Clean up the analyzer (somewhat!)

This commit is contained in:
Pyrex 2025-04-25 22:18:53 -07:00
parent f777d9ecf8
commit 9a07551a22
8 changed files with 3 additions and 28 deletions

File diff suppressed because one or more lines are too long

View File

@ -4,4 +4,4 @@
[number of bytes in starting state as a uint32_t] [number of bytes in starting state as a uint32_t]
00 [00-ff] <bytes>: Use the following 00-ff bytes literally 00 [00-ff] <bytes>: Use the following 00-ff bytes literally
[01-ff] <byte>: Repeat the next byte 02 to ff times [01-ff] <byte>: Repeat the next byte 01 to ff times

View File

@ -46,20 +46,18 @@ def _create_binary(subject: pefile.PE) -> Binary:
relevant_sections = [section for section in (text_section, data_section, rdata_section) if section is not None] relevant_sections = [section for section in (text_section, data_section, rdata_section) if section is not None]
if len(relevant_sections) == 0: if len(relevant_sections) == 0:
raise ValueError("no sections to plot") raise ValueError("no sections to plot")
print([(i.VirtualAddress, i) for i in relevant_sections])
min_address = min(i.VirtualAddress for i in relevant_sections) min_address = min(i.VirtualAddress for i in relevant_sections)
max_address = max(_round_up_to_page(i.VirtualAddress + i.SizeOfRawData) for i in relevant_sections) max_address = max(i.VirtualAddress + i.SizeOfRawData for i in relevant_sections)
buffer = bytearray(max_address - min_address) buffer = bytearray(max_address - min_address)
for section in relevant_sections: for section in relevant_sections:
data = section.get_data() # TODO: De-pad the text section from 0xccs data = section.get_data()
start = section.VirtualAddress - min_address start = section.VirtualAddress - min_address
buffer[start:start+len(data)] = data buffer[start:start+len(data)] = data
starting_state = bytes(buffer) starting_state = bytes(buffer)
entry_point_rva = getattr(optional_header, "AddressOfEntryPoint") entry_point_rva = getattr(optional_header, "AddressOfEntryPoint")
print(entry_point_rva)
entry_point = (entry_point_rva - min_address) entry_point = (entry_point_rva - min_address)
imports: list[Import] = [] imports: list[Import] = []
@ -67,7 +65,6 @@ def _create_binary(subject: pefile.PE) -> Binary:
library: bytes = entry.dll library: bytes = entry.dll
procedures: list[tuple[bytes, int]] = [] procedures: list[tuple[bytes, int]] = []
for imp in entry.imports: for imp in entry.imports:
# print(dir(imp))
import_address_rva = imp.address - getattr(optional_header, "ImageBase") import_address_rva = imp.address - getattr(optional_header, "ImageBase")
import_address = import_address_rva - min_address import_address = import_address_rva - min_address
procedures.append((imp.name, import_address)) procedures.append((imp.name, import_address))
@ -96,9 +93,7 @@ def _encode_binary(binary: Binary) -> bytes:
_write_u32(binary.entry_point) _write_u32(binary.entry_point)
for i in binary.imports: for i in binary.imports:
print(i.library)
_write_zt(i.library) _write_zt(i.library)
print(i.procedures)
for (procedure, address) in i.procedures: for (procedure, address) in i.procedures:
_write_zt(procedure) _write_zt(procedure)
_write_u32(address) _write_u32(address)
@ -163,9 +158,5 @@ def main():
with open("binaries\\main.dat", "wb") as f: with open("binaries\\main.dat", "wb") as f:
f.write(code) f.write(code)
def _round_up_to_page(x: int):
# TODO: Is this the page size on x64? I think it is
return ((x + 0x1000 - 1) // 0x1000) * 0x1000
if __name__ == "__main__": if __name__ == "__main__":
main() main()