-
Notifications
You must be signed in to change notification settings - Fork 63
/
Copy pathida_helper.py
1474 lines (1356 loc) · 65 KB
/
ida_helper.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#
# Wrappers on some IDA Python functions to help using them :)
#
# It has been heavily tested on x86/x86_64 but could possibly be modified to
# work on other architectures.
#
from idc import *
from idautils import *
import idaapi
import sark
import binascii
import sys
import ida_segment
import idautils
import idaapi
import ida_name
import re
def logmsg(s, end=None):
if type(s) == str:
if end != None:
print("[ida_helper] " + s, end=end)
else:
print("[ida_helper] " + s)
else:
print(s)
# Attempt to have globals we can use in all other functions without having to
# worry about architecture :)
info = idaapi.get_inf_structure()
if info.is_64bit():
ERROR_MINUS_1 = 0xffffffffffffffff
SIZE_POINTER = 8
ARCHITECTURE = 64
Pword = get_qword
else:
ERROR_MINUS_1 = 0xffffffff
SIZE_POINTER = 4
ARCHITECTURE = 32
Pword = get_wide_dword
# Gives us the xrefs jumping/calling an address
def get_xrefs(ea = get_screen_ea()):
res = []
for e in XrefsTo(ea):
#logmsg("0x%x -> 0x%x" % (e.frm, e.to))
res.append(e.frm)
return res
# Gives the current function's name an address is part of
def get_function_name(ea = get_screen_ea()):
func = idaapi.get_func(ea)
if func is None:
return None
funcname = get_func_name(func.start_ea)
#logmsg("%X is in %s" % (ea, funcname))
return funcname
# Gives the current function's address an address is part of
def get_function_addr(ea = get_screen_ea()):
func = idaapi.get_func(ea)
if not func:
logmsg("Error: get_function_addr: Failed to find function start for 0x%x" % ea)
return None
return func.start_ea
def rename_address(e, new_name):
return rename_function(e, new_name)
# Renames an address with a name (and append a digit at the end if already
# exists)
def rename_function(e, funcname):
currname = funcname
count = 1
if e == None:
logmsg("Error: can't rename Nonetype to %s" % funcname)
return False
while not set_name(e, currname, SN_CHECK):
currname = "%s_%d" % (funcname, count)
count += 1
if count > 1000:
logmsg("Error: rename_function looped too much for 0x%d -> %s" % (e, funcname))
return False
return True
# Remove name for a function (most likely to have sub_XXXXXXXX back after that)
def unname_address(e):
if not set_name(e, "", SN_CHECK):
logmsg("Error: unname_address: could not remove name for element")
return False
return True
unname_function = unname_address
# https://reverseengineering.stackexchange.com/questions/14725/using-ida-python-iterate-through-all-functions-and-their-instructions
def get_functions():
"""Return a list of functions addresses"""
L = []
for segea in idautils.Segments():
for funcea in idautils.Functions(segea, idc.get_segm_end(segea)):
L.append(funcea)
return L
# Retrieve a list with all the idbs' segments' names
def get_segments():
seg_names = []
for seg in idautils.Segments():
st = ida_segment.getseg(seg)
seg_names.append(idaapi.get_segm_name(st))
return seg_names
# Note this must match the list of segments in the current file
default_seg_names = [".init", ".plt", ".text", ".fini", ".rodata", ".eh_frame_hdr",
"eh_frame", ".gcc_except_table", ".tdata", ".ctors", ".dtors",
".jcr", ".got", ".got.plt", ".data", "freq_data_section",
".bss", "extern", "abs", ".rdata"]
# For each segment name, save start address, end address in a dictionary
# This can be used to know if a pointer in one segment is part of another
# segment
def get_segments_info(seg_names=default_seg_names):
res = {}
for name in seg_names:
seg = idaapi.get_segm_by_name(name)
if not seg:
continue
res[name] = {}
res[name]['start_ea'] = seg.start_ea
for n in range(idaapi.get_segm_qty()):
seg = idaapi.getnseg(n)
for name,d in res.items():
if d['start_ea'] == seg.start_ea:
res[name]['ID'] = seg.name # this is an ID, not a name, kthx IDA :(
res[name]['end_ea'] = seg.end_ea
return res
# Checks if an address is part of a given segment
# seg_info = get_segments_info() is passed to this function
def addr_is_in_one_segment(addr, seg_info):
for name, d in seg_info.items():
if addr <= seg_info[name]["end_ea"] and addr >= seg_info[name]["start_ea"]:
return True
return False
def name_to_rva(s):
addr = get_name_ea_simple(s)
if addr == ERROR_MINUS_1:
logmsg("Error: name_to_rva: Failed to find '%s' symbol" % s)
return None
logmsg("image base 0x%x" % idaapi.get_imagebase())
return addr - idaapi.get_imagebase()
