dotnet: Refactor .NET bindings for .NET5.0
This commit is contained in:
TSR Berry
parent
b99ec09c90
commit
ff1f0a5c1a
|
|
@ -1,41 +0,0 @@
|
|||
namespace UnicornManaged.AssemblyInfo
|
||||
|
||||
open System.Reflection
|
||||
open System.Runtime.CompilerServices
|
||||
open System.Runtime.InteropServices
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[<assembly: AssemblyTitle("UnicornManaged")>]
|
||||
[<assembly: AssemblyDescription("")>]
|
||||
[<assembly: AssemblyConfiguration("")>]
|
||||
[<assembly: AssemblyCompany("")>]
|
||||
[<assembly: AssemblyProduct("UnicornManaged")>]
|
||||
[<assembly: AssemblyCopyright("Copyright © Antonio Parata 2016")>]
|
||||
[<assembly: AssemblyTrademark("")>]
|
||||
[<assembly: AssemblyCulture("")>]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[<assembly: ComVisible(false)>]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[<assembly: Guid("0c21f1c1-2725-4a46-9022-1905f85822a5")>]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [<assembly: AssemblyVersion("1.0.*")>]
|
||||
[<assembly: AssemblyVersion("1.0.0.0")>]
|
||||
[<assembly: AssemblyFileVersion("1.0.0.0")>]
|
||||
|
||||
do
|
||||
()
|
||||
|
|
@ -1,6 +1,5 @@
|
|||
namespace UnicornManaged.Binding
|
||||
|
||||
open System
|
||||
|
||||
module BindingFactory =
|
||||
let mutable _instance = NativeBinding.instance
|
||||
|
|
@ -10,4 +9,3 @@ module BindingFactory =
|
|||
|
||||
let getDefault() =
|
||||
_instance
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
namespace UnicornManaged
|
||||
|
||||
open System
|
||||
open System.Threading
|
||||
open System.Collections.Generic
|
||||
open System.Runtime.InteropServices
|
||||
open System.Linq
|
||||
|
|
|
|||
|
|
@ -1,56 +1,45 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<SchemaVersion>2.0</SchemaVersion>
|
||||
<ProjectGuid>0c21f1c1-2725-4a46-9022-1905f85822a5</ProjectGuid>
|
||||
<OutputType>Library</OutputType>
|
||||
<TargetFramework>net5.0</TargetFramework>
|
||||
<RootNamespace>UnicornManaged</RootNamespace>
|
||||
<AssemblyName>UnicornManaged</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<TargetFSharpCoreVersion>4.3.1.0</TargetFSharpCoreVersion>
|
||||
<Copyright>Copyright © Antonio Parata 2016</Copyright>
|
||||
<RepositoryUrl>https://github.com/unicorn-engine/unicorn</RepositoryUrl>
|
||||
<Version>2.0.0</Version>
|
||||
<ProjectGuid>0c21f1c1-2725-4a46-9022-1905f85822a5</ProjectGuid>
|
||||
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
|
||||
<Name>UnicornManaged</Name>
|
||||
<TargetFrameworkProfile />
|
||||
<GenerateDocumentationFile>true</GenerateDocumentationFile>
|
||||
</PropertyGroup>
|
||||
|
||||
<PropertyGroup>
|
||||
<WarningLevel>3</WarningLevel>
|
||||
</PropertyGroup>
|
||||
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<Tailcalls>false</Tailcalls>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<WarningLevel>3</WarningLevel>
|
||||
<DocumentationFile>bin\Debug\UnicornManaged.XML</DocumentationFile>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<Tailcalls>true</Tailcalls>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<WarningLevel>3</WarningLevel>
|
||||
<DocumentationFile>bin\Release\UnicornManaged.XML</DocumentationFile>
|
||||
</PropertyGroup>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<Tailcalls>false</Tailcalls>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<Tailcalls>true</Tailcalls>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
</PropertyGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<Reference Include="mscorlib" />
|
||||
<Reference Include="FSharp.Core, Version=$(TargetFSharpCoreVersion), Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
|
||||
<Private>True</Private>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Numerics" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="AssemblyInfo.fs" />
|
||||
<Compile Include="Const\Arm.fs" />
|
||||
<Compile Include="Const\Arm64.fs" />
|
||||
<Compile Include="Const\Common.fs" />
|
||||
<Compile Include="Const\M68k.fs" />
|
||||
<Compile Include="Const\Mips.fs" />
|
||||
<Compile Include="Const\Ppc.fs" />
|
||||
<Compile Include="Const\Riscv.fs" />
|
||||
<Compile Include="Const\S390x.fs" />
|
||||
<Compile Include="Const\Sparc.fs" />
|
||||
<Compile Include="Const\TriCore.fs" />
|
||||
<Compile Include="Const\X86.fs" />
|
||||
<Compile Include="Binding\IBinding.fs" />
|
||||
<Compile Include="Binding\MockBinding.fs" />
|
||||
|
|
@ -61,27 +50,4 @@
|
|||
<Compile Include="ConvertUtility.fs" />
|
||||
<Compile Include="Unicorn.fs" />
|
||||
</ItemGroup>
|
||||
<PropertyGroup>
|
||||
<MinimumVisualStudioVersion Condition="'$(MinimumVisualStudioVersion)' == ''">11</MinimumVisualStudioVersion>
|
||||
</PropertyGroup>
|
||||
<Choose>
|
||||
<When Condition="'$(VisualStudioVersion)' == '11.0'">
|
||||
<PropertyGroup Condition="Exists('$(MSBuildExtensionsPath32)\..\Microsoft SDKs\F#\3.0\Framework\v4.0\Microsoft.FSharp.Targets')">
|
||||
<FSharpTargetsPath>$(MSBuildExtensionsPath32)\..\Microsoft SDKs\F#\3.0\Framework\v4.0\Microsoft.FSharp.Targets</FSharpTargetsPath>
|
||||
</PropertyGroup>
|
||||
</When>
|
||||
<Otherwise>
|
||||
<PropertyGroup Condition="Exists('$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)\FSharp\Microsoft.FSharp.Targets')">
|
||||
<FSharpTargetsPath>$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)\FSharp\Microsoft.FSharp.Targets</FSharpTargetsPath>
|
||||
</PropertyGroup>
|
||||
</Otherwise>
|
||||
</Choose>
|
||||
<Import Project="$(FSharpTargetsPath)" />
|
||||
<!-- To modify your build process, add your task inside one of the targets below and uncomment it.
