Merge pull request #175 from enkomio/master
Completed .NET binding and refactoring
This commit is contained in:
@ -1,51 +0,0 @@
|
|||||||
(*
|
|
||||||
|
|
||||||
.NET bindings for the UnicornEngine Emulator Engine
|
|
||||||
|
|
||||||
Copyright(c) 2015 Antonio Parata
|
|
||||||
|
|
||||||
This program is free software; you can redistribute it and/or
|
|
||||||
modify it under the terms of the GNU General Public License
|
|
||||||
version 2 as published by the Free Software Foundation.
|
|
||||||
|
|
||||||
This program is distributed in the hope that it will be useful,
|
|
||||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
GNU General Public License for more details.
|
|
||||||
|
|
||||||
You should have received a copy of the GNU General Public License
|
|
||||||
along with this program; if not, write to the Free Software
|
|
||||||
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
||||||
|
|
||||||
*)
|
|
||||||
|
|
||||||
namespace UnicornEngine.Const
|
|
||||||
|
|
||||||
open System
|
|
||||||
|
|
||||||
module UcError =
|
|
||||||
|
|
||||||
let toErrorDesc(err: Int32) =
|
|
||||||
match err with
|
|
||||||
| 0 -> "UC_ERR_OK"
|
|
||||||
| 1 -> "UC_ERR_NOMEM"
|
|
||||||
| 2 -> "UC_ERR_ARCH"
|
|
||||||
| 3 -> "UC_ERR_HANDLE"
|
|
||||||
| 4 -> "UC_ERR_MODE"
|
|
||||||
| 5 -> "UC_ERR_VERSION"
|
|
||||||
| 6 -> "UC_ERR_READ_INVALID"
|
|
||||||
| 7 -> "UC_ERR_WRITE_INVALID"
|
|
||||||
| 8 -> "UC_ERR_FETCH_INVALID"
|
|
||||||
| 9 -> "UC_ERR_CODE_INVALID"
|
|
||||||
| 10 -> "UC_ERR_HOOK"
|
|
||||||
| 11 -> "UC_ERR_INSN_INVALID"
|
|
||||||
| 12 -> "UC_ERR_MAP"
|
|
||||||
| 13 -> "UC_ERR_WRITE_PROT"
|
|
||||||
| 14 -> "UC_ERR_READ_PROT"
|
|
||||||
| 15 -> "UC_ERR_FETCH_PROT"
|
|
||||||
| 16 -> "UC_ERR_ARG"
|
|
||||||
| 17 -> "UC_ERR_READ_UNALIGNED"
|
|
||||||
| 18 -> "UC_ERR_WRITE_UNALIGNED"
|
|
||||||
| 19 -> "UC_ERR_FETCH_UNALIGNED"
|
|
||||||
| _ -> String.Empty
|
|
||||||
|
|
@ -64,6 +64,9 @@ module NativeUnicornEngine =
|
|||||||
[<DllImport("unicorn", CallingConvention = CallingConvention.Cdecl)>]
|
[<DllImport("unicorn", CallingConvention = CallingConvention.Cdecl)>]
|
||||||
extern Int32 uc_errno(UIntPtr eng)
|
extern Int32 uc_errno(UIntPtr eng)
|
||||||
|
|
||||||
|
[<DllImport("unicorn", CallingConvention = CallingConvention.Cdecl)>]
|
||||||
|
extern IntPtr uc_strerror(Int32 err)
|
||||||
|
|
||||||
[<DllImport("unicorn", CallingConvention = CallingConvention.Cdecl, EntryPoint = "uc_hook_add")>]
|
[<DllImport("unicorn", CallingConvention = CallingConvention.Cdecl, EntryPoint = "uc_hook_add")>]
|
||||||
extern Int32 uc_hook_add_noarg(UIntPtr eng, UIntPtr hh, Int32 callbackType, UIntPtr callback, IntPtr userData)
|
extern Int32 uc_hook_add_noarg(UIntPtr eng, UIntPtr hh, Int32 callbackType, UIntPtr callback, IntPtr userData)
|
||||||
|
|
||||||
@ -86,6 +89,7 @@ module NativeUnicornEngine =
|
|||||||
let mutable emu_stop = fun(eng) -> Imported.uc_emu_stop(eng)
|
let mutable emu_stop = fun(eng) -> Imported.uc_emu_stop(eng)
|
||||||
let mutable arch_supported = fun(arch) -> Imported.uc_arch_supported(arch)
|
let mutable arch_supported = fun(arch) -> Imported.uc_arch_supported(arch)
|
||||||
let mutable errno = fun(eng) -> Imported.uc_errno(eng)
|
let mutable errno = fun(eng) -> Imported.uc_errno(eng)
