diff options
| -rw-r--r-- | miasm2/analysis/machine.py | 8 | ||||
| -rw-r--r-- | miasm2/arch/arm/jit.py | 71 | ||||
| -rw-r--r-- | miasm2/arch/x86/jit.py | 166 | ||||
| -rw-r--r-- | miasm2/core/utils.py | 4 | ||||
| -rw-r--r-- | miasm2/jitter/jitload.py | 216 | ||||
| -rw-r--r-- | test/jitter/os_dep/win_api_x86_32.py | 7 |
6 files changed, 249 insertions, 223 deletions
diff --git a/miasm2/analysis/machine.py b/miasm2/analysis/machine.py index 2fd88fda..3f1a346c 100644 --- a/miasm2/analysis/machine.py +++ b/miasm2/analysis/machine.py @@ -28,7 +28,7 @@ class Machine(object): from miasm2.arch.arm.disasm import dis_arm as dis_engine from miasm2.arch.arm.arch import mn_arm as mn from miasm2.arch.arm.ira import ir_a_arm as ira - from miasm2.jitter.jitload import jitter_arm as jitter + from miasm2.arch.arm.jit import jitter_arm as jitter elif machine_name == "armt": from miasm2.arch.arm.disasm import dis_armt as dis_engine from miasm2.arch.arm.arch import mn_armt as mn @@ -41,18 +41,18 @@ class Machine(object): from miasm2.arch.x86.disasm import dis_x86_16 as dis_engine from miasm2.arch.x86.arch import mn_x86 as mn from miasm2.arch.x86.ira import ir_a_x86_16 as ira - from miasm2.jitter.jitload import jitter_x86_16 as jitter + from miasm2.arch.x86.jit import jitter_x86_16 as jitter elif machine_name == "x86_32": from miasm2.arch.x86.disasm import dis_x86_32 as dis_engine from miasm2.arch.x86.arch import mn_x86 as mn from miasm2.arch.x86.ira import ir_a_x86_32 as ira - from miasm2.jitter.jitload import jitter_x86_32 as jitter + from miasm2.arch.x86.jit import jitter_x86_32 as jitter from miasm2.analysis.gdbserver import GdbServer_x86_32 as gdbserver elif machine_name == "x86_64": from miasm2.arch.x86.disasm import dis_x86_64 as dis_engine from miasm2.arch.x86.arch import mn_x86 as mn from miasm2.arch.x86.ira import ir_a_x86_64 as ira - from miasm2.jitter.jitload import jitter_x86_64 as jitter + from miasm2.arch.x86.jit import jitter_x86_64 as jitter elif machine_name == "msp430": from miasm2.arch.msp430.disasm import dis_msp430 as dis_engine from miasm2.arch.msp430.arch import mn_msp430 as mn diff --git a/miasm2/arch/arm/jit.py b/miasm2/arch/arm/jit.py new file mode 100644 index 00000000..d491671c --- /dev/null +++ b/miasm2/arch/arm/jit.py @@ -0,0 +1,71 @@ +from miasm2.jitter.jitload import jitter +from miasm2.core import asmbloc +from miasm2.core.utils import * +from miasm2.arch.arm.sem import ir_arm + +import logging + +log = logging.getLogger('jit_arm') +hnd = logging.StreamHandler() +hnd.setFormatter(logging.Formatter("[%(levelname)s]: %(message)s")) +log.addHandler(hnd) +log.setLevel(logging.CRITICAL) + +class jitter_arm(jitter): + + def __init__(self, *args, **kwargs): + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_arm(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.PC + + def vm_push_uint32_t(self, v): + self.cpu.SP -= 4 + self.vm.vm_set_mem(self.cpu.SP, pck32(v)) + + def vm_pop_uint32_t(self): + x = upck32(self.vm.vm_get_mem(self.cpu.SP, 4)) + self.cpu.SP += 4 + return x + + def get_stack_arg(self, n): + x = upck32(self.vm.vm_get_mem(self.cpu.SP + 4 * n, 4)) + return x + + # calling conventions + + def func_args_stdcall(self, n_args): + args = [] + for i in xrange(min(n_args, 4)): + args.append(self.cpu.vm_get_gpreg()['R%d' % i]) + for i in xrange(max(0, n_args - 