|
||||
Other similar extension points exist, see Microsoft.Common.targets.
|
||||
<Target Name="BeforeBuild">
|
||||
</Target>
|
||||
<Target Name="AfterBuild">
|
||||
</Target>
|
||||
-->
|
||||
</Project>
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<configuration>
|
||||
<startup>
|
||||
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/>
|
||||
</startup>
|
||||
</configuration>
|
||||
|
|
@ -2,9 +2,9 @@
|
|||
|
||||
namespace UnicornSamples
|
||||
{
|
||||
class Program
|
||||
internal static class Program
|
||||
{
|
||||
static void Main(string[] args)
|
||||
private static void Main(string[] args)
|
||||
{
|
||||
// X86 tests 32bit
|
||||
X86Sample32.X86Code32();
|
||||
|
|
|
|||
|
|
@ -1,36 +0,0 @@
|
|||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
// General Information about an assembly is controlled through the following
|
||||
// set of attributes. Change these attribute values to modify the information
|
||||
// associated with an assembly.
|
||||
[assembly: AssemblyTitle("UnicornSamples")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyConfiguration("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: AssemblyProduct("UnicornSamples")]
|
||||
[assembly: AssemblyCopyright("Copyright © Antonio Parata 2016")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyCulture("")]
|
||||
|
||||
// Setting ComVisible to false makes the types in this assembly not visible
|
||||
// to COM components. If you need to access a type in this assembly from
|
||||
// COM, set the ComVisible attribute to true on that type.
|
||||
[assembly: ComVisible(false)]
|
||||
|
||||
// The following GUID is for the ID of the typelib if this project is exposed to COM
|
||||
[assembly: Guid("b80b5987-1e24-4309-8bf9-c4f91270f21c")]
|
||||
|
||||
// Version information for an assembly consists of the following four values:
|
||||
//
|
||||
// Major Version
|
||||
// Minor Version
|
||||
// Build Number
|
||||
// Revision
|
||||
//
|
||||
// You can specify all the values or you can default the Build and Revision Numbers
|
||||
// by using the '*' as shown below:
|
||||
// [assembly: AssemblyVersion("1.0.*")]
|
||||
[assembly: AssemblyVersion("1.0.0.0")]
|
||||
[assembly: AssemblyFileVersion("1.0.0.0")]
|
||||
|
|
@ -1,24 +1,20 @@
|
|||
using Gee.External.Capstone;
|
||||
using Gee.External.Capstone.X86;
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Diagnostics;
|
||||
using System.Linq;
|
||||
using System.Reflection;
|
||||
using System.Text;
|
||||
using System.Threading.Tasks;
|
||||
using UnicornManaged;
|
||||
using UnicornManaged.Const;
|
||||
|
||||
namespace UnicornSamples
|
||||
{
|
||||
internal class ShellcodeSample
|
||||
internal static class ShellcodeSample
|
||||
{
|
||||
private const Int64 ADDRESS = 0x1000000;
|
||||
private const long ADDRESS = 0x1000000;
|
||||
|
||||
public static void X86Code32Self()
|
||||
{
|
||||
Byte[] X86_CODE32_SELF =
|
||||
byte[] X86_CODE32_SELF =
|
||||
{
|
||||
0xeb, 0x1c, 0x5a, 0x89, 0xd6, 0x8b, 0x02, 0x66, 0x3d, 0xca, 0x7d, 0x75, 0x06, 0x66, 0x05, 0x03, 0x03,
|
||||
0x89, 0x02, 0xfe, 0xc2, 0x3d, 0x41, 0x41, 0x41, 0x41, 0x75, 0xe9, 0xff, 0xe6, 0xe8, 0xdf, 0xff, 0xff,
|
||||
|
|
@ -31,7 +27,7 @@ namespace UnicornSamples
|
|||
|
||||
public static void X86Code32()
|
||||
{
|
||||
Byte[] X86_CODE32 =
|
||||
byte[] X86_CODE32 =
|
||||
{
|
||||
0xeb, 0x19, 0x31, 0xc0, 0x31, 0xdb, 0x31, 0xd2, 0x31, 0xc9, 0xb0, 0x04, 0xb3, 0x01, 0x59, 0xb2, 0x05,
|
||||
0xcd, 0x80, 0x31, 0xc0, 0xb0, 0x01, 0x31, 0xdb, 0xcd, 0x80, 0xe8, 0xe2, 0xff, 0xff, 0xff, 0x68, 0x65,
|
||||
|
|
@ -41,28 +37,28 @@ namespace UnicornSamples
|
|||
Run(X86_CODE32);
|
||||
}
|
||||
|
||||
private static void Run(Byte[] code)
|
||||
private static void Run(byte[] code)
|
||||
{
|
||||
Console.WriteLine();
|
||||
var stackTrace = new StackTrace();
|
||||
var stackFrame = stackTrace.GetFrames()[1];
|
||||
var methodName = stackFrame.GetMethod().Name;
|
||||
|
||||
Console.WriteLine("*** Start: " + methodName);
|
||||
Console.WriteLine($"*** Start: {methodName}");
|
||||
RunTest(code, ADDRESS);
|
||||
Console.WriteLine("*** End: " + methodName);
|
||||
Console.WriteLine($"*** End: {methodName}");
|
||||
Console.WriteLine();
|
||||
}
|
||||
|
||||
|
||||
private static void RunTest(Byte[] code, Int64 address)
|
||||
private static void RunTest(byte[] code, long address)
|
||||
{