|
||||||
|
let mutable strerror = fun(err) -> Imported.uc_strerror(err)
|
||||||
let mutable hook_add_noarg = fun(eng, hh, callbackType, callback, userData) -> Imported.uc_hook_add_noarg(eng, hh, callbackType, callback, userData)
|
let mutable hook_add_noarg = fun(eng, hh, callbackType, callback, userData) -> Imported.uc_hook_add_noarg(eng, hh, callbackType, callback, userData)
|
||||||
let mutable hook_add_arg0 = fun(eng, hh, callbackType, callback, userData, arg0) -> Imported.uc_hook_add_arg0(eng, hh, callbackType, callback, userData, arg0)
|
let mutable hook_add_arg0 = fun(eng, hh, callbackType, callback, userData, arg0) -> Imported.uc_hook_add_arg0(eng, hh, callbackType, callback, userData, arg0)
|
||||||
let mutable hook_add_arg0_arg1 = fun(eng, hh, callbackType, callback, userData, arg0, arg1) -> Imported.uc_hook_add_arg0_arg1(eng, hh, callbackType, callback, userData, arg0, arg1)
|
let mutable hook_add_arg0_arg1 = fun(eng, hh, callbackType, callback, userData, arg0, arg1) -> Imported.uc_hook_add_arg0_arg1(eng, hh, callbackType, callback, userData, arg0, arg1)
|
@ -55,7 +55,7 @@ and Unicorn(arch: Int32, mode: Int32) =
|
|||||||
let mutable _eng = [|UIntPtr.Zero|]
|
let mutable _eng = [|UIntPtr.Zero|]
|
||||||
|
|
||||||
let checkResult(errCode: Int32, errMsg: String) =
|
let checkResult(errCode: Int32, errMsg: String) =
|
||||||
if errCode <> Common.UC_ERR_OK then raise(ApplicationException(errMsg + ". Error: " + UcError.toErrorDesc(errCode)))
|
if errCode <> Common.UC_ERR_OK then raise(ApplicationException(String.Format("{0}. Error: {1}", errMsg, errCode)))
|
||||||
|
|
||||||
let getId =
|
let getId =
|
||||||
let counter = ref 0
|
let counter = ref 0
|
||||||
@ -103,9 +103,9 @@ and Unicorn(arch: Int32, mode: Int32) =
|
|||||||
member this.ErrNo() =
|
member this.ErrNo() =
|
||||||
NativeUnicornEngine.errno(_eng.[0])
|
NativeUnicornEngine.errno(_eng.[0])
|
||||||
|
|
||||||
member this.StrError() =
|
member this.StrError(errorNo: Int32) =
|
||||||
// TODO: to be implemented
|
let errorStringPointer = NativeUnicornEngine.strerror(errorNo)
|
||||||
raise(NotImplementedException())
|
Marshal.PtrToStringAnsi(errorStringPointer)
|
||||||
|
|
||||||
member this.AddCodeHook(callback: CodeHook, userData: Object, beginAdd: UInt64, endAddr: UInt64) =
|
member this.AddCodeHook(callback: CodeHook, userData: Object, beginAdd: UInt64, endAddr: UInt64) =
|
||||||
let trampoline(u: IntPtr) (addr: UInt64) (size: Int32) (user: IntPtr) =
|
let trampoline(u: IntPtr) (addr: UInt64) (size: Int32) (user: IntPtr) =
|
||||||
|
@ -29,149 +29,11 @@ namespace UnicornTests
|
|||||||
{
|
{
|
||||||
class Program
|
class Program
|
||||||
{
|
{
|
||||||
private const UInt64 ADDRESS = 0x1000000;
|
|
||||||
|
|
||||||
private static Byte[] X86_CODE32_SELF =
|
|
||||||
{
|
|
||||||
0xeb, 0x19, 0x31, 0xc0, 0x31, 0xdb, 0x31, 0xd2, 0x31, 0xc9, 0xb0, 0x04, 0xb3, 0x01, 0x59, 0xb2, 0x05, 0xcd,
|
|
||||||
0x80, 0x31, 0xc0, 0xb0, 0x01, 0x31, 0xdb, 0xcd, 0x80, 0xe8, 0xe2, 0xff, 0xff, 0xff, 0x68, 0x65, 0x6c, 0x6c,
|
|
||||||
0x6f
|
|
||||||
};
|
|
||||||
|
|
||||||
private static UInt64 ToInt(Byte[] val)
|
|
||||||
{
|
|
||||||
UInt64 res = 0;
|
|
||||||
for (var i = 0; i < val.Length; i++)
|
|
||||||
{
|
|
||||||
var v = val[i] & 0xFF;
