diff options
| author | bloodstalker <thabogre@gmail.com> | 2018-01-02 19:12:05 +0000 | 
|---|---|---|
| committer | bloodstalker <thabogre@gmail.com> | 2018-01-02 19:12:05 +0000 | 
| commit | d7f4a97c10813eb4f8e8a31064deedbf0d7d2a8b (patch) | |
| tree | ba63aaa4624329a7b23350ffc8f8f77c1ac0dc43 | |
| parent | wip (diff) | |
| download | mutator-d7f4a97c10813eb4f8e8a31064deedbf0d7d2a8b.tar.gz mutator-d7f4a97c10813eb4f8e8a31064deedbf0d7d2a8b.zip | |
load.py now loads all objects and functions along with names to c++. next is getting them to lua.
Diffstat (limited to '')
| -rwxr-xr-x | bfd/load.py | 104 | ||||
| -rw-r--r-- | bruiser/bruiser.cpp | 34 | ||||
| -rw-r--r-- | bruiser/executioner.h | 11 | ||||
| -rw-r--r-- | bruiser/lua-scripts/demo1.lua | 47 | 
4 files changed, 145 insertions, 51 deletions
| diff --git a/bfd/load.py b/bfd/load.py index ccaec6a..08adfc5 100755 --- a/bfd/load.py +++ b/bfd/load.py @@ -23,6 +23,7 @@ class CLIArgParser(object):          parser.add_argument("--stentries", action='store_true', help="dump section table entries", default=False)          parser.add_argument("--objcode", action='store_true', help="dump objects", default=False)          parser.add_argument("--test", action='store_true', help="test switch", default=False) +        parser.add_argument("--dynsym", action='store_true', help="dump dynamic symbol table", default=False)          self.args = parser.parse_args()          if self.args.obj is None:              raise Exception("no object file provided. please specify an object with --obj.") @@ -299,32 +300,32 @@ class ELF(object):      def init(self, size):          self.size = size          self.read_ELF_H(size) -        self.so.seek(int.from_bytes(self.elfhdr.e_phoff, byteorder="little", signed=False)) -        phnum = int.from_bytes(self.elfhdr.e_phnum, byteorder="little", signed=False) +        self.so.seek(byte2int(self.elfhdr.e_phoff)) +        phnum = byte2int(self.elfhdr.e_phnum)          for i in range(0, phnum):              self.read_PHDR(size) -        self.so.seek(int.from_bytes(self.elfhdr.e_shoff, byteorder="little", signed=False)) -        shnum = int.from_bytes(self.elfhdr.e_shnum, byteorder="little", signed=False) +        self.so.seek(byte2int(self.elfhdr.e_shoff)) +        shnum = byte2int(self.elfhdr.e_shnum)          for i in range(0, shnum):              self.read_SHDR(size)          for i in range(0, shnum): -            type = int.from_bytes(self.shhdr[i].sh_type, byteorder="little", signed=False) +            type = byte2int(self.shhdr[i].sh_type)              if type == sh_type_e.SHT_SYMTAB: -                self.so.seek(int.from_bytes(self.shhdr[i].sh_offset, byteorder="little", signed=False), 0) -                symbol_tb = self.so.read(int.from_bytes(self.shhdr[i].sh_size, byteorder="little", signed=False)) +                self.so.seek(byte2int(self.shhdr[i].sh_offset), 0) +                symbol_tb = self.so.read(byte2int(self.shhdr[i].sh_size))                  offset = 0 -                num = int(int.from_bytes(self.shhdr[i].sh_size, byteorder="little") / 24) +                num = int(byte2int(self.shhdr[i].sh_size) / 24)                  for j in range(0, num):                      self.read_st_entry(symbol_tb[offset:offset + 24], self.string_tb_e) -                    offset += 8*24 +                    offset += 24              if type == sh_type_e.SHT_DYNSYM: -                self.so.seek(int.from_bytes(self.shhdr[i].sh_offset, byteorder="little", signed=False), 0) -                symbol_tb = self.so.read(int.from_bytes(self.shhdr[i].sh_size, byteorder="little", signed=False)) +                self.so.seek(byte2int(self.shhdr[i].sh_offset), 0) +                symbol_tb = self.so.read(byte2int(self.shhdr[i].sh_size))                  offset = 0 -                num = int(int.from_bytes(self.shhdr[i].sh_size, byteorder="little") / 24) +                num = int(byte2int(self.shhdr[i].sh_size) / 24)                  for j in range(0, num):                      self.read_st_entry(symbol_tb[offset:offset + 24], self.string_tb_e_dyn) -                    offset += 8*24 +                    offset += 24          self.pop_data_section()          self.pop_text_section() @@ -442,13 +443,21 @@ class ELF(object):          ret_list = []          for entry in self.string_tb_e:              if entry.st_type == stt_type: -                ret_list.append("".join(self.get_st_entry_symbol_string(byte2int(entry.st_name)))) +                ret_list.append("".join(self.get_st_entry_symbol_string(byte2int(entry.st_name), ".strtab")))          if dump_b:              for name in ret_list:                  print(name) -          return ret_list +    def dump_obj_size(self, stt_type, dump_b): +        ret_list = [] +        for entry in self.string_tb_e: +            if entry.st_type == stt_type: +                ret_list.append(byte2int(entry.st_size)) +        if dump_b: +            for name in ret_list: +                print(name) +        return ret_list      def dump_symbol_idx(self):          print(Colors.green + "symbol:" + Colors.ENDC) @@ -546,21 +555,34 @@ class ELF(object):              print(Colors.blue + "sh_entsize: " + Colors.cyan + repr(byte2int(self.shhdr[i].sh_entsize)) + Colors.ENDC)              counter += 1 -    def dump_symbol_tb(self): -        for i in range(0, int.from_bytes(self.elfhdr.e_shnum, byteorder="little", signed=False)): -            if int.from_bytes(self.shhdr[i].sh_type, byteorder="little", signed=False) == sh_type_e.SHT_STRTAB: -                print(Colors.BOLD + Colors.yellow + "STRING TABLE:" + Colors.ENDC) -                self.so.seek(int.from_bytes(self.shhdr[i].sh_offset, byteorder="little", signed=False), 0) -                symbol_tb = self.so.read(int.from_bytes(self.shhdr[i].sh_size, byteorder="little", signed=False)) -                for byte in symbol_tb: -                    print(chr(byte), end='') -                    if chr(byte) == '\0': print() +    def dump_symbol_tb(self, name, type): +        for i in range(0, byte2int(self.elfhdr.e_shnum)): +            if byte2int(self.shhdr[i].sh_type) == type: +                if name == self.read_section_name(byte2int(self.shhdr[i].sh_name)): +                    print(Colors.BOLD + Colors.yellow + "STRING TABLE:" + Colors.ENDC) +                    self.so.seek(byte2int(self.shhdr[i].sh_offset), 0) +                    symbol_tb = self.so.read(byte2int(self.shhdr[i].sh_size)) +                    for byte in symbol_tb: +                        print(chr(byte), end='') +                        if chr(byte) == '\0': print()      def dump_st_entries(self):          for entry in self.string_tb_e:              print(Colors.green + "name index: " + Colors.ENDC + repr(byte2int(entry.st_name)), end="") -            print(Colors.green + " name: " + Colors.ENDC + repr("".join(self.get_st_entry_symbol_string(byte2int(entry.st_name)))), end="") +            print(Colors.green + " name: " + Colors.ENDC + repr("".join(self.get_st_entry_symbol_string(byte2int(entry.st_name), ".strtab"))), end="") +            