mirrors/unicorn
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

samples: update shellcode.c to use new API

Browse Source
This commit is contained in:
Jonathon Reinhart 2015-08-26 08:37:45 -04:00
parent 4c9e78d2f9
commit 0202a57d32
1 changed files with 21 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
samples/shellcode.c
View File

@ -20,18 +20,18 @@
#define MIN(a, b) (a < b? a : b) #define MIN(a, b) (a < b? a : b)
// callback for tracing instruction // callback for tracing instruction
static void hook_code(uch handle, uint64_t address, uint32_t size, void *user_data) static void hook_code(struct uc_struct *uc, uint64_t address, uint32_t size, void *user_data)
{ {
int r_eip; int r_eip;
char tmp[16]; char tmp[16];
printf("Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size); printf("Tracing instruction at 0x%"PRIx64 ", instruction size = 0x%x\n", address, size);
uc_reg_read(handle, UC_X86_REG_EIP, &r_eip); uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);
printf("*** EIP = %x ***: ", r_eip); printf("*** EIP = %x ***: ", r_eip);
size = MIN(sizeof(tmp), size); size = MIN(sizeof(tmp), size);
if (!uc_mem_read(handle, address, (uint8_t *)tmp, size)) { if (!uc_mem_read(uc, address, (uint8_t *)tmp, size)) {
int i; int i;
for (i=0; i<size; i++) { for (i=0; i<size; i++) {
printf("%x ", ((uint8_t*)tmp)[i]); printf("%x ", ((uint8_t*)tmp)[i]);
@ -43,7 +43,7 @@ static void hook_code(uch handle, uint64_t address, uint32_t size, void *user_da
#define MIN(a, b) (a < b? a : b) #define MIN(a, b) (a < b? a : b)
// callback for handling interrupt // callback for handling interrupt
// ref: http://syscalls.kernelgrok.com/ // ref: http://syscalls.kernelgrok.com/
static void hook_intr(uch handle, uint32_t intno, void *user_data) static void hook_intr(struct uc_struct *uc, uint32_t intno, void *user_data)
{ {
int32_t r_eax, r_ecx, r_eip; int32_t r_eax, r_ecx, r_eip;
uint32_t r_edx, size; uint32_t r_edx, size;
@ -53,8 +53,8 @@ static void hook_intr(uch handle, uint32_t intno, void *user_data)
if (intno != 0x80) if (intno != 0x80)
return; return;
uc_reg_read(handle, UC_X86_REG_EAX, &r_eax); uc_reg_read(uc, UC_X86_REG_EAX, &r_eax);
uc_reg_read(handle, UC_X86_REG_EIP, &r_eip); uc_reg_read(uc, UC_X86_REG_EIP, &r_eip);
switch(r_eax) { switch(r_eax) {
default: default:
@ -62,19 +62,19 @@ static void hook_intr(uch handle, uint32_t intno, void *user_data)
break; break;
case 1: // sys_exit case 1: // sys_exit
printf(">>> 0x%x: interrupt 0x%x, SYS_EXIT. quit!\n\n", r_eip, intno); printf(">>> 0x%x: interrupt 0x%x, SYS_EXIT. quit!\n\n", r_eip, intno);
uc_emu_stop(handle); uc_emu_stop(uc);
break; break;
case 4: // sys_write case 4: // sys_write
// ECX = buffer address // ECX = buffer address
uc_reg_read(handle, UC_X86_REG_ECX, &r_ecx); uc_reg_read(uc, UC_X86_REG_ECX, &r_ecx);
// EDX = buffer size // EDX = buffer size
uc_reg_read(handle, UC_X86_REG_EDX, &r_edx); uc_reg_read(uc, UC_X86_REG_EDX, &r_edx);
// read the buffer in // read the buffer in
size = MIN(sizeof(buffer)-1, r_edx); size = MIN(sizeof(buffer)-1, r_edx);
if (!uc_mem_read(handle, r_ecx, buffer, size)) { if (!uc_mem_read(uc, r_ecx, buffer, size)) {
buffer[size] = '\0'; buffer[size] = '\0';
printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = %u, content = '%s'\n", printf(">>> 0x%x: interrupt 0x%x, SYS_WRITE. buffer = 0x%x, size = %u, content = '%s'\n",
r_eip, intno, r_ecx, r_edx, buffer); r_eip, intno, r_ecx, r_edx, buffer);
@ -88,44 +88,44 @@ static void hook_intr(uch handle, uint32_t intno, void *user_data)
static void test_i386(void) static void test_i386(void)
{ {
uch handle, evh; struct uc_struct *uc;
uc_err err; uc_err err;
uch trace1; uc_hook_h trace1, trace2;
int r_esp = ADDRESS + 0x200000; // ESP register int r_esp = ADDRESS + 0x200000; // ESP register
printf("Emulate i386 code\n"); printf("Emulate i386 code\n");
// Initialize emulator in X86-32bit mode // Initialize emulator in X86-32bit mode
err = uc_open(UC_ARCH_X86, UC_MODE_32, &handle); err = uc_open(UC_ARCH_X86, UC_MODE_32, &uc);
if (err) { if (err) {
printf("Failed on uc_open() with error returned: %u\n", err); printf("Failed on uc_open() with error returned: %u\n", err);
return; return;
} }
// map 2MB memory for this emulation // map 2MB memory for this emulation
uc_mem_map(handle, ADDRESS, 2 * 1024 * 1024); uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024);
// write machine code to be emulated to memory // write machine code to be emulated to memory
if (uc_mem_write(handle, ADDRESS, (uint8_t *)X86_CODE32_SELF, sizeof(X86_CODE32_SELF) - 1)) { if (uc_mem_write(uc, ADDRESS, (uint8_t *)X86_CODE32_SELF, sizeof(X86_CODE32_SELF) - 1)) {
printf("Failed to write emulation code to memory, quit!\n"); printf("Failed to write emulation code to memory, quit!\n");
return; return;
} }
// initialize machine registers // initialize machine registers
uc_reg_write(handle, UC_X86_REG_ESP, &r_esp); uc_reg_write(uc, UC_X86_REG_ESP, &r_esp);
// tracing all instructions by having @begin > @end // tracing all instructions by having @begin > @end
uc_hook_add(handle, &trace1, UC_HOOK_CODE, hook_code, NULL, 1, 0); uc_hook_add(uc, &trace1, UC_HOOK_CODE, hook_code, NULL, 1, 0);
// handle interrupt ourself // handle interrupt ourself
uc_hook_add(handle, &evh, UC_HOOK_INTR, hook_intr, NULL); uc_hook_add(uc, &trace2, UC_HOOK_INTR, hook_intr, NULL);
printf("\n>>> Start tracing this Linux code\n"); printf("\n>>> Start tracing this Linux code\n");
// emulate machine code in infinite time // emulate machine code in infinite time
// err = uc_emu_start(handle, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF), 0, 12); <--- emulate only 12 instructions // err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF), 0, 12); <--- emulate only 12 instructions
err = uc_emu_start(handle, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF) - 1, 0, 0); err = uc_emu_start(uc, ADDRESS, ADDRESS + sizeof(X86_CODE32_SELF) - 1, 0, 0);
if (err) { if (err) {
printf("Failed on uc_emu_start() with error returned %u: %s\n", printf("Failed on uc_emu_start() with error returned %u: %s\n",
err, uc_strerror(err)); err, uc_strerror(err));
@ -133,7 +133,7 @@ static void test_i386(void)
printf("\n>>> Emulation done.\n"); printf("\n>>> Emulation done.\n");
uc_close(&handle); uc_close(uc);
} }
int main(int argc, char **argv, char **envp) int main(int argc, char **argv, char **envp)