|
||||
try
|
||||
{
|
||||
using (var u = new Unicorn(Common.UC_ARCH_X86, Common.UC_MODE_32))
|
||||
using(var disassembler = CapstoneDisassembler.CreateX86Disassembler(DisassembleMode.Bit32))
|
||||
using(var disassembler = CapstoneDisassembler.CreateX86Disassembler(X86DisassembleMode.Bit32))
|
||||
{
|
||||
Console.WriteLine("Unicorn version: {0}", u.Version());
|
||||
Console.WriteLine($"Unicorn version: {u.Version()}");
|
||||
|
||||
// map 2MB of memory for this emulation
|
||||
u.MemMap(address, 2 * 1024 * 1024, Common.UC_PROT_ALL);
|
||||
|
|
@ -73,7 +69,7 @@ namespace UnicornSamples
|
|||
// initialize machine registers
|
||||
u.RegWrite(X86.UC_X86_REG_ESP, Utils.Int64ToBytes(address + 0x200000));
|
||||
|
||||
var regv = new Byte[4];
|
||||
var regv = new byte[4];
|
||||
u.RegRead(X86.UC_X86_REG_ESP, regv);
|
||||
|
||||
// tracing all instructions by having @begin > @end
|
||||
|
|
@ -100,42 +96,42 @@ namespace UnicornSamples
|
|||
}
|
||||
|
||||
private static void CodeHookCallback(
|
||||
CapstoneDisassembler<X86Instruction, X86Register, X86InstructionGroup,X86InstructionDetail> disassembler,
|
||||
CapstoneX86Disassembler disassembler,
|
||||
Unicorn u,
|
||||
Int64 addr,
|
||||
Int32 size,
|
||||
Object userData)
|
||||
long addr,
|
||||
int size,
|
||||
object userData)
|
||||
{
|
||||
Console.Write("[+] 0x{0}: ", addr.ToString("X"));
|
||||
Console.Write($"[+] 0x{addr:X}: ");
|
||||
|
||||
var eipBuffer = new Byte[4];
|
||||
var eipBuffer = new byte[4];
|
||||
u.RegRead(X86.UC_X86_REG_EIP, eipBuffer);
|
||||
|
||||
var effectiveSize = Math.Min(16, size);
|
||||
var tmp = new Byte[effectiveSize];
|
||||
var tmp = new byte[effectiveSize];
|
||||
u.MemRead(addr, tmp);
|
||||
|
||||
var sb = new StringBuilder();
|
||||
foreach (var t in tmp)
|
||||
{
|
||||
sb.AppendFormat("{0} ", (0xFF & t).ToString("X"));
|
||||
sb.AppendFormat($"{(0xFF & t):X} ");
|
||||
}
|
||||
Console.Write("{0,-20}", sb);
|
||||
Console.Write($"{sb,-20}");
|
||||
Console.WriteLine(Utils.Disassemble(disassembler, tmp));
|
||||
}
|
||||
|
||||
private static void SyscallHookCallback(Unicorn u, Object userData)
|
||||
private static void SyscallHookCallback(Unicorn u, object userData)
|
||||
{
|
||||
var eaxBuffer = new Byte[4];
|
||||
var eaxBuffer = new byte[4];
|
||||
u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer);
|
||||
var eax = Utils.ToInt(eaxBuffer);
|
||||
|
||||
Console.WriteLine("[!] Syscall EAX = 0x{0}", eax.ToString("X"));
|
||||
Console.WriteLine($"[!] Syscall EAX = 0x{eax:X}");
|
||||
|
||||
u.EmuStop();
|
||||
}
|
||||
|
||||
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData)
|
||||
private static void InterruptHookCallback(Unicorn u, int intNumber, object userData)
|
||||
{
|
||||
// only handle Linux syscall
|
||||
if (intNumber != 0x80)
|
||||
|
|
@ -143,8 +139,8 @@ namespace UnicornSamples
|
|||
return;
|
||||
}
|
||||
|
||||
var eaxBuffer = new Byte[4];
|
||||
var eipBuffer = new Byte[4];
|
||||
var eaxBuffer = new byte[4];
|
||||
var eipBuffer = new byte[4];
|
||||
|
||||
u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer);
|
||||
u.RegRead(X86.UC_X86_REG_EIP, eipBuffer);
|
||||
|
|
@ -155,19 +151,19 @@ namespace UnicornSamples
|
|||
switch (eax)
|
||||
{
|
||||
default:
|
||||
Console.WriteLine("[!] Interrupt 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X"));
|
||||
Console.WriteLine($"[!] Interrupt 0x{eip:X} num {intNumber:X}, EAX=0x{eax:X}");
|
||||
break;
|
||||
case 1: // sys_exit
|
||||
Console.WriteLine("[!] Interrupt 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X"));
|
||||
Console.WriteLine($"[!] Interrupt 0x{eip:X} num {intNumber:X}, SYS_EXIT");
|
||||
u.EmuStop();
|
||||
break;
|
||||
case 4: // sys_write
|
||||
|
||||
// ECX = buffer address
|
||||
var ecxBuffer = new Byte[4];
|
||||
var ecxBuffer = new byte[4];
|
||||
|
||||
// EDX = buffer size
|
||||
var edxBuffer = new Byte[4];
|
||||
var edxBuffer = new byte[4];
|
||||
|
||||
u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer);
|
||||
u.RegRead(X86.UC_X86_REG_EDX, edxBuffer);
|
||||
|
|
@ -177,16 +173,11 @@ namespace UnicornSamples
|
|||
|
||||
// read the buffer in
|
||||
var size = Math.Min(256, edx);
|
||||
var buffer = new Byte[size];
|
||||
var buffer = new byte[size];
|
||||
u.MemRead(ecx, buffer);
|
||||
var content = Encoding.Default.GetString(buffer);
|
||||
|
||||