print(Colors.green + " value: " + Colors.ENDC + repr(byte2int(entry.st_value)), end="") +            print(Colors.green + " size: " + Colors.ENDC + repr(byte2int(entry.st_size)), end="") +            print(Colors.green + " info: " + Colors.ENDC + repr(byte2int(entry.st_info)), end="") +            print(Colors.green + " other: " + Colors.ENDC + repr(byte2int(entry.st_other)), end="") +            print(Colors.green + " shndx: " + Colors.ENDC + repr(byte2int(entry.st_shndx)), end="") +            print(Colors.green + " bind: " + Colors.ENDC + get_elf_st_bind_string(entry.st_bind), end="") +            print(Colors.green + " type: " + Colors.ENDC + get_elf_st_type_string(entry.st_type)) + +    def dump_st_entries_dyn(self): +        for entry in self.string_tb_e_dyn: +            print(Colors.green + "name index: " + Colors.ENDC + repr(byte2int(entry.st_name)), end="") +            print(Colors.green + " name: " + Colors.ENDC + repr("".join(self.get_st_entry_symbol_string(byte2int(entry.st_name), ".dynstr"))), end="")              print(Colors.green + " value: " + Colors.ENDC + repr(byte2int(entry.st_value)), end="")              print(Colors.green + " size: " + Colors.ENDC + repr(byte2int(entry.st_size)), end="")              print(Colors.green + " info: " + Colors.ENDC + repr(byte2int(entry.st_info)), end="") @@ -569,11 +591,11 @@ class ELF(object):              print(Colors.green + " bind: " + Colors.ENDC + get_elf_st_bind_string(entry.st_bind), end="")              print(Colors.green + " type: " + Colors.ENDC + get_elf_st_type_string(entry.st_type)) -    def get_st_entry_symbol_string(self, index): +    def get_st_entry_symbol_string(self, index, section_name):          symbol = []          for i in range(0, byte2int(self.elfhdr.e_shnum)):              name = self.read_section_name(byte2int(self.shhdr[i].sh_name)) -            if byte2int(self.shhdr[i].sh_type) == sh_type_e.SHT_STRTAB and name == ".strtab": +            if byte2int(self.shhdr[i].sh_type) == sh_type_e.SHT_STRTAB and name == section_name:                  self.so.seek(byte2int(self.shhdr[i].sh_offset) + index, 0)                  byte = self.so.read(1)                  while chr(byte[0]) != "\0": @@ -646,30 +668,48 @@ def elf_get_func_names():      elf.init(64)      return elf.dump_symbol_string(ELF_ST_TYPE.STT_FUNC, False) -def main2(): +# obj here means variables or what the C standard means by objects +def elf_get_obj_names(): +    so = openSO_r(sys.argv[1]) +    elf = ELF(so) +    elf.init(64) +    return elf.dump_symbol_string(ELF_ST_TYPE.STT_OBJECT, False) + +# obj here means variables or what the C standard means by objects +def elf_get_obj_sizes(): +    so = openSO_r(sys.argv[1]) +    elf = ELF(so) +    elf.init(64) +    return elf.dump_obj_size(ELF_ST_TYPE.STT_OBJECT, False) + +def elf_get_func_code():      so = openSO_r(sys.argv[1])      elf = ELF(so)      elf.init(64)      return elf.dump_funcs(False)  def main(): -    variables = globals().copy() -    variables.update(locals()) -    shell = code.InteractiveConsole(variables)      try:          argparser = CLIArgParser()          so = openSO_r(argparser.args.obj)          elf = ELF(so)          elf.init(64)          if argparser.args.header: elf.dump_header() -        elif argparser.args.symboltable: elf.dump_symbol_tb() +        elif argparser.args.symboltable: +            elf.dump_symbol_tb(".strtab", sh_type_e.SHT_STRTAB) +            elf.dump_symbol_tb(".dynstr", sh_type_e.SHT_STRTAB)          elif argparser.args.phdrs: elf.dump_phdrs()          elif argparser.args.shdrs: elf.dump_shdrs()          elif argparser.args.symbolindex: elf.dump_symbol_idx()          elif argparser.args.stentries: elf.dump_st_entries()          elif argparser.args.objcode: elf.dump_funcs(True)          elif argparser.args.test: elf.dump_symbol_string(ELF_ST_TYPE.STT_FUNC, True) +        elif argparser.args.test: elf.dump_symbol_string(ELF_ST_TYPE.STT_OBJECT, True) +        elif argparser.args.dynsym: elf.dump_st_entries_dyn()      except: +        variables = globals().copy() +        variables.update(locals()) +        shell = code.InteractiveConsole(variables)          shell.interact(banner="PyElfDump REPL")  if __name__ == "__main__": diff --git a/bruiser/bruiser.cpp b/bruiser/bruiser.cpp index 8934867..cd52603 100644 --- a/bruiser/bruiser.cpp +++ b/bruiser/bruiser.cpp @@ -283,7 +283,8 @@ class PyExec {                  tempvec.push_back(int(byte));                }              } -            if (!tempvec.empty()) {hexobj.push_back(tempvec);} +            //if (!tempvec.empty()) {hexobj.push_back(tempvec);} +            hexobj.push_back(tempvec);              tempvec.clear();            }          } @@ -305,9 +306,8 @@ class PyExec {          }      } -    std::vector<std::vector<uint8_t>> exportObjs(void) { -      return hexobj; -    } +    std::vector<std::vector<uint8_t>> exportObjs(void) {return hexobj;} +    std::vector<std::string> exportStrings(void) {return hexobj_str;}    private:      std::string py_script_name; @@ -1183,6 +1183,7 @@ class LuaWrapper          funcname = lua_tostring(__ls, 1);          objjpath = lua_tostring(__ls, 2);          action = lua_tostring(__ls, 3); +        lua_pop(__ls, 3);        }        else {          std::cout << RED << "wrong number of arguments provided. should give the python script name, python func name and its args.\n" << NORMAL; @@ -1191,18 +1192,15 @@ class LuaWrapper        std::cout << CYAN << "initing the py embed class...\n" << NORMAL;        PyExec py(filename.c_str(), funcname.c_str(), objjpath.c_str()); -        std::cout << CYAN << "forking python script...\n" << NORMAL;        pid_t pid = fork(); -      if (pid < 0) -      { +      if (pid < 0) {          PRINT_WITH_COLOR_LB(RED, "could not fork...");          lua_pushnumber(__ls, EXIT_FAILURE);        } -      if (pid == 0) -      { +      if (pid == 0) {          std::cout << BLUE << "running load.py: " << NORMAL << "\n";          py.run();          if (action == "code_list") { @@ -1212,20 +1210,28 @@ class LuaWrapper          else if (action == "symbol_list") {            py.getAsCppStringVec();          } + +        lua_newtable(__ls); +        int tableindex = 0 ; +        for (auto& iter : py.exportStrings()) { +          lua_pushnumber(__ls, tableindex); +          tableindex++; +          lua_pushstring(__ls, iter.c_str()); +          lua_settable(__ls, 1); +        }          //py.killPyObj(); -        lua_pushnumber(__ls, 0); +        //lua_pushnumber(__ls, 0);          exit(EXIT_SUCCESS);        } -      if (pid > 0) -      { +      if (pid > 0) {          int status;          pid_t returned;          returned = waitpid(pid, &status, 0); -        lua_pushnumber(__ls, returned); +        //lua_pushnumber(__ls, returned);        } -      lua_pushnumber(__ls, 0); +      //lua_pushnumber(__ls, 0);        return 1;      } diff --git a/bruiser/executioner.h b/bruiser/executioner.h index b881902..4b8b651 100644 --- a/bruiser/executioner.h +++ b/bruiser/executioner.h @@ -19,6 +19,9 @@ You should have received a copy of the GNU General Public License  along with this program; if not, write to the Free Software  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.