1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
#! /usr/bin/env python
from miasm2.core.cpu import parse_ast
from miasm2.arch.arm.arch import mn_armt, base_expr, variable
from miasm2.core import parse_asm
from miasm2.expression.expression import *
from miasm2.core import asmbloc
from elfesteem.strpatchwork import StrPatchwork
from pdb import pm
my_mn = mn_armt
reg_and_id = dict(mn_armt.regs.all_regs_ids_byname)
def my_ast_int2expr(a):
return ExprInt32(a)
def my_ast_id2expr(t):
return reg_and_id.get(t, ExprId(t, size=32))
my_var_parser = parse_ast(my_ast_id2expr, my_ast_int2expr)
base_expr.setParseAction(my_var_parser)
blocs, symbol_pool = parse_asm.parse_txt(my_mn, "armt", '''
memcpy:
PUSH {R0-R3, LR}
B test_end
loop:
LDRB R3, [R1]
STRB R3, [R0]
ADDS R0, R0, 1
ADDS R1, R1, 1
SUBS R2, R2, 1
test_end:
CMP R2, 0
BNE loop
POP {R0-R3, PC}
main:
PUSH {LR}
SUB SP, 0x100
MOV R0, SP
ADD R1, PC, mystr-$+6
MOV R0, R0
EORS R2, R2
ADDS R2, R2, 0x4
BL memcpy
ADD SP, 0x100
POP {PC}
mystr:
.string "toto"
''')
# fix shellcode addr
symbol_pool.set_offset(symbol_pool.getby_name("main"), 0x3a4b8)
for b in blocs[0]:
print b
# graph sc####
g = asmbloc.bloc2graph(blocs[0])
open("graph.txt", "w").write(g)
s = StrPatchwork()
print "symbols"
print symbol_pool
# dont erase from start to shell code padading
resolved_b, patches = asmbloc.asm_resolve_final(
my_mn, 'armt', blocs[0], symbol_pool)
print patches
for offset, raw in patches.items():
s[offset] = raw
open('demo_armt.bin', 'wb').write(str(s))
|