Ejemplo n.º 1
0
 public static bool ShouldCheckInstruction(X86InstructionId id)
 {
     return(new List <X86InstructionId> {
         X86InstructionId.X86_INS_CALL,
         X86InstructionId.X86_INS_JAE,
         X86InstructionId.X86_INS_JA,
         X86InstructionId.X86_INS_JBE,
         X86InstructionId.X86_INS_JB,
         X86InstructionId.X86_INS_JCXZ,
         X86InstructionId.X86_INS_JECXZ,
         X86InstructionId.X86_INS_JE,
         X86InstructionId.X86_INS_JGE,
         X86InstructionId.X86_INS_JG,
         X86InstructionId.X86_INS_JL,
         X86InstructionId.X86_INS_JMP,
         X86InstructionId.X86_INS_JNO,
         X86InstructionId.X86_INS_JNP,
         X86InstructionId.X86_INS_JNS,
         X86InstructionId.X86_INS_JO,
         X86InstructionId.X86_INS_JP,
         X86InstructionId.X86_INS_JRCXZ,
         X86InstructionId.X86_INS_JS,
         X86InstructionId.X86_INS_PUSH,
         X86InstructionId.X86_INS_PUSHAL,
         X86InstructionId.X86_INS_PUSHAW,
         X86InstructionId.X86_INS_PUSHF,
         X86InstructionId.X86_INS_PUSHFD,
         X86InstructionId.X86_INS_PUSHFQ,
         X86InstructionId.X86_INS_MOV,
     }.Contains(id));
 }
Ejemplo n.º 2
0
        private void ps4KernelDlSymRetrieveSymbols(Byte[] buffer)
        {
            using (CapstoneX86Disassembler disassembler = CapstoneDisassembler.CreateX86Disassembler(X86DisassembleMode.Bit64))
            {
                disassembler.EnableInstructionDetails = true;
                disassembler.DisassembleSyntax        = DisassembleSyntax.Intel;
                //disassembler.EnableSkipDataMode = true;
                X86Instruction[] instructions = disassembler.Disassemble(buffer);
                int i = 0;
                foreach (X86Instruction instruction in instructions)
                {
                    i++;
                    X86Instruction   lastInsn         = (i > 1) ? instructions[i - 2] : null;
                    long             address          = instruction.Address;
                    X86InstructionId id               = instruction.Id;
                    String           curr_instruction = GetInstructionTxt(instruction);
                    String           last_instruction = GetInstructionTxt(lastInsn);

                    //if (address == 0x14362)
                    // MessageBox.Show(curr_instruction);

                    if (!instruction.IsSkippedData)
                    {
                        String ps4KernelDlSym = GetMemoryAddress((UInt64)ps4KernelDlSym_offset).ToString("x");
                        //if (instruction.Operand.Contains(ps4KernelDlSym))
                        //  MessageBox.Show("call to ps4KernelDlSym: " + curr_instruction);
                        //if(id == X86InstructionId.X86_INS_MOVABS)
                        //  MessageBox.Show("moveabs: " + curr_instruction);
                        //MessageBox.Show(ps4KernelDlSym);

                        if (instruction.Operand.Contains(ps4KernelDlSym) && id == X86InstructionId.X86_INS_MOVABS)
                        {
                            String ps4KernelDlSym_call = instructions[i + 1].Operand;//instructions[i + 1].Id == X86InstructionId.X86_INS_CALL ?
                            string last_operand        = lastInsn.Operand;
                            if (lastInsn.Id == X86InstructionId.X86_INS_MOVABS)
                            {
                                String symbolReg  = "";
                                var    symbolName = ParseSymbolReference(lastInsn, out symbolReg);
                                if (symbolName != "")
                                {
                                    sympool.Add(lastInsn.Address, symbolName);//ps4KernelDlSym_Symbols.Add(symbolName);
                                }
                                // after we have got a symbol, find for near ps4KernelDlSym references
                                var targetReg   = instructions[i].Operand;
                                var targetBytes = instructions[i].Bytes;
                                //MessageBox.Show(targetReg);
                                //MessageBox.Show(GetInstructionTxt(instructions[i+1]));
                                for (int x = i + 2; x < instructions.Count(); x++)
                                {
                                    var instruct = instructions[x];
                                    if (instruct == null || instruct.IsSkippedData || instruct.Id == X86InstructionId.X86_INS_RET || instruct.Id == X86InstructionId.X86_INS_MOVABS & instruct.Operand.Split(',')[0] == targetReg)//GetInstructionTxt(instruct).Contains("ret"))
                                    {
                                        break;
                                    }

                                    if (instruct.Id == X86InstructionId.X86_INS_CALL)// && instruct.Operand == ps4KernelDlSym_call.Split(',')[0])
                                    {
                                        //MessageBox.Show(GetInstructionTxt(instruct));
                                        //MessageBox.Show(instruct.Operand + "\n\n" + ps4KernelDlSym_call);
                                        var reg          = instruct.Operand;
                                        var prev_sym_reg = symbolReg;
                                        if (reg == targetReg & (symbolName = ParseSymbolReference(instructions[x - 1], out symbolReg)) != "")
                                        {
                                            if (targetBytes.SequenceEqual(instruct.Bytes))//if ((symbolName = ParseSymbolReference(instructions[x - 1], out symbolReg)) != "")
                                            {
                                                if (symbolReg == prev_sym_reg)
                                                {
                                                    sympool.Add(instructions[x - 1].Address, symbolName);

                                                    /*
                                                     * var addr = GetMemoryAddress((ulong)instructions[x - 1].Address) - 0x1000;
                                                     * Clipboard.SetText(addr.ToString("X2"));
                                                     * MessageBox.Show("Addr: " + addr.ToString("X2") + ", " + symbolName + "\n\n" + GetInstructionTxt(instructions[x-1]));
                                                     */
                                                }
                                                //MessageBox.Show(last_instruction + "\n" + curr_instruction + "\n\n" + GetInstructionTxt(instructions[x-1]) + "\n" + GetInstructionTxt(instruct), "Near " + symbolName);
                                            }
                                        }
                                        //MessageBox.Show(curr_instruction + "\n" + GetInstructionTxt(instruct));
                                    }
                                    //MessageBox.Show(last_instruction + "\n" + curr_instruction + "\n\n" + targetReg);
                                }
                            }

                            /*else if (id == X86InstructionId.X86_INS_CALL)
                             * {
                             *  MessageBox.Show(last_instruction + "\n" + curr_instruction);
                             * }*/
                        }
                    }
                }
            }
        }