Clean up the analyzer (somewhat!)
This commit is contained in:
parent
f777d9ecf8
commit
9a07551a22
File diff suppressed because one or more lines are too long
Binary file not shown.
@ -4,4 +4,4 @@
|
|||||||
|
|
||||||
[number of bytes in starting state as a uint32_t]
|
[number of bytes in starting state as a uint32_t]
|
||||||
00 [00-ff] <bytes>: Use the following 00-ff bytes literally
|
00 [00-ff] <bytes>: Use the following 00-ff bytes literally
|
||||||
[01-ff] <byte>: Repeat the next byte 02 to ff times
|
[01-ff] <byte>: Repeat the next byte 01 to ff times
|
@ -46,20 +46,18 @@ def _create_binary(subject: pefile.PE) -> Binary:
|
|||||||
relevant_sections = [section for section in (text_section, data_section, rdata_section) if section is not None]
|
relevant_sections = [section for section in (text_section, data_section, rdata_section) if section is not None]
|
||||||
if len(relevant_sections) == 0:
|
if len(relevant_sections) == 0:
|
||||||
raise ValueError("no sections to plot")
|
raise ValueError("no sections to plot")
|
||||||
print([(i.VirtualAddress, i) for i in relevant_sections])
|
|
||||||
min_address = min(i.VirtualAddress for i in relevant_sections)
|
min_address = min(i.VirtualAddress for i in relevant_sections)
|
||||||
max_address = max(_round_up_to_page(i.VirtualAddress + i.SizeOfRawData) for i in relevant_sections)
|
max_address = max(i.VirtualAddress + i.SizeOfRawData for i in relevant_sections)
|
||||||
|
|
||||||
buffer = bytearray(max_address - min_address)
|
buffer = bytearray(max_address - min_address)
|
||||||
for section in relevant_sections:
|
for section in relevant_sections:
|
||||||
data = section.get_data() # TODO: De-pad the text section from 0xccs
|
data = section.get_data()
|
||||||
start = section.VirtualAddress - min_address
|
start = section.VirtualAddress - min_address
|
||||||
buffer[start:start+len(data)] = data
|
buffer[start:start+len(data)] = data
|
||||||
|
|
||||||
starting_state = bytes(buffer)
|
starting_state = bytes(buffer)
|
||||||
|
|
||||||
entry_point_rva = getattr(optional_header, "AddressOfEntryPoint")
|
entry_point_rva = getattr(optional_header, "AddressOfEntryPoint")
|
||||||
print(entry_point_rva)
|
|
||||||
entry_point = (entry_point_rva - min_address)
|
entry_point = (entry_point_rva - min_address)
|
||||||
|
|
||||||
imports: list[Import] = []
|
imports: list[Import] = []
|
||||||
@ -67,7 +65,6 @@ def _create_binary(subject: pefile.PE) -> Binary:
|
|||||||
library: bytes = entry.dll
|
library: bytes = entry.dll
|
||||||
procedures: list[tuple[bytes, int]] = []
|
procedures: list[tuple[bytes, int]] = []
|
||||||
for imp in entry.imports:
|
for imp in entry.imports:
|
||||||
# print(dir(imp))
|
|
||||||
import_address_rva = imp.address - getattr(optional_header, "ImageBase")
|
import_address_rva = imp.address - getattr(optional_header, "ImageBase")
|
||||||
import_address = import_address_rva - min_address
|
import_address = import_address_rva - min_address
|
||||||
procedures.append((imp.name, import_address))
|
procedures.append((imp.name, import_address))
|
||||||
@ -96,9 +93,7 @@ def _encode_binary(binary: Binary) -> bytes:
|
|||||||
|
|
||||||
_write_u32(binary.entry_point)
|
_write_u32(binary.entry_point)
|
||||||
for i in binary.imports:
|
for i in binary.imports:
|
||||||
print(i.library)
|
|
||||||
_write_zt(i.library)
|
_write_zt(i.library)
|
||||||
print(i.procedures)
|
|
||||||
for (procedure, address) in i.procedures:
|
for (procedure, address) in i.procedures:
|
||||||
_write_zt(procedure)
|
_write_zt(procedure)
|
||||||
_write_u32(address)
|
_write_u32(address)
|
||||||
@ -163,9 +158,5 @@ def main():
|
|||||||
with open("binaries\\main.dat", "wb") as f:
|
with open("binaries\\main.dat", "wb") as f:
|
||||||
f.write(code)
|
f.write(code)
|
||||||
|
|
||||||
def _round_up_to_page(x: int):
|
|
||||||
# TODO: Is this the page size on x64? I think it is
|
|
||||||
return ((x + 0x1000 - 1) // 0x1000) * 0x1000
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
if __name__ == "__main__":
|
||||||
main()
|
main()
|
0
analyzer/poetry.lock → compiler/poetry.lock
generated
0
analyzer/poetry.lock → compiler/poetry.lock
generated
Loading…
x
Reference in New Issue
Block a user