diff options
Diffstat (limited to 'example')
| -rwxr-xr-x | example/asm/shellcode.py | 5 | ||||
| -rw-r--r-- | example/disasm/single_instr.py | 4 | ||||
| -rw-r--r-- | example/expression/get_read_write.py | 5 | ||||
| -rw-r--r-- | example/expression/solve_condition_stp.py | 46 | ||||
| -rw-r--r-- | example/symbol_exec/single_instr.py | 8 |
5 files changed, 31 insertions, 37 deletions
diff --git a/example/asm/shellcode.py b/example/asm/shellcode.py index bacb65fb..0c08a8a3 100755 --- a/example/asm/shellcode.py +++ b/example/asm/shellcode.py @@ -64,7 +64,10 @@ else: with open(args.source) as fstream: source = fstream.read() -blocks, symbol_pool = parse_asm.parse_txt(machine.mn, attrib, source) + +symbol_pool = asmblock.AsmSymbolPool() + +blocks, symbol_pool = parse_asm.parse_txt(machine.mn, attrib, source, symbol_pool) # Fix shellcode addrs symbol_pool.set_offset(symbol_pool.getby_name("main"), addr_main) diff --git a/example/disasm/single_instr.py b/example/disasm/single_instr.py index 0e29dcee..59b81de7 100644 --- a/example/disasm/single_instr.py +++ b/example/disasm/single_instr.py @@ -1,7 +1,9 @@ from miasm2.arch.x86.arch import mn_x86 from miasm2.arch.x86.regs import EDX +from miasm2.core.asmblock import AsmSymbolPool -l = mn_x86.fromstring('MOV EAX, EBX', 32) +symbol_pool = AsmSymbolPool() +l = mn_x86.fromstring('MOV EAX, EBX', symbol_pool, 32) print "instruction:", l print "arg:", l.args[0] x = mn_x86.asm(l) diff --git a/example/expression/get_read_write.py b/example/expression/get_read_write.py index d107cfa2..9e3b5caf 100644 --- a/example/expression/get_read_write.py +++ b/example/expression/get_read_write.py @@ -1,6 +1,9 @@ from miasm2.arch.x86.arch import mn_x86 from miasm2.expression.expression import get_rw from miasm2.arch.x86.ira import ir_a_x86_32 +from miasm2.core.asmblock import AsmSymbolPool + +symbol_pool = AsmSymbolPool() print """ @@ -11,7 +14,7 @@ Get read/written registers for a given instruction arch = mn_x86 ir_arch = ir_a_x86_32() -l = arch.fromstring('LODSB', 32) +l = arch.fromstring('LODSB', symbol_pool, 32) l.offset, l.l = 0, 15 ir_arch.add_instr(l) diff --git a/example/expression/solve_condition_stp.py b/example/expression/solve_condition_stp.py index 44b73043..201d9f26 100644 --- a/example/expression/solve_condition_stp.py +++ b/example/expression/solve_condition_stp.py @@ -6,7 +6,6 @@ from pdb import pm from miasm2.analysis.machine import Machine from miasm2.expression.expression import ExprInt, ExprCond, ExprId, \ get_expr_ids, ExprAff -from miasm2.arch.x86.arch import ParseAst from miasm2.core.bin_stream import bin_stream_str from miasm2.core import asmblock from miasm2.ir.symbexec import SymbolicExecutionEngine, get_block @@ -50,7 +49,6 @@ def emul_symb(ir_arch, mdis, states_todo, states_done): symbexec.dump(mems=False) assert addr is not None - if isinstance(addr, ExprCond): # Create 2 states, each including complementary conditions cond_group_a = {addr.cond: ExprInt(0, addr.cond.size)} @@ -67,15 +65,15 @@ def emul_symb(ir_arch, mdis, states_todo, states_done): addr_b = int(addr_b.arg) states_todo.add((addr_a, symbexec.symbols.copy(), tuple(list(conds) + cond_group_a.items()))) states_todo.add((addr_b, symbexec.symbols.copy(), tuple(list(conds) + cond_group_b.items()))) + elif addr == ret_addr: + print 'Return address reached' + continue elif isinstance(addr, ExprInt): addr = int(addr.arg) states_todo.add((addr, symbexec.symbols.copy(), tuple(conds))) elif asmblock.expr_is_label(addr): addr = addr.name states_todo.add((addr, symbexec.symbols.copy(), tuple(conds))) - elif addr == ret_addr: - print 'Return address reached' - continue else: raise ValueError("Unsupported destination") @@ -92,32 +90,6 @@ if __name__ == '__main__': symbols_init = dict(machine.mn.regs.regs_init) - # config parser for 32 bit - reg_and_id = dict(machine.mn.regs.all_regs_ids_byname) - - def my_ast_int2expr(name): - return ExprInt(name, 32) - - # Modifify parser to avoid label creation in PUSH argc - def my_ast_id2expr(string_parsed): - if string_parsed in reg_and_id: - return reg_and_id[string_parsed] - return ExprId(string_parsed, size=32) - - my_var_parser = ParseAst(my_ast_id2expr, my_ast_int2expr) - machine.base_expr.setParseAction(my_var_parser) - - argc = ExprId('argc', 32) - argv = ExprId('argv', 32) - ret_addr = ExprId('ret_addr', 32) - reg_and_id[argc.name] = argc - reg_and_id[argv.name] = argv - reg_and_id[ret_addr.name] = ret_addr - - my_symbols = [argc, argv, ret_addr] - my_symbols = dict([(x.name, x) for x in my_symbols]) - my_symbols.update(machine.mn.regs.all_regs_ids_byname) - ir_arch = machine.ir(mdis.symbol_pool) symbexec = SymbolicExecutionEngine(ir_arch, symbols_init) @@ -126,7 +98,17 @@ if __name__ == '__main__': PUSH argv PUSH argc PUSH ret_addr - ''') + ''', + symbol_pool=mdis.symbol_pool) + + + argc_lbl = symbol_pool.getby_name('argc') + argv_lbl = symbol_pool.getby_name('argv') + ret_addr_lbl = symbol_pool.getby_name('ret_addr') + + argc = ExprId(argc_lbl, 32) + argv = ExprId(argv_lbl, 32) + ret_addr = ExprId(ret_addr_lbl, 32) b = list(blocks)[0] diff --git a/example/symbol_exec/single_instr.py b/example/symbol_exec/single_instr.py index e5637ad8..22a48fc6 100644 --- a/example/symbol_exec/single_instr.py +++ b/example/symbol_exec/single_instr.py @@ -2,18 +2,22 @@ from miasm2.core.bin_stream import bin_stream_str from miasm2.ir.symbexec import SymbolicExecutionEngine from miasm2.analysis.machine import Machine +from miasm2.core.asmblock import AsmSymbolPool START_ADDR = 0 machine = Machine("x86_32") +symbol_pool = AsmSymbolPool() + + # Assemble and disassemble a MOV ## Ensure that attributes 'offset' and 'l' are set -line = machine.mn.fromstring("MOV EAX, EBX", 32) +line = machine.mn.fromstring("MOV EAX, EBX", symbol_pool, 32) asm = machine.mn.asm(line)[0] # Get back block bin_stream = bin_stream_str(asm) -mdis = machine.dis_engine(bin_stream) +mdis = machine.dis_engine(bin_stream, symbol_pool=symbol_pool) mdis.lines_wd = 1 asm_block = mdis.dis_block(START_ADDR) |