diff options
Diffstat (limited to 'miasm2')
| -rw-r--r-- | miasm2/analysis/sandbox.py | 38 | ||||
| -rw-r--r-- | miasm2/os_dep/linux_stdlib.py | 47 |
2 files changed, 59 insertions, 26 deletions
diff --git a/miasm2/analysis/sandbox.py b/miasm2/analysis/sandbox.py index 5bdccddd..8ffdb4ac 100644 --- a/miasm2/analysis/sandbox.py +++ b/miasm2/analysis/sandbox.py @@ -284,6 +284,7 @@ class OS_Linux(OS): # Library calls handler self.jitter.add_lib_handler(self.libs, methods) + linux_stdlib.ABORT_ADDR = self.CALL_FINISH_ADDR # Arguments self.argv = [self.PROGRAM_PATH] @@ -329,6 +330,7 @@ class OS_Linux_str(OS): # Library calls handler self.jitter.add_lib_handler(libs, methods) + linux_stdlib.ABORT_ADDR = self.CALL_FINISH_ADDR # Arguments self.argv = [self.PROGRAM_PATH] @@ -458,10 +460,10 @@ class Sandbox_Win_x86_32(Sandbox, Arch_x86_32, OS_Win): self.jitter.push_uint32_t(2) self.jitter.push_uint32_t(1) self.jitter.push_uint32_t(0) - self.jitter.push_uint32_t(0x1337beef) + self.jitter.push_uint32_t(self.CALL_FINISH_ADDR) # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): """ @@ -491,10 +493,10 @@ class Sandbox_Win_x86_64(Sandbox, Arch_x86_64, OS_Win): self.jitter.push_uint64_t(0) # Pre-stack return address - self.jitter.push_uint64_t(0x1337beef) + self.jitter.push_uint64_t(self.CALL_FINISH_ADDR) # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): """ @@ -536,7 +538,7 @@ class Sandbox_Linux_x86_32(Sandbox, Arch_x86_32, OS_Linux): self.jitter.vm.set_mem(ptr, arg) argv_ptrs.append(ptr) - self.jitter.push_uint32_t(0x1337beef) + self.jitter.push_uint32_t(self.CALL_FINISH_ADDR) self.jitter.push_uint32_t(0) for ptr in reversed(env_ptrs): self.jitter.push_uint32_t(ptr) @@ -545,10 +547,10 @@ class Sandbox_Linux_x86_32(Sandbox, Arch_x86_32, OS_Linux): self.jitter.push_uint32_t(ptr) self.jitter.push_uint32_t(len(self.argv)) else: - self.jitter.push_uint32_t(0x1337beef) + self.jitter.push_uint32_t(self.CALL_FINISH_ADDR) # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): """ @@ -591,7 +593,7 @@ class Sandbox_Linux_x86_64(Sandbox, Arch_x86_64, OS_Linux): self.jitter.vm.set_mem(ptr, arg) argv_ptrs.append(ptr) - self.jitter.push_uint64_t(0x1337beef) + self.jitter.push_uint64_t(self.CALL_FINISH_ADDR) self.jitter.push_uint64_t(0) for ptr in reversed(env_ptrs): self.jitter.push_uint64_t(ptr) @@ -600,10 +602,10 @@ class Sandbox_Linux_x86_64(Sandbox, Arch_x86_64, OS_Linux): self.jitter.push_uint64_t(ptr) self.jitter.push_uint64_t(len(self.argv)) else: - self.jitter.push_uint64_t(0x1337beef) + self.jitter.push_uint64_t(self.CALL_FINISH_ADDR) # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): """ @@ -653,10 +655,10 @@ class Sandbox_Linux_arml(Sandbox, Arch_arml, OS_Linux): self.jitter.push_uint32_t(ptr) self.jitter.push_uint32_t(len(self.argv)) - self.jitter.cpu.LR = 0x1337beef + self.jitter.cpu.LR = self.CALL_FINISH_ADDR # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): if addr is None and self.options.address is None: @@ -678,10 +680,10 @@ class Sandbox_Linux_armb_str(Sandbox, Arch_armb, OS_Linux_str): def __init__(self, *args, **kwargs): Sandbox.