2 from argparse
import ArgumentParser
12 Parent class for Sandbox abstraction
23 Iterator on parent classes except Sanbox
25 for base_cls
in cls.__bases__:
27 if base_cls == Sandbox:
32 classes = property(
lambda x:x.__class__._classes_())
34 def __init__(self, fname, options, custom_methods = {}):
38 @options: namespace instance of specific options
39 @custom_methods: { str => func } for custom API implementations
48 if issubclass(cls, OS):
49 cls.__init__(self, custom_methods)
54 if self.options.singlestep:
55 self.jitter.jit.log_mn =
True
56 self.jitter.jit.log_regs =
True
58 if not self.options.quiet_function_calls:
59 log_func.setLevel(logging.INFO)
61 if self.options.dumpblocs:
62 self.jitter.jit.log_newbloc =
True
67 Return instance of instance parser with expecting options.
68 Extra parameters are passed to parser initialisation.
71 parser = ArgumentParser(*args, **kwargs)
72 parser.add_argument(
'-a',
"--address",
73 help=
"Force entry point address", default=
None)
74 parser.add_argument(
'-x',
"--dumpall", action=
"store_true",
76 parser.add_argument(
'-b',
"--dumpblocs", action=
"store_true",
77 help=
"Log disasm blocks")
78 parser.add_argument(
'-z',
"--singlestep", action=
"store_true",
79 help=
"Log single step")
80 parser.add_argument(
'-d',
"--debugging", action=
"store_true",
82 parser.add_argument(
'-g',
"--gdbserver", type=int,
83 help=
"Listen on port @port")
84 parser.add_argument(
"-j",
"--jitter",
85 help=
"Jitter engine. Possible values are: tcc (default), llvm, python",
87 parser.add_argument(
'-q',
"--quiet-function-calls", action=
"store_true",
88 help=
"Don't log function calls")
90 for base_cls
in cls._classes_():
91 base_cls.update_parser(parser)
94 def run(self, addr=None):
96 Launch emulation (gdbserver, debugging, basic JIT).
97 @addr: (int) start address
99 if addr
is None and self.options.address
is not None:
100 addr = int(self.options.address, 0)
102 if any([self.options.debugging, self.options.gdbserver]):
107 if self.options.gdbserver:
108 port = self.options.gdbserver
109 print "Listen on port %d" % port
110 gdb = self.machine.gdbserver(dbg, port)
119 self.jitter.init_run(addr)
120 self.jitter.continue_run()
125 Parent class for OS abstraction
138 Parent class for Arch abstraction
145 self.
jitter = self.machine.jitter(self.options.jitter)
154 ALL_IMP_DLL = [
"ntdll.dll",
"kernel32.dll",
"user32.dll",
155 "ole32.dll",
"urlmon.dll",
156 "ws2_32.dll",
'advapi32.dll',
"psapi.dll",
159 def __init__(self, custom_methods, *args, **kwargs):
162 methods = win_api_x86_32.__dict__
163 methods.update(custom_methods)
165 super(OS_Win, self).
__init__(methods, *args, **kwargs)
170 win_api_x86_32.winobjs.runtime_dll = libs
173 if self.options.loadbasedll:
180 for pe
in all_pe.values():
184 with open(self.fname)
as fstream:
187 win_api_x86_32.winobjs.current_pe = self.
pe
193 self.jitter.add_lib_handler(libs, methods)
196 if self.options.use_seh:
197 win_api_x86_32_seh.main_pe_name = self.fname
198 win_api_x86_32_seh.main_pe = self.
pe
199 win_api_x86_32_seh.loaded_modules = self.
ALL_IMP_DLL
200 win_api_x86_32_seh.init_seh(self.jitter)
201 win_api_x86_32_seh.set_win_fs_0(self.jitter)
203 self.
entry_point = self.pe.rva2virt(self.pe.Opthdr.AddressOfEntryPoint)
207 parser.add_argument(
'-o',
"--loadhdr", action=
"store_true",
209 parser.add_argument(
'-e',
"--loadmainpe", action=
"store_true",
211 parser.add_argument(
'-y',
"--use-seh", action=
"store_true",
212 help=
"Use windows SEH")
213 parser.add_argument(
'-l',
"--loadbasedll", action=
"store_true",
214 help=
"Load base dll (path './win_dll')")
215 parser.add_argument(
'-r',
"--parse-resources",
216 action=
"store_true", help=
"Load resources")
221 def __init__(self, custom_methods, *args, **kwargs):
224 methods = linux_stdlib.__dict__
225 methods.update(custom_methods)
227 super(OS_Linux, self).
