private static void CodeHookCallback( CapstoneDisassembler <X86Instruction, X86Register, X86InstructionGroup, X86InstructionDetail> disassembler, Unicorn u, Int64 addr, Int32 size, Object userData) { Console.Write("[+] 0x{0}: ", addr.ToString("X")); var eipBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_EIP, eipBuffer); var effectiveSize = Math.Min(16, size); var tmp = new Byte[effectiveSize]; u.MemRead(addr, tmp); var sb = new StringBuilder(); foreach (var t in tmp) { sb.AppendFormat("{0} ", (0xFF & t).ToString("X")); } Console.Write("{0,-20}", sb); Console.WriteLine(Utils.Disassemble(disassembler, tmp)); }
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData) { // only handle Linux syscall if (intNumber != 0x80) { return; } var eaxBuffer = new Byte[4]; var eipBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer); u.RegRead(X86.UC_X86_REG_EIP, eipBuffer); var eax = Utils.ToInt(eaxBuffer); var eip = Utils.ToInt(eipBuffer); switch (eax) { default: Console.WriteLine("[!] Interrupt 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X")); break; case 1: // sys_exit Console.WriteLine("[!] Interrupt 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X")); u.EmuStop(); break; case 4: // sys_write // ECX = buffer address var ecxBuffer = new Byte[4]; // EDX = buffer size var edxBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer); u.RegRead(X86.UC_X86_REG_EDX, edxBuffer); var ecx = Utils.ToInt(ecxBuffer); var edx = Utils.ToInt(edxBuffer); // read the buffer in var size = Math.Min(256, edx); var buffer = new Byte[size]; u.MemRead(ecx, buffer); var content = Encoding.Default.GetString(buffer); Console.WriteLine( "[!] Interrupt 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'", eip.ToString("X"), ecx.ToString("X"), edx.ToString("X"), content); break; } }
private static void CodeHookCallback(Unicorn u, UInt64 addr, Int32 size, Object userData) { Console.Write("Tracing >>> 0x{0} ", addr.ToString("X")); var eipBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_EIP, eipBuffer); var effectiveSize = Math.Min(16, size); var tmp = new Byte[effectiveSize]; u.MemRead(addr, tmp); foreach (var t in tmp) { Console.Write("{0} ", (0xFF & t).ToString("X")); } Console.WriteLine(); }
private static void CodeHookCallback(Unicorn u, UInt64 addr, Int32 size, Object userData) { Console.Write("Tracing >>> 0x{0} ", addr.ToString("X")); var eipBuffer = new Byte[4]; Utils.CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer)); var effectiveSize = Math.Min(16, size); var tmp = new Byte[effectiveSize]; Utils.CheckError(u.MemRead(addr, tmp)); foreach (var t in tmp) { Console.Write("{0} ", (0xFF & t).ToString("X")); } Console.WriteLine(); }
private static void InterruptHookCallback(Unicorn u, Int32 intNumber, Object userData) { // only handle Linux syscall if (intNumber != 0x80) { return; } var eaxBuffer = new Byte[4]; var eipBuffer = new Byte[4]; Utils.CheckError(u.RegRead(X86.UC_X86_REG_EAX, eaxBuffer)); Utils.CheckError(u.RegRead(X86.UC_X86_REG_EIP, eipBuffer)); var eax = Utils.ToInt(eaxBuffer); var eip = Utils.ToInt(eipBuffer); switch (eax) { default: Console.WriteLine("Interrupt >>> 0x{0} num {1}, EAX=0x{2}", eip.ToString("X"), intNumber.ToString("X"), eax.ToString("X")); break; case 1: // sys_exit Console.WriteLine("Interrupt >>> 0x{0} num {1}, SYS_EXIT", eip.ToString("X"), intNumber.ToString("X")); u.EmuStop(); break; case 4: // sys_write // ECX = buffer address var ecxBuffer = new Byte[4]; // EDX = buffer size var edxBuffer = new Byte[4]; Utils.CheckError(u.RegRead(X86.UC_X86_REG_ECX, ecxBuffer)); Utils.CheckError(u.RegRead(X86.UC_X86_REG_EDX, edxBuffer)); var ecx = Utils.ToInt(ecxBuffer); var edx = Utils.ToInt(edxBuffer); // read the buffer in var size = Math.Min(256, edx); var buffer = new Byte[size]; Utils.CheckError(u.MemRead(ecx, buffer)); var content = Encoding.Default.GetString(buffer); Console.WriteLine( "Interrupt >>> 0x{0}: num {1}, SYS_WRITE. buffer = 0x{2}, size = , content = '{3}'", eip.ToString("X"), ecx.ToString("X"), edx.ToString("X"), content); break; } }
private static void CodeHookCallback( CapstoneDisassembler<X86Instruction, X86Register, X86InstructionGroup, X86InstructionDetail> disassembler, Unicorn u, Int64 addr, Int32 size, Object userData) { Console.Write("[+] 0x{0}: ", addr.ToString("X")); var eipBuffer = new Byte[4]; u.RegRead(X86.UC_X86_REG_EIP, eipBuffer); var effectiveSize = Math.Min(16, size); var tmp = new Byte[effectiveSize]; u.MemRead(addr, tmp); var sb = new StringBuilder(); foreach (var t in tmp) { sb.AppendFormat("{0} ", (0xFF & t).ToString("X")); } Console.Write("{0,-20}", sb); Console.WriteLine(Utils.Disassemble(disassembler, tmp)); }