public override void ReadExternal(BinaryReader input) { _flags = input.ReadUInt32(); _abc = new Abc46(); _abc.Length = (uint)(_parent.Header.Length - 4); _abc.ReadExternal(input); }
public void Compile() { for (int i = 0, n = _swf.AbcCount; i < n; ++i) { Abc46 abc = _swf.GetAbcAt(i); for (int j = 0, m = abc.MethodBodies.Count; j < m; ++j) { PatchBody(abc, (MethodBodyInfo)abc.MethodBodies[j], j); } } }
static private MethodBodyInfo FindBody(Abc46 abc, U30 methodIndex) { SwfLibrary.Abc.MethodInfo methodInfo = (SwfLibrary.Abc.MethodInfo)abc.Methods[(int)methodIndex]; MethodBodyInfo methodBody = null; for (int i = 0, n = abc.MethodBodies.Count; i < n; ++i) { methodBody = (MethodBodyInfo)abc.MethodBodies[i]; if (methodBody.Method.Value == methodIndex.Value) { break; } } return(methodBody); }
public static U30 GetClass(Abc46 abc, string argument) { U30 multinameIndex = GetMultiname(abc, argument); U30 result = new U30(); for (int i = 0, n = abc.Instances.Count; i < n; ++i) { InstanceInfo ii = (InstanceInfo)abc.Instances[i]; if (ii.Name.Value == multinameIndex.Value) { result.Value = (uint)i; break; } } return result; }
public static U30 GetClass(Abc46 abc, string argument) { U30 multinameIndex = GetMultiname(abc, argument); U30 result = new U30(); for (int i = 0, n = abc.Instances.Count; i < n; ++i) { InstanceInfo ii = (InstanceInfo)abc.Instances[i]; if (ii.Name.Value == multinameIndex.Value) { result.Value = (uint)i; break; } } return(result); }
public static void CheckInlineFlag(Abc46 abc, MethodBodyInfo body) { byte[] code = body.Code; uint i = 0; uint n = (uint)code.Length; while (i < n) { AVM2Command command = Translator.ToCommand(code[i++]); i += command.ReadParameters(code, i); if (command.OpCode == (byte)Op.FindPropertyStrict) { string name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value])); if (CompilerInline.inlineMarker == name) { body.IsInline = true; return; } } } }
public static string ResolveMultiname(Abc46 abc, U30 index) { return(ResolveMultiname(abc, (MultinameInfo)abc.ConstantPool.MultinameTable[(int)index.Value])); }
public static U30 GetMultiname(Abc46 abc, string argument) { if (argument.StartsWith("#")) { int index = int.Parse(argument.Substring(1, argument.Length - 1)); if (index < abc.ConstantPool.MultinameTable.Count && index > 0) { return((U30)index); } throw new Exception(String.Format("Invalid multiname {0}", index)); } NamespaceInfo ns; NamespaceSetInfo nss; StringInfo name; bool skipQname = argument.IndexOf("[") == 0; if (skipQname) { //BAD quick dirty hack argument = argument.Replace(" ", ""); } string tempName; U30 result = new U30(); for (int i = 1, n = abc.ConstantPool.MultinameTable.Count; i < n; ++i) { MultinameInfo multiName = (MultinameInfo)abc.ConstantPool.MultinameTable[i]; switch (multiName.Kind) { #region QName, QNameA case MultinameInfo.QName: case MultinameInfo.QNameA: if (skipQname) { continue; } ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)multiName.Data[0].Value]); name = ((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[1].Value]); tempName = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: tempName = "private"; break; case NamespaceInfo.ProtectedNamespace: tempName = "protected"; break; case NamespaceInfo.StaticProtectedNs: tempName = "protected$"; break; case NamespaceInfo.PackageInternalNs: tempName = "internal"; break; case NamespaceInfo.PackageNamespace: tempName = "public"; break; default: tempName = "*"; break; } if (0 != ns.Name.Value) { string namespaceName = ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if ("" != namespaceName && tempName != "") { tempName += "::"; } tempName += namespaceName; } tempName += "::" + name.ToString(); if (tempName == argument) { result.Value = (uint)i; return(result); } break; #endregion #region MultinameL, MultinameLA case MultinameInfo.MultinameL: case MultinameInfo.MultinameLA: if (!skipQname) { continue; } tempName = "["; nss = (NamespaceSetInfo)abc.ConstantPool.NamespaceSetTable[(int)multiName.Data[0].Value]; for (int j = 0, m = nss.NamespaceSet.Count; j < m; ++j) { U30 nssNs = (U30)nss.NamespaceSet[j]; ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)nssNs.Value]); string r2 = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: r2 = "private"; break; case NamespaceInfo.ProtectedNamespace: r2 = "protected"; break; case NamespaceInfo.StaticProtectedNs: r2 = "protected$"; break; case NamespaceInfo.PackageInternalNs: r2 = "internal"; break; case NamespaceInfo.PackageNamespace: r2 = "public"; break; default: r2 = "*"; break; } tempName += r2 + "::" + ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if (j != (m - 1)) { tempName += ","; } } tempName += "]"; if (argument == tempName) { result.Value = (uint)i; return(result); } break; #endregion default: continue; } } if (skipQname) { #region Create MultinameL // // Create a MultinameL // // Remove [] from argument argument = argument.Substring(1, argument.Length - 2); // Get new NamespaceSet index U30 setIndex = new U30(); setIndex.Value = (uint)abc.ConstantPool.NamespaceSetTable.Count; // Create MultinameInfo MultinameInfo newName = new MultinameInfo(); newName.Data = new U30[1] { setIndex }; newName.Kind = MultinameInfo.MultinameL; // Create NamespaceSet NamespaceSetInfo newSet = new NamespaceSetInfo(); newSet.NamespaceSet = new ArrayList(); abc.ConstantPool.NamespaceSetTable.Add(newSet); for (int i = 0, n = abc.ConstantPool.NamespaceTable.Count; i < n; ++i) { ns = (NamespaceInfo)abc.ConstantPool.NamespaceTable[i]; string r2 = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: r2 = "private"; break; case NamespaceInfo.ProtectedNamespace: r2 = "protected"; break; case NamespaceInfo.StaticProtectedNs: r2 = "protected$"; break; case NamespaceInfo.PackageInternalNs: r2 = "internal"; break; case NamespaceInfo.PackageNamespace: r2 = "public"; break; default: r2 = "*"; break; } r2 += "::" + ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if (argument.IndexOf(r2) != -1) { U30 nsIndex = new U30(); nsIndex.Value = (uint)i; newSet.NamespaceSet.Add(nsIndex); } } result.Value = (uint)abc.ConstantPool.MultinameTable.Count; abc.ConstantPool.MultinameTable.Add(newName); #endregion } else { #region Create QName // Create a QName U30 nsIndex = new U30(); if (argument.IndexOf("::") == argument.LastIndexOf("::")) { nsIndex.Value = GetNamespace(abc, argument.Substring(0, argument.LastIndexOf("::") + 2)).Value; } else { nsIndex.Value = GetNamespace(abc, argument.Substring(0, argument.LastIndexOf("::"))).Value; } MultinameInfo newQName = new MultinameInfo(); newQName.Data = new U30[2] { nsIndex, (U30)abc.ConstantPool.ResolveString(argument.Substring(argument.LastIndexOf("::") + 2)) }; newQName.Kind = MultinameInfo.QName; result.Value = (uint)abc.ConstantPool.MultinameTable.Count; abc.ConstantPool.MultinameTable.Add(newQName); #endregion } return(result); }
public static string ResolveClass(Abc46 abc, InstanceInfo info) { return(ResolveMultiname(abc, (MultinameInfo)abc.ConstantPool.MultinameTable[(int)info.Name.Value])); }