4)): + args.append(self.get_stack_arg(i)) + + ret_ad = self.cpu.LR + log.debug('%s %s %s' % (whoami(), hex(ret_ad), [hex(x) for x in args])) + return ret_ad, args + + def func_ret_stdcall(self, ret_addr, ret_value=None): + self.pc = self.cpu.PC = ret_addr + if ret_value is not None: + self.cpu.R0 = ret_value + return True + + def get_arg_n_stdcall(self, n): + if n < 4: + arg = self.cpu.vm_get_gpreg()['R%d' % n] + else: + arg = self.get_stack_arg(n-4) + return arg + + def add_lib_handler(self, libs): + from miasm2.jitter.os_dep import linux_stdlib + for offset, fname in libs.fad2cname.iteritems(): + if fname in linux_stdlib.__dict__: + self.add_breakpoint(offset, linux_stdlib.__dict__[fname]) + else: + log.warning( + 'jitter libhandler: %s function not found!' % fname) + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.PC = self.pc diff --git a/miasm2/arch/x86/jit.py b/miasm2/arch/x86/jit.py new file mode 100644 index 00000000..a365502f --- /dev/null +++ b/miasm2/arch/x86/jit.py @@ -0,0 +1,166 @@ +from miasm2.jitter.jitload import jitter +from miasm2.core import asmbloc +from miasm2.core.utils import * +from miasm2.arch.x86.sem import ir_x86_16, ir_x86_32, ir_x86_64 + + +import logging + +log = logging.getLogger('jit_x86') +hnd = logging.StreamHandler() +hnd.setFormatter(logging.Formatter("[%(levelname)s]: %(message)s")) +log.addHandler(hnd) +log.setLevel(logging.CRITICAL) + +class jitter_x86_16(jitter): + + def __init__(self, *args, **kwargs): + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_x86_16(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.RIP + self.my_ir.do_stk_segm = False + self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode + self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode + + def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): + self.orig_irbloc_fix_regs_for_mode(irbloc, 64) + + def vm_push_uint16_t(self, v): + self.cpu.SP -= self.my_ir.sp.size / 8 + self.vm.vm_set_mem(self.cpu.SP, pck16(v)) + + def vm_pop_uint16_t(self): + x = upck16(self.vm.vm_get_mem(self.cpu.SP, self.my_ir.sp.size / 8)) + self.cpu.SP += self.my_ir.sp.size / 8 + return x + + def get_stack_arg(self, n): + x = upck16(self.vm.vm_get_mem(self.cpu.SP + 4 * n, 4)) + return x + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.IP = self.pc + + +class jitter_x86_32(jitter): + + def __init__(self, *args, **kwargs): + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_x86_32(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.RIP + self.my_ir.do_stk_segm = False + + self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode + self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode + + def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): + self.orig_irbloc_fix_regs_for_mode(irbloc, 64) + + def vm_push_uint32_t(self, v): + self.cpu.ESP -= self.my_ir.sp.size / 8 + self.vm.vm_set_mem(self.cpu.ESP, pck32(v)) + + def vm_pop_uint32_t(self): + x = upck32(self.vm.vm_get_mem(self.cpu.ESP, self.my_ir.sp.size / 8)) + self.cpu.ESP += self.my_ir.sp.size / 8 + return x + + def get_stack_arg(self, n): + x = upck32(self.vm.vm_get_mem(self.cpu.ESP + 4 * n, 4)) + return x + + # calling conventions + + # stdcall + def func_args_stdcall(self, n_args): + ret_ad = self.vm_pop_uint32_t() + args = [] + for _ in xrange(n_args): + args.append(self.vm_pop_uint32_t()) + log.debug('%s %s %s' % (whoami(), hex(ret_ad), [hex(x) for x in args])) + return ret_ad, args + + def func_ret_stdcall(self, ret_addr, ret_value1=None, ret_value2=None): + self.cpu.EIP = ret_addr + if ret_value1 is not None: + self.cpu.EAX = ret_value1 + if ret_value2 is not None: + self.cpu.EDX = ret_value + + # cdecl + def func_args_cdecl(self, n_args, dolog=True): + ret_ad = self.vm_pop_uint32_t() + args = [] + for i in xrange(n_args): + args.append(self.get_stack_arg(i)) + if dolog: + log.debug('%s %s %s' % + (whoami(), hex(ret_ad), [hex(x) for x in args])) + return ret_ad, args + + def func_ret_cdecl(self, ret_addr, ret_value): + self.cpu.EIP = ret_addr + self.cpu.EAX = ret_value + + def add_lib_handler(self, libs, user_globals=None): + """Add a function to handle libs call with breakpoints + @libs: libimp instance + @user_globals: dictionnary for defined user function + """ + if user_globals is None: + user_globals = {} + + from miasm2.jitter.os_dep import win_api_x86_32 + + def handle_lib(jitter): + fname = libs.fad2cname[jitter.pc] + if fname in user_globals: + f = user_globals[fname] + elif fname in win_api_x86_32.__dict__: + f = win_api_x86_32.__dict__[fname] + else: + log.debug('%s' % repr(fname)) + raise ValueError('unknown api', hex(jitter.vm_pop_uint32_t()), repr(fname)) + f(jitter) + jitter.pc = getattr(jitter.cpu, jitter.my_ir.pc.name) + return True + + for f_addr in libs.fad2cname: + self.add_breakpoint(f_addr, handle_lib) + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.EIP = self.pc + + +class jitter_x86_64(jitter): + + def __init__(self, *args, **kwargs): + sp = asmbloc.asm_symbol_pool() + jitter.__init__(self, ir_x86_64(sp), *args, **kwargs) + self.my_ir.jit_pc = self.my_ir.arch.regs.RIP + self.my_ir.do_stk_segm = False + + self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode + self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode + + def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): + self.orig_irbloc_fix_regs_for_mode(irbloc, 64) + + def vm_push_uint64_t(self, v): + self.cpu.RSP -= self.my_ir.sp.size / 8 + self.vm.vm_set_mem(self.cpu.RSP, pck64(v)) + + def vm_pop_uint64_t(self): + x = upck64(self.vm.vm_get_mem(self.cpu.RSP, self.my_ir.sp.size / 8)) + self.cpu.RSP += self.my_ir.sp.size / 8 + return x + + def get_stack_arg(self, n): + x = upck64(self.vm.vm_get_mem(self.cpu.RSP + 8 * n, 8)) + return x + + def init_run(self, *args, **kwargs): + jitter.init_run(self, *args, **kwargs) + self.cpu.RIP = self.pc diff --git a/miasm2/core/utils.py b/miasm2/core/utils.py index ebffd786..360deb8d 100644 --- a/miasm2/core/utils.py +++ b/miasm2/core/utils.py @@ -1,4 +1,5 @@ import struct +import inspect upck8 = lambda x: struct.unpack('B', x)[0] upck16 = lambda x: struct.unpack('H', x)[0] @@ -44,3 +45,6 @@ class keydefaultdict(collections.defaultdict): raise KeyError(key) value = self[key] = self.default_factory(key) return value + +def whoami(): + return inspect.stack()[2][3] diff --git a/miasm2/jitter/jitload.py b/miasm2/jitter/jitload.py index a7249f78..56c1c09b 100644 --- a/miasm2/jitter/jitload.py +++ b/miasm2/jitter/jitload.py @@ -785,222 +785,6 @@ class jitter: self.vm.vm_set_mem(addr, s) -class jitter_x86_16(jitter): - - def __init__(self, *args, **kwargs): - from miasm2.arch.x86.sem import ir_x86_16 - sp = asmbloc.asm_symbol_pool() - jitter.