diff options
Diffstat (limited to '')
| -rw-r--r-- | bruiser/bruiser.cpp | 4 | ||||
| -rw-r--r-- | bruiser/bruisercapstone.c | 247 | ||||
| -rw-r--r-- | bruiser/bruisercapstone.h | 49 | ||||
| -rw-r--r-- | bruiser/bruiserffi.c | 33 | ||||
| -rw-r--r-- | bruiser/bruiserffi.h | 19 | ||||
| -rw-r--r-- | bruiser/devi_extra.h | 33 | ||||
| -rw-r--r-- | bruiser/lua-scripts/demo1.lua | 3 |
7 files changed, 343 insertions, 45 deletions
diff --git a/bruiser/bruiser.cpp b/bruiser/bruiser.cpp index 053bffc..936bd83 100644 --- a/bruiser/bruiser.cpp +++ b/bruiser/bruiser.cpp @@ -1392,9 +1392,9 @@ class LuaWrapper PRINT_WITH_COLOR_LB(RED, "cant grow lua stack. current size is too small."); } for (auto& iter : xlist) { - std::cout << CYAN << iter.second << NORMAL; + if (Verbose) std::cout << CYAN << iter.second << NORMAL; lua_pushstring(__ls, iter.second.c_str()); - std::cout << " " << MAGENTA << (long int)iter.first << NORMAL <<"\n"; + if (Verbose) std::cout << " " << MAGENTA << (long int)iter.first << NORMAL <<"\n"; lua_pushinteger(__ls, (long int)iter.first); lua_settable(__ls, -3); } diff --git a/bruiser/bruisercapstone.c b/bruiser/bruisercapstone.c new file mode 100644 index 0000000..e65be3b --- /dev/null +++ b/bruiser/bruisercapstone.c @@ -0,0 +1,247 @@ + +/***************************************************Project Mutator****************************************************/ +/*first line intentionally left blank.*/ +/*bruiser's capstone side for rewriting xobjects*/ +/*Copyright (C) 2018 Farzad Sadeghi + +This program is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License +as published by the Free Software Foundation; either version 2 +of the License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program; if not, write to the Free Software +Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.*/ +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +#include "./bruisercapstone.h" +#include "./devi_extra.h" +#include <capstone/capstone.h> +#include <errno.h> +#include <inttypes.h> +#include <keystone/keystone.h> +#include <stdarg.h> +#include <stdint.h> +#include <stdio.h> +#include <string.h> +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +extern char etext, edata, end; +// quad +#define CODE_1 "\x55\x48\x89\xe5\x48\x83\xec\x20\x89\x7d\xfc\x89\x75\xf8\x89\x55\xf4\x89\x4d\xf0\x8b\x7d\xfc\x8b\x75\xf8\xe8\xd1\xfd\xff\xff\x8b\x7d\xf4\x8b\x75\xf0\x89\x45\xec\xe8\xc3\xfd\xff\xff\x8b\x4d\xec\x1\xc1\x89\xc8\x48\x83\xc4\x20\x5d\xc3" +// glob +#define CODE_2 "\x55\x48\x89\xe5\x48\x8b\x05\x0d\x15\x20\x00\x48\x8b\x0d\xee\x14\x20\x00\x48\x8b\x15\xf7\x14\x20\x00\x48\x8b\x35\xd8\x14\x20\x00\x8b\x3e\x03\x3a\x03\x39\x03\x38\x89\xf8\x5d\xc3" +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +uint32_t get_textsection_length(void) {return &edata-&etext;} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +uintptr_t get_symbol_rt_address(const char* symbol_name) {} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +void int2byte(int value, uint8_t* ret_value, size_t size) { + for (int i = 0; i < size; ++i) { + ret_value[i] = (value & (0xff << (8*i))) >> (8*i); + } +} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +void leb128_encode_s(int32_t value, uint8_t* ret_value, size_t size) { + uint8_t dummy; + if (value == 0) {for (int i = 0; i < size; ++i) ret_value[i] = 0;} + for (int i = 0; i < size; ++i) { + dummy = value & 0x7f; + ret_value[i] = dummy | 0x80; + value >>=7; + if (((value == 0) && ((dummy & 0x40) == 0)) || ((value == -1) && (dummy & 0x40))) { + ret_value[size - 1] ^= 0x80; + break; + } + } +} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +void leb128_encode_u(uint32_t value, uint8_t* ret_value, size_t size) { + uint8_t dummy; + if (value == 0) {for (int i = 0; i < size; ++i) ret_value[i] = 0;} + for (int i = 0; i < size; ++i) { + dummy = value & 0x7f; + ret_value[i] = dummy | 0x80; + value >>=7; + } + ret_value[size - 1] ^= 0x80; +} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +void leb128_decode_s(int32_t value, uint8_t* ret_value, size_t size) {} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +void leb128_decode_u(uint32_t value, uint8_t* ret_value, size_t size) {} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +int ks_write(ks_arch arch, int mode, const char* assembly, int syntax, unsigned char* encode) { + ks_engine* ks; + ks_err err = KS_ERR_ARCH; + size_t count; + size_t size; + + err = ks_open(arch, mode, &ks); + if (err != KS_ERR_OK) {printf("failed on ks_open().