예제 #1
0
        public Argument(PythonBoss pyBoss, long address, PythonDictionary spec, Process process, int depth, Arguments parent, string namePrefix)
        {
            Address = address;
            this.process = process;
            _pyBoss = pyBoss;
            _parent = parent;
            NamePrefix = namePrefix;

            // Parse the spec for this argument
            // stackspec: [{"name": "socket",
            //		      "size": 4,
            //		      "type": None,
            //		      "fuzz": NOFUZZ,
            //            "type_args": None},]

            Fuzz = (bool)spec.get("fuzz");
            Name = (string)spec.get("name");
            _argumentType = (object)spec.get("type");
            if ( spec.ContainsKey("type_args") )
            {
                _typeArgs = spec.get("type_args");
            }

            // Validate required fields
            if (Name == null)
                throw new Exception("ERROR: Argument specification must include 'name' attribute. Failed when parsing name prefix '" + namePrefix + "'.");
            else if (Fuzz == null)
                throw new Exception("ERROR: Argument specification must include 'fuzz' attribute. Failed when parsing type '" + namePrefix + Name + "'.");
            else if (spec.get("size") == null)
                throw new Exception("ERROR: Argument specification must include 'size' attribute. Failed when parsing type '" + namePrefix + Name + "'.");

            if (spec.get("size") is string)
            {
                object sizeArgument = null;
                if (parent.TryGetMemberSearchUp((string)spec.get("size"), out sizeArgument))
                    Size = ((Argument)sizeArgument).ToInt();
                else
                    throw new Exception("ERROR: Unable to load size for type '" + Name + "' from parent member named '" + (string)spec.get("size") + "'. Please make sure this field exists in the parent.");
            }
            else if (spec.get("size") is int)
            {
                Size = (int)spec.get("size");
            }
            else
            {
                throw new Exception("ERROR: Unable to load size for type '" + Name + "'. The size must be of type 'int' or type 'string'. Size is type: '" + spec.get("size").ToString() + "'" );
            }

            // Read the data
            try
            {
                Data = MemoryFunctions.ReadMemory(process.ProcessDotNet, address, (uint)Size);
            }
            catch (Exception e)
            {
                Data = null;
            }

            PointerTarget = null;
        }
예제 #2
0
파일: Target.cs 프로젝트: Zinterax/meddle
 public Target(object targetClass, PythonBoss pyBoss, Process process)
 {
     _targetClass = targetClass;
     _process = process;
     _pyBoss = pyBoss;
     _breakpoints = new List<Breakpoint>(1);
     _name = Target.GetName(targetClass);
 }
예제 #3
0
 public Breakpoint(Process process, IntPtr address, Target target, string name)
 {
     _process = process;
     _address = address;
     _targets = new List<Target>(1);
     Names = new List<string>(1);
     _targets.Add(target);
     Names.Add(name);
     SetBreakpoint();
 }
예제 #4
0
파일: Context.cs 프로젝트: Zinterax/meddle
 public Context(Process process)
 {
     isContext64 = process.IsWin64;
     if (process.IsWin64)
     {
         context64 = new CONTEXT();
         context64.ContextFlags = CONTEXT_FLAGS.CONTEXT_ALL;
     }
     else
     {
         context32 = new Context32();
         context32.ContextFlags = CONTEXT_FLAGS.CONTEXT_ALL;
     }
 }
예제 #5
0
 public bool AttachProcess(dynamic pyProcess)
 {
     try
     {
         // Add this process
         Process newProcess = new Process(_pyBoss, this, pyProcess);
         return true;
     }
     catch (Exception e)
     {
         Console.WriteLine("ERROR: An unknown error occured while processing Controller.AddProcess(). Plase check that the argument inputs were correct.");
         Console.WriteLine(e);
     }
     return false;
 }
예제 #6
0
파일: Context.cs 프로젝트: Zinterax/meddle
 public Context(Process process, IntPtr hThread)
 {
     isContext64 = process.IsWin64;
     if (process.IsWin64)
     {
         context64 = new CONTEXT();
         context64.ContextFlags = CONTEXT_FLAGS.CONTEXT_ALL;
     }
     else
     {
         context32 = new Context32();
         context32.ContextFlags = CONTEXT_FLAGS.CONTEXT_ALL;
     }
     GetContext(hThread);
     //if (!GetContext(hThread))
     //  throw new Exception("Failed to GetContext(), get last error: " + Debugger.GetLastError().ToString());
 }
예제 #7
0
        public Arguments(PythonBoss pyBoss, long address, List specs, Process process, int depth, Argument parent, string namePrefix)
        {
            NamePrefix = namePrefix;
            _process = process;
            _address = address;
            _pyBoss = pyBoss;
            _depth = depth;
            _parent = parent;
            _args = new List<Argument>(specs.Count);
            _arg_offsets = new List<long>(specs.Count);

            // Handle the case of infinite recursion
            if (depth > 1000)
                throw new Exception("Error when processing argument types: An infinite loop has been detected, this is caused by a type somehow including a pointer to itself. Name: " + namePrefix);

            ParseCurrentLevel(specs);
            ParseNextLevel();
        }
예제 #8
0
        public Shellcode(XDocument description, Process process)
        {
            _process = process;
            _code = null;
            IsWin64 = process.IsWin64;

            // Load the xml description
            parse(description);
        }
예제 #9
0
        public bool Assemble(Shellcode parent, Process process, string instruction, UInt64 offset)
        {
            // Parse this instruction if there is one
            Offset = offset;
            Size = 0;
            Data = null;
            HasVariable = false;
            VariableIsOffset = false;
            FullyAssembled = false;
            VariableName = "";

            string[] fields = instruction.Split(new char[] { ' ', '\t', ',' }, StringSplitOptions.RemoveEmptyEntries);

            if (fields.Length == 1 && fields.Contains(":"))
            {
                // This is a label. Add it as a variable.
                parent.SetVariable(fields[0].Replace(":", ""), offset);
                FullyAssembled = true;
            }
            else
            {
                // Load the opcode and operands
                string opcode = fields[0];
                List<Operand> operands = new List<Operand>(fields.Length - 1);
                for (int i = 1; i < fields.Length; i++)
                    operands.Add(new Operand(fields[i]));

                // Assemble the instruction now
                byte[] bytes;
                if (operands.Count < 1)
                {
                    OpcodeAssembler builder = AssemblyDefines.OpcodeAssemblers[new OpcodeDescriptor(opcode)];
                    bytes = builder.Assemble(out FullyAssembled, parent);
                }
                else if (operands.Count < 2)
                {
                    OpcodeAssembler builder = AssemblyDefines.OpcodeAssemblers[new OpcodeDescriptor(opcode, operands[0])];
                    bytes = builder.Assemble(operands[0], out FullyAssembled, parent);
                }
                else
                {
                    OpcodeAssembler builder = AssemblyDefines.OpcodeAssemblers[new OpcodeDescriptor(opcode, operands[0], operands[1])];
                    bytes = builder.Assemble(operands[0], operands[1], out FullyAssembled, parent);
                }

                Data = bytes;
                this.Size = bytes.Length;
            }

            return FullyAssembled;
        }
예제 #10
0
 public Instruction(Shellcode parent, Process process, string instruction, UInt64 offset)
 {
     Assemble( parent, process, instruction, offset);
 }