# Returns the address of any name: function, label, global, etc.
def name_to_addr(s):
addr = get_name_ea_simple(s)
if addr == ERROR_MINUS_1:
logmsg("Error: name_to_addr: Failed to find '%s' symbol" % s)
return None
return addr
def addr_to_name(ea):
name = get_name(ea, ida_name.GN_VISIBLE)
if name == "":
logmsg("Error: addr_to_name: Failed to find '0x%x' address" % ea)
return ""
return name
# Gives the first Xref
def first_xref(addr):
for e in XrefsTo(addr):
addr = e.frm
return addr
logmsg("Error: first_xref: Failed to find xref for 0x%x" % addr)
return None
# Gives the first Xref of first Xref to an address
def first_xref_of_first_xref(addr):
for e in XrefsTo(addr):
addr = e.frm
for e in XrefsTo(addr):
addr = e.frm
return addr
logmsg("Error: first_xref_of_first_xref: Failed to find xref for 0x%x" % addr)
return None
# Gives the second Xref
def second_xref(addr):
i = 1
for e in XrefsTo(addr):
frm = e.frm
if i == 2:
return frm
i += 1
logmsg("Error: second_xref: Failed to find xref for 0x%x" % addr)
return None
# Gives the third Xref
def third_xref(addr):
i = 1
for e in XrefsTo(addr):
frm = e.frm
if i == 3:
return frm
i += 1
logmsg("Error: third_xref: Failed to find xref for 0x%x" % addr)
return None
# Gives the last Xref
def last_xref(addr):
frm = None
for e in XrefsTo(addr):
frm = e.frm
#print("0x%x" % frm)
if frm == None:
logmsg("Error: last_xref: Failed to find xref for 0x%x" % addr)
return frm
# Find a series of bytes
# e.g. with byteStr = JMP_ESP = '\xff\xe4'
def find_gadget(byteStr):
seg_info = get_segments_info()
addr = seg_info[".text"]["start_ea"]
while addr <= seg_info[".text"]["end_ea"]:
b = get_bytes(addr, len(byteStr))
if b == byteStr:
#logmsg("Found candidate for gadget %s in .text at 0x%x" % (binascii.hexlify(byteStr), addr))
return addr
addr += 1
if addr > seg_info[".data"]["end_ea"]:
logmsg("Error: Could not find gadget in .text")
return None
# helper for get_call_arguments()-like for when we get a register instead of a useful
# value as an argument, so we can retrieve what the register value is.
# e.g.
# .text:08380F8D mov eax, offset aAdmin_quick_ha ; "admin_quick_handoff"
# .text:08380F92 mov [esp+20h], edi
# .text:08380F96 mov [esp+1Ch], ecx
# .text:08380F9A mov [esp+18h], edx
# .text:08380F9E mov [esp+4], eax
# .text:08380FA2 mov dword ptr [esp], offset aUnicorn_admi_0 ; "unicorn_admin_server.c"
# .text:08380FA9 call unicorn_log_impl
# assuming we are on instruction at 08380F9E, we want to resolve what eax is i.e. 0x0921BA08
# .rodata:0921BA08 aAdmin_quick_ha db 'admin_quick_handoff',0
def get_register_value(e=get_screen_ea(), register=None, count_max=20):
reg = print_operand(e, 1)
if register != reg:
logmsg("Error: bad register at 0x%x" % e)
return None
arg_instructions = ["mov %s",
"movsxd %s",
"lea %s"]
e = prev_head(e)
count = 0
while count <= count_max:
disasm_line = GetDisasm(e)
#logmsg("'%s'" % disasm_line)
for i in range(len(arg_instructions)):
ins = arg_instructions[i] % register
if ins in disasm_line:
#logmsg("0x%x - Matches '%s'" % (e, ins))
# First arrive, first serve
# We suppose that the instruction closest is the
# one giving the register value.
# If we encounter another instruction initializing
# the register later, we ignore it
# XXX: if a different register is used, it may give weird result
# mov rax, cs:off_46141C0 -> accepted
# movsxd rax, dword ptr [rax] -> rejected
# mov [rdx+18h], rax
if get_operand_type(e, 1) == o_mem:
val = get_operand_value(e, 1)
#logmsg("Found register value %s: 0x%x" % (register, val))
return val
e = prev_head(e)
count += 1
#logmsg("Could not find register value")
return None
# For a given address, check instructions above looking for potential arguments
# and save this into a dictionary.
# It only works on x86 architecture.
# E.g.: this can be used on some logging functions where one of the argument
# passed to the logging function contains the caller's function name
# This allows renaming the caller's function automatically
def get_call_arguments_x86_1(e=get_screen_ea(), count_max=10):
return get_structure_offsets(e=e, count_max=count_max, reg="esp")
# Works on both 32-bit and 64-bit
# depending on the reg we provide ("rdx", "edx", etc.)
#
# It is generally useful when reg="esp" but we also support parsing from
# other registers in case a structure is filled
def get_structure_offsets(e=get_screen_ea(), count_max=10, reg="esp"):
args = {}
# are we a call instruction?
mnem = print_insn_mnem(e)
if mnem != "call" and mnem != "jmp":
logmsg("Error: not a x86 call instruction at 0x%x" % e)