protected override void FormatAbc(Abc46 abc46) { base.FormatAbc(abc46); _abc = abc46; _output.Add(";namespaces:\r\n"); for (int i = 0, n = _abc.ConstantPool.NamespaceTable.Count; i < n; ++i) { NamespaceInfo ns = (NamespaceInfo)_abc.ConstantPool.NamespaceTable[i]; string result = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: result = "private"; break; case NamespaceInfo.ProtectedNamespace: result = "protected"; break; case NamespaceInfo.StaticProtectedNs: result = "protected$"; break; case NamespaceInfo.PackageInternalNs: result = "internal"; break; case NamespaceInfo.PackageNamespace: result = "public"; break; default: result = "*"; break; //throw new VerifyException("Unexpected namespace kind."); } result += "::"; result += ((StringInfo)_abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); _output.Add(String.Format(";id{0}\t\t{1}\r\n", i, result)); } _output.Add(";multinames:\r\n"); for (int i = 0, n = abc46.ConstantPool.MultinameTable.Count; i < n; ++i) { _output.Add(String.Format(";id{0}\t\t{1}\r\n", i, NameUtil.ResolveMultiname(abc46, i))); } _output.Add(";strings\r\n"); for (int i = 0, n = abc46.ConstantPool.StringTable.Count; i < n; ++i) { _output.Add(String.Format(";id{0}\t\t{1}\r\n", i, ((StringInfo)abc46.ConstantPool.StringTable[i]).ToString())); } for (int i = 0, n = _abc.Scripts.Count; i < n; ++i) { FormatScript(i); } }
static void Main(string[] args) { #if DEBUG DateTime start = DateTime.Now; #endif try { #region Initialization try { bool hasMethod = false; if (args.Length < 1) { WriteInfo(); Console.WriteLine("[?] Use -help for some instructions."); return; } for (int i = 0, n = args.Length; i < n; ++i) { switch (args[i]) { case "-h": case "-help": case "-?": case "/?": case "/help": WriteInfo(); Usage(); return; // OPTIONS ///////////////////////////////////////////////////////////////////// case "-o": case "-output": _pathOutput = args[++i]; break; case "-q": case "-quiet": _isQuiet = true; break; // REPLACE //////////////////////////////////////////////////////////////////// case "-r": case "-replace": _action = Action.Replace; break; // REPLACE PROPERTIES //////////////////////////////////////////////////////// case "-sm": case "-static-method": if (hasMethod) { throw new Exception("Two methods defined."); } _isMethodStatic = true; _methodName = args[++i]; break; case "-m": case "-method": if (hasMethod) { throw new Exception("Two methods defined."); } _isMethodStatic = false; _methodName = args[++i]; break; case "-co": case "-constructor": if (hasMethod) { throw new Exception("Two methods defined."); } _isConstructor = true; _isMethodStatic = false; break; case "-sc": case "-static-constructor": if (hasMethod) { throw new Exception("Two methods defined."); } _isConstructor = true; _isMethodStatic = true; break; case "-c": case "-class": _className = args[++i]; break; case "-n": case "-namespace": _namespace = args[++i]; break; // INLINE /////////////////////////////////////////////////////////////////// case "-i": case "-inline": _action = Action.Inline; _pathSwf = args[++i]; break; // PATCH /////////////////////////////////////////////////////////////////// case "-optimize": _action = Action.Optimize; _pathSwf = args[++i]; break; // DASM //////////////////////////////////////////////////////////////////// case "-d": case "-dasm": _action = Action.Dasm; break; // DASM PROPERTIES //////////////////////////////////////////////////////// case "-a": case "-as3c": _dasmType = Dasm.As3c; break; case "-p": case "-plain": _dasmType = Dasm.Plain; break; default: if (File.Exists(args[i])) { try { BinaryReader fileHead = new BinaryReader(File.Open(args[i], FileMode.Open, FileAccess.Read)); if (fileHead.BaseStream.Length < 3) { throw new Exception("Invalid file given."); } byte[] head = fileHead.ReadBytes(3); fileHead.Close(); //TODO fix this ugly part... if ((head[0] == (byte)'C' || head[0] == (byte)'F') && head[1] == (byte)'W' && head[2] == (byte)'S') { if (_pathSwf != "") { throw new Exception("Two SWF files given."); } _pathSwf = args[i]; } else { if ("" != _pathAsm) { throw new Exception("Two ASM files given."); } _pathAsm = args[i]; } } catch (IOException io) { WriteInfo(); Console.Error.WriteLine("[-] Error: Can not open file {0}", args[i]); #if DEBUG Console.Error.WriteLine("[-] {0}", io.Message); #endif return; } catch (Exception e) { WriteInfo(); Console.Error.WriteLine("[-] Error: {0}", e.Message); #if DEBUG Console.Error.WriteLine("[-] {0}", e.StackTrace); #endif return; } } else { if (args[i].IndexOf(".") != -1) { WriteInfo(); Console.Error.WriteLine("[-] File {0} does not exist.", args[i]); return; } else { throw new Exception("Invalid argument given."); } } break; } } } catch (Exception e) { WriteInfo(); Console.Error.WriteLine("[-] Error: Invalid arguments. Use -help for help ..."); #if DEBUG Console.Error.WriteLine("[-] {0}", e.Message); Console.Error.WriteLine("[-] {0}", e.StackTrace); #endif return; } if (!_isQuiet) { Console.WriteLine("[i] As3c - ActionScript3 ASM compiler"); } Translator.InitTable(); #endregion #region Integrity scan for the Translator class (DEBUG only) #if DEBUG if (Translator.CheckIntegrity()) { if (!_isQuiet) { Console.WriteLine("[+] Integrity scan passed!"); } } else { Console.WriteLine("[-] Integrity scan failed...!"); } #endif #endregion FileStream fileInput; FileStream fileOutput; SwfFormat swf; switch (_action) { case Action.Dasm: #region Disassemble file swf = new SwfFormat(); fileInput = File.Open(_pathSwf, FileMode.Open, FileAccess.Read); swf.Read(fileInput); fileInput.Close(); fileInput.Dispose(); DisassemblerBase dasm; switch (_dasmType) { case Dasm.As3c: dasm = new DisassemblerAs3c(); break; case Dasm.Plain: dasm = new DisassemblerPlain(); break; default: throw new Exception(); } dasm.Parse(swf); if ("" == _pathOutput) { dasm.EmitToConsole(); } else { fileOutput = File.Open(_pathOutput, FileMode.OpenOrCreate, FileAccess.Write); dasm.EmitToStream(fileOutput); fileOutput.Close(); fileOutput.Dispose(); } #endregion break; case Action.Optimize: #region Optimize SWF swf = new SwfFormat(); fileInput = File.Open(_pathSwf, FileMode.Open, FileAccess.Read); swf.Read(fileInput); fileInput.Close(); fileInput.Dispose(); CompilerOptimize compOptimize = new CompilerOptimize(swf); compOptimize.Compile(); fileOutput = File.Open((_pathOutput != "") ? _pathOutput : _pathSwf, FileMode.OpenOrCreate, FileAccess.Write); swf.Write(fileOutput); fileOutput.Close(); fileOutput.Dispose(); #endregion break; case Action.Inline: #region Compile inline instructions swf = new SwfFormat(); fileInput = File.Open(_pathSwf, FileMode.Open, FileAccess.Read); swf.Read(fileInput); fileInput.Close(); fileInput.Dispose(); CompilerInline compInline = new CompilerInline(swf); compInline.Compile(); fileOutput = File.Open((_pathOutput != "") ? _pathOutput : _pathSwf, FileMode.OpenOrCreate, FileAccess.Write); swf.Write(fileOutput); fileOutput.Close(); fileOutput.Dispose(); #endregion break; case Action.Replace: #region Replace method body #region Simple pre-check if ("" == _pathAsm || !File.Exists(_pathAsm)) { Console.Error.WriteLine("[-] No valid ASM input given."); return; } if ("" == _pathSwf || !File.Exists(_pathSwf)) { Console.Error.WriteLine("[-] No valid SWF target given."); return; } if ("" == _className) { Console.Error.WriteLine("[-] No class given."); return; } if (!