diff options
author | bloodstalker <thabogre@gmail.com> | 2018-04-27 11:52:34 +0000 |
---|---|---|
committer | bloodstalker <thabogre@gmail.com> | 2018-04-27 11:52:34 +0000 |
commit | de305c003e15bad254e92054d17a0655215bdfb8 (patch) | |
tree | ccf04588e9ceb1aca540a87ff3db21dcb00803b4 /bruiser | |
parent | finally updated the readmes. they make more sense now. (diff) | |
download | mutator-de305c003e15bad254e92054d17a0655215bdfb8.tar.gz mutator-de305c003e15bad254e92054d17a0655215bdfb8.zip |
relicensed everything excluding safercpp to GPL-3.0. fixes #31. now there is ramdump. i just need to write a luawrapper.
Diffstat (limited to '')
-rw-r--r-- | bruiser/CompletionHints.cpp | 2 | ||||
-rw-r--r-- | bruiser/CompletionHints.h | 2 | ||||
-rw-r--r-- | bruiser/ORCmutation.h | 2 | ||||
-rw-r--r-- | bruiser/asmrewriter.c | 2 | ||||
-rw-r--r-- | bruiser/asmrewriter.h | 2 | ||||
-rw-r--r-- | bruiser/bruiser-extra.h | 2 | ||||
-rw-r--r-- | bruiser/bruiser.cpp | 60 | ||||
-rw-r--r-- | bruiser/bruiser.h | 2 | ||||
-rw-r--r-- | bruiser/bruisercapstone.c | 2 | ||||
-rw-r--r-- | bruiser/bruisercapstone.h | 2 | ||||
-rw-r--r-- | bruiser/bruiserffi.c | 2 | ||||
-rw-r--r-- | bruiser/bruiserffi.h | 2 | ||||
-rw-r--r-- | bruiser/defaults.lua | 32 | ||||
-rw-r--r-- | bruiser/executioner.h | 2 | ||||
-rw-r--r-- | bruiser/lua-scripts/asmrw.lua | 21 | ||||
-rw-r--r-- | bruiser/lua-scripts/demo2.lua | 2 | ||||
-rw-r--r-- | bruiser/lua-scripts/df-demo.lua | 45 | ||||
-rw-r--r-- | bruiser/lua-scripts/xobj.lua | 2 | ||||
-rw-r--r-- | bruiser/mutagen.cpp | 2 | ||||
-rw-r--r-- | bruiser/mutagen.h | 2 | ||||
-rw-r--r-- | bruiser/ramdump.c | 87 | ||||
-rw-r--r-- | bruiser/ramdump.h | 25 |
22 files changed, 224 insertions, 78 deletions
diff --git a/bruiser/CompletionHints.cpp b/bruiser/CompletionHints.cpp index 43f4345..0afe094 100644 --- a/bruiser/CompletionHints.cpp +++ b/bruiser/CompletionHints.cpp @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/CompletionHints.h b/bruiser/CompletionHints.h index 4a1d0aa..6d1db84 100644 --- a/bruiser/CompletionHints.h +++ b/bruiser/CompletionHints.h @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/ORCmutation.h b/bruiser/ORCmutation.h index 288ea21..10e060f 100644 --- a/bruiser/ORCmutation.h +++ b/bruiser/ORCmutation.h @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/asmrewriter.c b/bruiser/asmrewriter.c index e126577..694a6fe 100644 --- a/bruiser/asmrewriter.c +++ b/bruiser/asmrewriter.c @@ -6,7 +6,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/asmrewriter.h b/bruiser/asmrewriter.h index c8b69c0..6f96df5 100644 --- a/bruiser/asmrewriter.h +++ b/bruiser/asmrewriter.h @@ -6,7 +6,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/bruiser-extra.h b/bruiser/bruiser-extra.h index 94392e2..58ff8e9 100644 --- a/bruiser/bruiser-extra.h +++ b/bruiser/bruiser-extra.h @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/bruiser.cpp b/bruiser/bruiser.cpp index 2477759..a18b48d 100644 --- a/bruiser/bruiser.cpp +++ b/bruiser/bruiser.cpp @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, @@ -42,6 +42,7 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.