuite = unittest.TestLoader().loadTestsFromTestCase(testcase) diff --git a/test/test_all.py b/test/test_all.py index 5de12bf4..66620375 100644 --- a/test/test_all.py +++ b/test/test_all.py @@ -120,7 +120,7 @@ class ExampleShellcode(ExampleAssembler): testset += ExampleShellcode(['x86_32', 'x86_32_manip_ptr.S', "demo_x86_32.bin"]) test_box = {} -test_box_names = ["mod", "mod_self", "repmod", "simple", "enc"] +test_box_names = ["mod", "mod_self", "repmod", "simple", "enc", "pop_esp"] for source in test_box_names: sample_base = "x86_32_" + source args = ["x86_32", sample_base + ".S", sample_base + ".bin", "--PE"] |