_isConstructor) { if ("" == _methodName) { Console.Error.WriteLine("[-] Need method name or constructor to replace"); return; } } #endregion swf = new SwfFormat(); fileInput = File.Open(_pathSwf, FileMode.Open, FileAccess.Read); swf.Read(fileInput); fileInput.Close(); fileInput.Dispose(); #region Body lookup Abc46 abc = null; SwfLibrary.Abc.MethodInfo method = null; MethodBodyInfo body = null; bool instanceFound = false; Abc46 currentAbc = null; string classFormat; if (_className.IndexOf(".") != -1) { classFormat = "public::" + _className.Substring(0, _className.LastIndexOf(".")) + "::" + _className.Substring(_className.LastIndexOf(".") + 1, _className.Length - _className.LastIndexOf(".") - 1); } else { classFormat = "public::" + _className; } string methodFormat = _namespace + "::" + _methodName; // Parse for all possibilities for (int i = 0, n = swf.AbcCount; i < n; ++i) { currentAbc = swf.GetAbcAt(i); for (int j = 0, m = currentAbc.Scripts.Count; j < m; ++j) { ScriptInfo script = (ScriptInfo)currentAbc.Scripts[j]; for (int k = 0, o = script.Traits.Count; k < o; ++k) { TraitInfo scriptTrait = (TraitInfo)script.Traits[k]; if (!(scriptTrait.Body is TraitClass)) { continue; } TraitClass classBody = (TraitClass)scriptTrait.Body; ClassInfo classInfo = (ClassInfo)currentAbc.Classes[(int)classBody.ClassI]; InstanceInfo instanceInfo = (InstanceInfo)currentAbc.Instances[(int)classBody.ClassI]; string instanceName = NameUtil.ResolveMultiname(currentAbc, instanceInfo.Name); if (classFormat == instanceName) { instanceFound = true; if (!_isQuiet) { Console.WriteLine("[+] Found class {0}", instanceName); } if (_isMethodStatic) { if (_isConstructor) { if (null != body) { Console.Error.WriteLine("[-] Can not explicitly determine method body."); return; } method = (SwfLibrary.Abc.MethodInfo)currentAbc.Methods[(int)classInfo.CInit]; body = FindBody(currentAbc, classInfo.CInit); abc = currentAbc; if (null != body) { if (!_isQuiet) { Console.WriteLine("[+] Found static class initializer."); } } } else { Console.Error.WriteLine("[-] Sorry, static methods do not work yet ..."); return; //TODO support static methods... } } else { if (_isConstructor) { if (null != body) { Console.Error.WriteLine("[-] Can not explicitly determine method body."); return; } method = (SwfLibrary.Abc.MethodInfo)currentAbc.Methods[(int)instanceInfo.IInit]; body = FindBody(currentAbc, instanceInfo.IInit); abc = currentAbc; if (null != body) { if (!_isQuiet) { Console.WriteLine("[+] Found class initializer."); } } } else { // here begins the ugly part ... for (int l = 0, p = instanceInfo.Traits.Count; l < p; ++l) { TraitInfo instanceTrait = (TraitInfo)instanceInfo.Traits[l]; if (!(instanceTrait.Body is TraitMethod)) { continue; } string methodName = NameUtil.ResolveMultiname(currentAbc, instanceTrait.Name); if ("" == _namespace) { if ("public::" + _methodName != methodName && "private::" + _methodName != methodName && "protected::" + _methodName != methodName && "protected$::" + _methodName != methodName && "internal::" + _methodName != methodName) { continue; } } else { if (methodName != methodFormat) { continue; } } if (null != body) { Console.Error.WriteLine("[-] Can not explicitly determine method body."); return; } TraitMethod methodBody = (TraitMethod)instanceTrait.Body; method = (SwfLibrary.Abc.MethodInfo)currentAbc.Methods[(int)methodBody.Method]; body = FindBody(currentAbc, methodBody.Method); abc = currentAbc; if (null != body) { if (!_isQuiet) { Console.WriteLine("[+] Found method {0}", methodName); } } } } } } } } } if (null == body) { Console.Error.WriteLine("[-] Could not find {0}.", (instanceFound) ? "method" : "class"); return; } #endregion // // We have valid body to replace. Start the parser. // ParserAs3c parser = new ParserAs3c(); parser.Parse(_pathAsm); // // Convert the parser instructions to actual bytecode for the AVM2. // CompilerAs3c compAs3c = new CompilerAs3c(); compAs3c.Compile(currentAbc, parser.Instructions, parser.Labels, false); // // Get body information (maxstack, localcount, maxscopedepth, initscopedepth) // We keep compiler directives in respect here ... // #region MethodBody information U30 maxStack; U30 maxScopeDepth; U30 localCount; U30 initScopeDepth = new U30(); if (parser.HasMaxStack) { maxStack = new U30(); maxStack.Value = parser.MaxStack; } else { maxStack = ByteCodeAnalyzer.CalcMaxStack(compAs3c.Code); if (maxStack.Value < method.ParameterCount.Value) { maxStack.Value = method.ParameterCount.Value; } } if (parser.HasLocalCount) { localCount = new U30(); localCount.Value = parser.LocalCount; } else { localCount = ByteCodeAnalyzer.CalcLocalCount(compAs3c.Code); } if (parser.HasInitScopeDepth) { initScopeDepth.Value = parser.InitScopeDepth; } else { initScopeDepth.Value = 1; } if (parser.HasMaxScopeDepth) { maxScopeDepth = new U30(); maxScopeDepth.Value = parser.MaxScopeDepth; } else { maxScopeDepth = ByteCodeAnalyzer.CalcScopeDepth(compAs3c.Code); maxScopeDepth.Value += initScopeDepth.Value; } if (!_isQuiet) { Console.WriteLine("[i] InitScopeDepth: {0}", (int)initScopeDepth); Console.WriteLine("[i] MaxScopeDepth: {0}", (int)maxScopeDepth); Console.WriteLine("[i] MaxStack: {0}", (int)maxStack); Console.WriteLine("[i] LocalCount: {0}", (int)localCount); } #endregion // // Replace the code of the body. // body.Code = compAs3c.Code; // // Update body information // body.MaxStack = maxStack; body.MaxScopeDepth = maxScopeDepth; body.InitScopeDepth = initScopeDepth; body.LocalCount = localCount; #region Write output if ("" == _pathOutput) { fileOutput = File.Open(_pathSwf, FileMode.OpenOrCreate, FileAccess.Write); } else { fileOutput = File.Open(_pathOutput, FileMode.OpenOrCreate, FileAccess.Write); } swf.Write(fileOutput); fileOutput.Close(); fileOutput.Dispose(); #endregion #endregion break; case Action.Usage: Usage(); break; } #region Program end if (!_isQuiet) { Console.WriteLine("[i] Done."); } #endregion } catch (IOException ioex) { Console.Error.WriteLine("[-] Error: {0}", ioex.Message); } catch (InstructionException iex) { #region Parser errors string message; switch (iex.ErrorType) { case InstructionException.Type.InvalidSyntax: message = "Error while parsing"; break; case InstructionException.Type.NotEnoughArguments: message = "Not enough arguments"; break; case InstructionException.Type.TooManyArguments: message = "Too many arguments"; break; case InstructionException.Type.UnknownType: message = "Unknown type"; break; case InstructionException.Type.LabelRedefined: message = "Label has already been defined"; break; case InstructionException.Type.LabelMissing: message = "Label has never been defined"; break; default: message = "Unknown error at"; break; } Console.Error.WriteLine("[-] " + message + ":"); if (null != iex.ParserInfo) { Console.Error.WriteLine("{0}({1}): {2}", iex.ParserInfo.FilePath, iex.ParserInfo.LineNumber, iex.ParserInfo.Line); } #endregion } catch (Exception ex) { Console.Error.WriteLine("[-] Unexpected error: {0}", ex.Message); #if DEBUG Console.Error.WriteLine("[-] Stacktrace: {0}", ex.StackTrace); #endif } #if DEBUG DateTime end = DateTime.Now; TimeSpan delta = end - start; Console.WriteLine("[i] Total: {0}sec {1}ms", delta.Seconds, delta.Milliseconds); #endif }