__init__(methods, *args, **kwargs)
232 with open(self.fname)
as fstream:
239 self.jitter.add_lib_handler(self.
libs, methods)
242 def __init__(self, custom_methods, *args, **kwargs):
245 methods = linux_stdlib.__dict__
246 methods.update(custom_methods)
248 super(OS_Linux_str, self).
__init__(methods, *args, **kwargs)
254 data = open(self.fname).read()
255 self.options.load_base_addr = int(self.options.load_base_addr, 0)
256 self.jitter.vm.add_memory_page(self.options.load_base_addr, PAGE_READ | PAGE_WRITE, data)
259 self.jitter.add_lib_handler(libs, methods)
263 parser.add_argument(
"load_base_addr", help=
"load base address")
269 STACK_BASE = 0x130000
274 if self.options.usesegm:
275 self.jitter.ir_arch.do_stk_segm=
True
276 self.jitter.ir_arch.do_ds_segm=
True
277 self.jitter.ir_arch.do_str_segm =
True
278 self.jitter.ir_arch.do_all_segm =
True
283 self.jitter.init_stack()
288 parser.add_argument(
'-s',
"--usesegm", action=
"store_true",
302 STACK_SIZE = 0x100000
303 STACK_BASE = 0x100000
311 self.jitter.init_stack()
315 STACK_SIZE = 0x100000
316 STACK_BASE = 0x100000
324 self.jitter.init_stack()
328 STACK_SIZE = 0x100000
329 STACK_BASE = 0x100000
332 super(Arch_aarch64l, self).
__init__()
337 self.jitter.init_stack()
342 STACK_SIZE = 0x100000
343 STACK_BASE = 0x100000
346 super(Arch_aarch64b, self).
__init__()
351 self.jitter.init_stack()
358 Sandbox.__init__(self, *args, **kwargs)
361 self.jitter.push_uint32_t(2)
362 self.jitter.push_uint32_t(1)
363 self.jitter.push_uint32_t(0)
364 self.jitter.push_uint32_t(0x1337beef)
367 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
370 def run(self, addr = None):
372 If addr is not set, use entrypoint
374 if addr
is None and self.options.address
is None:
376 super(Sandbox_Win_x86_32, self).
run(addr)
382 Sandbox.__init__(self, *args, **kwargs)
385 for i
in xrange(0x4):
386 self.jitter.push_uint64_t(0)
389 self.jitter.push_uint64_t(0x1337beef)
392 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
395 def run(self, addr = None):
397 If addr is not set, use entrypoint
399 if addr
is None and self.options.address
is None:
401 super(Sandbox_Win_x86_64, self).
run(addr)
407 Sandbox.__init__(self, *args, **kwargs)
410 self.jitter.push_uint32_t(2)
411 self.jitter.push_uint32_t(1)
412 self.jitter.push_uint32_t(0)
413 self.jitter.push_uint32_t(0x1337beef)
416 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
419 def run(self, addr = None):
421 If addr is not set, use entrypoint
423 if addr
is None and self.options.address
is None:
425 super(Sandbox_Linux_x86_32, self).
run(addr)
431 Sandbox.__init__(self, *args, **kwargs)
434 for i
in xrange(0x4):
435 self.jitter.push_uint64_t(0)
438 self.jitter.push_uint64_t(0x1337beef)
441 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
444 def run(self, addr = None):
446 If addr is not set, use entrypoint
448 if addr
is None and self.options.address
is None:
450 super(Sandbox_Linux_x86_64, self).
run(addr)
456 Sandbox.__init__(self, *args, **kwargs)
458 self.jitter.cpu.LR = 0x1337beef
461 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
464 def run(self, addr = None):
465 if addr
is None and self.options.address
is not None:
466 addr = int(self.options.address, 16)
467 super(Sandbox_Linux_arml, self).
run(addr)
472 Sandbox.__init__(self, *args, **kwargs)
474 self.jitter.cpu.LR = 0x1337beef
477 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
480 def run(self, addr = None):
481 if addr
is None and self.options.address
is not None:
482 addr = int(self.options.address, 0)
483 super(Sandbox_Linux_armb_str, self).
run(addr)
489 Sandbox.__init__(self, *args, **kwargs)
491 self.jitter.cpu.LR = 0x1337beef
494 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
497 def run(self, addr = None):
498 if addr
is None and self.options.address
is not None:
499 addr = int(self.options.address, 0)
500 super(Sandbox_Linux_arml_str, self).
run(addr)
506 Sandbox.__init__(self, *args, **kwargs)
508 self.jitter.cpu.LR = 0x1337beef
511 self.jitter.add_breakpoint(0x1337beef, self.__class__.code_sentinelle)
514 def run(self, addr = None):
515 if addr
is None and self.options.address
is not None:
516 addr = int(self.options.address, 0)
517 super(Sandbox_Linux_aarch64l, self).
run(addr)