return None
# we hardcode the instructions that we are looking for i.e. we don't look
# for anything else that +4, +8, etc.
# i.e we don't support yet case where the offset to esp is renamed by IDA
# direct offset
# e.g. "mov dword ptr [esp], offset aUnicorn_admi_0"
arg_instructions = ["mov dword ptr [%s]" % reg,
"mov dword ptr [%s+4]" % reg,
"mov dword ptr [%s+8]" % reg,
"mov dword ptr [%s+0Ch]" % reg,
"mov dword ptr [%s+10h]" % reg,
"mov dword ptr [%s+14h]" % reg,
"mov dword ptr [%s+18h]" % reg,
"mov dword ptr [%s+1Ch]" % reg]
arg_instructions_2 = ["mov qword ptr [%s]" % reg,
"mov qword ptr [%s+4]" % reg,
"mov qword ptr [%s+8]" % reg,
"mov qword ptr [%s+0Ch]" % reg,
"mov qword ptr [%s+10h]" % reg,
"mov qword ptr [%s+14h]" % reg,
"mov qword ptr [%s+18h]" % reg,
"mov qword ptr [%s+1Ch]" % reg]
# register so will need an extra step to resolve...
# e.g. "mov [esp+4], eax"
arg_instructions_3 = ["mov [%s]" % reg,
"mov [%s+4]" % reg,
"mov [%s+8]" % reg,
"mov [%s+0Ch]" % reg,
"mov [%s+10h]" % reg,
"mov [%s+14h]" % reg,
"mov [%s+18h]" % reg,
"mov [%s+1Ch]" % reg]
# parse arguments, parsing instructions backwards
e = prev_head(e)
count = 0
# we only supports 10 instructions backwards looking for arguments
while count <= count_max:
disasm_line = GetDisasm(e)
#logmsg("'%s'" % disasm_line)
for i in range(len(arg_instructions)):
if arg_instructions[i] in disasm_line:
#logmsg("0x%x - Matches '%s'" % (e, arg_instructions[i]))
# First arrive, first serve
# We suppose that the instruction closest to the call is the
# one giving the argument.
# If we encounter another instruction with mov [esp+offset]
# later with the same offset, we ignore it
if i not in args.keys():
args[i] = get_operand_value(e,1)
#logmsg("Found argument %d: 0x%x" % (i, args[i]))
for i in range(len(arg_instructions_2)):
if arg_instructions_2[i] in disasm_line:
#logmsg("Matches '%s'" % arg_instructions_2[i])
if i not in args.keys():
args[i] = get_operand_value(e,1)
#logmsg("Found argument %d: 0x%x (2)" % (i, args[i]))
for i in range(len(arg_instructions_3)):
if arg_instructions_3[i] in disasm_line:
#logmsg("Matches '%s'" % arg_instructions_3[i])
if i not in args.keys():
register = print_operand(e, 1)
#logmsg("Argument %d based on register %s..." % (i, register))
value = get_register_value(e, register)
if value != None:
args[i] = value
#logmsg("Found argument %d: 0x%x (3)" % (i, args[i]))
e = prev_head(e)
count += 1
return args
# see get_call_arguments_x86_1
def get_call_arguments_x86_3(e = get_screen_ea(), count_max = 5):
args = {}
# are we a call instruction?
mnem = print_insn_mnem(e)
if mnem != "call" and mnem != "jmp":
logmsg("Error: not a x86 call instruction at 0x%x" % e)
return None
# Parse something like:
# push offset aSshPacketSocke ; "ssh_packet_socket_callback"
# push 2
# push esi
# call log
args_tmp = []
# parse arguments, parsing instructions backwards
e = prev_head(e)
count = 0
# we only supports 10 instructions backwards looking for arguments
while count <= count_max:
disasm_line = GetDisasm(e)
#logmsg("'%s'" % disasm_line)
# arguments are pushed in reverse order so we get the last arg first
if "push " in disasm_line:
args_tmp.append(get_operand_value(e,0))
e = prev_head(e)
count += 1
for i in range(len(args_tmp)):
args[i] = args_tmp[i]
return args
# Alternative to get_call_arguments_x86_1(). See get_call_arguments_x86_1() for more
# information.
def get_call_arguments_x86_2(e = get_screen_ea(), count_max = 10):
args = {}
# are we a call instruction?
mnem = print_insn_mnem(e)
if mnem != "call" and mnem != "jmp":
logmsg("Error: not a x86 call instruction at 0x%x" % e)