__init__(self, *args, **kwargs) - self.jitter.cpu.LR = 0x1337beef + self.jitter.cpu.LR = self.CALL_FINISH_ADDR # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): if addr is None and self.options.address is not None: @@ -694,10 +696,10 @@ class Sandbox_Linux_arml_str(Sandbox, Arch_arml, OS_Linux_str): def __init__(self, *args, **kwargs): Sandbox.__init__(self, *args, **kwargs) - self.jitter.cpu.LR = 0x1337beef + self.jitter.cpu.LR = self.CALL_FINISH_ADDR # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): if addr is None and self.options.address is not None: @@ -735,10 +737,10 @@ class Sandbox_Linux_aarch64l(Sandbox, Arch_aarch64l, OS_Linux): self.jitter.push_uint64_t(ptr) self.jitter.push_uint64_t(len(self.argv)) - self.jitter.cpu.LR = 0x1337beef + self.jitter.cpu.LR = self.CALL_FINISH_ADDR # Set the runtime guard - self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle) + self.jitter.add_breakpoint(self.CALL_FINISH_ADDR, self.__class__.code_sentinelle) def run(self, addr=None): if addr is None and self.options.address is None: diff --git a/miasm2/os_dep/linux_stdlib.py b/miasm2/os_dep/linux_stdlib.py index d0e281a1..9e1cc9db 100644 --- a/miasm2/os_dep/linux_stdlib.py +++ b/miasm2/os_dep/linux_stdlib.py @@ -1,5 +1,6 @@ #-*- coding:utf-8 -*- +import struct from sys import stdout from string import printable @@ -31,21 +32,51 @@ def xxx___libc_start_main(jitter): Note: - init, fini, rtld_fini are ignored - return address is forced to ABORT_ADDR, to avoid calling abort/hlt/... + - in powerpc, signature is: + + int __libc_start_main (int argc, char **argv, char **ev, ElfW (auxv_t) * + auxvec, void (*rtld_fini) (void), struct startup_info + *stinfo, char **stack_on_entry) """ global ABORT_ADDR - ret_ad, args = jitter.func_args_systemv(["main", "argc", "ubp_av", "init", - "fini", "rtld_fini", "stack_end"]) + if jitter.arch.name == "ppc32": + ret_ad, args = jitter.func_args_systemv( + ["argc", "argv", "ev", "aux_vec", "rtld_fini", "st_info", + "stack_on_entry"] + ) + + # Mimic glibc implementation + if args.stack_on_entry != 0: + argc = struct.unpack(">I", + jitter.vm.get_mem(args.stack_on_entry, 4))[0] + argv = args.stack_on_entry + 4 + envp = argv + ((argc + 1) * 4) + else: + argc = args.argc + argv = args.argv + envp = args.ev + # sda_base, main, init, fini + _, main, _, _ = struct.unpack(">IIII", + jitter.vm.get_mem(args.st_info, 4 * 4)) + + else: + ret_ad, args = jitter.func_args_systemv( + ["main", "argc", "ubp_av", "init", "fini", "rtld_fini", "stack_end"] + ) + + main = args.main + # done by __libc_init_first + size = jitter.ir_arch.pc.size / 8 + argc = args.argc + argv = args.ubp_av + envp = argv + (args.argc + 1) * size - # done by __libc_init_first - size = jitter.ir_arch.pc.size / 8 - argv = args.ubp_av - envp = argv + (args.argc + 1) * size # Call int main(int argc, char** argv, char** envp) - jitter.func_ret_systemv(args.main) + jitter.func_ret_systemv(main) ret_ad = ABORT_ADDR - jitter.func_prepare_systemv(ret_ad, args.argc, argv, envp) + jitter.func_prepare_systemv(ret_ad, argc, argv, envp) return True |