Console.WriteLine(
|
||||
"[!] Interrupt 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'",
|
||||
eip.ToString("X"),
|
||||
ecx.ToString("X"),
|
||||
edx.ToString("X"),
|
||||
content);
|
||||
Console.WriteLine($"[!] Interrupt 0x{eip:X}: num {ecx:X}, SYS_WRITE. buffer = 0x{edx:X}, size = {size:X}, content = '{content}'");
|
||||
|
||||
break;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,43 +1,28 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{B80B5987-1E24-4309-8BF9-C4F91270F21C}</ProjectGuid>
|
||||
<TargetFramework>net5.0</TargetFramework>
|
||||
<OutputType>Exe</OutputType>
|
||||
<AppDesignerFolder>Properties</AppDesignerFolder>
|
||||
<RootNamespace>UnicornSamples</RootNamespace>
|
||||
<AssemblyName>UnicornSamples</AssemblyName>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<FileAlignment>512</FileAlignment>
|
||||
<Copyright>Copyright © Antonio Parata 2016</Copyright>
|
||||
<RepositoryUrl>https://github.com/unicorn-engine/unicorn</RepositoryUrl>
|
||||
<Version>2.0.0</Version>
|
||||
<ProjectGuid>{B80B5987-1E24-4309-8BF9-C4F91270F21C}</ProjectGuid>
|
||||
<!-- <FileAlignment>512</FileAlignment>-->
|
||||
<AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
|
||||
<TargetFrameworkProfile />
|
||||
<PublishUrl>publish\</PublishUrl>
|
||||
<Install>true</Install>
|
||||
<InstallFrom>Disk</InstallFrom>
|
||||
<UpdateEnabled>false</UpdateEnabled>
|
||||
<UpdateMode>Foreground</UpdateMode>
|
||||
<UpdateInterval>7</UpdateInterval>
|
||||
<UpdateIntervalUnits>Days</UpdateIntervalUnits>
|
||||
<UpdatePeriodically>false</UpdatePeriodically>
|
||||
<UpdateRequired>false</UpdateRequired>
|
||||
<MapFileExtensions>true</MapFileExtensions>
|
||||
<ApplicationRevision>0</ApplicationRevision>
|
||||
<ApplicationVersion>1.0.0.%2a</ApplicationVersion>
|
||||
<IsWebBootstrapper>false</IsWebBootstrapper>
|
||||
<UseApplicationTrust>false</UseApplicationTrust>
|
||||
<BootstrapperEnabled>true</BootstrapperEnabled>
|
||||
</PropertyGroup>
|
||||
|
||||
<PropertyGroup>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>x86</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
<UseVSHostingProcess>false</UseVSHostingProcess>
|
||||
<CodeAnalysisIgnoreGeneratedCode>false</CodeAnalysisIgnoreGeneratedCode>
|
||||
</PropertyGroup>
|
||||
|
|
@ -47,62 +32,16 @@
|
|||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Gee.External.Capstone, Version=1.2.2.0, Culture=neutral, processorArchitecture=x86">
|
||||
<HintPath>..\packages\Gee.External.Capstone.1.2.2\lib\net45\Gee.External.Capstone.dll</HintPath>
|
||||
<Private>True</Private>
|
||||
</Reference>
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Core" />
|
||||
<Reference Include="System.Xml.Linq" />
|
||||
<Reference Include="System.Data.DataSetExtensions" />
|
||||
<Reference Include="Microsoft.CSharp" />
|
||||
<Reference Include="System.Data" />
|
||||
<Reference Include="System.Net.Http" />
|
||||
<Reference Include="System.Xml" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Program.cs" />
|
||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||
<Compile Include="ShellcodeSample.cs" />
|
||||
<Compile Include="Utils.cs" />
|
||||
<Compile Include="X86Sample32.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="App.config" />
|
||||
<None Include="packages.config" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<BootstrapperPackage Include=".NETFramework,Version=v4.5">
|
||||
<Visible>False</Visible>
|
||||
<ProductName>Microsoft .NET Framework 4.5 %28x86 and x64%29</ProductName>
|
||||
<Install>true</Install>
|
||||
</BootstrapperPackage>
|
||||
<BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
|
||||
<Visible>False</Visible>
|
||||
<ProductName>.NET Framework 3.5 SP1</ProductName>
|
||||
<Install>false</Install>
|
||||
</BootstrapperPackage>
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\UnicornManaged\UnicornManaged.fsproj">
|
||||
<Project>{0c21f1c1-2725-4a46-9022-1905f85822a5}</Project>
|
||||
<Name>UnicornManaged</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<Content Include="capstone.dll" />
|
||||
<Content Include="Gee.External.Capstone.Proxy.dll" />
|
||||
<PackageReference Include="Gee.External.Capstone" Version="2.2.0" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<!-- To modify your build process, add your task inside one of the targets below and uncomment it.