|
|
||||||
res += (UInt64)(v << (i * 8));
|
|
||||||
}
|
|
||||||
return res;
|
|
||||||
}
|
|
||||||
|
|
||||||
private static void CheckError(Int32 err)
|
|
||||||
{
|
|
||||||
if (err != Common.UC_ERR_OK)
|
|
||||||
{
|
|
||||||
throw new ApplicationException("Operation failed, error: " + UcError.toErrorDesc(err));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
private static Byte[] Int64ToBytes(UInt64 intVal)
|
|
||||||
{
|
|
||||||
var res = new Byte[8];
|
|
||||||
for (var i = 0; i < res.Length; i++)
|
|
||||||
{
|
|
||||||
res[i] = (Byte)(intVal & 0xff);
|
|
||||||
intVal = intVal >> 8;
|
|
||||||
}
|
|
||||||
return res;
|
|
||||||
}
|
|
||||||
|
|
||||||
private static void CodeHookCallback(Unicorn u, UInt64 addr, Int32 size, Object userData)
|
|
||||||
{
|
|
||||||
Console.Write("Tracing >>> 0x{0} ", addr.ToString("X"));
|
|
||||||
|
|
||||||
var eipBuffer = new Byte[4];
|
|
||||||
CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer));
|
|
||||||
|
|
||||||
var effectiveSize = Math.Min(16, size);
|
|
||||||
var tmp = new Byte[effectiveSize];
|
|
||||||
CheckError(u.MemRead(addr, tmp));
|
|
||||||
|
|
||||||
foreach (var t in tmp)
|
|
||||||
{
|
|
||||||
Console.Write("{0} ", (0xFF & t).ToString("X"));
|
|
||||||
}
|
|
||||||
|
|
||||||
Console.WriteLine();
|
|
||||||
}
|
|
||||||
|
|
||||||
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData)
|
|
||||||
{
|
|
||||||
// only handle Linux syscall
|
|
||||||
if (intNumber != 0x80)
|
|
||||||
{
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
var eaxBuffer = new Byte[4];
|
|
||||||
var eipBuffer = new Byte[4];
|
|
||||||
|
|
||||||
CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer));
|
|
||||||
CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer));
|
|
||||||
|
|
||||||
var eax = ToInt(eaxBuffer);
|
|
||||||
var eip = ToInt(eipBuffer);
|
|
||||||
|
|
||||||
switch (eax)
|
|
||||||
{
|
|
||||||
default:
|
|
||||||
Console.WriteLine("Interrupt >>> 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X"));
|
|
||||||
break;
|
|
||||||
case 1: // sys_exit
|
|
||||||
Console.WriteLine("Interrupt >>> 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X"));
|
|
||||||
u.EmuStop();
|
|
||||||
break;
|
|
||||||
case 4: // sys_write
|
|
||||||
|
|
||||||
// ECX = buffer address
|
|
||||||
var ecxBuffer = new Byte[4];
|
|
||||||
|
|
||||||
// EDX = buffer size
|
|
||||||
var edxBuffer = new Byte[4];
|
|
||||||
|
|
||||||
CheckError(u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer));
|
|
||||||
CheckError(u.RegRead(X86.UC_X86_REG_EDX, edxBuffer));
|
|
||||||
|
|
||||||
var ecx = ToInt(ecxBuffer);
|
|
||||||
var edx = ToInt(edxBuffer);
|
|
||||||
|
|
||||||
// read the buffer in
|
|
||||||
var size = Math.Min(256, edx);
|
|
||||||
var buffer = new Byte[size];
|
|
||||||
CheckError(u.MemRead(ecx, buffer));
|
|
||||||
var content = Encoding.Default.GetString(buffer);
|
|
||||||
|
|
||||||
Console.WriteLine(
|
|
||||||
"Interrupt >>> 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'",
|
|
||||||
eip.ToString("X"),
|
|
||||||
ecx.ToString("X"),
|
|
||||||
edx.ToString("X"),
|
|
||||||
content);
|
|
||||||
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void Main(String[] args)
|
static void Main(String[] args)