__init__(self, ir_x86_16(sp), *args, **kwargs) - self.my_ir.jit_pc = self.my_ir.arch.regs.RIP - self.my_ir.do_stk_segm = False - self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode - self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode - - def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): - self.orig_irbloc_fix_regs_for_mode(irbloc, 64) - - def vm_push_uint16_t(self, v): - self.cpu.SP -= self.my_ir.sp.size / 8 - self.vm.vm_set_mem(self.cpu.SP, pck16(v)) - - def vm_pop_uint16_t(self): - x = upck16(self.vm.vm_get_mem(self.cpu.SP, self.my_ir.sp.size / 8)) - self.cpu.SP += self.my_ir.sp.size / 8 - return x - - def get_stack_arg(self, n): - x = upck16(self.vm.vm_get_mem(self.cpu.SP + 4 * n, 4)) - return x - - def init_run(self, *args, **kwargs): - jitter.init_run(self, *args, **kwargs) - self.cpu.IP = self.pc - - -class jitter_x86_32(jitter): - - def __init__(self, *args, **kwargs): - from miasm2.arch.x86.sem import ir_x86_32 - sp = asmbloc.asm_symbol_pool() - jitter.__init__(self, ir_x86_32(sp), *args, **kwargs) - self.my_ir.jit_pc = self.my_ir.arch.regs.RIP - self.my_ir.do_stk_segm = False - - self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode - self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode - - def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): - self.orig_irbloc_fix_regs_for_mode(irbloc, 64) - - def vm_push_uint32_t(self, v): - self.cpu.ESP -= self.my_ir.sp.size / 8 - self.vm.vm_set_mem(self.cpu.ESP, pck32(v)) - - def vm_pop_uint32_t(self): - x = upck32(self.vm.vm_get_mem(self.cpu.ESP, self.my_ir.sp.size / 8)) - self.cpu.ESP += self.my_ir.sp.size / 8 - return x - - def get_stack_arg(self, n): - x = upck32(self.vm.vm_get_mem(self.cpu.ESP + 4 * n, 4)) - return x - - # calling conventions - - # stdcall - def func_args_stdcall(self, n_args): - ret_ad = self.vm_pop_uint32_t() - args = [] - for _ in xrange(n_args): - args.append(self.vm_pop_uint32_t()) - log.debug('%s %s %s' % (whoami(), hex(ret_ad), [hex(x) for x in args])) - return ret_ad, args - - def func_ret_stdcall(self, ret_addr, ret_value1=None, ret_value2=None): - self.cpu.EIP = ret_addr - if ret_value1 is not None: - self.cpu.EAX = ret_value1 - if ret_value2 is not None: - self.cpu.EDX = ret_value - - # cdecl - def func_args_cdecl(self, n_args, dolog=True): - ret_ad = self.vm_pop_uint32_t() - args = [] - for i in xrange(n_args): - args.append(self.get_stack_arg(i)) - if dolog: - log.debug('%s %s %s' % - (whoami(), hex(ret_ad), [hex(x) for x in args])) - return ret_ad, args - - def func_ret_cdecl(self, ret_addr, ret_value): - self.cpu.EIP = ret_addr - self.cpu.EAX = ret_value - - def add_lib_handler(self, libs, user_globals=None): - """Add a function to handle libs call with breakpoints - @libs: libimp instance - @user_globals: dictionnary for defined user function - """ - if user_globals is None: - user_globals = {} - - from miasm2.jitter.os_dep import win_api_x86_32 - - def handle_lib(jitter): - fname = libs.fad2cname[jitter.pc] - if fname in user_globals: - f = user_globals[fname] - elif fname in win_api_x86_32.__dict__: - f = win_api_x86_32.