private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData) { // only handle Linux syscall if (intNumber != 0x80) { return; } var eaxBuffer = new Byte[4]; var eipBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer); u.RegRead(X86.UC_X86_REG_EIP, eipBuffer); var eax = Utils.ToInt(eaxBuffer); var eip = Utils.ToInt(eipBuffer); switch (eax) { default: Console.WriteLine("[!] Interrupt 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X")); break; case 1: // sys_exit Console.WriteLine("[!] Interrupt 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X")); u.EmuStop(); break; case 4: // sys_write // ECX = buffer address var ecxBuffer = new Byte[4]; // EDX = buffer size var edxBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer); u.RegRead(X86.UC_X86_REG_EDX, edxBuffer); var ecx = Utils.ToInt(ecxBuffer); var edx = Utils.ToInt(edxBuffer); // read the buffer in var size = Math.Min(256, edx); var buffer = new Byte[size]; u.MemRead(ecx, buffer); var content = Encoding.Default.GetString(buffer); Console.WriteLine( "[!] Interrupt 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'", eip.ToString("X"), ecx.ToString("X"), edx.ToString("X"), content); break; } }
private static void SyscallHookCallback(Unicorn u, Object userData) { var eaxBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer); var eax = Utils.ToInt(eaxBuffer); Console.WriteLine("[!] Syscall EAX = 0x{0}", eax.ToString("X")); u.EmuStop(); }
private static void SyscallHookCallback(Unicorn u, Object userData) { var eaxBuffer = new Byte[4]; Utils.CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer)); var eax = Utils.ToInt(eaxBuffer); Console.WriteLine("Syscall >>> EAX = 0x{0}", eax.ToString("X")); u.EmuStop(); }
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData) { // only handle Linux syscall if (intNumber != 0x80) { return; } var eaxBuffer = new Byte[4]; var eipBuffer = new Byte[4]; Utils.CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer)); Utils.CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer)); var eax = Utils.ToInt(eaxBuffer); var eip = Utils.ToInt(eipBuffer); switch (eax) { default: Console.WriteLine("Interrupt >>> 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X")); break; case 1: // sys_exit Console.WriteLine("Interrupt >>> 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X")); u.EmuStop(); break; case 4: // sys_write // ECX = buffer address var ecxBuffer = new Byte[4]; // EDX = buffer size var edxBuffer = new Byte[4]; Utils.CheckError(u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer)); Utils.CheckError(u.RegRead(X86.UC_X86_REG_EDX, edxBuffer)); var ecx = Utils.ToInt(ecxBuffer); var edx = Utils.ToInt(edxBuffer); // read the buffer in var size = Math.Min(256, edx); var buffer = new Byte[size]; Utils.CheckError(u.MemRead(ecx, buffer)); var content = Encoding.Default.GetString(buffer); Console.WriteLine( "Interrupt >>> 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'", eip.ToString("X"), ecx.ToString("X"), edx.ToString("X"), content); break; } }