|
||||||
{
|
{
|
||||||
var u = new Unicorn(Common.UC_ARCH_X86, Common.UC_MODE_32);
|
// Run all shellcode tests
|
||||||
Console.WriteLine("Unicorn version: {0}", u.Version());
|
ShellcodeTest.TestX86Code32Self();
|
||||||
|
ShellcodeTest.TestX86Code32();
|
||||||
// map 2MB of memory for this emulation
|
|
||||||
CheckError(u.MemMap(ADDRESS, new UIntPtr(2 * 1024 * 1024), Common.UC_PROT_ALL));
|
|
||||||
|
|
||||||
// write machine code to be emulated to memory
|
|
||||||
CheckError(u.MemWrite(ADDRESS, X86_CODE32_SELF));
|
|
||||||
|
|
||||||
// initialize machine registers
|
|
||||||
CheckError(u.RegWrite(X86.UC_X86_REG_ESP, Int64ToBytes(ADDRESS + 0x200000)));
|
|
||||||
|
|
||||||
// tracing all instructions by having @begin > @end
|
|
||||||
CheckError(u.AddCodeHook(CodeHookCallback, null, 1, 0).Item1);
|
|
||||||
|
|
||||||
// handle interrupt ourself
|
|
||||||
CheckError(u.AddInterruptHook(InterruptHookCallback, null).Item1);
|
|
||||||
|
|
||||||
Console.WriteLine();
|
|
||||||
Console.WriteLine(">>> Start tracing linux code");
|
|
||||||
|
|
||||||
// emulate machine code in infinite time
|
|
||||||
u.EmuStart(ADDRESS, ADDRESS + (UInt64)X86_CODE32_SELF.Length, 0u, new UIntPtr(0));
|
|
||||||
|
|
||||||
Console.WriteLine();
|
|
||||||
Console.WriteLine(">>> Emulation Done!");
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
168
bindings/dotnet/UnicornTests/ShellcodeTest.cs
Normal file
168
bindings/dotnet/UnicornTests/ShellcodeTest.cs
Normal file
@ -0,0 +1,168 @@
|
|||||||
|
using System;
|
||||||
|
using System.Collections.Generic;
|
||||||
|
using System.Linq;
|
||||||
|
using System.Reflection;
|
||||||
|
using System.Text;
|
||||||
|
using System.Threading.Tasks;
|
||||||
|
using UnicornEngine;
|
||||||
|
using UnicornEngine.Const;
|
||||||
|
|
||||||
|
namespace UnicornTests
|
||||||
|
{
|
||||||
|
internal class ShellcodeTest
|
||||||
|
{
|
||||||
|
private const UInt64 ADDRESS = 0x1000000;
|
||||||
|
|
||||||
|
public static void TestX86Code32Self()
|
||||||
|
{
|
||||||
|
Byte[] X86_CODE32_SELF =
|
||||||
|
{
|
||||||
|
0xeb, 0x1c, 0x5a, 0x89, 0xd6, 0x8b, 0x02, 0x66, 0x3d, 0xca, 0x7d, 0x75, 0x06, 0x66, 0x05, 0x03, 0x03,
|
||||||
|
0x89, 0x02, 0xfe, 0xc2, 0x3d, 0x41, 0x41, 0x41, 0x41, 0x75, 0xe9, 0xff, 0xe6, 0xe8, 0xdf, 0xff, 0xff,
|
||||||
|
0xff, 0x31, 0xd2, 0x6a, 0x0b, 0x58, 0x99, 0x52, 0x68, 0x2f, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x62, 0x69,
|
||||||
|
0x6e, 0x89, 0xe3, 0x52, 0x53, 0x89, 0xe1, 0xca, 0x7d, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41
|
||||||
|
};
|
||||||
|
|
||||||
|
Console.WriteLine();
|
||||||
|
Console.WriteLine("*** Start Shellcode: " + MethodInfo.GetCurrentMethod().Name);
|
||||||
|
RunTest(X86_CODE32_SELF, ADDRESS);
|
||||||
|
Console.WriteLine("End Shellcode: " + MethodInfo.GetCurrentMethod().Name);
|
||||||
|
Console.WriteLine();
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void TestX86Code32()
|
||||||
|
{
|
||||||
|
Byte[] X86_CODE32 =
|
||||||
|
{
|
||||||
|
0xeb, 0x19, 0x31, 0xc0, 0x31, 0xdb, 0x31, 0xd2, 0x31, 0xc9, 0xb0, 0x04, 0xb3, 0x01, 0x59, 0xb2, 0x05,
|
||||||
|
0xcd, 0x80, 0x31, 0xc0, 0xb0, 0x01, 0x31, 0xdb, 0xcd, 0x80, 0xe8, 0xe2, 0xff, 0xff, 0xff, 0x68, 0x65,
|
||||||
|
0x6c, 0x6c, 0x6f
|
||||||
|
};
|
||||||