* #include <sys/time.h> #include <sys/wait.h> #include <thread> +#include <unistd.h> /*LLVM headers*/ #include "clang/AST/AST.h" #include "clang/AST/ASTConsumer.h" @@ -113,7 +114,7 @@ cl::opt<bool> Nosrc("No Source file needed", cl::desc("verbosity"), cl::init(tru // @DEVI-FIXME-we need something like python's code module. lua's -i is not it. cl::opt<bool> LuaInteractive("interactive", cl::desc("run in interactive mode"), cl::init(false), cl::cat(BruiserCategory), cl::ZeroOrMore); cl::opt<std::string> NonCLILuaScript("lua", cl::desc("specifies a lua script for bruiser to run in non-interactive mode"), cl::init(""), cl::cat(BruiserCategory), cl::Optional); -cl::opt<std::string> LuaDefault("luadefault", cl::desc("the path to the luadefault file. the default option is where the bruiser executable is."), cl::init("./defaults.lua"), cl::cat(BruiserCategory), cl::ZeroOrMore); +cl::opt<std::string> LuaDefault("luadefault", cl::desc("the path to the luadefault file. the default option is where the bruiser executable is."), cl::init(""), cl::cat(BruiserCategory), cl::ZeroOrMore); /**********************************************************************************************************************/ template <typename T> int pushLuaTableInt(lua_State* __ls, std::vector<T> vec) { @@ -250,6 +251,37 @@ class LuaEngine } void RunLuaDefaults(void) { + char buf[500]; + std::string bruiser_path; + // @DEVI-linux-only + size_t len = readlink("/proc/self/exe", buf, 499); + if (len != -1) { + buf[len] = '\0'; + bruiser_path = buf; + auto index = bruiser_path.rfind("/"); + bruiser_path = bruiser_path.substr(0, index); + if (Verbose) std::cout << GREEN << bruiser_path << NORMAL << "\n"; + } + else { + PRINT_WITH_COLOR_LB(RED, "could not get bruiser's path. bruiser modules path wont be added."); + return void(); + } + + lua_getglobal(LS, "package"); + lua_getfield(LS, -1, "path"); + std::string cur_path = lua_tostring(LS, -1); + cur_path.append(";"); + cur_path.append(bruiser_path); + cur_path.append("/lua-scripts/?.lua"); + lua_pop(LS, 1); + lua_pushstring(LS, cur_path.c_str()); + lua_setfield(LS, -2, "path"); + lua_pop(LS,1); + + if (LuaDefault == "") { + LuaDefault = bruiser_path + "/defaults.lua"; + if (Verbose) std::cout << BLUE << LuaDefault << NORMAL << "\n"; + } luaL_dofile(LS, LuaDefault.c_str()); } @@ -308,16 +340,28 @@ class PyExec { py_script_name(__py_script_name), py_func_name(__py_func_name), obj_path(__obj_path) {} int run(void) { - //std::wstring py_sys_path = L"../bfd"; Py_Initialize(); + int argc = 2; - //std::wstring argv[2]; wchar_t* argv[2]; argv[0] = Py_DecodeLocale((char*)py_script_name.c_str(), 0); argv[1] = Py_DecodeLocale((char*)obj_path.c_str(), 0); + + char buf[500]; + std::string bruiser_path; + // @DEVI-linux-only + size_t len = readlink("/proc/self/exe", buf, 499); + if (len != -1) { + buf[len] = '\0'; + bruiser_path = buf; + auto index = bruiser_path.rfind("/"); + bruiser_path = bruiser_path.substr(0, index); + } + PySys_SetArgv(argc, argv); pName = PyUnicode_DecodeFSDefault(py_script_name.c_str()); - PyRun_SimpleString("import sys\nsys.path.append(\"../bfd\")\n"); + std::string command = "import sys\nsys.path.append(\"" + bruiser_path + "/../bfd\")\n"; + PyRun_SimpleString(command.c_str()); pModule = PyImport_Import(pName); Py_DECREF(pName); @@ -1646,6 +1690,12 @@ class LuaWrapper return 0; } + int BruiserRamDump(lua_State* __ls) { + int numargs = lua_gettop(__ls); + if (numargs != 1) {PRINT_WITH_COLOR_LB(RED, "expected exactly one argument of type int.");} + + } + /*read the m0 report*/ int BruiserLuaM0(lua_State* __ls) { diff --git a/bruiser/bruiser.h b/bruiser/bruiser.h index 584d652..b20d08f 100644 --- a/bruiser/bruiser.h +++ b/bruiser/bruiser.h @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/bruisercapstone.c b/bruiser/bruisercapstone.c index de40e6c..9db031f 100644 --- a/bruiser/bruisercapstone.c +++ b/bruiser/bruisercapstone.c @@ -6,7 +6,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/bruisercapstone.h