return None
# we hardcode the instructions that we are looking for i.e. we don't look
# for anything else that +4, +8, etc.
# i.e we don't support yet case where the offset to esp is renamed by IDA
args_offsets = [0, 4, 8, 0xC, 0x10, 0x14]
# parse arguments, parsing instructions backwards
e = prev_head(e)
count = 0
# we only supports 10 instructions backwards looking for arguments
while count <= count_max:
disasm_line = GetDisasm(e)
#logmsg("'%s'" % disasm_line)
if disasm_line.startswith("mov [esp"):
# o_phrase = 3 # Memory Ref [Base Reg + Index Reg] phrase
if get_operand_type(e,0) == o_phrase:
# unfortunately we can't test that there is no index register
# so we ignore for now...
if 0 not in args.keys():
args[0] = get_operand_value(e,1)
# o_displ = 4 # Memory Reg [Base Reg + Index Reg + Displacement] phrase+addr
if get_operand_type(e,0) == o_displ:
for i in range(len(args_offsets)):
if i == 0:
continue # handled by above case
if get_operand_value(e,0) == args_offsets[i]:
# First arrive, first serve
# We suppose that the instruction closest to the call
# is the one giving the argument.
# If we encounter another instruction with mov [esp+offset]
# later with the same offset, we ignore it
if i not in args.keys():
args[i] = get_operand_value(e,1)
#logmsg("Found argument %d: 0x%x" % (i, args[i]))
e = prev_head(e)
count += 1
return args
def get_call_arguments_x64_linux(e = get_screen_ea(), count_max = 10, debug=False):
return get_call_arguments_x64_generic(e=e, count_max=count_max, debug=debug, linux=True)
def get_call_arguments_x64_windows(e = get_screen_ea(), count_max = 10, debug=False):
return get_call_arguments_x64_generic(e=e, count_max=count_max, debug=debug, linux=False)
# Similar to get_call_arguments_x86_1() but for x86_64. See get_call_arguments_x86_1()
# for more information.
def get_call_arguments_x64_generic(e = get_screen_ea(), count_max = 10, debug=False, linux=True):
args = {}
# are we a call instruction?
mnem = print_insn_mnem(e)
if mnem != "call" and mnem != "jmp":
logmsg("Error: not a x86 call instruction at 0x%x" % e)
return None
# we only supports 6 arguments for Linux
if linux:
arg_instructions_x86 = ["mov edi",
"mov esi",
"mov edx",
"mov ecx",
"mov r8d",
"mov r9d"]
arg_instructions_x86_lea = ["lea edi",
"lea esi",
"lea edx",
"lea ecx",
"lea r8d",
"lea r9d"]
arg_instructions_x64 = ["mov rdi",
"mov rsi",
"mov rdx",
"mov rcx",
"mov r8",
"mov r9"]
arg_instructions_x64_lea = ["lea rdi",
"lea rsi",
"lea rdx",
"lea rcx",
"lea r8",
"lea r9"]
# we only supports 4 arguments for Windows
else:
arg_instructions_x86 = ["mov ecx",
"mov edx",
"mov r8d",
"mov r9d"]
arg_instructions_x86_lea = ["lea ecx",
"lea edx",
"lea r8d",
"lea r9d"]
arg_instructions_x64 = ["mov rcx",
"mov rdx",
"mov r8",
"mov r9"]
arg_instructions_x64_lea = ["lea rcx",
"lea rdx",
"lea r8",
"lea r9"]
# parse arguments, parsing instructions backwards
e = prev_head(e)
count = 0
# we only supports 10 instructions backwards looking for arguments
while count <= count_max:
disasm_line = GetDisasm(e)
if debug:
logmsg("Handling '%s'" % disasm_line)
for i in range(len(arg_instructions_x86)):
#if debug:
# logmsg("'%s'" % arg_instructions_x86[i])
instruction_list = [arg_instructions_x86[i],
arg_instructions_x86_lea[i],
arg_instructions_x64[i],
arg_instructions_x64_lea[i]]
if any(instruction in disasm_line for instruction in instruction_list):
# First arrive, first serve
# We suppose that the instruction closest to the call is the one giving the argument.
# If we encounter another instruction with "mov reg" later with the same offset, we ignore it
if i not in args.keys():
args[i] = get_operand_value(e,1)
if debug:
logmsg("Found argument %d: 0x%x" % (i, args[i]))
e = prev_head(e)
count += 1
return args
# Similar to get_call_arguments_x64_linux() but for ARM 32-bit. See get_call_arguments_x86_1()
# for more information.
def get_call_arguments_arm(e=get_screen_ea(), count_max=10):
