Skip to content

Commit 93ced98

Browse files
archived-carchived-c
authored
Replace run_to_addr uses with set_breakpoint (#7)
* Replace run_to_addr with set_breakpoint in examples * Replace run_to_addr in documentation
1 parent 281d31d commit 93ced98

6 files changed

Lines changed: 74 additions & 50 deletions

File tree

‎docs/tutorials/02_scripting.md‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,9 @@ def patch_mem():
141141
z = Zelos("password_check.bin", verbosity=1)
142142
# The address cmp instr observed above
143143
target_address = 0x0040107C
144-
# run to the target address and stop
145-
z.plugins.runner.run_to_addr(target_address)
144+
# run to the address of cmp and break
145+
z.set_breakpoint(target_address, True)
146+
z.start()
146147

147148
# Execution is now STOPPED at address 0x0040107C
148149

@@ -176,8 +177,10 @@ def patch_reg():
176177
z = Zelos("password_check.bin", verbosity=1)
177178
# The address of the first time eax is used above
178179
target_address = 0x00401810
179-
# run to the target address and stop
180-
z.plugins.runner.run_to_addr(target_address)
180+
# run to the address of cmp and break
181+
z.set_breakpoint(target_address, True)
182+
z.start()
183+
181184
# Execution is now STOPPED at address 0x00401810
182185

183186
# Set eax to 0x0
@@ -215,8 +218,9 @@ def patch_code():
215218
z = Zelos("password_check.bin", verbosity=1)
216219
# The address of the cmp instr
217220
target_address = 0x0040107C
218-
# run to the address of cmp and stop
219-
z.plugins.runner.run_to_addr(target_address)
221+
# run to the address of cmp and break
222+
z.set_breakpoint(target_address, True)
223+
z.start()
220224

221225
# Execution is now STOPPED at address 0x0040107C
222226

@@ -321,8 +325,10 @@ def brute():
321325
z = Zelos("password.bin", verbosity=1)
322326
# The address of strcmp observed above
323327
strcmp_address = 0x00400BB6
324-
# run to the address of call to strcmp and stop
325-
z.plugins.runner.run_to_addr(strcmp_address)
328+
# run to the address of cmp and break
329+
z.set_breakpoint(strcmp_address, True)
330+
z.start()
331+
326332
# Execution is now STOPPED at address 0x00400BB6
327333

328334
# get initial reg values of rdi & rsi before strcmp is called
@@ -386,8 +392,10 @@ def brute():
386392
z = Zelos("password.bin", verbosity=1)
387393
# The address of strcmp observed above
388394
strcmp_address = 0x00400BB6
389-
# run to the address of call to strcmp and stop
390-
z.plugins.runner.run_to_addr(strcmp_address)
395+
# run to the address of cmp and break
396+
z.set_breakpoint(strcmp_address, True)
397+
z.start()
398+
391399
# Execution is now STOPPED at address 0x00400BB6
392400

393401
# get initial reg values of rdi & rsi before strcmp is called
@@ -402,8 +410,10 @@ def brute():
402410

403411
# Address of the test instr
404412
test_address = 0x00400BBB
405-
# run to the address of test instr and stop
406-
z.plugins.runner.run_to_addr(test_address)
413+
# run to the address of cmp and break
414+
z.set_breakpoint(test_address, True)
415+
z.start()
416+
407417
# execute one step, in this case the test instr
408418
z.step()
409419

‎examples/script_brute/README.md‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,10 @@ def brute():
7171
z = Zelos("password.bin", verbosity=1)
7272
# The address of strcmp observed above
7373
strcmp_address = 0x00400BB6
74-
# run to the address of call to strcmp and stop
75-
z.plugins.runner.run_to_addr(strcmp_address)
74+
# run to the address of call to strcmp and break
75+
z.set_breakpoint(strcmp_address, True)
76+
z.start()
77+
7678
# Execution is now STOPPED at address 0x00400BB6
7779

7880
# get initial reg values of rdi & rsi before strcmp is called
@@ -136,8 +138,10 @@ def brute():
136138
z = Zelos("password.bin", verbosity=1)
137139
# The address of strcmp observed above
138140
strcmp_address = 0x00400BB6
139-
# run to the address of call to strcmp and stop
140-
z.plugins.runner.run_to_addr(strcmp_address)
141+
# run to the address of call to strcmp and break
142+
z.set_breakpoint(strcmp_address, True)
143+
z.start()
144+
141145
# Execution is now STOPPED at address 0x00400BB6
142146

143147
# get initial reg values of rdi & rsi before strcmp is called
@@ -152,8 +156,10 @@ def brute():
152156

153157
# Address of the test instr
154158
test_address = 0x00400BBB
155-
# run to the address of test instr and stop
156-
z.plugins.runner.run_to_addr(test_address)
159+
# run to the address of test instr and break
160+
z.set_breakpoint(test_address, True)
161+
z.start()
162+
157163
# execute one step, in this case the test instr
158164
z.step()
159165

‎examples/script_brute/brute.py‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,9 @@ def brute():
2727
z = Zelos(path.join(DATA_DIR, "password.bin"), verbosity=1)
2828
# The address of strcmp observed above
2929
strcmp_address = 0x00400BB6
30-
# run to the address of call to strcmp and stop
31-
z.plugins.runner.run_to_addr(strcmp_address)
30+
# run to the address of call to strcmp and break
31+
z.set_breakpoint(strcmp_address, True)
32+
z.start()
3233

