fromunicornimport*fromunicorn.x86_constimport*fromcapstoneimport*fromcapstone.x86_constimport*BASE_ADDRESS=0x1000000STACK_OFFSET=0x200000defsetup(code_bin):"""init capstone, return instance"""try:# Initialize emulator in X86-32bit modemu=Uc(UC_ARCH_X86,UC_MODE_32)# map 2MB memory for this emulationmu.mem_map(BASE_ADDRESS,8*1024*1024)# write data to memorymu.mem_write(BASE_ADDRESS,code_bin)# initialize register for stack mu.reg_write(UC_X86_REG_ESP,BASE_ADDRESS+STACK_OFFSET)mu.reg_write(UC_X86_REG_EBP,BASE_ADDRESS+STACK_OFFSET)exceptUcErrorase:print("ERROR SETUP:%s"%e)returnNonereturnmu#TODO: calculuate the string size defget_string(offset,size=0x20):"""read string from stack, example: lea ecx, [ebp+var_44], enter 0x44 """read_str=str(emu.mem_read(BASE_ADDRESS+STACK_OFFSET-offset,size))temp=read_str[:read_str.find("\x00\x00")]read_str=temp.replace("\x00","")returnread_strdefget_code():""" read bytes from idb"""try:start=SelStart()end=SelEnd()length=end-startstring="".join([byteforbyteinGetManyBytes(SelStart(),length)])return(start,end,string)except:return(0,0,0)start,end,data=get_code()ifstart:emu=setup(data)ifemu:try:emu.emu_start(BASE_ADDRESS,BASE_ADDRESS+len(data))exceptUcErrorase:print("ERROR START: %s"%e)offset=AskLong(0,"Please enter stack offset")comment=get_string(offset)print"0x%x, %s"%(PrevHead(end),comment)MakeComm(PrevHead(end),comment)
Comments (0)
HTTPSSSH
You can clone a snippet to your computer for local editing.
Learn more.