private void PatchBody(Abc46 abc, MethodBodyInfo body, int bodyId) { AVM2Command command; AVM2Command inlineCommand; Dictionary <string, Label> labels = new Dictionary <string, Label>(); ArrayList instructions = new ArrayList(); Label label; string labelId; byte[] il = body.Code; uint i = 0; uint n = (uint)il.Length; uint addr; string name; bool patchBody = false; bool ignoreBody = false; _labelUtil.Clear(); while (i < n) { addr = i; if (_labelUtil.IsMarked(addr)) { labelId = String.Format(":{0}:", _labelUtil.GetLabelAt(addr).id); label = new Label(labelId); labels.Add(labelId, label); instructions.Add(label); } command = Translator.ToCommand(il[i++]); if (null == command) { throw new Exception("Unknown opcode detected."); } i += command.ReadParameters(il, i); switch (command.OpCode) { case (byte)Op.Label: labelId = String.Format(":{0}:", _labelUtil.GetLabelAt(addr).id); label = new Label(labelId); labels.Add(labelId, label); instructions.Add(label); break; case (byte)Op.IfEqual: case (byte)Op.IfFalse: case (byte)Op.IfGreaterEqual: case (byte)Op.IfGreaterThan: case (byte)Op.IfLessEqual: case (byte)Op.IfLowerThan: case (byte)Op.IfNotEqual: case (byte)Op.IfNotGreaterEqual: case (byte)Op.IfNotGreaterThan: case (byte)Op.IfNotLowerEqual: case (byte)Op.IfNotLowerThan: case (byte)Op.IfStrictEqual: case (byte)Op.IfStrictNotEqual: case (byte)Op.IfTrue: case (byte)Op.Jump: S24 offset = (S24)command.Parameters[0]; command.Parameters[0] = String.Format(":{0}:", _labelUtil.GetLabelAt((uint)(addr + 1 + offset.Length + offset.Value)).id); instructions.Add(command); break; case (byte)Op.GetLex: name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value])); if ("public::Math" == name || "Math" == name) { patchBody = true; } instructions.Add(command); break; case (byte)Op.LookupSwitch: ignoreBody = true; instructions.Add(command); break; default: instructions.Add(command); break; } } if (ignoreBody) { #if DEBUG Console.WriteLine("[-] Have to ignore body because of lookupswitch ..."); #endif } if (patchBody && !ignoreBody) { // // We have to patch this function ... // Note: We do not change the initScopeDepth // #if DEBUG Console.WriteLine("[i] Patching body (id: {0})", bodyId); #endif CompilerAs3c compAs3c = new CompilerAs3c(); compAs3c.Compile(abc, instructions, labels, true); // Now .. only patch if we find a correct stack! U30 maxStack = maxStack = ByteCodeAnalyzer.CalcMaxStack(compAs3c.Code); if (0 == (ByteCodeAnalyzer.Flags & ByteCodeAnalyzer.InvalidStack)) { MethodInfo method = (MethodInfo)abc.Methods[(int)body.Method.Value]; body.MaxStack = maxStack; body.MaxScopeDepth = body.InitScopeDepth + ByteCodeAnalyzer.CalcScopeDepth(compAs3c.Code); U30 minLocalCount = method.ParameterCount; U30 maxLocalCount = ByteCodeAnalyzer.CalcLocalCount(compAs3c.Code); if (maxLocalCount.Value > minLocalCount.Value) { body.LocalCount = ByteCodeAnalyzer.CalcLocalCount(compAs3c.Code); } //else <- we would have unused parameters in a function... body.Code = compAs3c.Code; } else { // // What else? We will display warnings automatically but what about // telling the guy in which function he has an invalid stack? // } #if DEBUG Console.WriteLine("[+] Body patched"); #endif } }
public static U30 GetNamespace(Abc46 abc, string argument) { NamespaceInfo ns; for (int i = 0, n = abc.ConstantPool.NamespaceTable.Count; i < n; ++i) { ns = (NamespaceInfo)abc.ConstantPool.NamespaceTable[i]; string namespaceString = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: namespaceString = "private"; break; case NamespaceInfo.ProtectedNamespace: namespaceString = "protected"; break; case NamespaceInfo.StaticProtectedNs: namespaceString = "protected$"; break; case NamespaceInfo.PackageInternalNs: namespaceString = "internal"; break; case NamespaceInfo.PackageNamespace: namespaceString = "public"; break; default: namespaceString = "*"; break; } namespaceString += "::" + ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if (argument.IndexOf(namespaceString) != -1) { U30 nsIndex = new U30(); nsIndex.Value = (uint)i; return nsIndex; } } NamespaceInfo newNs = new NamespaceInfo(); string name = ""; byte kind = 0; if(0 == argument.IndexOf("private::")) { kind = NamespaceInfo.PrivateNs; name = argument.Substring(8); } else if (0 == argument.IndexOf("public::")) { kind = NamespaceInfo.PackageNamespace; name = argument.Substring(7); } newNs.Kind = kind; if ("" == name) newNs.Name = (U30)0; else newNs.Name = (U30)abc.ConstantPool.ResolveString(name); U30 result = new U30(); result.Value = (uint)abc.ConstantPool.NamespaceTable.Count; abc.ConstantPool.NamespaceTable.Add(newNs); return result; }
public void Compile(Abc46 abc, ArrayList instructions, Dictionary <string, Label> labels, bool patchMath) { #if DEBUG //Console.WriteLine("[i] Starting to compile method body ..."); #endif // // Create buffer // MemoryStream buffer = new MemoryStream(); BinaryWriter output = new BinaryWriter(buffer); // // Convert compiler instructions to IL. // Instruction instruction; Label label; List <ReplaceInformation> replaceList = new List <ReplaceInformation>(); bool hasLocalMath = false; uint mathRegister = 0; U30 mathMultiName = new U30(); AVM2Command mathCommand = null; AVM2Command lastCommand = null; for (int i = 0, n = instructions.Count; i < n; ++i) { if (instructions[i] is Label) { label = (Label)instructions[i]; label.Address = (uint)buffer.Position; if (!label.Referenced) { output.Write((byte)Op.Label); } } else if (instructions[i] is AVM2Command) { AVM2Command command = (AVM2Command)instructions[i]; output.Write((byte)command.OpCode); switch (command.OpCode) { case (byte)Op.IfEqual: case (byte)Op.IfFalse: case (byte)Op.IfGreaterEqual: case (byte)Op.IfGreaterThan: case (byte)Op.IfLessEqual: case (byte)Op.IfLowerThan: case (byte)Op.IfNotEqual: case (byte)Op.IfNotGreaterEqual: case (byte)Op.IfNotGreaterThan: case (byte)Op.IfNotLowerEqual: case (byte)Op.IfNotLowerThan: case (byte)Op.IfStrictEqual: case (byte)Op.IfStrictNotEqual: case (byte)Op.IfTrue: case (byte)Op.Jump: string labelId = (string)command.Parameters[0]; try { label = labels[labelId]; } catch (Exception) { Console.WriteLine("[-] WARNING: Jumping to an unknown label"); continue; } if (label.HasAddress) { int offset = (int)(label.Address - ((uint)buffer.Position + 3)); Primitives.WriteS24(output, offset); } else { replaceList.Add(new ReplaceInformation((uint)buffer.Position, label, false)); Primitives.WriteS24(output, 0); } label.Referenced = true; break; case (byte)Op.GetLex: if (patchMath) { string lexName = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value])); // // If getlex public::Math is called we will repalce it with // a get_local N where Math will be stored. // if (("public::Math" == lexName || "Math" == lexName) && (null != lastCommand) && (lastCommand.OpCode != (byte)Op.SetLocal)) { #if DEBUG Console.WriteLine("[i] Found call to Math class ..."); #endif if (!hasLocalMath) { mathMultiName = (U30)command.Parameters[0]; U30 currentMaxLocal = ByteCodeAnalyzer.CalcLocalCount(instructions); #if DEBUG Console.WriteLine(String.Format("[i] Math register will be {0}", currentMaxLocal.Value)); #endif if (currentMaxLocal.Value < 4) { int val = (int)currentMaxLocal.Value; mathCommand = Translator.ToCommand((byte)(0xd0 + val)); } else { mathCommand = Translator.ToCommand((byte)Op.GetLocal); mathCommand.Parameters.Add(currentMaxLocal); } mathRegister = currentMaxLocal.Value; hasLocalMath = true; } output.Seek(-1, SeekOrigin.Current); output.Write((byte)mathCommand.OpCode); if (mathCommand.OpCode == (byte)Op.GetLocal) { mathCommand.WriteParameters(output); } } else { command.WriteParameters(output); } } else { command.WriteParameters(output); } break; default: command.WriteParameters(output); break; } lastCommand = command; } else if (instructions[i] is Instruction) { instruction = (Instruction)instructions[i]; output.Write(instruction.Command.OpCode); switch (instruction.Command.OpCode) { case (byte)Op.PushShort: Primitives.WriteU30(output, (U30)Convert.ToInt32(instruction.Arguments[0])); break; case (byte)Op.AsType: case (byte)Op.Coerce: case (byte)Op.DeleteProperty: case (byte)Op.FindProperty: case (byte)Op.FindPropertyStrict: case (byte)Op.GetDescendants: case (byte)Op.GetLex: case (byte)Op.GetProperty: case (byte)Op.GetSuper: case (byte)Op.InitProperty: case (byte)Op.IsType: case (byte)Op.SetProperty: case (byte)Op.PushNamespace: Primitives.WriteU30(output, NameUtil.GetMultiname(abc, instruction.Arguments[0])); break; case (byte)Op.CallProperty: case (byte)Op.CallPropertyLex: case (byte)Op.CallPropertyVoid: case (byte)Op.CallSuper: case (byte)Op.CallSuperVoid: case (byte)Op.ConstructProperty: Primitives.WriteU30(output, NameUtil.GetMultiname(abc, instruction.Arguments[0])); Primitives.WriteU30(output, Convert.ToUInt32(instruction.Arguments[1])); break; case (byte)Op.NewClass: Primitives.WriteU30(output, NameUtil.GetClass(abc, instruction.Arguments[0])); break; case (byte)Op.PushDouble: Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveDouble(Convert.ToDouble(instruction.Arguments[0].Replace('.', ',')))); break; case (byte)Op.PushInt: Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveInt((S32)Convert.ToInt32(instruction.Arguments[0]))); break; case (byte)Op.PushUInt: Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveUInt((U32)Convert.ToUInt32(instruction.Arguments[0]))); break; case (byte)Op.DebugFile: case (byte)Op.PushString: if (instruction.Arguments[0].StartsWith("\"") && instruction.Arguments[0].EndsWith("\"")) //TODO fix ugly hack { Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveString(instruction.Arguments[0].Substring(1, instruction.Arguments[0].Length - 2))); } else { Primitives.WriteU30(output, (U30)abc.ConstantPool.ResolveString(instruction.Arguments[0])); } break; case (byte)Op.IfEqual: case (byte)Op.IfFalse: case (byte)Op.IfGreaterEqual: case (byte)Op.IfGreaterThan: case (byte)Op.IfLessEqual: case (byte)Op.IfLowerThan: case (byte)Op.IfNotEqual: case (byte)Op.IfNotGreaterEqual: case (byte)Op.IfNotGreaterThan: case (byte)Op.IfNotLowerEqual: case (byte)Op.IfNotLowerThan: case (byte)Op.IfStrictEqual: case (byte)Op.IfStrictNotEqual: case (byte)Op.IfTrue: case (byte)Op.Jump: // // Solve label offset // string labelId = null; try { labelId = instruction.Arguments[0]; } catch (Exception) { Console.WriteLine("[-] WARNING: Jumping to an unknown label"); continue; } // // Make sure the label exsists. // if (!labels.ContainsKey(labelId)) { #if DEBUG Console.WriteLine("[-] Label \"{0}\" is missing ...", labelId); #endif throw new InstructionException(InstructionException.Type.LabelMissing, instruction.DebugInfo); } label = labels[labelId]; if (label.HasAddress) { // // We already have the label address. This is a negative jump offset. // int offset = (int)(label.Address - ((uint)buffer.Position + 3)); Primitives.WriteS24(output, offset); } else { // // We do not know the label address. This is a positive jump offset. // Mark label to be solved afterwards and write a placeholder ... // replaceList.Add(new ReplaceInformation((uint)buffer.Position, label, false)); Primitives.WriteS24(output, 0); } label.Referenced = true; break; default: if (0 < instruction.Command.ParameterCount) { try { foreach (string argument in instruction.Arguments) { output.Write((byte)Convert.ToByte(argument)); } } catch (Exception) { throw new InstructionException(InstructionException.Type.UnknownType, instruction.DebugInfo); } } break; } lastCommand = instruction.Command; } } int labelOffset = 0; #region Add automatically generated code // // Add local variable containing Math // if (patchMath && hasLocalMath) { #if DEBUG Console.WriteLine("[i] Body has local Math"); #endif int mathAddress = 2; int lastOpCode = -1; int opCode = -1; long lastPosition = output.BaseStream.Position; output.BaseStream.Seek(0, SeekOrigin.Begin); while (((opCode = output.BaseStream.ReadByte()) != -1)) { if (lastOpCode == (byte)Op.GetLocal0 && opCode == (byte)Op.PushScope) { break; } lastOpCode = opCode; } mathAddress = (int)output.BaseStream.Position; output.BaseStream.Seek(lastPosition, SeekOrigin.Begin); #if DEBUG //Console.WriteLine("[i] Dump Before:"); //DebugUtil.Dump((MemoryStream)output.BaseStream); #endif InsertByte(output, mathAddress); InsertByte(output, mathAddress); labelOffset += 2; int byteCoundMulti = 0; while (byteCoundMulti < mathMultiName.Length) { byteCoundMulti++; labelOffset++; InsertByte(output, mathAddress); } if (mathRegister > 3) { #if DEBUG Console.WriteLine("[i] Adding extra register"); #endif int byteCount = 0; while (byteCount < ((U30)mathRegister).Length + 1) { ++byteCount; ++labelOffset; InsertByte(output, mathAddress); } } output.Seek(mathAddress, SeekOrigin.Begin); AVM2Command getLexCommand = Translator.ToCommand((byte)Op.GetLex); getLexCommand.Parameters.Add(mathMultiName); output.Write((byte)getLexCommand.OpCode); getLexCommand.WriteParameters(output); if (mathRegister > 3) { AVM2Command setLocalCommand = Translator.ToCommand((byte)Op.SetLocal); setLocalCommand.Parameters.Add((U30)mathRegister); output.Write((byte)setLocalCommand.OpCode); setLocalCommand.WriteParameters(output); } else { output.Write((byte)(0xd4 + mathRegister)); } #if DEBUG //Console.WriteLine("[i] Dump After:"); //DebugUtil.Dump((MemoryStream)output.BaseStream); #endif output.Seek(0, SeekOrigin.End); output.Flush(); } #endregion // // Solve remainig labels // for (int i = 0, n = replaceList.Count; i < n; ++i) { ReplaceInformation replaceInfo = replaceList[i]; label = replaceInfo.label; if (!label.Referenced || !label.HasAddress) { Console.WriteLine("[-] Warning: Label {0} has never been defined or used ...", label.Identifier); continue; } if (replaceInfo.lookUpSwitch) { // // LookUpSwitch with special offset calculation // throw new Exception("IMPLEMENT ME!"); } else { // // Simple jump // int offset = (int)(label.Address - ((uint)replaceInfo.address + 3)); buffer.Seek(replaceInfo.address + labelOffset, SeekOrigin.Begin); Primitives.WriteS24(output, offset); } } // // Convert stream to byte[] // buffer.Seek(0, SeekOrigin.Begin); BinaryReader reader = new BinaryReader(buffer); _code = reader.ReadBytes((int)buffer.Length); // // Clean up // reader.Close(); buffer.Dispose(); #if DEBUG //Console.WriteLine("[i] Done compiling method body ..."); #endif }