b/bruiser/bruisercapstone.h index 8d97220..423c5fd 100644 --- a/bruiser/bruisercapstone.h +++ b/bruiser/bruisercapstone.h @@ -6,7 +6,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/bruiserffi.c b/bruiser/bruiserffi.c index 24ebe0d..371176c 100644 --- a/bruiser/bruiserffi.c +++ b/bruiser/bruiserffi.c @@ -6,7 +6,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/bruiserffi.h b/bruiser/bruiserffi.h index c06ecda..2b751b9 100644 --- a/bruiser/bruiserffi.h +++ b/bruiser/bruiserffi.h @@ -6,7 +6,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/defaults.lua b/bruiser/defaults.lua index 9f9f33b..756ba81 100644 --- a/bruiser/defaults.lua +++ b/bruiser/defaults.lua @@ -2,23 +2,27 @@ -- This is run everytime bruiser is called. -- adds luarocks' path and cpath to bruiser -local luarocks_handle = io.popen("luarocks path --bin") -for line in luarocks_handle:lines() do - local path = string.match(line, "LUA_PATH%s*=%s*('.+')") - local cpath = string.match(line, "LUA_CPATH%s*=%s*('.+')") +function default_luarocks_modules() + local luarocks_handle = io.popen("luarocks path --bin") local path_b = false local cpath_b = false - if path ~= nil then - package.path = package.path..path + for line in luarocks_handle:lines() do + local path = string.match(line, "LUA_PATH%s*=%s*('.+')") + local cpath = string.match(line, "LUA_CPATH%s*=%s*('.+')") + if path ~= nil then + package.path = package.path..";"..path + end + if cpath ~= nil then + package.cpath = package.cpath..";"..cpath + end end - if cpath ~= nil then - package.cpath = package.cpath..cpath + + if path_b then + io.write("failed to get path from luarocks.\n") + end + if cpath_b then + io.write("failed to get cpath from luarocks.\n") end end -if path_b then - io.write("failed to get path from luarocks.\n") -end -if cpath_b then - io.write("failed to get cpath from luarocks.\n") -end +default_luarocks_modules() diff --git a/bruiser/executioner.h b/bruiser/executioner.h index 3fe0fac..90a205a 100644 --- a/bruiser/executioner.h +++ b/bruiser/executioner.h @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/lua-scripts/asmrw.lua b/bruiser/lua-scripts/asmrw.lua index 68603fa..b8de4c5 100644 --- a/bruiser/lua-scripts/asmrw.lua +++ b/bruiser/lua-scripts/asmrw.lua @@ -4,7 +4,7 @@ --This program is free software; you can redistribute it and/or --modify it under the terms of the GNU General Public License ---as published by the Free Software Foundation; either version 2 +--as published by the Free Software Foundation; either version 3 --of the License, or (at your option) any later version. --This program is distributed in the hope that it will be useful, @@ -18,7 +18,7 @@ -------------------------------------------------------------------------------------------------------------- --start of asmrewriter module local asmrw = {} -xobj = require("lua-scripts.xobj") +xobj = require("xobj") -- this will hold a copy of the original text section local text_buffer = {} @@ -31,6 +31,23 @@ setmetatable(jmp_s_t, {__call = } ) +function asmrw.strings(exe) + io.write(colors("%{cyan}".."lua:getting text section...