|
| 1 | +from abc import ABC |
| 2 | +from collections import defaultdict |
| 3 | +from enum import Enum |
| 4 | +from multiprocessing import Pool |
| 5 | +from capstone import * |
| 6 | +from pwn import * |
| 7 | +from z3 import * |
| 8 | + |
| 9 | +import archinfo |
| 10 | +import angr |
| 11 | +import subprocess |
| 12 | +import logging |
| 13 | + |
| 14 | + |
| 15 | +class Arch(Enum): |
| 16 | + PE32 = 1 |
| 17 | + POWER32 = 2 |
| 18 | + POWER64 = 3 |
| 19 | + ALPHA64 = 4 |
| 20 | + EXE_86_64 = 5 |
| 21 | + LIB_86_64 = 6 |
| 22 | + M68K = 7 |
| 23 | + MIPS64 = 8 |
| 24 | + MIPS32_LE = 9 |
| 25 | + MIPS32_BE = 10 |
| 26 | + SPARC = 11 |
| 27 | + RENESAS = 12 |
| 28 | + ARM64 = 13 |
| 29 | + ARM32 = 14 |
| 30 | + S390 = 15 |
| 31 | + HP_PA = 16 |
| 32 | + RISCV64 = 17 |
| 33 | + |
| 34 | + |
| 35 | +name_to_arch = { |
| 36 | + "ELF 32-bit MSB executable, PowerPC or cisco 4500": Arch.POWER32, |
| 37 | + "ELF 64-bit MSB executable, 64-bit PowerPC or cisco 7500": Arch.POWER64, |
| 38 | + "ELF 64-bit LSB executable, Alpha (unofficial)": Arch.ALPHA64, |
| 39 | + "ELF 64-bit LSB executable, x86-64": Arch.EXE_86_64, |
| 40 | + "ELF 64-bit LSB shared object, x86-64": Arch.LIB_86_64, |
| 41 | + "ELF 32-bit MSB executable, Motorola m68k": Arch.M68K, |
| 42 | + "ELF 64-bit MSB executable, MIPS": Arch.MIPS64, |
| 43 | + "ELF 32-bit LSB executable, MIPS": Arch.MIPS32_LE, |
| 44 | + "ELF 32-bit MSB executable, MIPS": Arch.MIPS32_BE, |
| 45 | + "ELF 64-bit MSB executable, SPARC V9": Arch.SPARC, |
| 46 | + "ELF 32-bit LSB executable, Renesas SH": Arch.RENESAS, |
| 47 | + "ELF 64-bit LSB executable, ARM aarch64": Arch.ARM64, |
| 48 | + "ELF 32-bit LSB executable, ARM": Arch.ARM32, |
| 49 | + "ELF 64-bit MSB executable, IBM S/390": Arch.S390, |
| 50 | + "ELF 32-bit MSB executable, PA-RISC": Arch.HP_PA, |
| 51 | + "ELF 64-bit LSB executable, UCB RISC-V": Arch.RISCV64, |
| 52 | +} |
| 53 | + |
| 54 | + |
| 55 | +def get_arch(filename): |
| 56 | + out = subprocess.check_output(["file", "-b", filename]).decode() |
| 57 | + if out.startswith("PE32+ executable (console) x86-64"): |
| 58 | + return Arch.PE32 |
| 59 | + else: |
| 60 | + arch = ", ".join(out.split(", ")[:2]) |
| 61 | + return name_to_arch[arch] |
| 62 | + |
| 63 | + |
| 64 | +class Family(ABC): |
| 65 | + pass |
| 66 | + |
| 67 | + |
| 68 | +FILE_LEN = 24315 |
| 69 | + |
| 70 | + |
| 71 | +def file_name(id): |
| 72 | + return f"ncuts/{id}" |
| 73 | + |
| 74 | + |
| 75 | +def parse_imm(s): |
| 76 | + if s[0] == "#": |
| 77 | + s = s[1:] |
| 78 | + if s[:2] == "0x": |
| 79 | + return int(s[2:], 16) |
| 80 | + return int(s) |
| 81 | + |
| 82 | + |
| 83 | +def check_answer(qemu, id, num): |
| 84 | + output = subprocess.check_output(f"echo {num} | {qemu} {file_name(id)}", shell=True) |
| 85 | + return b"Congrats!" in output |
| 86 | + |
| 87 | + |
| 88 | +with Pool() as p: |
| 89 | + arch_list = p.map(get_arch, map(file_name, range(FILE_LEN))) |
| 90 | + |
| 91 | +arch_map = defaultdict(list) |
| 92 | +for (i, arch) in enumerate(arch_list): |
| 93 | + arch_map[arch].append(i) |
| 94 | + |
| 95 | +context.arch = "aarch64" |
| 96 | +context.log_level = "error" |
| 97 | +logging.getLogger("pwnlib.elf.elf").setLevel("ERROR") |
| 98 | + |
| 99 | +# for bin_id in [64]: |
| 100 | +for bin_id in arch_map[Arch.ARM64]: |
| 101 | + e = ELF(file_name(bin_id)) |
| 102 | + func_bytes = e.read(0x400540, 400) |
| 103 | + |
| 104 | + md = Cs(CS_ARCH_ARM64, CS_MODE_ARM) |
| 105 | + |
| 106 | + inst_list = list(md.disasm(func_bytes, 0x400540)) |
| 107 | + inst_map = {} |
| 108 | + for inst in inst_list: |
| 109 | + inst_map[inst.address] = inst |
| 110 | + |
| 111 | + # for inst in inst_list: |
| 112 | + # print("0x%x:\t%s\t%s" % (inst.address, inst.mnemonic, inst.op_str)) |
| 113 | + |
| 114 | + if ( |
| 115 | + inst_map[0x400580].mnemonic != "mov" |
| 116 | + or inst_map[0x400584].mnemonic != "bl" |
| 117 | + or inst_map[0x400588].mnemonic != "cbnz" |
| 118 | + ): |
| 119 | + continue |
| 120 | + |
| 121 | + find = parse_imm(inst_map[0x400588].op_str.split(", ")[1]) |
| 122 | + avoid = [0x40058c] |
| 123 | + |
| 124 | + SP_BASE = 0x7F000000 |
| 125 | + |
| 126 | + proj = angr.Project(file_name(bin_id)) |
| 127 | + state = proj.factory.blank_state( |
| 128 | + addr=0x400580, add_options={angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS} |
| 129 | + ) |
| 130 | + |
| 131 | + x = state.solver.BVS("x", 64) |
| 132 | + |
| 133 | + state.memory.store(SP_BASE + 0x20, x) |
| 134 | + state.regs.sp = SP_BASE |
| 135 | + state.regs.x20 = SP_BASE + 0x20 |
| 136 | + |
| 137 | + sm = proj.factory.simulation_manager(state) |
| 138 | + sm.explore(find=find, avoid=avoid) |
| 139 | + |
| 140 | + s = sm.found[0] |
| 141 | + ans = s.solver.eval(s.memory.load(SP_BASE + 0x20, 8, endness=archinfo.Endness.LE)) |
| 142 | + |
| 143 | + if check_answer("qemu-aarch64", bin_id, ans): |
| 144 | + print(f"{bin_id}: {ans}") |
| 145 | + else: |
| 146 | + print(f"{bin_id}: {ans} (WRONG!)") |
0 commit comments