__dict__[fname] - else: - log.debug('%s' % repr(fname)) - raise ValueError('unknown api', hex(jitter.vm_pop_uint32_t()), repr(fname)) - f(jitter) - jitter.pc = getattr(jitter.cpu, jitter.my_ir.pc.name) - return True - - for f_addr in libs.fad2cname: - self.add_breakpoint(f_addr, handle_lib) - - def init_run(self, *args, **kwargs): - jitter.init_run(self, *args, **kwargs) - self.cpu.EIP = self.pc - - -class jitter_x86_64(jitter): - - def __init__(self, *args, **kwargs): - from miasm2.arch.x86.sem import ir_x86_64 - sp = asmbloc.asm_symbol_pool() - jitter.__init__(self, ir_x86_64(sp), *args, **kwargs) - self.my_ir.jit_pc = self.my_ir.arch.regs.RIP - self.my_ir.do_stk_segm = False - - self.orig_irbloc_fix_regs_for_mode = self.my_ir.irbloc_fix_regs_for_mode - self.my_ir.irbloc_fix_regs_for_mode = self.my_irbloc_fix_regs_for_mode - - def my_irbloc_fix_regs_for_mode(self, irbloc, attrib=64): - self.orig_irbloc_fix_regs_for_mode(irbloc, 64) - - def vm_push_uint64_t(self, v): - self.cpu.RSP -= self.my_ir.sp.size / 8 - self.vm.vm_set_mem(self.cpu.RSP, pck64(v)) - - def vm_pop_uint64_t(self): - x = upck64(self.vm.vm_get_mem(self.cpu.RSP, self.my_ir.sp.size / 8)) - self.cpu.RSP += self.my_ir.sp.size / 8 - return x - - def get_stack_arg(self, n): - x = upck64(self.vm.vm_get_mem(self.cpu.RSP + 8 * n, 8)) - return x - - def init_run(self, *args, **kwargs): - jitter.init_run(self, *args, **kwargs) - self.cpu.RIP = self.pc - - -class jitter_arm(jitter): - - def __init__(self, *args, **kwargs): - from miasm2.arch.arm.sem import ir_arm - sp = asmbloc.asm_symbol_pool() - jitter.__init__(self, ir_arm(sp), *args, **kwargs) - self.my_ir.jit_pc = self.my_ir.arch.regs.PC - - def vm_push_uint32_t(self, v): - self.cpu.SP -= 4 - self.vm.vm_set_mem(self.cpu.SP, pck32(v)) - - def vm_pop_uint32_t(self): - x = upck32(self.vm.vm_get_mem(self.cpu.SP, 4)) - self.cpu.SP += 4 - return x - - def get_stack_arg(self, n): - x = upck32(self.vm.vm_get_mem(self.cpu.SP + 4 * n, 4)) - return x - - # calling conventions - - def func_args_stdcall(self, n_args): - args = [] - for i in xrange(min(n_args, 4)): - args.append(self.cpu.vm_get_gpreg()['R%d' % i]) - for i in xrange(max(0, n_args - 4)): - args.append(self.get_stack_arg(i)) - - ret_ad = self.cpu.LR - log.debug('%s %s %s' % (whoami(), hex(ret_ad), [hex(x) for x in args])) - return ret_ad, args - - def func_ret_stdcall(self, ret_addr, ret_value=None): - self.pc = self.cpu.PC = ret_addr - if ret_value is not None: - self.cpu.R0 = ret_value - return True - - def get_arg_n_stdcall(self, n): - if n < 4: - arg = self.cpu.vm_get_gpreg()['R%d' % n] - else: - arg = self.get_stack_arg(n-4) - return arg - - def add_lib_handler(self, libs): - from miasm2.jitter.os_dep import linux_stdlib - for offset, fname in libs.fad2cname.iteritems(): - if fname in linux_stdlib.__dict__: - self.add_breakpoint(offset, linux_stdlib.__dict__[fname]) - else: - log.warning( - 'jitter libhandler: %s function not found!' % fname) - - def init_run(self, *args, **kwargs): - jitter.init_run(self, *args, **kwargs) - self.cpu.PC = self.pc def vm2pe(myjit, fname, libs=None, e_orig=None, diff --git a/test/jitter/os_dep/win_api_x86_32.py b/test/jitter/os_dep/win_api_x86_32.py index a3b89305..08611af4 100644 --- a/test/jitter/os_dep/win_api_x86_32.py +++ b/test/jitter/os_dep/win_api_x86_32.py @@ -3,11 +3,12 @@ import unittest import logging - -from miasm2.jitter.jitload import jitter_x86_32 +from miasm2.analysis.machine import Machine import miasm2.jitter.os_dep.win_api_x86_32 as winapi -jit = jitter_x86_32() +machine = Machine("x86_32") + +jit = machine.jitter() jit.init_stack() |