args = {}
cached_args = {}
# are we a BL instruction?
mnem = print_insn_mnem(e)
if mnem != "B" and mnem != "BL" and mnem != "SVC" and mnem != "BLNE" and mnem != "BLHI" and mnem != "BLEQ":
logmsg("Error: not a BL or SVC or BLNE or BLHI or BLEQ instruction at 0x%x" % e)
return None
arg_instructions_arm_add_pc = ["ADD R0, PC, R0",
"ADD R1, PC, R1",
"ADD R2, PC, R2",
"ADD R3, PC, R3"]
arg_instructions_arm_add = ["ADD R0, R0,",
"ADD R1, R1",
"ADD R2, R2",
"ADD R3, R3"]
# we only supports 4 arguments
arg_instructions_arm_mov = ["MOV R0,",
"MOV R1,",
"MOV R2,",
"MOV R3,"]
arg_instructions_arm_adr = ["ADR R0,",
"ADR R1,",
"ADR R2,",
"ADR R3,"]
arg_instructions_arm_ldr = ["LDR R0,",
"LDR R1,",
"LDR R2,",
"LDR R3,"]
arg_instructions_arm_adr2 = ["ADREQ R0,",
"ADREQ R1,",
"ADDEQ R2,",
"ADREQ R3,"]
arg_instructions_arm_mov2 = ["MOVEQ R0,",
"MOVEQ R1,",
"MOVEQ R2,",
"MOVEQ R3,"]
arg_instructions_arm_adr3 = ["ADRNE R0,",
"ADRNE R1,",
"ADDNE R2,",
"ADRNE R3,"]
# parse arguments, parsing instructions backwards
e = prev_head(e)
count = 0
# we only supports 10 instructions backwards looking for arguments
while count <= count_max:
disasm_line = GetDisasm(e)
#logmsg("'%s'" % disasm_line)
for i in range(len(arg_instructions_arm_mov)):
#logmsg("'%s'" % arg_instructions_arm_mov[i])
#logmsg("Testing index %d" % i)
# First arrive, first serve
# We suppose that the instruction closest to the call is the one giving the argument.
# If we encounter another instruction with "MOV reg" later with the same offset, we ignore it
instruction_list = [arg_instructions_arm_mov[i],
arg_instructions_arm_mov2[i],
arg_instructions_arm_adr[i],
arg_instructions_arm_adr[i],
arg_instructions_arm_adr3[i]]
add_pc_instruction_list = [arg_instructions_arm_add_pc[i]]
add_instruction_list = [arg_instructions_arm_add[i]]
# Remove all spaces to get rid of indentation discrepancies
# .text:000492B4 64 01 9F E5 LDR R0, =(aHydraSSystemNo_0 - 0x492C8) ; "hydra: %s: System not yet ready. Waitin"...
# .text:000492B8 04 20 A0 E1 MOV R2, R4
# .text:000492BC 06 10 A0 E1 MOV R1, R6
# .text:000492C0 00 00 8F E0 ADD R0, PC, R0 ; "hydra: %s: System not yet ready. Waitin"...
# .text:000492C4 31 8B FF EB BL printf
# .text:000492C8 01 40 54 E2 SUBS R4, R4, #1
if any(instruction.replace(" ", "") in disasm_line.replace(" ", "") for instruction in add_pc_instruction_list):
if i not in cached_args.keys():
cached_args[i] = 0
val = e + 4 + 4 # +2 instructions due to cached instruction pipeline, see 0x492C8 instead of 0x492C0 above
#logmsg("Cached pc = 0x%x for %d" % (val, i))
cached_args[i] += val
# .text:004397D4 84 10 9F E5 LDR R1, =(aNetworkConnect - 0x4397E8) ; "network_connect_state"
# .text:004397D8 84 00 9F E5 LDR R0, =(aSEntryPortIfPD - 0x4397F4) ; "%s: entry. port_if=%p, devdep=%p\n"
# .text:004397DC 04 20 A0 E1 MOV R2, R4
# .text:004397E0 01 10 8F E0 ADD R1, PC, R1 ; "network_connect_state"
# .text:004397E4 1C 30 94 E5 LDR R3, [R4,#0x1C]
# .text:004397E8 44 10 81 E2 ADD R1, R1, #0x44 ; 'D'
# .text:004397EC 00 00 8F E0 ADD R0, PC, R0 ; "%s: entry. port_if=%p, devdep=%p\n"
# .text:004397F0 E6 C9 EF EB BL printf
elif any(instruction.replace(" ", "") in disasm_line.replace(" ", "") for instruction in add_instruction_list):
if i not in cached_args.keys():
cached_args[i] = 0
val = get_operand_value(e, 2)
#logmsg("Cached addition = 0x%x for %d" % (val, i))
cached_args[i] += val
elif any(instruction.replace(" ", "") in disasm_line.replace(" ", "") for instruction in instruction_list):
if i not in args.keys():
args[i] = get_operand_value(e,1)
#logmsg("Found argument %d: 0x%x" % (i, args[i]))
elif arg_instructions_arm_ldr[i].replace(" ", "") in disasm_line.replace(" ", ""):
if i not in args.keys():
addr = get_operand_value(e,1)
args[i] = get_wide_dword(addr)
if i in cached_args.keys():
#logmsg("args[i] = 0x%x" % (args[i]))
args[i] += cached_args[i]
#logmsg("Adjusted args[i] = 0x%x" % (args[i]))
#logmsg("Found argument %d: 0x%x" % (i, args[i]))
e = prev_head(e)
count += 1
return args
# XXX - empiric, probably has internal macros in IDA
X0_VAL = 0x81
X1_VAL = X0_VAL+1
X2_VAL = X0_VAL+2
X3_VAL = X0_VAL+3
# ... continues up until X21 like that
ARM64_VALS = [X0_VAL, X1_VAL, X2_VAL, X3_VAL]
