Python distorm3.Registers方法代码示例

# 需要导入模块: import distorm3 [as 别名]
# 或者: from distorm3 import Registers [as 别名]
def is_catch_instr(self):
        """
        @brief Tests if the instruction fetches
        more bytes form the obfuscated code
        @return True/False
        """
        if len(self.Instruction.operands) != 2:
            return False
        if (self.is_mov() and
            self.Instruction.operands[1].type == distorm3.OPERAND_MEMORY and
            self.Instruction.operands[0].type == distorm3.OPERAND_REGISTER):
            reg_index = self.Instruction.operands[1].index 
            if reg_index != None:
                reg_name = distorm3.Registers[reg_index]
                #change to reverserers input
                if('ESI' in reg_name or 'RSI' in reg_name):
                    return True
                else:
                    return False
            else:
                return False
        else:
            return False 

# 需要导入模块: import distorm3 [as 别名]
# 或者: from distorm3 import Registers [as 别名]
def is_write_stack(self):
        """
        @brief Tests if the instruction writes to
        the stack
        """
        if len(self.Instruction.operands) != 2:
            return False
        op0 = self.Instruction.operands[0]
        if op0.index == None or op0.disp != 0:
            return False
        if (self.is_mov() and
            op0.type == distorm3.OPERAND_MEMORY and
            (distorm3.Registers[op0.index] == 'EBP' or
             distorm3.Registers[op0.index] == 'RBP')):
            return True
        else:
            return False 

# 需要导入模块: import distorm3 [as 别名]
# 或者: from distorm3 import Registers [as 别名]
def is_read_stack(self):
        """
        @brief Tests if the instruction reads from
        the stack
        """
        if len(self.Instruction.operands) != 2:
            return False
        op1 = self.Instruction.operands[1]
        if op1.index == None or op1.disp != 0:
            return False
        if (self.is_mov() and
            op1.type == distorm3.OPERAND_MEMORY and
            (distorm3.Registers[op1.index] == 'EBP' or
             distorm3.Registers[op1.index] == 'RBP')):
            return True
        else:
            return False 

# 需要导入模块: import distorm3 [as 别名]
# 或者: from distorm3 import Registers [as 别名]
def is_isp_mov(self):
        """
        @brief Tests if the instructionpoiter of the vm
        gets a new value
        """
        if len(self.Instruction.operands) != 2:
            return False
        op0 = self.Instruction.operands[0]
        if op0.index == None:
            return False
        if (self.is_mov() and
            op0.type == distorm3.OPERAND_REGISTER and
            (distorm3.Registers[op0.index] == 'ESI' or
             distorm3.Registers[op0.index] == 'RSI')):
            return True
        else:
            return False


    #first op is 1 secend 2 and so on 

# 需要导入模块: import distorm3 [as 别名]
# 或者: from distorm3 import Registers [as 别名]
def find_rr_writes_distorm3(address, data):
    writes = []
    for insn in distorm3.Decompose(address, data, type=distorm3.Decode64Bits):
        if insn.mnemonic[:3] == 'RET':
            break
        if insn.mnemonic[:3] != 'MOV':
            continue

        # potential write
        opnd = insn.operands[0]
        if opnd.type != 'AbsoluteMemory' or opnd.index is None:
            continue
        # Absolute mov, with target that is register-based
        if distorm3.Registers[opnd.index] != 'RIP':
            continue
        # RIP-relative write, this is what we are looking for
        # distorm3 opnd.size is measured in bits, need to adjust to bytes
        writes.append((insn.address + insn.size + opnd.disp, opnd.size / 8))
    return writes

# Find rip-relative mov using capstone 

# 需要导入模块: import distorm3 [as 别名]
# 或者: from distorm3 import Registers [as 别名]
def is_vinst(self):
        """
        @brief Tests if one of the operands of the instruction is
        the 'esi' or 'rsi' register
        """
        for op in self.Instruction.operands:
            if op.type == distorm3.OPERAND_REGISTER:
                if op.name == 'ESI' or op.name == 'RSI':
                    return True
            elif op.type == distorm3.OPERAND_MEMORY:
                if op.index != None:
                    if (distorm3.Registers[op.index] == 'ESI' or
                        distorm3.Registers[op.index] == 'RSI'):
                        return True
        return False 

# 需要导入模块: import distorm3 [as 别名]
# 或者: from distorm3 import Registers [as 别名]
def shadowedSyscalls(self, model, distorm_mode, sysents_addr):
        #looks like these syscall functions end with a call to _thread_exception_return
        thread_exc_ret_addr = self.addr_space.profile.get_symbol('_thread_exception_return')

        prev_op = None
        sysent_funcs = ['_unix_syscall_return', '_unix_syscall64', '_unix_syscall']
        for func in sysent_funcs:
            func_addr = self.addr_space.profile.get_symbol(func)
            content = self.addr_space.read(func_addr, 1024)
            for op in distorm3.Decompose(func_addr, content, distorm_mode):
                if not op.valid:
                    break

                if op.mnemonic == "CALL" and op.operands[0].value == thread_exc_ret_addr:
                    break

                if model == "64bit":
                    #callp = &sysent[63] OR &sysent[code] OR callp == sysent
                    if op.mnemonic in ['ADD','CMP'] and op.operands[0].type == 'Register' and op.operands[0].name in ["RSP","RBX","R12","R13","R14","R15"] and 'FLAG_RIP_RELATIVE' in op.flags:
                        #compare actual sysent tbl address to the one in the instruction, calculated per distorm3 INSTRUCTION_GET_RIP_TARGET

                        op_sysent_ptr = obj.Object('Pointer', offset = (op.address + op.operands[1].disp + op.size), vm = self.addr_space)
 
                        if sysents_addr != op_sysent_ptr.v():
                            print "not same: %x | %x" % (sysents_addr, op_sysent_ptr.v())
                            yield (op_sysent_ptr.v(), func, op)
 
                elif model == "32bit":
                    #LEA EAX, [EAX*8+0x82ef20]
                    if op.mnemonic == 'LEA' and op.operands[0].type == 'Register' and op.operands[0].name in ['EDI','EAX'] and distorm3.Registers[op.operands[1].index] == "EAX" and op.operands[1].scale == 8:
                        if op.operands[1].disp != sysents_addr:
                            shadowtbl_addr = op.operands[1].disp
                            yield (shadowtbl_addr, func, op) 
                            break
                    #CMP EAX, 0x82ef20
                    elif op.mnemonic == 'CMP' and op.operands[0].type == 'Register' and op.operands[0].name in ['EDI','EAX'] and prev_op.mnemonic in ['LEA','MOV'] and self.addr_space.is_valid_address(op.operands[1].value) == True:
                        if op.operands[1].value != sysents_addr:
                            shadowtbl_addr = op.operands[1].value
                            yield (shadowtbl_addr, func, op)

                    #CMP DWORD [EBP-0x20], 0x82ef20
                    elif op.mnemonic == 'CMP' and op.operands[0].index != None and distorm3.Registers[op.operands[0].index] == "EBP" and op.operands[0].disp == -32 and op.operands[0].type == "Immediate":
                        if op.operands[1].value != sysents_addr:
                            shadowtbl_addr = op.operands[1].value
                            yield (shadowtbl_addr, func, op)
 
                prev_op = op