forked from MaidsShadowClub/triton_krackme
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathutils.cpp
189 lines (168 loc) · 5.64 KB
/
utils.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
#include <cstdarg>
#include <regex>
#include <triton/context.hpp>
#include "utils.hpp"
using namespace triton;
extern triton::Context gctx;
extern bool DEBUG;
uint64 heap_base = 0xAFFFFFFF;
std::map<int, std::vector<std::pair<std::string, arch::register_e>>> gpr = {
{arch::ARCH_X86_64,
{{"ip", arch::ID_REG_X86_RIP},
{"sp", arch::ID_REG_X86_RSP},
{"bp", arch::ID_REG_X86_RBP},
{"ret", arch::ID_REG_X86_RAX}}},
{arch::ARCH_X86,
{{"ip", arch::ID_REG_X86_EIP},
{"sp", arch::ID_REG_X86_ESP},
{"bp", arch::ID_REG_X86_EBP},
{"ret", arch::ID_REG_X86_EAX}}},
{arch::ARCH_AARCH64,
{{"ip", arch::ID_REG_AARCH64_PC},
{"sp", arch::ID_REG_AARCH64_SP},
{"bp", arch::ID_REG_AARCH64_X29},
{"ret", arch::ID_REG_AARCH64_X0}}},
{arch::ARCH_ARM32,
{{"ip", arch::ID_REG_ARM32_PC},
{"sp", arch::ID_REG_ARM32_SP},
{"bp", arch::ID_REG_ARM32_R11},
{"ret", arch::ID_REG_ARM32_R0}}}};
std::map<int, std::vector<arch::register_e>> arg_regs = {
{arch::ARCH_X86_64,
{arch::ID_REG_X86_RDI, arch::ID_REG_X86_RSI, arch::ID_REG_X86_RDX,
arch::ID_REG_X86_R10, arch::ID_REG_X86_R8,
arch::ID_REG_X86_R9}}, // depend on calling convention R10 can be replaced
// by RXC
{arch::ARCH_X86,
{arch::ID_REG_X86_EBX, arch::ID_REG_X86_ECX, arch::ID_REG_X86_EDX,
arch::ID_REG_X86_ESI, arch::ID_REG_X86_EDI, arch::ID_REG_X86_EBX}},
{arch::ARCH_AARCH64,
{arch::ID_REG_AARCH64_X0, arch::ID_REG_AARCH64_X1, arch::ID_REG_AARCH64_X2,
arch::ID_REG_AARCH64_X3, arch::ID_REG_AARCH64_X4,
arch::ID_REG_AARCH64_X5}},
{arch::ARCH_ARM32,
{arch::ID_REG_ARM32_R0, arch::ID_REG_ARM32_R1, arch::ID_REG_ARM32_R2,
arch::ID_REG_ARM32_R3, arch::ID_REG_ARM32_R4, arch::ID_REG_ARM32_R5}}};
uint64 getStack(int number) {
auto sp_val = getGpr("sp");
arch::MemoryAccess var(sp_val + number * gctx.getGprSize(),
gctx.getGprSize());
return static_cast<uint64>(gctx.getConcreteMemoryValue(var));
}
void setStack(int number, const uint64 value) {
auto sp_val = getGpr("sp");
arch::MemoryAccess var(sp_val + number * gctx.getGprSize(),
gctx.getGprSize());
gctx.setConcreteMemoryValue(var, value);
}
arch::Register getArgReg(int number) {
auto regs = arg_regs[gctx.getArchitecture()];
arch::Register reg;
reg = gctx.getRegister(regs[number]);
return reg;
}
uint64 getArg(int number) {
auto regs = arg_regs[gctx.getArchitecture()];
uint64 ret;
arch::Register reg;
switch (number) {
case 0 ... 5:
reg = gctx.getRegister(regs[number]);
ret = static_cast<uint64>(gctx.getConcreteRegisterValue(reg));
break;
default:
ret = getStack(number + 2); // stack is ip+old_sp+arg1+arg2+...
}
return ret;
}
void setArg(int number, const uint64 value) {
auto regs = arg_regs[gctx.getArchitecture()];
uint64 ret;
arch::Register reg;
switch (number) {
case 0 ... 5:
reg = gctx.getRegister(regs[number]);
gctx.setConcreteRegisterValue(reg, value);
break;
default:
setStack(number + 2, value); // stack is ip+old_sp+arg1+arg2+...
}
}
uint64 getGpr(const std::string &name) {
auto gpr_regs = gpr[gctx.getArchitecture()];
auto reg_id = std::find_if(gpr_regs.begin(), gpr_regs.end(),
[=](auto r) { return r.first == name; });
if (reg_id == gpr_regs.end())
throw std::invalid_argument("cannot get this general purpose register");
auto reg = gctx.getRegister(reg_id->second);
return static_cast<uint64>(gctx.getConcreteRegisterValue(reg));
}
void setGpr(const std::string &name, const uint64 value) {
auto gpr_regs = gpr[gctx.getArchitecture()];
auto reg_id = std::find_if(gpr_regs.begin(), gpr_regs.end(),
[=](auto r) { return r.first == name; });
if (reg_id == gpr_regs.end())
throw std::invalid_argument("cannot set this general purpose register");
auto reg = gctx.getRegister(reg_id->second);
gctx.setConcreteRegisterValue(reg, value);
}
arch::register_e getGprId(const std::string &name) {
auto gpr_regs = gpr[gctx.getArchitecture()];
auto reg_id = std::find_if(gpr_regs.begin(), gpr_regs.end(),
[=](auto r) { return r.first == name; });
if (reg_id == gpr_regs.end())
throw std::invalid_argument("cannot get this general purpose register id");
return reg_id->second;
}
uint64 allocate(uint8 *buf, uint64 size) {
gctx.setConcreteMemoryAreaValue(heap_base, buf, size);
uint64 ret = heap_base;
heap_base += size;
return ret;
}
std::string toHex(uint64 ptr, uint32 size) {
char hex[4];
std::string res = "";
for (uint32 i = 0; i < size; i++) {
snprintf(hex, 3, "%02x ", gctx.getConcreteMemoryValue(ptr + i));
res += hex;
}
return res;
}
std::string readAsciiString(uint64 ptr, uint64 len) {
std::string res = "";
for (uint64 i = 0; i < len; i++) {
uint8 c = gctx.getConcreteMemoryValue(ptr + i);
if ((c < 0x20) || (c > 0x7F))
break;
res += c;
}
return res;
}
std::string readUtf8String(uint64 ptr, uint64 len) {
std::string res = "";
for (uint64 i = 0; i < len; i++) {
uint8 c = gctx.getConcreteMemoryValue(ptr + i);
if (c == 0)
break;
res += c;
}
return res;
}
uint64 lenString(uint64 ptr) {
uint64 res;
for (res = 0;; res++) {
uint8 c = gctx.getConcreteMemoryValue(ptr + res);
if (c == 0)
break;
}
return res;
}
// print stuff
uint64 printfArgAmount(const std::string &format) {
std::regex const re("%[0-9$#xXzldos]*");
std::ptrdiff_t const count(
std::distance(std::sregex_iterator(format.begin(), format.end(), re),
std::sregex_iterator()));
return count;
}