ARM64_ARG_SUBVAL = X0_VAL # value to substract to get argument index
# Similar to get_call_arguments_arm() but for 64-bit. See get_call_arguments_x86_1()
# for more information.
def get_call_arguments_arm64(e=get_screen_ea(), count_max=10, debug=False):
args = {}
cached_args = {}
# are we a BL instruction?
mnem = print_insn_mnem(e)
if mnem != "B" and mnem != "BL" and mnem != "SVC" and mnem != "BLNE" and mnem != "BLHI" and mnem != "BLEQ":
logmsg("Error: not a BL or SVC or BLNE or BLHI or BLEQ instruction at 0x%x" % e)
return None
#arg_instructions_arm64_add = ["ADD X0, X0",
# "ADD X1, X1",
# "ADD X2, X2",
# "ADD X3, X3",
# "ADD X4, X4",
# "ADD X5, X5",
# "ADD X6, X6"]
arg_instructions_arm64_add = ["ADD X0, X",
"ADD X1, X",
"ADD X2, X",
"ADD X3, X",
"ADD X4, X",
"ADD X5, X",
"ADD X6, X"]
# we only supports 4 arguments
arg_instructions_arm64_mov = ["MOV W0,",
"MOV W1,",
"MOV W2,",
"MOV W3,",
"MOV W4,",
"MOV W5,",
"MOV W6,"]
arg_instructions_arm64_mov2 = ["MOV X0,",
"MOV X1,",
"MOV X2,",
"MOV X3,",
"MOV X4,",
"MOV X5,",
"MOV X6,"]
# parse arguments, parsing instructions backwards
e = prev_head(e)
count = 0
# we only supports 10 instructions backwards looking for arguments
while count <= count_max:
disasm_line = GetDisasm(e)
if debug:
logmsg("'%s'" % disasm_line)
found = False
for i in range(len(arg_instructions_arm64_mov)):
#logmsg("'%s'" % arg_instructions_arm64_mov[i])
#logmsg("Testing index %d" % i)
# First arrive, first serve
# We suppose that the instruction closest to the call is the one giving the argument.
# If we encounter another instruction with "MOV reg" later with the same offset, we ignore it
add_instruction_list = [arg_instructions_arm64_add[i]]
instruction_list = [arg_instructions_arm64_mov[i],
arg_instructions_arm64_mov2[i]]
#.text:000000000013A0EC ADRP X2, #aKillallSigusr2_0@PAGE ; "'killall -SIGUSR2 mdnsd' returned with "...
#.text:000000000013A0F0 ADRP X0, #aModZp@PAGE ; "mod_zp"
#.text:000000000013A0F4 ADD X2, X2, #aKillallSigusr2_0@PAGEOFF ; "'killall -SIGUSR2 mdnsd' returned with "...
#.text:000000000013A0F8 ADD X0, X0, #aModZp@PAGEOFF ; "mod_zp"
#.text:000000000013A0FC MOV W1, #1
#.text:000000000013A100 BL log_func
if any(instruction.replace(" ", "") in disasm_line.replace(" ", "") for instruction in add_instruction_list):
reg2 = get_operand_value(e, 1)
val = get_operand_value(e, 2)
if i not in cached_args.keys():
if debug:
logmsg("Cached addition = 0x%x and reg2 = 0x%x for %d" % (val, reg2, i))
cached_args[i] = (reg2, val)
found = True
break
else:
reg1 = get_operand_value(e, 0)
# Only take into account ADD if we had another valid ADD instruction before, with the same register
for (j, t) in cached_args.items():
(old_reg, old_val) = t
if reg1 == old_reg:
if debug:
logmsg("Cached addition = 0x%x and reg1 = 0x%x for %d" % (val, reg1, i))
new_val = val + old_val
cached_args[i] = (reg2, new_val)
found = True
break
elif any(instruction.replace(" ", "") in disasm_line.replace(" ", "") for instruction in instruction_list):
if i not in args.keys():
args[i] = get_operand_value(e,1)
if debug:
logmsg("Found argument %d: 0x%x" % (i, args[i]))
found = True
break
# We put it outside of any register as X0...X21 can be used
# https://stackoverflow.com/questions/41906688/what-are-the-semantics-of-adrp-and-adrl-instructions-in-arm-assembly
# https://reverseengineering.stackexchange.com/questions/15418/getting-function-address-by-reading-adrp-and-add-instruction-values
if found is False:
# Remove all spaces to get rid of indentation discrepancies
#.text:000000000013A0EC ADRP X2, #aKillallSigusr2_0@PAGE ; "'killall -SIGUSR2 mdnsd' returned with "...
#.text:000000000013A0F0 ADRP X0, #aModZp@PAGE ; "mod_zp"
#.text:000000000013A0F4 ADD X2, X2, #aKillallSigusr2_0@PAGEOFF ; "'killall -SIGUSR2 mdnsd' returned with "...