\n")) + local text_section = xobj.getTextSection(exe) + local rodata = xobj.getRODataSection(exe) + for k,v in pairs(rodata) do + if v > 33 and v < 127 then + io.write(string.format("%c",v)) + else + io.write(" ") + end + end + io.write("\0\n") +end + +function asmrw.strings_deep(exe) +end + function jmp_s_t:dump(msg) print(msg, self:custom()) return self diff --git a/bruiser/lua-scripts/demo2.lua b/bruiser/lua-scripts/demo2.lua index bd2eb91..a5cf1af 100644 --- a/bruiser/lua-scripts/demo2.lua +++ b/bruiser/lua-scripts/demo2.lua @@ -1,5 +1,5 @@ -xobj = require("lua-scripts.xobj") +xobj = require("xobj") colors = require("ansicolors") elf_file = "../bfd/test/test.so" elf_exe = "../bfd/test/test" diff --git a/bruiser/lua-scripts/df-demo.lua b/bruiser/lua-scripts/df-demo.lua index 7db2f85..916db00 100644 --- a/bruiser/lua-scripts/df-demo.lua +++ b/bruiser/lua-scripts/df-demo.lua @@ -1,59 +1,22 @@ -xobj = require("lua-scripts.xobj") -asmrw = require("lua-scripts.asmrw") +xobj = require("xobj") +asmrw = require("asmrw") colors = require("ansicolors") df_exe = "/home/bloodstalker/df/df_44_09_linux/df_linux/libs/Dwarf_Fortress" -function main() - local text_section = xobj.getTextSection(df_exe) -end - -function pretty_dump() - count = 0 - local text_section = xobj.getTextSection(df_exe) - io.write(colors("%{blue}".." ".."\t".."00 ".."01 ".."02 ".."03 ".."04 ".."05 ".."06 ".."07 ".."08 ".."09 ".."0A ".."0B ".."0C ".."0D ".."0E ".."0F")) - for k,v in pairs(text_section) do - if count % 16 == 0 then - print() - io.write(colors("%{blue}".."0x"..string.format("%03x",count)), "\t") - end - io.write(colors("%{green}"..string.format("%02x", v)), " ") - count = count + 1 - end - count = 0 - print() -end - function jmp_table_test() io.write(colors("%{cyan}".."lua:getting text section...\n")) local text_section = xobj.getTextSection(df_exe) local rodata = xobj.getRODataSection(df_exe) for k,v in pairs(rodata) do - if v > 32 and v < 127 then + if v > 33 and v < 127 then io.write(string.format("%c",v)) else io.write(" ") end end io.write("\0\n") - io.write(colors("%{green}".."lua:got text section.\n")) - local head = jmp_s_t() - -- messes up the stack. I could fix it but not sure why i would want to keep this in - --local head2 = jmp_s_t:new() - io.write(colors("%{cyan}".."lua:calling getjmptable\n")) - --head = getjmptable(#text_section, text_section) - - --if false then - --while head:inext() ~= nil do - --head:dump("entry") - --io.write("type:", head:type(), "\tlocation:", "0x"..string.format("%x", head:location())) - --print() - --head = head:inext() - --end - --end end ---main() ---pretty_dump() -jmp_table_test() +asmrw.strings(df_exe) diff --git a/bruiser/lua-scripts/xobj.lua b/bruiser/lua-scripts/xobj.lua index 1d1f748..08a2945 100644 --- a/bruiser/lua-scripts/xobj.lua +++ b/bruiser/lua-scripts/xobj.lua @@ -4,7 +4,7 @@ --This program is free software; you can redistribute it and/or --modify it under the terms of the GNU General Public License ---as published by the Free Software Foundation; either version 2 +--as published by the Free Software Foundation; either version 3 --of the License, or (at your option) any later version. --This program is distributed in the hope that it will be useful, diff --git a/bruiser/mutagen.cpp b/bruiser/mutagen.cpp index 46c5738..fb55594 100644 --- a/bruiser/mutagen.cpp +++ b/bruiser/mutagen.cpp @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/mutagen.h b/bruiser/mutagen.h index 0488dcb..51659b4 100644 --- a/bruiser/mutagen.h +++ b/bruiser/mutagen.h @@ -7,7 +7,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License -as published by the Free Software Foundation; either version 2 +as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, diff --git a/bruiser/ramdump.c b/bruiser/ramdump.c new file mode 100644 index 0000000..e481583 --- /dev/null +++ b/bruiser/ramdump.c @@ -0,0 +1,87 @@ + +/***************************************************Project Mutator****************************************************/ +/*first line intentionally left blank.