/** * HERE STARTS THE SPAGHETTI CODE */ public static string ResolveMultiname(Abc46 abc, MultinameInfo multiName) { NamespaceInfo ns; NamespaceSetInfo nss; StringInfo name; string result; switch (multiName.Kind) { case MultinameInfo.RTQName: case MultinameInfo.RTQNameA: //Console.WriteLine("[-] RTQName/RTQNameA is currently not supported."); return ((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[0].Value]).ToString(); case MultinameInfo.QName: case MultinameInfo.QNameA: ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)multiName.Data[0].Value]); name = ((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[1].Value]); result = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: result = "private"; break; case NamespaceInfo.ProtectedNamespace: result = "protected"; break; case NamespaceInfo.StaticProtectedNs: result = "protected$"; break; case NamespaceInfo.PackageInternalNs: result = "internal"; break; case NamespaceInfo.PackageNamespace: result = "public"; break; default: result = "*"; break; //throw new VerifyException("Unexpected namespace kind."); } if (0 != ns.Name.Value) { string namespaceName = ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if ("" != namespaceName && result != "") result += "::"; result += namespaceName; } result += "::" + name.ToString(); return result; case MultinameInfo.RTQNameL: case MultinameInfo.RTQNameLA: Console.WriteLine("[-] RTQNameL/RTQameLA is currently not supported."); return ""; case MultinameInfo.Multiname_: case MultinameInfo.MultinameA: //TODO fix this -- what about the namespace set here? //Console.WriteLine("[-] Multiname/MultinameA is currently not supported."); name = ((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[0].Value]); nss = ((NamespaceSetInfo)abc.ConstantPool.NamespaceSetTable[(int)multiName.Data[1].Value]); return name.ToString(); ; case MultinameInfo.MultinameL: case MultinameInfo.MultinameLA: //Console.WriteLine("[-] MultinameL/MultinameLA is currently not supported.") nss = ((NamespaceSetInfo)abc.ConstantPool.NamespaceSetTable[(int)multiName.Data[0].Value]); string set = "["; for (int i = 0, n = nss.NamespaceSet.Count; i < n; ++i) { U30 nssNs = (U30)nss.NamespaceSet[i]; ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)nssNs.Value]); string r2 = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: r2 = "private"; break; case NamespaceInfo.ProtectedNamespace: r2 = "protected"; break; case NamespaceInfo.StaticProtectedNs: r2 = "protected$"; break; case NamespaceInfo.PackageInternalNs: r2 = "internal"; break; case NamespaceInfo.PackageNamespace: r2 = "public"; break; default: r2 = "*"; break; } set += String.Format("{0}::{1}", r2, ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString()); if (i != n - 1) set += ", "; } set += "]"; return set; default: return "*"; //throw new VerifyException("Unknown multiname kind."); } }
/** * HERE STARTS THE SPAGHETTI CODE */ public static string ResolveMultiname(Abc46 abc, MultinameInfo multiName) { NamespaceInfo ns; NamespaceSetInfo nss; StringInfo name; string result; switch (multiName.Kind) { case MultinameInfo.RTQName: case MultinameInfo.RTQNameA: //Console.WriteLine("[-] RTQName/RTQNameA is currently not supported."); return(((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[0].Value]).ToString()); case MultinameInfo.QName: case MultinameInfo.QNameA: ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)multiName.Data[0].Value]); name = ((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[1].Value]); result = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: result = "private"; break; case NamespaceInfo.ProtectedNamespace: result = "protected"; break; case NamespaceInfo.StaticProtectedNs: result = "protected$"; break; case NamespaceInfo.PackageInternalNs: result = "internal"; break; case NamespaceInfo.PackageNamespace: result = "public"; break; default: result = "*"; break; //throw new VerifyException("Unexpected namespace kind."); } if (0 != ns.Name.Value) { string namespaceName = ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if ("" != namespaceName && result != "") { result += "::"; } result += namespaceName; } result += "::" + name.ToString(); return(result); case MultinameInfo.RTQNameL: case MultinameInfo.RTQNameLA: Console.WriteLine("[-] RTQNameL/RTQameLA is currently not supported."); return(""); case MultinameInfo.Multiname_: case MultinameInfo.MultinameA: //TODO fix this -- what about the namespace set here? //Console.WriteLine("[-] Multiname/MultinameA is currently not supported."); name = ((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[0].Value]); nss = ((NamespaceSetInfo)abc.ConstantPool.NamespaceSetTable[(int)multiName.Data[1].Value]); return(name.ToString());; case MultinameInfo.MultinameL: case MultinameInfo.MultinameLA: //Console.WriteLine("[-] MultinameL/MultinameLA is currently not supported.") nss = ((NamespaceSetInfo)abc.ConstantPool.NamespaceSetTable[(int)multiName.Data[0].Value]); string set = "["; for (int i = 0, n = nss.NamespaceSet.Count; i < n; ++i) { U30 nssNs = (U30)nss.NamespaceSet[i]; ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)nssNs.Value]); string r2 = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: r2 = "private"; break; case NamespaceInfo.ProtectedNamespace: r2 = "protected"; break; case NamespaceInfo.StaticProtectedNs: r2 = "protected$"; break; case NamespaceInfo.PackageInternalNs: r2 = "internal"; break; case NamespaceInfo.PackageNamespace: r2 = "public"; break; default: r2 = "*"; break; } set += String.Format("{0}::{1}", r2, ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString()); if (i != n - 1) { set += ", "; } } set += "]"; return(set); default: return("*"); //throw new VerifyException("Unknown multiname kind."); } }
public static string ResolveMultiname(Abc46 abc, int index) { return ResolveMultiname(abc, (MultinameInfo)abc.ConstantPool.MultinameTable[index]); }
public static string ResolveMultiname(Abc46 abc, U30 index) { return ResolveMultiname(abc, (MultinameInfo)abc.ConstantPool.MultinameTable[(int)index.Value]); }
public static string ResolveClass(Abc46 abc, InstanceInfo info) { return ResolveMultiname(abc, (MultinameInfo)abc.ConstantPool.MultinameTable[(int)info.Name.Value]); }
public static string ResolveMultiname(Abc46 abc, int index) { return(ResolveMultiname(abc, (MultinameInfo)abc.ConstantPool.MultinameTable[index])); }
protected void PatchBody(Abc46 abc, MethodBodyInfo body, int bodyId) { AVM2Command command; AVM2Command inlineCommand; Dictionary <string, Label> labels = new Dictionary <string, Label>(); ArrayList instructions = new ArrayList(); Label label; string labelId; byte[] il = body.Code; uint i = 0; uint n = (uint)il.Length; uint addr; string name; bool hasManualMaxStack = false; uint manualMaxStackValue = 0; bool patchBody = false; //bool parseInline = false; _labelUtil.Clear(); // // We will convert the bytecode into a format that the As3c compiler can understand. // When converting labels we will use a ':' in front of them instead of a '.' char for // the ones "defined" by the ASC so that we have unique names (label syntax is .label) // while (i < n) { addr = i; if (_labelUtil.IsMarked(addr)) { labelId = String.Format(":{0}:", _labelUtil.GetLabelAt(addr).id); label = new Label(labelId); labels.Add(labelId, label); instructions.Add(label); } command = Translator.ToCommand(il[i++]); if (null == command) { throw new Exception("Unknown opcode detected."); } i += command.ReadParameters(il, i); switch (command.OpCode) { case (byte)Op.Label: labelId = String.Format(":{0}:", _labelUtil.GetLabelAt(addr).id); label = new Label(labelId); labels.Add(labelId, label); instructions.Add(label); break; case (byte)Op.IfEqual: case (byte)Op.IfFalse: case (byte)Op.IfGreaterEqual: case (byte)Op.IfGreaterThan: case (byte)Op.IfLessEqual: case (byte)Op.IfLowerThan: case (byte)Op.IfNotEqual: case (byte)Op.IfNotGreaterEqual: case (byte)Op.IfNotGreaterThan: case (byte)Op.IfNotLowerEqual: case (byte)Op.IfNotLowerThan: case (byte)Op.IfStrictEqual: case (byte)Op.IfStrictNotEqual: case (byte)Op.IfTrue: case (byte)Op.Jump: // Convert label offset to label reference ... S24 offset = (S24)command.Parameters[0]; command.Parameters[0] = String.Format(":{0}:", _labelUtil.GetLabelAt((uint)(addr + 1 + offset.Length + offset.Value)).id); instructions.Add(command); break; case (byte)Op.GetLex: name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value])); //Console.WriteLine("Called