|
||||
Other similar extension points exist, see Microsoft.Common.targets.
|
||||
<Target Name="BeforeBuild">
|
||||
</Target>
|
||||
<Target Name="AfterBuild">
|
||||
</Target>
|
||||
-->
|
||||
</Project>
|
||||
|
|
@ -1,45 +1,41 @@
|
|||
using Gee.External.Capstone;
|
||||
using Gee.External.Capstone.X86;
|
||||
using Gee.External.Capstone.X86;
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using System.Text;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace UnicornSamples
|
||||
{
|
||||
internal static class Utils
|
||||
{
|
||||
public static Int64 ToInt(Byte[] val)
|
||||
public static long ToInt(byte[] val)
|
||||
{
|
||||
UInt64 res = 0;
|
||||
ulong res = 0;
|
||||
for (var i = 0; i < val.Length; i++)
|
||||
{
|
||||
var v = val[i] & 0xFF;
|
||||
res += (UInt64)(v << (i * 8));
|
||||
res += (ulong)(v << (i * 8));
|
||||
}
|
||||
return (Int64)res;
|
||||
return (long)res;
|
||||
}
|
||||
|
||||
public static Byte[] Int64ToBytes(Int64 intVal)
|
||||
public static byte[] Int64ToBytes(long intVal)
|
||||
{
|
||||
var res = new Byte[8];
|
||||
var uval = (UInt64)intVal;
|
||||
var res = new byte[8];
|
||||
var uval = (ulong)intVal;
|
||||
for (var i = 0; i < res.Length; i++)
|
||||
{
|
||||
res[i] = (Byte)(uval & 0xff);
|
||||
res[i] = (byte)(uval & 0xff);
|
||||
uval = uval >> 8;
|
||||
}
|
||||
return res;
|
||||
}
|
||||
|
||||
public static String Disassemble(CapstoneDisassembler<X86Instruction, X86Register, X86InstructionGroup, X86InstructionDetail> disassembler, Byte[] code)
|
||||
public static string Disassemble(CapstoneX86Disassembler disassembler, byte[] code)
|
||||
{
|
||||
var sb = new StringBuilder();
|
||||
var instructions = disassembler.DisassembleAll(code);
|
||||
var instructions = disassembler.Disassemble(code);
|
||||
foreach (var instruction in instructions)
|
||||
{
|
||||
sb.AppendFormat("{0} {1}{2}", instruction.Mnemonic, instruction.Operand, Environment.NewLine);
|
||||
sb.AppendFormat($"{instruction.Mnemonic} {instruction.Operand}{Environment.NewLine}");
|
||||
}
|
||||
return sb.ToString().Trim();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,24 +1,20 @@
|
|||
using Gee.External.Capstone;
|
||||
using Gee.External.Capstone.X86;
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Diagnostics;
|
||||
using System.Linq;
|
||||
using System.Reflection;
|
||||
using System.Text;
|
||||
using System.Threading.Tasks;
|
||||
using UnicornManaged;
|
||||
using UnicornManaged.Const;
|
||||
|
||||
namespace UnicornSamples
|
||||
{
|
||||
internal class X86Sample32
|
||||
internal static class X86Sample32
|
||||
{
|
||||
private const Int64 ADDRESS = 0x1000000;
|
||||
private const long ADDRESS = 0x1000000;
|
||||
|
||||
public static void X86Code32()
|
||||
{
|
||||
Byte[] X86_CODE32 =
|
||||
byte[] X86_CODE32 =
|
||||
{
|
||||
// INC ecx; DEC edx
|
||||
0x41, 0x4a
|
||||
|
|
@ -28,7 +24,7 @@ namespace UnicornSamples
|
|||
|
||||
public static void X86Code32InvalidMemRead()
|
||||
{
|
||||
Byte[] X86_CODE32_MEM_READ =
|
||||
byte[] X86_CODE32_MEM_READ =
|
||||
{
|
||||
// mov ecx,[0xaaaaaaaa]; INC ecx; DEC edx
|
||||
0x8B, 0x0D, 0xAA, 0xAA, 0xAA, 0xAA, 0x41, 0x4a
|
||||
|
|
@ -38,7 +34,7 @@ namespace UnicornSamples
|
|||
|
||||
public static void X86Code32InvalidMemWriteWithRuntimeFix()
|
||||
{
|
||||
Byte[] X86_CODE32_MEM_WRITE =
|
||||
byte[] X86_CODE32_MEM_WRITE =
|
||||
{
|
||||
// mov [0xaaaaaaaa], ecx; INC ecx; DEC edx
|
||||
0x89, 0x0D, 0xAA, 0xAA, 0xAA, 0xAA, 0x41, 0x4a
|
||||
|
|
@ -48,7 +44,7 @@ namespace UnicornSamples
|
|||
|
||||
public static void X86Code32InOut()
|
||||
{
|
||||
Byte[] X86_CODE32_INOUT =
|
||||
byte[] X86_CODE32_INOUT =
|
||||
{
|
||||
// INC ecx; IN AL, 0x3f; DEC edx; OUT 0x46, AL; INC ebx
|
||||
0x41, 0xE4, 0x3F, 0x4a, 0xE6, 0x46, 0x43
|
||||
|
|
@ -57,14 +53,14 @@ namespace UnicornSamples
|
|||
}
|
||||
|
||||
|
||||
private static void Run(Byte[] code, Boolean raiseException = false)
|
||||
private static void Run(byte[] code, bool raiseException = false)
|
||||
{
|
||||
Console.WriteLine();
|
||||
var stackTrace = new StackTrace();
|
||||
var stackFrame = stackTrace.GetFrames()[1];
|
||||
var methodName = stackFrame.GetMethod().Name;