|
|
||||||
|
Console.WriteLine();
|
||||||
|
Console.WriteLine("*** Start Shellcode: " + MethodInfo.GetCurrentMethod().Name);
|
||||||
|
RunTest(X86_CODE32, ADDRESS);
|
||||||
|
Console.WriteLine("End Shellcode: " + MethodInfo.GetCurrentMethod().Name);
|
||||||
|
Console.WriteLine();
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
public static void RunTest(Byte[] code, UInt64 address)
|
||||||
|
{
|
||||||
|
var u = new Unicorn(Common.UC_ARCH_X86, Common.UC_MODE_32);
|
||||||
|
Console.WriteLine("Unicorn version: {0}", u.Version());
|
||||||
|
|
||||||
|
// map 2MB of memory for this emulation
|
||||||
|
Utils.CheckError(u.MemMap(address, new UIntPtr(2 * 1024 * 1024), Common.UC_PROT_ALL));
|
||||||
|
|
||||||
|
// write machine code to be emulated to memory
|
||||||
|
Utils.CheckError(u.MemWrite(address, code));
|
||||||
|
|
||||||
|
// initialize machine registers
|
||||||
|
Utils.CheckError(u.RegWrite(X86.UC_X86_REG_ESP, Utils.Int64ToBytes(address + 0x200000)));
|
||||||
|
|
||||||
|
// tracing all instructions by having @begin > @end
|
||||||
|
Utils.CheckError(u.AddCodeHook(CodeHookCallback, null, 1, 0).Item1);
|
||||||
|
|
||||||
|
// handle interrupt ourself
|
||||||
|
Utils.CheckError(u.AddInterruptHook(InterruptHookCallback, null).Item1);
|
||||||
|
|
||||||
|
// handle SYSCALL
|
||||||
|
Utils.CheckError(u.AddSyscallHook(SyscallHookCallback, null).Item1);
|
||||||
|
|
||||||
|
Console.WriteLine(">>> Start tracing linux code");
|
||||||
|
|
||||||
|
// emulate machine code in infinite time
|
||||||
|
u.EmuStart(address, address + (UInt64)code.Length, 0u, new UIntPtr(0));
|
||||||
|
|
||||||
|
Console.WriteLine(">>> Emulation Done!");
|
||||||
|
}
|
||||||
|
|
||||||
|
private static void CodeHookCallback(Unicorn u, UInt64 addr, Int32 size, Object userData)
|
||||||
|
{
|
||||||
|
Console.Write("Tracing >>> 0x{0} ", addr.ToString("X"));
|
||||||
|
|
||||||
|
var eipBuffer = new Byte[4];
|
||||||
|
Utils.CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer));
|
||||||
|
|
||||||
|
var effectiveSize = Math.Min(16, size);
|
||||||
|
var tmp = new Byte[effectiveSize];
|
||||||
|
Utils.CheckError(u.MemRead(addr, tmp));
|
||||||
|
|
||||||
|
foreach (var t in tmp)
|
||||||
|
{
|
||||||
|
Console.Write("{0} ", (0xFF & t).ToString("X"));
|
||||||
|
}
|
||||||
|
|
||||||
|
Console.WriteLine();
|
||||||
|
}
|
||||||
|
|
||||||
|
private static void SyscallHookCallback(Unicorn u, Object userData)
|
||||||
|
{
|
||||||
|
var eaxBuffer = new Byte[4];
|
||||||
|
Utils.CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer));
|
||||||
|
var eax = Utils.ToInt(eaxBuffer);
|
||||||
|
|
||||||
|
Console.WriteLine("Syscall >>> EAX = 0x{0}", eax.ToString("X"));
|
||||||
|
|
||||||
|
u.EmuStop();
|
||||||
|
}
|
||||||
|
|
||||||
|
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData)
|
||||||
|
{
|
||||||
|
// only handle Linux syscall
|
||||||
|
if (intNumber != 0x80)
|
||||||
|
{
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
var eaxBuffer = new Byte[4];
|
||||||
|
var eipBuffer = new Byte[4];
|
||||||
|
|
||||||
|
Utils.CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer));
|
||||||
|
Utils.CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer));
|
||||||
|
|
||||||
|
var eax = Utils.ToInt(eaxBuffer);
|
||||||
|
var eip = Utils.ToInt(eipBuffer);
|
||||||
|
|
||||||
|
switch (eax)
|
||||||
|
{
|
||||||
|
default:
|
||||||
|
Console.WriteLine("Interrupt >>> 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X"));
|
||||||
|
break;
|
||||||
|
case 1: // sys_exit
|
||||||
|
Console.WriteLine("Interrupt >>> 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X"));
|
||||||
|
u.EmuStop();
|
||||||
|
break;
|
||||||
|
case 4: // sys_write
|
||||||
|
|
||||||
|
// ECX = buffer address
|
||||||
|
var ecxBuffer = new Byte[4];
|
||||||
|
|
||||||
|
// EDX = buffer size
|
||||||
|
var edxBuffer = new Byte[4];
|
||||||
|
|
||||||
|
Utils.CheckError(u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer));
|
||||||
|
Utils.CheckError(u.RegRead(X86.UC_X86_REG_EDX, edxBuffer));
|
||||||
|
|
||||||
|
var ecx = Utils.ToInt(ecxBuffer);
|
||||||
|
var edx = Utils.ToInt(edxBuffer);
|
||||||
|
|
||||||
|
// read the buffer in
|
||||||
|
var size = Math.Min(256, edx);
|
||||||
|
var buffer = new Byte[size];
|
||||||
|
Utils.CheckError(u.MemRead(ecx, buffer));
|
||||||
|
var content = Encoding.Default.GetString(buffer);
|
||||||
|
|
||||||
|
Console.WriteLine(
|
||||||
|
"Interrupt >>> 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'",
|
||||||
|
eip.ToString("X"),
|
||||||
|
ecx.ToString("X"),
|
||||||
|
edx.ToString("X"),
|
||||||
|
content);
|
||||||
|
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
@ -45,6 +45,8 @@
|
|||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<Compile Include="Program.cs" />
|
<Compile Include="Program.cs" />
|
||||||
<Compile Include="Properties\AssemblyInfo.cs" />
|
<Compile Include="Properties\AssemblyInfo.cs" />
|
||||||
|
<Compile Include="ShellcodeTest.cs" />
|
||||||
|
<Compile Include="Utils.cs" />
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<None Include="App.config" />
|
<None Include="App.config" />
|
||||||
|
42
bindings/dotnet/UnicornTests/Utils.cs
Normal file
42
bindings/dotnet/UnicornTests/Utils.cs
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
using System;
|
||||||
|
using System.Collections.Generic;
|
||||||
|
using System.Linq;
|
||||||
|
using System.Text;
|
||||||
|
using System.Threading.Tasks;
|
||||||
|
using UnicornEngine.Const;
|
||||||
|
|
||||||
|
namespace UnicornTests
|
||||||
|
{
|
||||||
|
internal static class Utils
|
||||||
|
{
|
||||||
|
public static UInt64 ToInt(Byte[] val)
|
||||||
|
{
|
||||||
|
UInt64 res = 0;
|
||||||
|
for (var i = 0; i < val.Length; i++)
|
||||||
|
{
|
||||||
|
var v = val[i] & 0xFF;
|
||||||
|
res += (UInt64)(v << (i * 8));
|
||||||
|
}
|
||||||
|
return res;
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void CheckError(Int32 err)
|
||||||
|
{
|
||||||
|
if (err != Common.UC_ERR_OK)
|
||||||
|
{
|
||||||
|
throw new ApplicationException("Operation failed, error: " + err);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
public static Byte[] Int64ToBytes(UInt64 intVal)
|
||||||
|
{
|
||||||
|
var res = new Byte[8];
|
||||||
|
for (var i = 0; i < res.Length; i++)
|
||||||
|
{
|
||||||
|
res[i] = (Byte)(intVal & 0xff);
|
||||||
|
intVal = intVal >> 8;
|
||||||
|
}
|
||||||
|
return res;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
Reference in New Issue
Block a user