\n"); return -1;} + if (syntax) ks_option(ks, KS_OPT_SYNTAX, syntax); + + if (ks_asm(ks, assembly, 0, &encode, &size, &count)) {printf("errored out\n"); return -1;} +#if 0 + else { + printf("%s =", assembly); + for (size_t i = 0; i < size; ++i) { + printf("%02x ", encode[i]); + } + printf("\n"); + } +#endif + + ks_close(ks); + return size; +} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +int global_rewriter(int offset, size_t size, uint8_t* asm_code, const char* obj) { + csh handle; + cs_insn* insn; + size_t count; + uint8_t code[16]; + size_t size_counter = 0; + unsigned char *encode; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle) != CS_ERR_OK) return -1; + count = cs_disasm(handle, obj, size, 0x0, 0, &insn); + printf("number of instructions: %d.\n\n", count); + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + if (count > 0) { + size_t j; + for (j = 0; j < count; ++j) { + printf(CYAN"%d.\t"NORMAL, j); + printf(GREEN"0x%"PRIx64":\t%s\t\t%s\t"NORMAL, insn[j].address, insn[j].mnemonic, insn[j].op_str); + printf(BLUE"insn size: %d\n"NORMAL, insn[j].size); + //for (int i = 0; i < 16; ++i) {code[i] = insn[j].bytes[i]; printf("%02x ", code[i]);} + //printf("\n"); + + if (strcmp(insn[j].mnemonic, "mov") == 0) { + } + + for (int i = 0; i < insn[j].size; ++i) { + asm_code[size_counter] = insn[j].bytes[i]; + size_counter++; + } + } + + cs_free(insn, count); + } else { + printf("ERROR!!!\n"); + } + cs_close(&handle); + return size_counter; +} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +int call_rewriter(int offset, size_t size, uint8_t* asm_code, const char* obj) { + csh handle; + cs_insn* insn; + size_t count; + uint8_t rewritten[16]; + uint8_t code[16]; + size_t size_counter = 0; + + if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle) != CS_ERR_OK) return -1; + count = cs_disasm(handle, obj, size, 0x0, 0, &insn); + printf("number of instructions: %d.\n\n", count); + cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON); + + if (count > 0) { + size_t j; + for (j = 0; j < count; ++j) { + printf(CYAN"%d.\t"NORMAL, j); + printf(GREEN"0x%"PRIx64":\t%s""\t\t%s\t"NORMAL, insn[j].address, insn[j].mnemonic, insn[j].op_str); + for (int i = 0; i < 16; ++i) {code[i] = insn[j].bytes[i]; printf(BLUE"%02x "NORMAL, code[i]);} + printf("\n"); + + if (strcmp(insn[j].mnemonic, "call") == 0) { + char* endptr; + intmax_t address = strtoimax(insn[j].op_str, &endptr, 0); + uintmax_t uaddress = strtoumax(insn[j].op_str, &endptr, 0); + // rewriting + asm_code[size_counter] = 0xe8, size_counter++; + uint8_t temp[4]; + //@DEVI-call cant be the last instructino in a function + int2byte(offset + insn[j].address, temp, 4); + for (int i = 0; i < 4; ++i) {asm_code[size_counter] = temp[i]; size_counter++;} + continue; + } + for (int i = 0; i < insn[j].size; ++i) { + asm_code[size_counter] = insn[j].bytes[i]; + size_counter++; + } + } + + cs_free(insn, count); + } else { + printf("ERROR!!!\n"); + } + cs_close(&handle); + return size_counter; +} +/**********************************************************************************************************************/ +/**********************************************************************************************************************/ +// @DEVI-the following lines are only meant for testing. +#pragma weak main +int main(int argc, char** argv) { + uint8_t asm_code[58]; + uint8_t asm_code2[44]; + printf("----------------------------------------------------------\n"); + printf("call_rewriter:\n"); + int new_size = call_rewriter(-528, 58, asm_code, CODE_1); + printf("new size is %d.\n", new_size); + for (int i = new_size; i < 58; ++i) {asm_code[i] = 0;} + for (int i = 0; i < 58; ++i) {printf("%02x ", asm_code[i]);} + + printf("\n----------------------------------------------------------\n"); + printf("global_rewriter:\n"); + new_size = global_rewriter(-528, 44, asm_code2, CODE_2); + printf("new size is %d.