|
||||
var methodName = stackFrame.GetMethod()?.Name;
|
||||
|
||||
Console.WriteLine("*** Start: " + methodName);
|
||||
Console.WriteLine($"*** Start: {methodName}");
|
||||
Exception e = null;
|
||||
try
|
||||
{
|
||||
|
|
@ -84,93 +80,88 @@ namespace UnicornSamples
|
|||
Console.WriteLine();
|
||||
}
|
||||
|
||||
private static void RunTest(Byte[] code, Int64 address, Int32 mode)
|
||||
private static void RunTest(byte[] code, long address, int mode)
|
||||
{
|
||||
using (var u = new Unicorn(Common.UC_ARCH_X86, mode))
|
||||
using (var disassembler = CapstoneDisassembler.CreateX86Disassembler(DisassembleMode.Bit32))
|
||||
{
|
||||
Console.WriteLine("Unicorn version: {0}", u.Version());
|
||||
using var u = new Unicorn(Common.UC_ARCH_X86, mode);
|
||||
using var disassembler = CapstoneDisassembler.CreateX86Disassembler(X86DisassembleMode.Bit32);
|
||||
Console.WriteLine($"Unicorn version: {u.Version()}");
|
||||
|
||||
// map 2MB of memory for this emulation
|
||||
u.MemMap(address, 2 * 1024 * 1024, Common.UC_PROT_ALL);
|
||||
// map 2MB of memory for this emulation
|
||||
u.MemMap(address, 2 * 1024 * 1024, Common.UC_PROT_ALL);
|
||||
|
||||
// initialize machine registers
|
||||
u.RegWrite(X86.UC_X86_REG_EAX, 0x1234);
|
||||
u.RegWrite(X86.UC_X86_REG_ECX, 0x1234);
|
||||
u.RegWrite(X86.UC_X86_REG_EDX, 0x7890);
|
||||
// initialize machine registers
|
||||
u.RegWrite(X86.UC_X86_REG_EAX, 0x1234);
|
||||
u.RegWrite(X86.UC_X86_REG_ECX, 0x1234);
|
||||
u.RegWrite(X86.UC_X86_REG_EDX, 0x7890);
|
||||
|
||||
// write machine code to be emulated to memory
|
||||
u.MemWrite(address, code);
|
||||
// write machine code to be emulated to memory
|
||||
u.MemWrite(address, code);
|
||||
|
||||
// initialize machine registers
|
||||
u.RegWrite(X86.UC_X86_REG_ESP, Utils.Int64ToBytes(address + 0x200000));
|
||||
// initialize machine registers
|
||||
u.RegWrite(X86.UC_X86_REG_ESP, Utils.Int64ToBytes(address + 0x200000));
|
||||
|
||||
// handle IN & OUT instruction
|
||||
u.AddInHook(InHookCallback);
|
||||
u.AddOutHook(OutHookCallback);
|
||||
// handle IN & OUT instruction
|
||||
u.AddInHook(InHookCallback);
|
||||
u.AddOutHook(OutHookCallback);
|
||||
|
||||
// tracing all instructions by having @begin > @end
|
||||
u.AddCodeHook((uc, addr, size, userData) => CodeHookCallback(disassembler, uc, addr, size, userData), 1, 0);
|
||||
// tracing all instructions by having @begin > @end
|
||||
u.AddCodeHook((uc, addr, size, userData) => CodeHookCallback(disassembler, uc, addr, size, userData), 1, 0);
|
||||
|
||||
// handle interrupt ourself
|
||||
u.AddInterruptHook(InterruptHookCallback);
|
||||
// handle interrupt ourself
|
||||
u.AddInterruptHook(InterruptHookCallback);
|
||||
|
||||
// handle SYSCALL
|
||||
u.AddSyscallHook(SyscallHookCallback);
|
||||
// handle SYSCALL
|
||||
u.AddSyscallHook(SyscallHookCallback);
|
||||
|
||||
// intercept invalid memory events
|
||||
u.AddEventMemHook(MemMapHookCallback, Common.UC_HOOK_MEM_READ_UNMAPPED | Common.UC_HOOK_MEM_WRITE_UNMAPPED);
|
||||
// intercept invalid memory events
|
||||
u.AddEventMemHook(MemMapHookCallback, Common.UC_HOOK_MEM_READ_UNMAPPED | Common.UC_HOOK_MEM_WRITE_UNMAPPED);
|
||||
|
||||
Console.WriteLine(">>> Start tracing code");
|
||||
Console.WriteLine(">>> Start tracing code");
|
||||
|
||||
// emulate machine code in infinite time
|
||||
u.EmuStart(address, address + code.Length, 0u, 0u);
|
||||
// emulate machine code in infinite time
|
||||
u.EmuStart(address, address + code.Length, 0u, 0u);
|
||||
|
||||
// print registers
|
||||
var ecx = u.RegRead(X86.UC_X86_REG_ECX);
|
||||
var edx = u.RegRead(X86.UC_X86_REG_EDX);
|
||||
var eax = u.RegRead(X86.UC_X86_REG_EAX);
|
||||
Console.WriteLine("[!] EAX = {0}", eax.ToString("X"));
|
||||
Console.WriteLine("[!] ECX = {0}", ecx.ToString("X"));
|
||||
Console.WriteLine("[!] EDX = {0}", edx.ToString("X"));
|
||||
// print registers
|
||||
var ecx = u.RegRead(X86.UC_X86_REG_ECX);
|
||||
var edx = u.RegRead(X86.UC_X86_REG_EDX);
|
||||
var eax = u.RegRead(X86.UC_X86_REG_EAX);
|
||||
Console.WriteLine($"[!] EAX = {eax:X}");
|
||||
Console.WriteLine($"[!] ECX = {ecx:X}");
|
||||
