diff options
Diffstat (limited to 'example/asm/armt.py')
| -rw-r--r-- | example/asm/armt.py | 90 |
1 files changed, 90 insertions, 0 deletions
diff --git a/example/asm/armt.py b/example/asm/armt.py new file mode 100644 index 00000000..f4ce6d2d --- /dev/null +++ b/example/asm/armt.py @@ -0,0 +1,90 @@ +#! /usr/bin/env python + +from pdb import pm + +from elfesteem.strpatchwork import StrPatchwork + +from miasm2.core.cpu import parse_ast +from miasm2.arch.arm.arch import mn_armt, base_expr +from miasm2.core import parse_asm +import miasm2.expression.expression as m2_expr +from miasm2.core import asmbloc + +my_mn = mn_armt + +reg_and_id = dict(mn_armt.regs.all_regs_ids_byname) + + +def my_ast_int2expr(a): + return m2_expr.ExprInt32(a) + + +def my_ast_id2expr(t): + return reg_and_id.get(t, m2_expr.ExprId(t, size=32)) + +my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr) +base_expr.setParseAction(my_var_parser) + +txt = ''' +memcpy: + PUSH {R0-R3, LR} + B test_end +loop: + LDRB R3, [R1] + STRB R3, [R0] + ADDS R0, R0, 1 + ADDS R1, R1, 1 + SUBS R2, R2, 1 +test_end: + CMP R2, 0 + BNE loop + POP {R0-R3, PC} +main: + PUSH {LR} + SUB SP, 0x100 + MOV R0, SP + ADD R1, PC, mystr-$+6 + MOV R0, R0 + EORS R2, R2 + ADDS R2, R2, 0x4 + BL memcpy + ADD SP, 0x100 + POP {PC} + +mystr: +.string "toto" +''' + +blocs_b, symbol_pool_b = parse_asm.parse_txt(my_mn, "b", txt) +blocs_l, symbol_pool_l = parse_asm.parse_txt(my_mn, "l", txt) + +# fix shellcode addr +symbol_pool_b.set_offset(symbol_pool_b.getby_name("main"), 0) +symbol_pool_l.set_offset(symbol_pool_l.getby_name("main"), 0) + +# graph sc#### +g = asmbloc.bloc2graph(blocs_b[0]) +open("graph.txt", "w").write(g) + +s_b = StrPatchwork() +s_l = StrPatchwork() + +print "symbols" +print symbol_pool_b +# dont erase from start to shell code padading +resolved_b, patches_b = asmbloc.asm_resolve_final( + my_mn, blocs_b[0], symbol_pool_b) +resolved__l, patches_l = asmbloc.asm_resolve_final( + my_mn, blocs_l[0], symbol_pool_l) +print patches_b +print patches_l + + + +for offset, raw in patches_b.items(): + s_b[offset] = raw +for offset, raw in patches_l.items(): + s_l[offset] = raw + +open('demo_armt_b.bin', 'wb').write(str(s_b)) +open('demo_armt_l.bin', 'wb').write(str(s_l)) |