\n", new_size); + for (int i = new_size; i < 44; ++i) {asm_code2[i] = 0;} + for (int i = 0; i < 44; ++i) {printf("%02x ", asm_code2[i]);} + + printf("\n----------------------------------------------------------\n"); + printf("etext: %10p\n", &etext); + printf("edata: %10p\n", &edata); + printf("end: %10p\n", &end); + printf("text section length: %d\n", get_textsection_length()); + + printf("----------------------------------------------------------\n"); + uint8_t value[4]; + int2byte(-528, value, 4); + for (int i = 0; i < 4; ++i) {printf("%02x ", value[i]);} + printf("\n"); + leb128_encode_u(528, value, 4); + for (int i = 0; i < 4; ++i) {printf("%02x ", value[i]);} + printf("\n"); + leb128_encode_s(-528, value, 4); + for (int i = 0; i < 4; ++i) {printf("%02x ", value[i]);} + printf("\n"); + printf("----------------------------------------------------------\n"); + + unsigned char* encode; + ks_write(KS_ARCH_X86, KS_MODE_64, "add rax, rcx", 0, encode); + ks_free(encode); + + return 0; +} +/**********************************************************************************************************************/ +/*last line intentionally left blank.*/ + diff --git a/bruiser/bruisercapstone.h b/bruiser/bruisercapstone.h new file mode 100644 index 0000000..054eb19 --- /dev/null +++ b/bruiser/bruisercapstone.h @@ -0,0 +1,49 @@ + +/***************************************************Project Mutator****************************************************/ +/*first line intentionally left blank.*/ +/*bruiser's capstone side for rewriting xobjects*/ +/*Copyright (C) 2018 Farzad Sadeghi + +This program is free software; you can redistribute it and/or +modify it under the terms of the GNU General Public License +as published by the Free Software Foundation; either version 2 +of the License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program; if not, write to the Free Software +Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.*/ +/**********************************************************************************************************************/ +#include <capstone/capstone.h> +#include <keystone/keystone.h> +#include <stdint.h> +/**********************************************************************************************************************/ +#ifndef BRUISER_CAPSTONE_H +#define BRUISER_CAPSTONE_H + +#ifdef __cplusplus +extern "C" { +#endif + +uint32_t get_textsection_length(void); +uintptr_t get_symbol_rt_address(const char* symbol_name); +void int2byte(int value, uint8_t* ret_value, size_t size); +void leb128_encode_s(int32_t value, uint8_t* ret_value, size_t size); +void leb128_encode_u(uint32_t value, uint8_t* ret_value, size_t size); +void leb128_decode_s(int32_t value, uint8_t* ret_value, size_t size); +void leb128_decode_u(uint32_t value, uint8_t* ret_value, size_t size); +int ks_write(ks_arch arch, int mode, const char* assembly, int syntax, unsigned char* encode); +int global_rewriter(int offset, size_t size, uint8_t* asm_code, const char* obj); +int call_rewriter(int offset, size_t size, uint8_t* asm_code, const char* obj); + +#ifdef __cplusplus +} +#endif +#endif +/**********************************************************************************************************************/ +/*last line intentionally left blank.*/ + diff --git a/bruiser/bruiserffi.c b/bruiser/bruiserffi.c index c847d10..fee9dfe 100644 --- a/bruiser/bruiserffi.c +++ b/bruiser/bruiserffi.c @@ -22,7 +22,6 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.* // @TODO-vararg xobjs are not supported /**********************************************************************************************************************/ #include "bruiserffi.h" -//#include <capstone/capstone.h> #include <errno.h> #include <ffi.h> #include <inttypes.h> @@ -169,34 +168,6 @@ void* ffi_callX(int argc, const char** arg_string, ffi_type rtype, void* x_ptr, void* ffi_callX_var(int argc, const char** arg_string, ffi_type rtype, void* x_ptr, void** values) {return NULL;} /**********************************************************************************************************************/ -#if 0 -#define CODE_1 "\x55\x48\x89\xe5\x48\x83\xec\x20\x89\x7d\xfc\x89\x75\xf8\x89\x55\xf4\x89\x4d\xf0\x8b\x7d\xfc\x8b\x75\xf8\xe8\xd1\xfd\xff\xff\x8b\x7d\xf4\x8b\x75\xf0\x89\x45\xec\xe8\xc3\xfd\xff\xff\x8b\x4d\xec\x1\xc1\x89\xc8\x48\x83\xc4\x20\x5d\xc3" -int capstone_test(void) { - csh handle; - cs_insn* insn; - size_t count; - if (cs_open(CS_ARCH_X86, CS_MODE_64, &handle) != CS_ERR_OK) return -1; - count = cs_disasm(handle, CODE_1, sizeof(CODE_1) - 1, 0x0, 0, &insn); - if (count > 0) { - size_t j; - for (j = 0; j <count; ++j) { - if (strcmp(insn[j].mnemonic, "call") == 0) { - printf("0x%"PRIx64":\t%s\t\t%s\n", insn[j].address, insn[j].mnemonic, insn[j].op_str); - char* endptr; - intmax_t address = strtoimax(insn[j].op_str, &endptr, 0); - uintmax_t uaddress = strtoumax(insn[j].op_str, &endptr, 0); - printf("address: %ld\n", address); - printf("uaddress: %ld\n", uaddress); - } - } - cs_free(insn, count); - } else { - printf("ERROR!!!\n"); - } - cs_close(&handle); - return 0; -} -#endif /**********************************************************************************************************************/ // @DEVI-the following lines are only meant for testing. uint32_t add2(uint32_t a, uint32_t b) {return a+b;} @@ -236,10 +207,6 @@ int main(int argc, char** argv) { result = ffi_callX(1, args3, ffi_type_pointer, pstring, values3); fprintf(stdout, "result of calling passthrough is %s\n", ffi_reinterpret_string(result)); - /*capstone tests*/ - printf("\n"); - //capstone_test(); - return 0; } /**********************************************************************************************************************/ diff --git a/bruiser/bruiserffi.h b/bruiser/bruiserffi.h index 567a6f6..c06ecda 100644 --- a/bruiser/bruiserffi.h +++ b/bruiser/bruiserffi.h @@ -18,7 +18,6 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.*/ /**********************************************************************************************************************/ -//#include <capstone/capstone.h> #include <ffi.h> #include <stdint.h> /**********************************************************************************************************************/ @@ -33,15 +32,15 @@ extern "C" { X ffi_reinterpret_##X(void* result); #define X_LIST_GEN \ - X(uint8_t, "uint8_t")\ - X(uint16_t, "uint8_t")\ - X(uint32_t, "uint8_t")\ - X(uint64_t, "uint8_t")\ - X(int8_t, "uint8_t")\ - X(int16_t, "uint8_t")\ - X(int32_t, "uint8_t")\ - X(int64_t, "uint8_t")\ - X(uintptr_t, "uint8_t")\ + X(uint8_t, "for uint8_t")\ + X(uint16_t, "for uint16_t")\ + X(uint32_t, "for uint32_t")\ + X(uint64_t, "for uint64_t")\ + X(int8_t, "for int8_t")\ + X(int16_t, "for int16_t")\ + X(int32_t, "for int32_t")\ + X(int64_t, "for int64_t")\ + X(uintptr_t, "for pointers")\ #define X(X1,X2) REINTERPRET_GENERATOR(X1) X_LIST_GEN diff --git a/bruiser/devi_extra.h b/bruiser/devi_extra.h new file mode 100644 index 0000000..9ef66b3 --- /dev/null +++ b/bruiser/devi_extra.h @@ -0,0 +1,33 @@ + +/*first line intentionally left blank.*/ +/**********************************************************************************************************************/ +#include <inttypes.h> +#include <stdint.h> +/**********************************************************************************************************************/ +#ifndef DEVI_EXTRA_H +#define DEVI_EXTRA_H + +#ifdef __cplusplus +extern "C" { +#endif + +#define RED "\033[1;31m" +#define CYAN "\033[1;36m" +#define GREEN "\033[1;32m" +#define BLUE "\033[1;34m" +#define BLACK "\033[1;30m" +#define BROWN "\033[1;33m" +#define MAGENTA "\033[1;35m" +#define GRAY "\033[1;37m" +#define DARKGRAY "\033[1;30m" +#define YELLOW "\033[1;33m" +#define NORMAL "\033[0m" +#define CLEAR "\033[2J" + +#ifdef __cplusplus +} +#endif +#endif +/**********************************************************************************************************************/ +/*last line intentionally left blank.*/ + diff --git a/bruiser/lua-scripts/demo1.lua b/bruiser/lua-scripts/demo1.lua index 6645098..efbc7c5 100644 --- a/bruiser/lua-scripts/demo1.lua +++ b/bruiser/lua-scripts/demo1.lua @@ -192,6 +192,9 @@ function main() --print("xcall returned:",a) --if a ~= 100 then print("test failed") end + a = xobjlist() + print("the offset of quad and add2 is : ", a["quad"] - a["add2"]) + end main() |