Console.WriteLine($"[!] EDX = {edx:X}");
|
||||
|
||||
Console.WriteLine(">>> Emulation Done!");
|
||||
}
|
||||
Console.WriteLine(">>> Emulation Done!");
|
||||
}
|
||||
|
||||
private static Int32 InHookCallback(Unicorn u, Int32 port, Int32 size, Object userData)
|
||||
private static int InHookCallback(Unicorn u, int port, int size, object userData)
|
||||
{
|
||||
var eip = u.RegRead(X86.UC_X86_REG_EIP);
|
||||
Console.WriteLine("[!] Reading from port 0x{0}, size: {1}, address: 0x{2}", port.ToString("X"), size.ToString("X"), eip.ToString("X"));
|
||||
var res = 0;
|
||||
switch (size)
|
||||
Console.WriteLine($"[!] Reading from port 0x{port:X}, size: {size:X}, address: 0x{eip:X}");
|
||||
var res = size switch
|
||||
{
|
||||
case 1:
|
||||
1 =>
|
||||
// read 1 byte to AL
|
||||
res = 0xf1;
|
||||
break;
|
||||
case 2:
|
||||
0xf1,
|
||||
2 =>
|
||||
// read 2 byte to AX
|
||||
res = 0xf2;
|
||||
break;
|
||||
case 4:
|
||||
0xf2,
|
||||
4 =>
|
||||
// read 4 byte to EAX
|
||||
res = 0xf4;
|
||||
break;
|
||||
}
|
||||
0xf4,
|
||||
_ => 0
|
||||
};
|
||||
|
||||
Console.WriteLine("[!] Return value: {0}", res.ToString("X"));
|
||||
Console.WriteLine($"[!] Return value: {res:X}");
|
||||
return res;
|
||||
}
|
||||
|
||||
private static void OutHookCallback(Unicorn u, Int32 port, Int32 size, Int32 value, Object userData)
|
||||
private static void OutHookCallback(Unicorn u, int port, int size, int value, object userData)
|
||||
{
|
||||
var eip = u.RegRead(X86.UC_X86_REG_EIP);
|
||||
Console.WriteLine("[!] Writing to port 0x{0}, size: {1}, value: 0x{2}, address: 0x{3}", port.ToString("X"), size.ToString("X"), value.ToString("X"), eip.ToString("X"));
|
||||
Console.WriteLine($"[!] Writing to port 0x{port:X}, size: {size:X}, value: 0x{value:X}, address: 0x{eip:X}");
|
||||
|
||||
// confirm that value is indeed the value of AL/ AX / EAX
|
||||
var v = 0L;
|
||||
var regName = String.Empty;
|
||||
var regName = string.Empty;
|
||||
switch (size)
|
||||
{
|
||||
case 1:
|
||||
|
|
@ -190,85 +181,81 @@ namespace UnicornSamples
|
|||
break;
|
||||
}
|
||||
|
||||
Console.WriteLine("[!] Register {0}: {1}", regName, v.ToString("X"));
|
||||
Console.WriteLine("[!] Register {0}: {1:X}", regName, v);
|
||||
}
|
||||
|
||||
private static Boolean MemMapHookCallback(Unicorn u, Int32 eventType, Int64 address, Int32 size, Int64 value, Object userData)
|
||||
private static bool MemMapHookCallback(Unicorn u, int eventType, long address, int size, long value, object userData)
|
||||
{
|
||||
if (eventType == Common.UC_MEM_WRITE_UNMAPPED)
|
||||
{
|
||||
Console.WriteLine("[!] Missing memory is being WRITE at 0x{0}, data size = {1}, data value = 0x{2}. Map memory.", address.ToString("X"), size.ToString("X"), value.ToString("X"));
|
||||
u.MemMap(0xaaaa0000, 2 * 1024 * 1024, Common.UC_PROT_ALL);
|
||||
return true;
|
||||
}
|
||||
else
|
||||
{
|
||||
return false;
|
||||
}
|
||||
if (eventType != Common.UC_MEM_WRITE_UNMAPPED) return false;
|
||||
|
||||
Console.WriteLine($"[!] Missing memory is being WRITE at 0x{address:X}, data size = {size:X}, data value = 0x{value:X}. Map memory.");
|
||||
u.MemMap(0xaaaa0000, 2 * 1024 * 1024, Common.UC_PROT_ALL);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
private static void CodeHookCallback1(
|
||||
CapstoneDisassembler<X86Instruction, X86Register, X86InstructionGroup, X86InstructionDetail> disassembler,
|
||||
CapstoneX86Disassembler disassembler,
|
||||
Unicorn u,
|
||||
Int64 addr,
|
||||
Int32 size,
|
||||
Object userData)
|
||||
long addr,
|
||||
int size,
|
||||
object userData)
|
||||
{
|
||||
Console.Write("[+] 0x{0}: ", addr.ToString("X"));
|
||||
Console.Write($"[+] 0x{addr:X}: ");
|
||||
|
||||
var eipBuffer = new Byte[4];
|
||||
var eipBuffer = new byte[4];
|
||||
u.RegRead(X86.UC_X86_REG_EIP, eipBuffer);
|
||||
|
||||
var effectiveSize = Math.Min(16, size);
|
||||
var tmp = new Byte[effectiveSize];
|
||||
var tmp = new byte[effectiveSize];
|
||||
u.MemRead(addr, tmp);
|
||||
|
||||
var sb = new StringBuilder();
|
||||
foreach (var t in tmp)
|
||||
{
|
||||
sb.AppendFormat("{0} ", (0xFF & t).ToString("X"));
|
||||
sb.AppendFormat($"{(0xFF & t):X} ");
|
||||
}
|
