24 lines
2.2 KiB
Plaintext
24 lines
2.2 KiB
Plaintext
|
Ë
|
||
|
|
¿�j ã ó: — d Z ddlZd„ Zd„ Z edk( r ed« ‚y)uŸ
|
||
|
|
RE (reverse engineering) skeleton — copy & fill. (p4-team style)
|
||
|
|
|
||
|
|
Common p4 patterns:
|
||
|
|
* Extract bytes from a .rodata / data dump (IDA "db 30h" lines) -> often just
|
||
|
|
RSA key material. See 'reversing_is_amazing': parse the bytes, RSA.importKey,
|
||
|
|
then decrypt the given ciphertext.
|
||
|
|
* Symbolic execution / path constraint solving with angr.
|
||
|
|
* Binary parsing / patching with lief; emulation with unicorn.
|
||
|
|
é Nc óÎ — g }| j « D ]· }t j d|« }|sŒ |j d« j d« d }t j
|
||
|
|
d|« D ]` }|d xs |d } |j
|
||
|
|
|d r|j d« s|d r |j « s t |d« n
|
||
|
|
t |« « Œb Œ¹ t |« S # t $ r Y Œ{w xY w)z>Parse lines like: .rodata:0000 db 30h, 82h, 2, 5Ch ; commentz
|
||
|
|
\bdb\b\s+(.*)é ú;r z([0-9a-fA-F]+)h?|(\d+)Úhé ) Ú
|
||
|
|
splitlinesÚreÚsearchÚgroupÚsplitÚfindallÚappendÚendswithÚisdigitÚintÚ
|
||
|
|
ValueErrorÚbytes)Ú dump_textÚoutÚlineÚmÚbodyÚtokÚvals útemplates/re_skeleton.pyÚbytes_from_rodatar sä € à
|
||
|
|
€CØ×$Ñ$Ó&ò ˆÜ �I‰IÐ&¨Ó -ˆÙØ Ø�w‰w�q‹z× Ñ Ó$ QÑ'ˆÜ—:‘:Ð 7¸Ó>ò ˆCØ�a‘&Ò"˜C ™FˆCð
|
||
|
|
Ø—
|
||
|
|
‘
|
||
|
|
¨C°ªF°s·|±|ÀCÔ7HØ šF¨3¯;©;¬=ô ˜s Bœ<Ü?BÀ3»xõIñ ð ô �‹:Ðøô ò
|
||
|
|
Ùð
|
||
|
|
ús Á8ACÃ C$Ã#C$c ó² — ddl m} ddlm} t | « }|j t
|
||
|
|
|« « } |t ||j |j « « S )Nr )ÚRSA)Ú
|