#.text:000000000013A0F8 ADD X0, X0, #aModZp@PAGEOFF ; "mod_zp"
#.text:000000000013A0FC MOV W1, #1
#.text:000000000013A100 BL log_func
# or
#.text:00000000003F3FC4 ADRP X20, #aGaSp@PAGE ; "ga_sp"
#.text:00000000003F3FC8 STR XZR, [X19,#0xB8]
#.text:00000000003F3FCC ADD X3, X3, #0x60 ; '`'
#.text:00000000003F3FD0 STP XZR, XZR, [X21,#8]
#.text:00000000003F3FD4 ADD X2, X2, #(aSSSSSSS+0x10)@PAGEOFF ; format
#.text:00000000003F3FD8 ADD X0, X20, #aGaSp@PAGEOFF ; "ga_sp"
#.text:00000000003F3FDC STRB WZR, [X19,#0xD0]
#.text:00000000003F3FE0 STRB WZR, [X19,#0xD1]
#.text:00000000003F3FE4 STRB WZR, [X19,#0xD2]
#.text:00000000003F3FE8 STR X1, [X19,#0xD8]
#.text:00000000003F3FEC MOV W1, #5 ; log_level
#.text:00000000003F3FF0 BL log_func
r = re.match("ADRP X[0-9]+, ", disasm_line)
if not r:
r = re.match("ADRL X[0-9]+, ", disasm_line)
if r:
reg = get_operand_value(e, 0)
val = get_operand_value(e, 1)
if debug:
logmsg("adrp/adrl = 0x%x and reg = 0x%x" % (val, reg))
# Only take into account ADRP if we had a valid ADD instruction before
for (j, t) in cached_args.items():
(old_reg, old_val) = t
if reg == old_reg:
if j not in args.keys():
args[j] = val + old_val
if debug:
logmsg("Adjusted args[i] = 0x%x for %d" % (args[j], j))
found = True
break
if not found:
i = reg-ARM64_ARG_SUBVAL
if i not in args.keys():
args[i] = get_operand_value(e,1)
if debug:
logmsg("Found argument %d: 0x%x" % (i, args[i]))
found = True
e = prev_head(e)
count += 1
return args
def get_call_arguments_x86(e = get_screen_ea(), count_max = 10):
args = get_call_arguments_x86_1(e, count_max)
if not args:
args = get_call_arguments_x86_2(e, count_max)
if not args:
args = get_call_arguments_x86_3(e, count_max)
return args
# Wrapper to have a generic method to get arguments for a function call
# based on internal helpers.
def get_call_arguments(e=get_screen_ea(), count_max=10):
if ARCHITECTURE == 32:
if info.procname == "ARM":
args = get_call_arguments_arm(e, count_max)
else:
args = get_call_arguments_x86(e, count_max)
else:
if info.procname == "ARM":
args = get_call_arguments_arm64(e, count_max)
else:
# XXX - we could determine if it is an ELF vs PE and call the right one
args = get_call_arguments_x64_linux(e, count_max)
#args = get_call_arguments_x64_windows(e, count_max)
return args
# find all candidates matching a given binary data
# bytes_str needs to have spaces between each byte
# e.g. "0x%x" % find_binary(get_screen_ea(), 1, '0d c0 a0 e1')
def find_all(bytes_str):
ret = []
ea = idc.find_binary(0, 1, bytes_str)
while ea != idc.BADADDR:
#print("ea = 0x%x" % ea)
# If the opcode is found in a function, skip it
if sark.Line(ea).is_code:
#print("Existing function at 0x%x" % ea)
pass
else:
ret.append(ea)
# In ARM every instruction is aligned to 4-bytes
ea = idc.find_binary(ea + 4, 1, bytes_str)
return ret
#.data:0012E70C off_12E70C DCD aGetstr ; DATA XREF: sub_1A104:loc_1A15C↑o
#.data:0012E70C ; .text:off_1A1C8↑o
#.data:0012E70C ; "getstr"
#.data:0012E710 DCD sub_9AE90
#.data:0012E714 DCD aNvramGet_0 ; "nvram_get"
#.data:0012E718 DCD sub_19950
#.data:0012E71C DCD aNvramMatch ; "nvram_match"
#...
#.data:0012F114 DCD aGetArmorServer_0 ; "get_armor_server"
#.data:0012F118 DCD sub_A72A8
#.data:0012F11C ALIGN 0x10
def rename_table_of_functions_by_ascii_string_being_used(str, table_name, xref_func=first_xref, simulate=False, replace_chars_func=None, prev_value=0x0):
"""This function takes a string as an argument and look for a table of strings/function pointers
where each string is the name of the function following.
It will use the string and go backwards until it find a zero value to know it went to the beginning
of the table. It will stop when encountering a NULL string.
:param str: one of the string present in the table
:param table_name: the name of the table to use for renaming it
:param simulate: True if you just want to simulate instead of actually renaming. False by default.