||||
Console.Write("{0,-20}", sb);
|
||||
Console.Write($"{sb,-20}");
|
||||
Console.WriteLine(Utils.Disassemble(disassembler, tmp));
|
||||
}
|
||||
|
||||
private static void CodeHookCallback(
|
||||
CapstoneDisassembler<X86Instruction, X86Register, X86InstructionGroup, X86InstructionDetail> disassembler,
|
||||
CapstoneX86Disassembler disassembler,
|
||||
Unicorn u,
|
||||
Int64 addr,
|
||||
Int32 size,
|
||||
Object userData)
|
||||
long addr,
|
||||
int size,
|
||||
object userData)
|
||||
{
|
||||
Console.Write("[+] 0x{0}: ", addr.ToString("X"));
|
||||
Console.Write($"[+] 0x{addr:X}: ");
|
||||
|
||||
var eipBuffer = new Byte[4];
|
||||
var eipBuffer = new byte[4];
|
||||
u.RegRead(X86.UC_X86_REG_EIP, eipBuffer);
|
||||
|
||||
var effectiveSize = Math.Min(16, size);
|
||||
var tmp = new Byte[effectiveSize];
|
||||
var tmp = new byte[effectiveSize];
|
||||
u.MemRead(addr, tmp);
|
||||
|
||||
var sb = new StringBuilder();
|
||||
foreach (var t in tmp)
|
||||
{
|
||||
sb.AppendFormat("{0} ", (0xFF & t).ToString("X"));
|
||||
sb.AppendFormat($"{(0xFF & t):X} ");
|
||||
}
|
||||
Console.Write("{0,-20}", sb);
|
||||
Console.Write($"{sb,-20}");
|
||||
Console.WriteLine(Utils.Disassemble(disassembler, tmp));
|
||||
}
|
||||
|
||||
private static void SyscallHookCallback(Unicorn u, Object userData)
|
||||
private static void SyscallHookCallback(Unicorn u, object userData)
|
||||
{
|
||||
var eaxBuffer = new Byte[4];
|
||||
var eaxBuffer = new byte[4];
|
||||
u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer);
|
||||
var eax = Utils.ToInt(eaxBuffer);
|
||||
|
||||
Console.WriteLine("[!] Syscall EAX = 0x{0}", eax.ToString("X"));
|
||||
Console.WriteLine($"[!] Syscall EAX = 0x{eax:X}");
|
||||
|
||||
u.EmuStop();
|
||||
}
|
||||
|
||||
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData)
|
||||
private static void InterruptHookCallback(Unicorn u, int intNumber, object userData)
|
||||
{
|
||||
// only handle Linux syscall
|
||||
if (intNumber != 0x80)
|
||||
|
|
@ -276,8 +263,8 @@ namespace UnicornSamples
|
|||
return;
|
||||
}
|
||||
|
||||
var eaxBuffer = new Byte[4];
|
||||
var eipBuffer = new Byte[4];
|
||||
var eaxBuffer = new byte[4];
|
||||
var eipBuffer = new byte[4];
|
||||
|
||||
u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer);
|
||||
u.RegRead(X86.UC_X86_REG_EIP, eipBuffer);
|
||||
|
|
@ -288,19 +275,19 @@ namespace UnicornSamples
|
|||
switch (eax)
|
||||
{
|
||||
default:
|
||||
Console.WriteLine("[!] Interrupt 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X"));
|
||||
Console.WriteLine($"[!] Interrupt 0x{eip:X} num {intNumber:X}, EAX=0x{eax:X}");
|
||||
break;
|
||||
case 1: // sys_exit
|
||||
Console.WriteLine("[!] Interrupt 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X"));
|
||||
Console.WriteLine($"[!] Interrupt 0x{eip:X} num {intNumber:X}, SYS_EXIT");
|
||||
u.EmuStop();
|
||||
break;
|
||||
case 4: // sys_write
|
||||
|
||||
// ECX = buffer address
|
||||
var ecxBuffer = new Byte[4];
|
||||
var ecxBuffer = new byte[4];
|
||||
|
||||
// EDX = buffer size
|
||||
var edxBuffer = new Byte[4];
|
||||
var edxBuffer = new byte[4];
|
||||
|
||||
u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer);
|
||||
u.RegRead(X86.UC_X86_REG_EDX, edxBuffer);
|
||||
|
|
@ -310,16 +297,11 @@ namespace UnicornSamples
|
|||
|
||||
// read the buffer in
|
||||
var size = Math.Min(256, edx);
|
||||
var buffer = new Byte[size];
|
||||
var buffer = new byte[size];
|
||||
u.MemRead(ecx, buffer);
|
||||
var content = Encoding.Default.GetString(buffer);
|
||||
|
||||
Console.WriteLine(
|
||||
"[!] Interrupt 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'",
|
||||
eip.ToString("X"),
|
||||
ecx.ToString("X"),
|
||||
edx.ToString("X"),
|
||||
content);
|
||||
Console.WriteLine($"[!] Interrupt 0x{eip:X}: num {ecx:X}, SYS_WRITE. buffer = 0x{edx:X}, size = {size:X}, content = '{content}'");
|
||||
|
||||
break;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +0,0 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<packages>
|
||||
<package id="Gee.External.Capstone" version="1.2.2" targetFramework="net45" />
|
||||
</packages>
|
||||
Loading…
Reference in New Issue