yizhi-js-lib/favicon-trap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactored test project

Browse Source
This commit is contained in:
Antonio Parata
2015-10-15 12:03:23 +02:00
parent c0ba09e0b8
commit d2f487485c
4 changed files with 215 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files

144
bindings/dotnet/UnicornTests/Program.cs
View File

@ -29,149 +29,11 @@ namespace UnicornTests
{
class Program
{
private const UInt64 ADDRESS = 0x1000000;
private static Byte[] X86_CODE32_SELF =
{
0xeb, 0x19, 0x31, 0xc0, 0x31, 0xdb, 0x31, 0xd2, 0x31, 0xc9, 0xb0, 0x04, 0xb3, 0x01, 0x59, 0xb2, 0x05, 0xcd,
0x80, 0x31, 0xc0, 0xb0, 0x01, 0x31, 0xdb, 0xcd, 0x80, 0xe8, 0xe2, 0xff, 0xff, 0xff, 0x68, 0x65, 0x6c, 0x6c,
0x6f
};
private static UInt64 ToInt(Byte[] val)
{
UInt64 res = 0;
for (var i = 0; i < val.Length; i++)
{
var v = val[i] & 0xFF;
res += (UInt64)(v << (i * 8));
}
return res;
}
private static void CheckError(Int32 err)
{
if (err != Common.UC_ERR_OK)
{
throw new ApplicationException("Operation failed, error: " + err);
}
}
private static Byte[] Int64ToBytes(UInt64 intVal)
{
var res = new Byte[8];
for (var i = 0; i < res.Length; i++)
{
res[i] = (Byte)(intVal & 0xff);
intVal = intVal >> 8;
}
return res;
}
private static void CodeHookCallback(Unicorn u, UInt64 addr, Int32 size, Object userData)
{
Console.Write("Tracing >>> 0x{0} ", addr.ToString("X"));
var eipBuffer = new Byte[4];
CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer));
var effectiveSize = Math.Min(16, size);
var tmp = new Byte[effectiveSize];
CheckError(u.MemRead(addr, tmp));
foreach (var t in tmp)
{
Console.Write("{0} ", (0xFF & t).ToString("X"));
}
Console.WriteLine();
}
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData)
{
// only handle Linux syscall
if (intNumber != 0x80)
{
return;
}
var eaxBuffer = new Byte[4];
var eipBuffer = new Byte[4];
CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer));
CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer));
var eax = ToInt(eaxBuffer);
var eip = ToInt(eipBuffer);
switch (eax)
{
default:
Console.WriteLine("Interrupt >>> 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X"));
break;
case 1: // sys_exit
Console.WriteLine("Interrupt >>> 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X"));
u.EmuStop();
break;
case 4: // sys_write
// ECX = buffer address
var ecxBuffer = new Byte[4];
// EDX = buffer size
var edxBuffer = new Byte[4];
CheckError(u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer));
CheckError(u.RegRead(X86.UC_X86_REG_EDX, edxBuffer));
var ecx = ToInt(ecxBuffer);
var edx = ToInt(edxBuffer);
// read the buffer in
var size = Math.Min(256, edx);
var buffer = new Byte[size];
CheckError(u.MemRead(ecx, buffer));
var content = Encoding.Default.GetString(buffer);
Console.WriteLine(
"Interrupt >>> 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'",
eip.ToString("X"),
ecx.ToString("X"),
edx.ToString("X"),
content);
break;
}
}
static void Main(String[] args)
{
var u = new Unicorn(Common.UC_ARCH_X86, Common.UC_MODE_32);
Console.WriteLine("Unicorn version: {0}", u.Version());
// map 2MB of memory for this emulation
CheckError(u.MemMap(ADDRESS, new UIntPtr(2 * 1024 * 1024), Common.UC_PROT_ALL));
// write machine code to be emulated to memory
CheckError(u.MemWrite(ADDRESS, X86_CODE32_SELF));
// initialize machine registers
CheckError(u.RegWrite(X86.UC_X86_REG_ESP, Int64ToBytes(ADDRESS + 0x200000)));
// tracing all instructions by having @begin > @end
CheckError(u.AddCodeHook(CodeHookCallback, null, 1, 0).Item1);
// handle interrupt ourself
CheckError(u.AddInterruptHook(InterruptHookCallback, null).Item1);
Console.WriteLine();
Console.WriteLine(">>> Start tracing linux code");
// emulate machine code in infinite time
u.EmuStart(ADDRESS, ADDRESS + (UInt64)X86_CODE32_SELF.Length, 0u, new UIntPtr(0));
Console.WriteLine();
Console.WriteLine(">>> Emulation Done!");
// Run all shellcode tests
ShellcodeTest.TestX86Code32Self();
ShellcodeTest.TestX86Code32();
}
}
}