*/ +/*bruiser's ram dump module*/ +/*Copyright (C) 2018 Farzad Sadeghi + +This program is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License +as published by the Free Software Foundation; either version 3 +of the License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program; if not, write to the Free Software +Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.*/ +/***********************************************************************************************************/ +#include <inttypes.h> +#include <limits.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <sys/ptrace.h> +#include <sys/wait.h> +#include <unistd.h> +/***********************************************************************************************************/ +FILE* dump_memory_region(FILE* pMemFile, uint64_t start_address, uint64_t length) { + FILE* out_file; + uint64_t address; + int pageLength = 4096; + unsigned char page[pageLength]; + fseeko(pMemFile, start_address, SEEK_SET); + + for (address=start_address; address < start_address + length; address += pageLength) { + fread(&page, 1, pageLength, pMemFile); + fwrite(&page, 1, pageLength, out_file); + } +} + +FILE* dump_ram(unsigned int pid) { + long ptraceResult = ptrace(PTRACE_ATTACH, pid, NULL, NULL); + if (ptraceResult < 0) { + printf("ramdump: unable to attach to the pid specified\n"); + return NULL; + } + wait(NULL); + + char mapsFilename[1024]; + char proc_str[6]; + sprintf(proc_str, "%d", pid); + sprintf(mapsFilename, "/proc/%s/maps", proc_str); + FILE* pMapsFile = fopen(mapsFilename, "r"); + char memFilename[1024]; + sprintf(memFilename, "/proc/%s/mem", proc_str); + FILE* pMemFile = fopen(memFilename, "r"); + char line[256]; + FILE* out_file; + while (fgets(line, 256, pMapsFile) != NULL) { + uint64_t start_address; + uint64_t end_address; + sscanf(line, "%08lx-%08lx\n", &start_address, &end_address); + dump_memory_region(pMemFile, start_address, end_address - start_address); + } + + fclose(pMapsFile); + fclose(pMemFile); + + ptrace(PTRACE_CONT, pid, NULL, NULL); + ptrace(PTRACE_DETACH, pid, NULL, NULL); + return out_file; +} + +#pragma weak main +int main(int argc, char **argv) { + if (argc != 2) { + printf("you were supposed to type in the int value"); + return 1; + } + int pid = atoi(argv[1]); + FILE* out_file = dump_ram(pid); +} +/***********************************************************************************************************/ +/*last line is intentionally left blank*/ + diff --git a/bruiser/ramdump.h b/bruiser/ramdump.h new file mode 100644 index 0000000..fc60cd3 --- /dev/null +++ b/bruiser/ramdump.h @@ -0,0 +1,25 @@ + +/***************************************************Project Mutator****************************************************/ +/*first line intentionally left blank.*/ +/*bruiser's ram dump module*/ +/*Copyright (C) 2018 Farzad Sadeghi + +This program is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License +as published by the Free Software Foundation; either version 3 +of the License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program; if not, write to the Free Software +Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.*/ +/***********************************************************************************************************/ +FILE* dump_memory_region(FILE* pMemFile, uint64_t start_address, uint64_t length); +FILE* dump_ram(unsigned int pid); +/***************************************************Project Mutator****************************************************/ +/*last line intentionally left blank.*/ + |