GetLex {0}", name); instructions.Add(command); break; case (byte)Op.FindPropertyStrict: name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)command.Parameters[0]).Value])); #region INLINE Block if (inlineWrapper == name) { bool parse = true; patchBody = true; #if DEBUG Console.WriteLine("[i] Parsing inline block in method {0}", body.Method.Value); #endif while (parse && i < n) { inlineCommand = Translator.ToCommand(il[i++]); if (null == inlineCommand) { throw new Exception("Unknown opcode detected."); } i += inlineCommand.ReadParameters(il, i); switch (inlineCommand.OpCode) { // // Debug instructions are kept even if they are in an inline block // case (byte)Op.Debug: case (byte)Op.DebugFile: case (byte)Op.DebugLine: instructions.Add(inlineCommand); break; // // Strings are treated as labels -- but make sure it is actually one! // case (byte)Op.PushString: labelId = ((StringInfo)abc.ConstantPool.StringTable[(int)((U30)inlineCommand.Parameters[0])]).ToString(); if (labelId.IndexOf('.') != 0 || labelId.IndexOf(':') != (labelId.Length - 1)) { throw new Exception(String.Format("Invalid string \"{0}\" in an inline block. Labels have the format \".labelName:\"", labelId)); } labelId = labelId.Substring(0, labelId.Length - 1); label = new Label(labelId); labels.Add(labelId, label); instructions.Add(label); break; // // GetLex is the one that will bring public::de.popforge.asm::Op on the stack // case (byte)Op.GetLex: name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value])); if (inlineKeyword != name) { throw new Exception("Malformed inline block. GetLex call with invalid parameters"); } List <AVM2Command> args = new List <AVM2Command>(); AVM2Command userCommand = null; uint argc; while (i < n) { AVM2Command arg = Translator.ToCommand(il[i++]); if (null == arg) { throw new Exception("Unknown opcode detected."); } i += arg.ReadParameters(il, i); if ((byte)Op.CallProperty == arg.OpCode) { name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)arg.Parameters[0]).Value])); userCommand = Translator.ToCommand(name, true); argc = ((U30)arg.Parameters[1]).Value; if (null == userCommand) { throw new Exception(String.Format("Unknown command {0}.", name)); } break; } args.Add(arg); } if (null == userCommand) { throw new Exception("Malformed inline block."); } instructions.Add(new Instruction(abc, userCommand, args)); break; case (byte)Op.CallPropertyVoid: name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value])); if (inlineWrapper == name) { parse = false; } else { throw new Exception("Malformed inline block. Method calls are not accepted ..."); } break; } } #if DEBUG Console.WriteLine("[+] Inline block parsed"); #endif } #endregion #region INLINE Marker else if (inlineMarker == name) { #if DEBUG Console.WriteLine("[i] Body {0} has been marked as inline", body.Method.Value); #endif bool parse = true; while (parse && i < n) { inlineCommand = Translator.ToCommand(il[i++]); if (null == inlineCommand) { throw new Exception("Unknown opcode detected."); } i += inlineCommand.ReadParameters(il, i); switch (inlineCommand.OpCode) { case (byte)Op.CallPropertyVoid: name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value])); if (inlineMarker == name) { parse = false; } else { throw new Exception("Malformed inline block. Method calls are not accepted ..."); } break; } } #if DEBUG Console.WriteLine("[+] Inline marker parsed."); #endif patchBody = true; } #endregion #region MAX_STACK Marker else if (inlineMaxStack == name) { #if DEBUG Console.WriteLine("[i] Body {0} has a manual maximum stack set.", body.Method.Value); #endif bool parse = true; uint maxStackValue = 0; bool hasMaxValue = false; while (parse && i < n) { inlineCommand = Translator.ToCommand(il[i++]); if (null == inlineCommand) { throw new Exception("Unknown opcode detected."); } i += inlineCommand.ReadParameters(il, i); switch (inlineCommand.OpCode) { case (byte)Op.PushByte: maxStackValue = (uint)((byte)inlineCommand.Parameters[0]); hasMaxValue = true; break; case (byte)Op.PushShort: maxStackValue = (uint)((U30)inlineCommand.Parameters[0]); hasMaxValue = true; break; case (byte)Op.PushInt: maxStackValue = (uint)((S32)abc.ConstantPool.IntTable[(int)((U30)inlineCommand.Parameters[0]).Value]).Value; hasMaxValue = true; break; case (byte)Op.PushDouble: throw new Exception("Max stack has to be an integer constant."); case (byte)Op.CallPropertyVoid: name = NameUtil.ResolveMultiname(abc, (MultinameInfo)(abc.ConstantPool.MultinameTable[(int)((U30)inlineCommand.Parameters[0]).Value])); if (inlineMaxStack == name) { parse = false; } else { throw new Exception("Malformed inline block. Method calls are not accepted ..."); } break; } } #if DEBUG Console.WriteLine("[+] MaxStack marker parsed."); #endif if (hasMaxValue) { hasManualMaxStack = true; manualMaxStackValue = maxStackValue; } patchBody = true; } #endregion else { instructions.Add(command); } break; default: instructions.Add(command); break; } } if (patchBody) { // // We have to patch this function ... // Note: We do not change the initScopeDepth // #if DEBUG Console.WriteLine("[i] Patching body (id: {0})", bodyId); #endif CompilerAs3c compAs3c = new CompilerAs3c(); compAs3c.Compile(abc, instructions, labels, false); // Now .. only patch if we find a correct stack! U30 maxStack; if (!hasManualMaxStack) { maxStack = ByteCodeAnalyzer.CalcMaxStack(compAs3c.Code); } else { maxStack = (U30)manualMaxStackValue; } if (hasManualMaxStack || 0 == (ByteCodeAnalyzer.Flags & ByteCodeAnalyzer.InvalidStack)) { MethodInfo method = (MethodInfo)abc.Methods[(int)body.Method.Value]; body.MaxStack = maxStack; body.MaxScopeDepth = body.InitScopeDepth + ByteCodeAnalyzer.CalcScopeDepth(compAs3c.Code); U30 minLocalCount = method.ParameterCount; U30 maxLocalCount = ByteCodeAnalyzer.CalcLocalCount(compAs3c.Code); if (maxLocalCount.Value > minLocalCount.Value) { body.LocalCount = ByteCodeAnalyzer.CalcLocalCount(compAs3c.Code); } //else <- we would have unused parameters in a function... body.Code = compAs3c.Code; } else { // // What else? We will display warnings automatically but what about // telling the guy in which function he has an invalid stack? // } #if DEBUG Console.WriteLine("[+] Body patched"); #endif } }
public static U30 GetNamespace(Abc46 abc, string argument) { NamespaceInfo ns; for (int i = 0, n = abc.ConstantPool.NamespaceTable.Count; i < n; ++i) { ns = (NamespaceInfo)abc.ConstantPool.NamespaceTable[i]; string namespaceString = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: namespaceString = "private"; break; case NamespaceInfo.ProtectedNamespace: namespaceString = "protected"; break; case NamespaceInfo.StaticProtectedNs: namespaceString = "protected$"; break; case NamespaceInfo.PackageInternalNs: namespaceString = "internal"; break; case NamespaceInfo.PackageNamespace: namespaceString = "public"; break; default: namespaceString = "*"; break; } namespaceString += "::" + ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if (argument.IndexOf(namespaceString) != -1) { U30 nsIndex = new U30(); nsIndex.Value = (uint)i; return(nsIndex); } } NamespaceInfo newNs = new NamespaceInfo(); string name = ""; byte kind = 0; if (0 == argument.IndexOf("private::")) { kind = NamespaceInfo.PrivateNs; name = argument.Substring(8); } else if (0 == argument.IndexOf("public::")) { kind = NamespaceInfo.PackageNamespace; name = argument.Substring(7); } newNs.Kind = kind; if ("" == name) { newNs.Name = (U30)0; } else { newNs.Name = (U30)abc.ConstantPool.ResolveString(name); } U30 result = new U30(); result.Value = (uint)abc.ConstantPool.NamespaceTable.Count; abc.ConstantPool.NamespaceTable.Add(newNs); return(result); }