:param replace_chars_func: If not None, is a function to call to replace characters in the string
before using it as a function name. E.g. when having the "bd_genie_prodcut_register.cgi"
string, it allows
:param prev_value: integer value of the size of a pointer that is used to know when we reached
the beginning of the table (i.e. it is the value before that start of the table)
"""
global SIZE_POINTER
bytes_str = " ".join("%02x" % x for x in str.encode("utf-8"))
matches = find_all(bytes_str)
if len(matches) != 1:
logmsg("ERROR: rename_table_of_functions_by_ascii_string_being_used does not support multiple strings: %s" % (["%x" % x for x in matches]))
return False
addr_str = matches[0]
# aString = get_name(addr_str, ida_name.GN_VISIBLE)
# if not aString:
# logmsg("ERROR: rename_table_of_functions_by_ascii_string_being_used did not find any name for aString")
# return False
addr_str_used = xref_func(addr_str)
if addr_str_used == None:
return False
addr_table = find_first_value_backwards(addr_str_used, prev_value, count_max=50)
logmsg("table address: 0x%x" % addr_table)
if not simulate:
rename_function(addr_table, table_name)
e = addr_table
count = 0
while True:
string_addr = get_wide_dword(e)
if string_addr == 0x0:
break
func_addr = get_wide_dword(e + SIZE_POINTER)
funcname = get_strlit_contents(string_addr).decode('utf-8')
if replace_chars_func != None:
funcname = replace_chars_func(funcname)
e += 2*SIZE_POINTER
current_func_name = get_func_name(func_addr)
if current_func_name.startswith("sub_"):
logmsg("0x%x -> %s" % (func_addr, funcname))
if not simulate:
rename_function(func_addr, funcname)
count += 1
else:
pass
#logmsg("0x%x -> %s (skipped. already named: %s)" % (current_func_addr, funcname, current_func_name))
logmsg("Renamed %d functions" % count)
# similar to rename_function_by_aString_being_used()
# but instead of assuming knowing an IDA aString label, takes
# a sequence of characters to look for in order to find the right
# aString
# Note: str can be null terminated or not, or have any byte value
def rename_function_by_ascii_string_being_used(str, funcName, prevFunc=None, nextFunc=None, xref_func=first_xref):
# XXX - may need to fix the hexlify to be python3 compliant like in
# rename_table_of_functions_by_ascii_string_being_used()
h = binascii.hexlify(str)
bytes_str = " ".join([h[i:i+2] for i in range(0, len(h), 2)])
matches = find_all(bytes_str)
if len(matches) != 1:
logmsg("ERROR: rename_function_by_ascii_string_being_used does not support multiple strings")
return False
str_addr = matches[0]
aString = get_name(str_addr, ida_name.GN_VISIBLE)
if not aString:
logmsg("ERROR: rename_function_by_ascii_string_being_used did not find any name for aString")
return False
return rename_function_by_aString_being_used(aString, funcName, prevFunc=prevFunc, nextFunc=nextFunc, xref_func=xref_func)
# Uses an IDA string label (aString) to find a function and rename it (funcName)
# It uses Xrefs to this string label to locate one function and optionally
# functions surrounding the located function to rename the function
def rename_function_by_aString_being_used(aString, funcName, prevFunc=None, nextFunc=None, xref_func=first_xref):
global ERROR_MINUS_1
if name_to_addr(funcName) != None:
logmsg("%s already defined" % funcName)
return True
addr_str = name_to_addr(aString)
if addr_str == None:
return False
addr_str_used = xref_func(addr_str)
if addr_str_used == None:
return False
funcaddr = get_function_addr(addr_str_used)
if funcaddr == None:
return False
if prevFunc != None:
for i in range(prevFunc):
logmsg("Going to previous function of 0x%x" % funcaddr)
funcaddr = get_prev_func(funcaddr)
if nextFunc != None:
for i in range(nextFunc):
logmsg("Going to next function of 0x%x" % funcaddr)
funcaddr = get_next_func(funcaddr)
logmsg("%s = 0x%x" % (funcName, funcaddr))
res = rename_address(funcaddr, funcName)
if res == None:
return False
return True
# Same as rename_function_by_aString_being_used() but with the additional
# capability to filter that the found function does not contain any references
# to some other IDA string labels.
def rename_function_by_aString_being_used_with_filter(aString, funcName, prevFunc=None, nextFunc=None, filtered_aStrings=[], override_old_name=False):
global ERROR_MINUS_1
if override_old_name:
funcaddr = name_to_addr(funcName)
if funcaddr != None:
logmsg("Removing old: %s at 0x%x" % (funcName, funcaddr))
unname_function(funcaddr)
else:
if name_to_addr(funcName) != None:
logmsg("%s already defined" % funcName)
return True
addr_str = name_to_addr(aString)
if addr_str == None:
return False
for addr_str_used in get_xrefs(addr_str):
if addr_str_used == None: