mirror of https://github.com/pwndbg/pwndbg.git
lots of WIP stuff
Zach Riggle
11 years ago
parent
3e57bc3445
commit
994afa9aef
@ -0,0 +1,60 @@
|
||||
# Byte-compiled / optimized / DLL files
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
|
||||
# C extensions
|
||||
*.so
|
||||
|
||||
# Distribution / packaging
|
||||
.Python
|
||||
env/
|
||||
build/
|
||||
develop-eggs/
|
||||
dist/
|
||||
downloads/
|
||||
eggs/
|
||||
.eggs/
|
||||
lib/
|
||||
lib64/
|
||||
parts/
|
||||
sdist/
|
||||
var/
|
||||
*.egg-info/
|
||||
.installed.cfg
|
||||
*.egg
|
||||
|
||||
# PyInstaller
|
||||
# Usually these files are written by a python script from a template
|
||||
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
||||
*.manifest
|
||||
*.spec
|
||||
|
||||
# Installer logs
|
||||
pip-log.txt
|
||||
pip-delete-this-directory.txt
|
||||
|
||||
# Unit test / coverage reports
|
||||
htmlcov/
|
||||
.tox/
|
||||
.coverage
|
||||
.coverage.*
|
||||
.cache
|
||||
nosetests.xml
|
||||
coverage.xml
|
||||
*,cover
|
||||
|
||||
# Translations
|
||||
*.mo
|
||||
*.pot
|
||||
|
||||
# Django stuff:
|
||||
*.log
|
||||
|
||||
# Sphinx documentation
|
||||
docs/_build/
|
||||
|
||||
# PyBuilder
|
||||
target/
|
||||
|
||||
npm-debug.log
|
||||
.gdb_history
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,18 @@
|
||||
import pwndbg.arch
|
||||
import pwndbg.jump.mips
|
||||
import pwndbg.jump.arm
|
||||
import pwndbg.jump.ppc
|
||||
import pwndbg.jump.x86
|
||||
import pwndbg.jump.sparc
|
||||
|
||||
def get_target(pc):
|
||||
return {
|
||||
'i386': pwndbg.jump.x86.resolver,
|
||||
'x86-64': pwndbg.jump.x86.resolver
|
||||
}.get(pwndbg.arch.current, lambda *a: None)(pc)
|
||||
|
||||
class Foo(object):
|
||||
@property
|
||||
def foobar(self):
|
||||
return self._foobar
|
||||
|
||||
@ -0,0 +1,82 @@
|
||||
import pwndbg.arch
|
||||
import pwndbg.memory
|
||||
import pwndbg.regs
|
||||
|
||||
from capstone import *
|
||||
from capstone.x86 import *
|
||||
|
||||
md = Cs(CS_ARCH_X86, CS_MODE_32)
|
||||
md.detail = True
|
||||
|
||||
class TargetResolver(object):
|
||||
groups = {v:k for k,v in globals().items() if k.startswith('X86_GRP_')}
|
||||
ops = {v:k for k,v in globals().items() if k.startswith('X86_OP_')}
|
||||
regs = {v:k for k,v in globals().items() if k.startswith('X86_REG_')}
|
||||
|
||||
def __init__(self):
|
||||
self.classes = {
|
||||
X86_GRP_CALL: self.call_or_jump,
|
||||
X86_GRP_JUMP: self.call_or_jump,
|
||||
X86_GRP_RET: self.ret
|
||||
}
|
||||
|
||||
def resolve(self, address):
|
||||
code = bytes(pwndbg.memory.read(address, 16))
|
||||
|
||||
md.mode = CS_MODE_32 if pwndbg.arch.ptrsize == 4 else CS_MODE_64
|
||||
|
||||
instruction = next(md.disasm(code, address, 1))
|
||||
|
||||
for group in instruction.groups:
|
||||
function = self.classes.get(group, None)
|
||||
print(self.groups[group])
|
||||
if function:
|
||||
return function(instruction)
|
||||
|
||||
def get_operand_target(self, op):
|
||||
# EB/E8/E9 or similar "call $+offset"
|
||||
# Capstone handles the instruction + instruction size.
|
||||
if op.type == X86_OP_IMM:
|
||||
return op.value.imm
|
||||
|
||||
# jmp/call REG
|
||||
if op.type == X86_OP_REG:
|
||||
regname = instruction.reg_name(op.value.reg)
|
||||
return pwndbg.regs[regname]
|
||||
|
||||
# base + disp + scale * offset
|
||||
assert op.type == X86_OP_MEM, "Invalid operand type %i" % op.type
|
||||
|
||||
target = 0
|
||||
|
||||
if op.mem.base != 0:
|
||||
regname = instruction.reg_name(op.value.reg)
|
||||
target += pwndbg.regs[regname]
|
||||
|
||||
if op.mem.disp != 0:
|
||||
target += op.value.mem.disp
|
||||
|
||||
if op.mem.index != 0:
|
||||
scale = op.mem.scale
|
||||
index = pwndbg.regs[instruction.reg_name(op.mem.index)]
|
||||
target += (scale * index)
|
||||
|
||||
return target
|
||||
|
||||
|
||||
def call_or_jump(self, instruction):
|
||||
ops = instruction.operands
|
||||
assert len(ops) == 1, "Too many operands (%i)" % len(ops)
|
||||
|
||||
return self.get_operand_target(ops[0])
|
||||
|
||||
def ret(self, instruction):
|
||||
target = pwndbg.regs.sp
|
||||
|
||||
for op in instruction.operands:
|
||||
assert op.type == X86_OP_IMM, "Unknown RET operand type"
|
||||
target += op.value.imm
|
||||
|
||||
return pwndbg.memory.pvoid(target)
|
||||
|
||||
resolver = TargetResolver()
|
||||
Loading…
Reference in new issue