protected virtual void FormatAbc(Abc46 abc46) { }
public static U30 GetMultiname(Abc46 abc, string argument) { if (argument.StartsWith("#")) { int index = int.Parse(argument.Substring(1,argument.Length-1)); if (index < abc.ConstantPool.MultinameTable.Count && index > 0) { return (U30)index; } throw new Exception(String.Format("Invalid multiname {0}", index)); } NamespaceInfo ns; NamespaceSetInfo nss; StringInfo name; bool skipQname = argument.IndexOf("[") == 0; if (skipQname) { //BAD quick dirty hack argument = argument.Replace(" ", ""); } string tempName; U30 result = new U30(); for (int i = 1, n = abc.ConstantPool.MultinameTable.Count; i < n; ++i) { MultinameInfo multiName = (MultinameInfo)abc.ConstantPool.MultinameTable[i]; switch (multiName.Kind) { #region QName, QNameA case MultinameInfo.QName: case MultinameInfo.QNameA: if (skipQname) continue; ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)multiName.Data[0].Value]); name = ((StringInfo)abc.ConstantPool.StringTable[(int)multiName.Data[1].Value]); tempName = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: tempName = "private"; break; case NamespaceInfo.ProtectedNamespace: tempName = "protected"; break; case NamespaceInfo.StaticProtectedNs: tempName = "protected$"; break; case NamespaceInfo.PackageInternalNs: tempName = "internal"; break; case NamespaceInfo.PackageNamespace: tempName = "public"; break; default: tempName = "*"; break; } if (0 != ns.Name.Value) { string namespaceName = ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if ("" != namespaceName && tempName != "") tempName += "::"; tempName += namespaceName; } tempName += "::" + name.ToString(); if (tempName == argument) { result.Value = (uint)i; return result; } break; #endregion #region MultinameL, MultinameLA case MultinameInfo.MultinameL: case MultinameInfo.MultinameLA: if (!skipQname) continue; tempName = "["; nss = (NamespaceSetInfo)abc.ConstantPool.NamespaceSetTable[(int)multiName.Data[0].Value]; for (int j = 0, m = nss.NamespaceSet.Count; j < m; ++j) { U30 nssNs = (U30)nss.NamespaceSet[j]; ns = ((NamespaceInfo)abc.ConstantPool.NamespaceTable[(int)nssNs.Value]); string r2 = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: r2 = "private"; break; case NamespaceInfo.ProtectedNamespace: r2 = "protected"; break; case NamespaceInfo.StaticProtectedNs: r2 = "protected$"; break; case NamespaceInfo.PackageInternalNs: r2 = "internal"; break; case NamespaceInfo.PackageNamespace: r2 = "public"; break; default: r2 = "*"; break; } tempName += r2 + "::" + ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if (j != (m-1)) tempName += ","; } tempName += "]"; if (argument == tempName) { result.Value = (uint)i; return result; } break; #endregion default: continue; } } if (skipQname) { #region Create MultinameL // // Create a MultinameL // // Remove [] from argument argument = argument.Substring(1, argument.Length - 2); // Get new NamespaceSet index U30 setIndex = new U30(); setIndex.Value = (uint)abc.ConstantPool.NamespaceSetTable.Count; // Create MultinameInfo MultinameInfo newName = new MultinameInfo(); newName.Data = new U30[1] { setIndex }; newName.Kind = MultinameInfo.MultinameL; // Create NamespaceSet NamespaceSetInfo newSet = new NamespaceSetInfo(); newSet.NamespaceSet = new ArrayList(); abc.ConstantPool.NamespaceSetTable.Add(newSet); for (int i = 0, n = abc.ConstantPool.NamespaceTable.Count; i < n; ++i) { ns = (NamespaceInfo)abc.ConstantPool.NamespaceTable[i]; string r2 = ""; switch (ns.Kind) { case NamespaceInfo.Namespace: case NamespaceInfo.ExplicitNamespace: //TODO implement this //user defined break; case NamespaceInfo.PrivateNs: r2 = "private"; break; case NamespaceInfo.ProtectedNamespace: r2 = "protected"; break; case NamespaceInfo.StaticProtectedNs: r2 = "protected$"; break; case NamespaceInfo.PackageInternalNs: r2 = "internal"; break; case NamespaceInfo.PackageNamespace: r2 = "public"; break; default: r2 = "*"; break; } r2 += "::" + ((StringInfo)abc.ConstantPool.StringTable[(int)ns.Name.Value]).ToString(); if (argument.IndexOf(r2) != -1) { U30 nsIndex = new U30(); nsIndex.Value = (uint)i; newSet.NamespaceSet.Add(nsIndex); } } result.Value = (uint)abc.ConstantPool.MultinameTable.Count; abc.ConstantPool.MultinameTable.Add(newName); #endregion } else { #region Create QName // Create a QName U30 nsIndex = new U30(); if (argument.IndexOf("::") == argument.LastIndexOf("::")) { nsIndex.Value = GetNamespace(abc, argument.Substring(0, argument.LastIndexOf("::") + 2)).Value; } else nsIndex.Value = GetNamespace(abc, argument.Substring(0, argument.LastIndexOf("::"))).Value; MultinameInfo newQName = new MultinameInfo(); newQName.Data = new U30[2] { nsIndex, (U30)abc.ConstantPool.ResolveString(argument.Substring(argument.LastIndexOf("::") + 2)) }; newQName.Kind = MultinameInfo.QName; result.Value = (uint)abc.ConstantPool.MultinameTable.Count; abc.ConstantPool.MultinameTable.Add(newQName); #endregion } return result; }
public Instruction(Abc46 abc, AVM2Command command, List <AVM2Command> arguments) { _cmd = command; _arguments = new List <string>(); for (int i = 0; i < arguments.Count; ++i) { AVM2Command argument = arguments[i]; switch (argument.OpCode) { case (byte)Op.PushByte: _arguments.Add(((byte)argument.Parameters[0]).ToString()); break; case (byte)Op.PushShort: _arguments.Add(((U30)argument.Parameters[0]).Value.ToString()); break; case (byte)Op.PushDouble: _arguments.Add(((double)(abc.ConstantPool.DoubleTable[(int)((U30)argument.Parameters[0])])).ToString()); break; case (byte)Op.PushInt: _arguments.Add(((S32)(abc.ConstantPool.IntTable[(int)((U30)argument.Parameters[0])])).Value.ToString()); Console.WriteLine("My arguments are now: {0}", _arguments); break; case (byte)Op.PushUInt: _arguments.Add(((U32)(abc.ConstantPool.DoubleTable[(int)((U30)argument.Parameters[0])])).Value.ToString()); break; case (byte)Op.PushString: _arguments.Add(((StringInfo)(abc.ConstantPool.StringTable[(int)((U30)argument.Parameters[0])])).ToString()); break; case (byte)Op.GetLocal0: if ((byte)Op.GetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.GetLocal0; } else if ((byte)Op.SetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.SetLocal0; } else { _arguments.Add("0"); } break; case (byte)Op.GetLocal1: if ((byte)Op.GetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.GetLocal1; } else if ((byte)Op.SetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.SetLocal1; } else { _arguments.Add("1"); } break; case (byte)Op.GetLocal2: if ((byte)Op.GetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.GetLocal2; } else if ((byte)Op.SetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.SetLocal2; } else { _arguments.Add("2"); } break; case (byte)Op.GetLocal3: if ((byte)Op.GetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.GetLocal3; } else if ((byte)Op.SetLocal == _cmd.OpCode) { _cmd.OpCode = (byte)Op.SetLocal3; } else { _arguments.Add("3"); } break; case (byte)Op.GetLocal: _arguments.Add(((int)((U30)argument.Parameters[0])).ToString()); break; default: #if DEBUG Console.WriteLine("[-] Parameter type {0} not handled ...", argument.StringRepresentation); #endif break; } } }