3334
# Execution is now STOPPED at address 0x00400BB6
3435

@@ -44,8 +45,10 @@ def brute():
4445

4546
# Address of the test instr
4647
test_address = 0x00400BBB
47-
# run to the address of test instr and stop
48-
z.plugins.runner.run_to_addr(test_address)
48+
# run to the address of test instr and break
49+
z.set_breakpoint(test_address, True)
50+
z.start()
51+
4952
# execute one step, in this case the test instr
5053
z.step()
5154

‎examples/script_bypass/README.md‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,9 @@ def patch_mem():
9595
z = Zelos("password_check.bin", verbosity=1)
9696
# The address cmp instr observed above
9797
target_address = 0x0040107C
98-
# run to the target address and stop
99-
z.plugins.runner.run_to_addr(target_address)
98+
# run to the address of cmp and break
99+
z.set_breakpoint(target_address, True)
100+
z.start()
100101

101102
# Execution is now STOPPED at address 0x0040107C
102103

@@ -130,8 +131,10 @@ def patch_reg():
130131
z = Zelos("password_check.bin", verbosity=1)
131132
# The address of the first time eax is used above
132133
target_address = 0x00401810
133-
# run to the target address and stop
134-
z.plugins.runner.run_to_addr(target_address)
134+
# run to the address of cmp and break
135+
z.set_breakpoint(target_address, True)
136+
z.start()
137+
135138
# Execution is now STOPPED at address 0x00401810
136139

137140
# Set eax to 0x0
@@ -169,8 +172,9 @@ def patch_code():
169172
z = Zelos("password_check.bin", verbosity=1)
170173
# The address of the cmp instr
171174
target_address = 0x0040107C
172-
# run to the address of cmp and stop
173-
z.plugins.runner.run_to_addr(target_address)
175+
# run to the address of cmp and break
176+
z.set_breakpoint(target_address, True)
177+
z.start()
174178

175179
# Execution is now STOPPED at address 0x0040107C
176180

‎examples/script_bypass/bypass.py‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,9 @@ def patch_mem():
2929
z = Zelos(path.join(DATA_DIR, "password_check.bin"))
3030
# The address of the cmp instr
3131
target_address = 0x0040107C
32-
# run to the address of cmp and stop
33-
z.internal_engine.plugins.runner.run_to_addr(target_address)
32+
# run to the address of cmp and break
33+
z.set_breakpoint(target_address, True)
34+
z.start()
3435

3536
# Execution is now STOPPED at address 0x0040107C
3637

@@ -44,8 +45,9 @@ def patch_reg():
4445
z = Zelos(path.join(DATA_DIR, "password_check.bin"))
4546
# The address of the first time eax is used above
4647
target_address = 0x00401810
47-
# run to the target address and stop
48-
z.internal_engine.plugins.runner.run_to_addr(target_address)
48+
# run to the target address and break
49+
z.set_breakpoint(target_address, True)
50+
z.start()
4951

5052
# Execution is now STOPPED at address 0x00401810
5153

@@ -56,21 +58,20 @@ def patch_reg():
5658

5759

5860
def patch_code():
59-
from keystone import KS_ARCH_X86, KS_MODE_64, Ks
60-
6161
z = Zelos(path.join(DATA_DIR, "password_check.bin"))
6262
# The address of the cmp instr
6363
target_address = 0x0040107C
64-
# run to the address of cmp and stop
65-
z.internal_engine.plugins.runner.run_to_addr(target_address)
64+
# run to the address of cmp and break
65+
z.set_breakpoint(target_address, True)
66+
z.start()
6667

6768
# Execution is now STOPPED at address 0x0040107C
6869

69-
# Code we want to insert
70-
code = b"NOP; NOP; CMP eax, eax"
71-
# Assemble with keystone
72-
ks = Ks(KS_ARCH_X86, KS_MODE_64)
73-
encoding, count = ks.asm(code)
70+
# Code we want to insert is:
71+
# NOP; NOP; CMP eax, eax;
72+
#
73+
# The assembled code is:
74+
encoding = [144, 144, 57, 192]
7475

7576
# replace the four bytes at this location with our code
7677
for i in range(len(encoding)):

‎examples/test_examples.py‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -86,15 +86,15 @@ def test_bypass_reg(self):
8686
)
8787
self.assertTrue("Correct!" in str(output))
8888

89-
# def test_bypass_code(self):
90-
# output = subprocess.check_output(
91-
# [
92-
# "python",
93-
# path.join(DATA_DIR, "script_bypass", "bypass.py"),
94-
# "code",
95-
# ]
96-
# )
97-
# self.assertTrue("Correct!" in str(output))
89+
def test_bypass_code(self):
90+
output = subprocess.check_output(
91+
[
92+
"python",
93+
path.join(DATA_DIR, "script_bypass", "bypass.py"),
94+
"code",
95+
]
96+
)
97+
self.assertTrue("Correct!" in str(output))
9898

9999

100100
def main():

0 commit comments

Comments
 (0)