*/  /**********************************************************************************************************************/ +#include "./bruiser.h" +#include "lua-5.3.4/src/lua.hpp" +  #include <iostream>  #include <tuple>  #include <vector> @@ -27,7 +30,6 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.*  #include <cstring>  #include <sys/mman.h>  #include <unistd.h> -#include "lua-5.3.4/src/lua.hpp"  /**********************************************************************************************************************/  #ifndef EXECUTIONER_H  #define EXECUTIONER_H @@ -68,7 +70,7 @@ namespace { // start of anonymous namespace      if (lua_type(__ls, 1) == LUA_TSTRING) {        xfuncname = lua_tostring(__ls, 1);      } else { -      //PRINT_WITH_COLOR_LB(RED, "the first argument should be a string that is the name of the xfunc to be called."); +      PRINT_WITH_COLOR_LB(RED, "the first argument should be a string that is the name of the xfunc to be called.");      }      // detecting arg types @@ -79,8 +81,10 @@ namespace { // start of anonymous namespace        else if (lua_type(__ls, i) == LUA_TLIGHTUSERDATA) {        }        else if (lua_type(__ls, i) == LUA_TNUMBER) { +        arg_double.push_back(std::make_pair(lua_tonumber(__ls, i), i));        }        else if (lua_type(__ls, i) == LUA_TSTRING) { +        arg_str.push_back(std::make_pair(lua_tostring(__ls, i), i));        }        else if (lua_type(__ls, i) == LUA_TTABLE) {        } @@ -92,12 +96,13 @@ namespace { // start of anonymous namespace        }        // type is Nil        else { +        PRINT_WITH_COLOR_LB(RED, "you passed a Nil argument...");        }      }      pid_t pid = fork();      if (pid < 0) { -      //PRINT_WITH_COLOR_LB(RED, "could not fork..."); +      PRINT_WITH_COLOR_LB(RED, "could not fork...");        lua_pushnumber(__ls, EXIT_FAILURE);      }      if (pid == 0) {} diff --git a/bruiser/lua-scripts/demo1.lua b/bruiser/lua-scripts/demo1.lua index 98bdb0d..b382f2d 100644 --- a/bruiser/lua-scripts/demo1.lua +++ b/bruiser/lua-scripts/demo1.lua @@ -1,2 +1,45 @@ -objload("elf_get_func_names", "../bfd/test/test.so", "symbol_list") -objload("main2", "../bfd/test/test.so", "code_list") +-- +-- get the .so object names +-- objload("elf_get_obj_names", "../bfd/test/test.so", "symbol_list") +-- +-- get the .so object sizes +-- objload("elf_get_obj_sizes", "../bfd/test/test.so", "symbol_list") +-- +-- get the .so function names +-- objload("elf_get_func_names", "../bfd/test/test.so", "symbol_list") +-- get the .so function code +-- objload("elf_get_func_code", "../bfd/test/test.so", "code_list") +-- + +function printObjNames() +  local c = {objload("elf_get_obj_names", "../bfd/test/test.so", "symbol_list")} +  for k,v in ipairs(c) do +    print(k,v) +  end +end + +function printObjSizes() +  local c = {objload("elf_get_obj_sizes", "../bfd/test/test.so", "symbol_list")} +  for k,v in ipairs(c) do +    print(k,v) +  end +end + +function printFuncNames() +  local c = {objload("elf_get_func_names", "../bfd/test/test.so", "symbol_list")} +  for k,v in ipairs(c) do +    print(k,v) +  end +end + +function printFuncCode() +  local c = {objload("elf_get_func_code", "../bfd/test/test.so", "code_list")} +  for k,v in ipairs(c) do +    print(k,v) +  end +end + +printObjNames() +printObjSizes() +printFuncNames() +--printFuncCode() | 
