From 639abbe623a5d04d173495f29aff698e80577d8a Mon Sep 17 00:00:00 2001 From: Ajax Date: Thu, 9 May 2019 10:40:26 +0200 Subject: Example: rename elfesteem -> loader --- example/elfesteem/minidump_to_pe.py | 48 ------------------------------------- example/elfesteem/test_pe.py | 31 ------------------------ example/loader/minidump_to_pe.py | 48 +++++++++++++++++++++++++++++++++++++ example/loader/test_pe.py | 31 ++++++++++++++++++++++++ 4 files changed, 79 insertions(+), 79 deletions(-) delete mode 100644 example/elfesteem/minidump_to_pe.py delete mode 100644 example/elfesteem/test_pe.py create mode 100644 example/loader/minidump_to_pe.py create mode 100644 example/loader/test_pe.py (limited to 'example') diff --git a/example/elfesteem/minidump_to_pe.py b/example/elfesteem/minidump_to_pe.py deleted file mode 100644 index 30a95325..00000000 --- a/example/elfesteem/minidump_to_pe.py +++ /dev/null @@ -1,48 +0,0 @@ -#! /usr/bin/env python -"""Minidump to PE example""" - -import sys - -from future.utils import viewvalues - -from miasm.loader.minidump_init import Minidump -from miasm.loader.pe_init import PE - -minidump = Minidump(open(sys.argv[1], 'rb').read()) - -pe = PE() -for i, memory in enumerate(sorted(viewvalues(minidump.memory), - key=lambda x:x.address)): - # Get section name - name = str(memory.name) - if not name: - name = "s_%02d" % i - else: - name = name.split('\\')[-1] - - # Get section protection - protect = memory.pretty_protect - protect_mask = 0x20 - if protect == "UNKNOWN": - protect_mask |= 0xe0000000 - else: - if "EXECUTE" in protect: - protect_mask |= 1 << 29 - if "READ" in protect: - protect_mask |= 1 << 30 - if "WRITE" in protect: - protect_mask |= 1 << 31 - - # Add the section - pe.SHList.add_section(name=name, addr=memory.address, rawsize=memory.size, - data=memory.content, flags=protect_mask) - -# Find entry point -try: - entry_point = minidump.threads.Threads[0].ThreadContext.Eip[0] -except AttributeError: - entry_point = minidump.threads.Threads[0].ThreadContext.Rip[0] - -pe.Opthdr.AddressOfEntryPoint = entry_point - -open("out_pe.bin", "wb").write(bytes(pe)) diff --git a/example/elfesteem/test_pe.py b/example/elfesteem/test_pe.py deleted file mode 100644 index 543cbea5..00000000 --- a/example/elfesteem/test_pe.py +++ /dev/null @@ -1,31 +0,0 @@ -#! /usr/bin/env python - -import miasm.loader.pe as pe -from miasm.loader.pe_init import PE -import rlcompleter -import readline -import pdb -import sys -from pprint import pprint as pp -readline.parse_and_bind("tab: complete") - - -e_ = PE() -mysh = b"\xc3" -s_text = e_.SHList.add_section( - name="text", addr=0x1000, rawsize=0x1000, data=mysh) -e_.Opthdr.AddressOfEntryPoint = s_text.addr -new_dll = [({"name": "kernel32.dll", - "firstthunk": s_text.addr + 0x100}, - ["CreateFileA", "SetFilePointer", "WriteFile", "CloseHandle"] - ), - ({"name": "USER32.dll", - "firstthunk": None}, - ["SetDlgItemInt", "GetMenu", "HideCaret"] - ) - ] -e_.DirImport.add_dlldesc(new_dll) - -s_myimp = e_.SHList.add_section(name="myimp", rawsize=0x1000) -e_.DirImport.set_rva(s_myimp.addr) -open('uu.bin', 'wb').write(bytes(e_)) diff --git a/example/loader/minidump_to_pe.py b/example/loader/minidump_to_pe.py new file mode 100644 index 00000000..30a95325 --- /dev/null +++ b/example/loader/minidump_to_pe.py @@ -0,0 +1,48 @@ +#! /usr/bin/env python +"""Minidump to PE example""" + +import sys + +from future.utils import viewvalues + +from miasm.loader.minidump_init import Minidump +from miasm.loader.pe_init import PE + +minidump = Minidump(open(sys.argv[1], 'rb').read()) + +pe = PE() +for i, memory in enumerate(sorted(viewvalues(minidump.memory), + key=lambda x:x.address)): + # Get section name + name = str(memory.name) + if not name: + name = "s_%02d" % i + else: + name = name.split('\\')[-1] + + # Get section protection + protect = memory.pretty_protect + protect_mask = 0x20 + if protect == "UNKNOWN": + protect_mask |= 0xe0000000 + else: + if "EXECUTE" in protect: + protect_mask |= 1 << 29 + if "READ" in protect: + protect_mask |= 1 << 30 + if "WRITE" in protect: + protect_mask |= 1 << 31 + + # Add the section + pe.SHList.add_section(name=name, addr=memory.address, rawsize=memory.size, + data=memory.content, flags=protect_mask) + +# Find entry point +try: + entry_point = minidump.threads.Threads[0].ThreadContext.Eip[0] +except AttributeError: + entry_point = minidump.threads.Threads[0].ThreadContext.Rip[0] + +pe.Opthdr.AddressOfEntryPoint = entry_point + +open("out_pe.bin", "wb").write(bytes(pe)) diff --git a/example/loader/test_pe.py b/example/loader/test_pe.py new file mode 100644 index 00000000..543cbea5 --- /dev/null +++ b/example/loader/test_pe.py @@ -0,0 +1,31 @@ +#! /usr/bin/env python + +import miasm.loader.pe as pe +from miasm.loader.pe_init import PE +import rlcompleter +import readline +import pdb +import sys +from pprint import pprint as pp +readline.parse_and_bind("tab: complete") + + +e_ = PE() +mysh = b"\xc3" +s_text = e_.SHList.add_section( + name="text", addr=0x1000, rawsize=0x1000, data=mysh) +e_.Opthdr.AddressOfEntryPoint = s_text.addr +new_dll = [({"name": "kernel32.dll", + "firstthunk": s_text.addr + 0x100}, + ["CreateFileA", "SetFilePointer", "WriteFile", "CloseHandle"] + ), + ({"name": "USER32.dll", + "firstthunk": None}, + ["SetDlgItemInt", "GetMenu", "HideCaret"] + ) + ] +e_.DirImport.add_dlldesc(new_dll) + +s_myimp = e_.SHList.add_section(name="myimp", rawsize=0x1000) +e_.DirImport.set_rva(s_myimp.addr) +open('uu.bin', 'wb').write(bytes(e_)) -- cgit 1.4.1