示例#1
0
        public static void a()
        {
            UTokenSp.Activate();
            AAsmTools.InitTools(new ASymbolHandler());
            var m = AAsmTools.SelfSymbolHandler.Process;

            AAsmTools.SymbolHandler.Process = m;
            var aa = AAsmTools.AutoAssembler;

            var cc   = @"
[ENABLE]
alloc(func, $1000)
registersymbol(func)

func:
mov eax, ecx
add dword ptr[data], eax
mov eax, dword ptr[data]
ret

data:
    db 00 00 00 00

[DISABLE]
unregistersymbol(func)
            ".Trim();
            var code = new ARefStringArray();

            code.Assign(UStringUtils.GetLines(cc).ToArray());
            aa.RemoveComments(code);
            var scr  = new AScriptBytesArray();
            var info = new ADisableInfo();
            var ret  = aa.AutoAssemble(m, code, false, true, false, false, info, false, scr);

            Console.WriteLine("Result: " + ret);

            var procAddress = AAsmTools.SymbolHandler.GetUserDefinedSymbolByName("func");

            Console.WriteLine("Symbol: " + procAddress.ToUInt64().ToString("X"));

            iTest = (ITest)Marshal.GetDelegateForFunctionPointer(procAddress.ToIntPtr(), typeof(ITest));

            Console.WriteLine(iTest.Invoke(1));


            Console.ReadKey();
            Environment.Exit(1);
        }
示例#2
0
        static void Main(string[] args)
        {
            //test.a();
            //var Brackets = new ACharArray('(', ')', '[', ']', '{', '}');
            //var StdWordDelims = new ACharArray(',', '.', ';', '/', '\\', ':', '\'', '"', '`', '(', ')', '[', ']', '{', '}');
            //StdWordDelims.AddRange(Brackets.TakeAll());
            //StdWordDelims.AddRange(ACharUtils.Range('\0', ' ').TakeAll());
            //
            //Console.WriteLine("done");

            var m = new AProcessSharp(System.Diagnostics.Process.GetProcessesByName("pacwin")[0], AMemoryType.Remote);

            UTokenSp.Activate();
            AAsmTools.InitTools(new ASymbolHandler());
            AAsmTools.SymbolHandler.Process = m;
            var a  = AAsmTools.Assembler;
            var b1 = new AByteArray();

            //var m2 = new AProcessSharp(System.Diagnostics.Process.GetCurrentProcess(), AMemoryType.Remote);
            a.SymbolHandler.Process = m;
            var aa = AAsmTools.AutoAssembler;
            //var result = a.Assemble("mov eax, [edx+esi+66]", 0x400300, b1); // E9 FB 01 00 00
            //var result = a.Assemble("mov rax,[1122334455778899]", 0x400300, b1); // E9 FB 01 00 00
            //Console.WriteLine("Result: " + result);
            //Console.WriteLine("Bytes:");
            //Console.WriteLine(UBinaryUtils.Expand(b1.TakeAll()));
            //
            //
            var d = AAsmTools.Disassembler;
            //var sd = "";
            //using (var pt = new UBytePtr(b1.TakeAll()))
            //{
            //    var ptt = pt.ToIntPtr().ToUIntPtr();
            //    d.Disassemble(ref ptt, ref sd);
            //}
            //Console.WriteLine(d.LastDisassembleData.Prefix + ' ' + d.LastDisassembleData.OpCode + ' ' + d.LastDisassembleData.Parameters);

            var bi = AAsmTools.ByteInterpreter;
            var bp = m.Memory.Read((IntPtr)0x411C88, 32);

            using (var bip = new UBytePtr(bp))
            {
                Console.WriteLine("Found dataType: " + bi.FindTypeOfData((UIntPtr)0x411C88, bip, 8));
                Console.WriteLine("Found dataType: " + bi.DataToString(bp, 8, AVariableType.Double));
            }

            // aa.Assembler.SymHandler.Process = m;
            // var cd = @"
            // 400300:
            // mov rax, [411c88]
            // mov rax, dword ptr[11223344556677]
            // ".Trim();
            // var codex = new ARefStringArray();
            // codex.Assign(UStringUtils.GetLines(cd).ToArray());
            // aa.RemoveComments(codex);
            //
            // var b = aa.Assemble(aa.SelfSymbolHandler.Process, codex);
            d.IsDataOnly = false;
            // d.Is64Bit = true;
            // d.SymbolHandler.Process = m;
            var s1 = "";
            // var bytes = new UBytePtr(b[0].Bytes.TakeAll());
            // //var ptr = bytes.ToIntPtr().ToUIntPtr();
            //
            var ptr = (UIntPtr)0x40230F;
            var i   = 30;

            while (i-- > 0)
            {
                try
                {
                    var dis = d.Disassemble(ref ptr, ref s1);
                    var cl  = d.LastDisassembleData.Prefix + ' ' + d.LastDisassembleData.OpCode + ' ' + d.LastDisassembleData.Parameters;
                    var dec = d.DecodeLastParametersToString();
                    //Console.WriteLine(cl + " ; " + dec);
                    d.SplitDisassembledString(dis, false, out var address, out var bytes, out var opcode, out var special);
                    Console.WriteLine($"0x{address.PadRight(8)} {bytes.PadRight(20)} {opcode} {special} ; {dec}");
                }
                catch (Exception e)
                {
                    Console.WriteLine("Error " + e.Message);
                    Console.WriteLine(e.Source);
                    Console.WriteLine(e.StackTrace);
                    break;
                }
            }
            // Console.ReadKey();
            // Environment.Exit(1);



            a.SymbolHandler.Process = m;

            var cc   = @"
[ENABLE]
400300:
mov edx, dword ptr[411c88]
reassemble(40230f);
reassemble(pacwin.exe+2379);
cat:
reassemble(pacwin.exe+237C);
call messageboxa
jmp cat


400314:
[DISABLE]
            ".Trim();
            var code = new ARefStringArray();

            code.Assign(UStringUtils.GetLines(cc).ToArray());
            aa.RemoveComments(code);
            var scr  = new AScriptBytesArray();
            var info = new ADisableInfo();
            var ret  = aa.AutoAssemble(m, code, false, true, false, false, info, false, scr);

            Console.WriteLine("Loaded 2");
            Console.WriteLine("Result: " + ret);
            aa.AutoAssemble(m, code, false, true, false, false, info, true, scr);
            Console.WriteLine("Loaded 3");
            foreach (var o in scr)
            {
                Console.WriteLine("Line: " + o.Type + " " + o.Address.ToUInt64().ToString("X") + " " + AStringUtils.BinToHexStr(o.Bytes.TakeAll()));
            }

            // var f = new AAssemblyFactory(m, new ASharpAsm());
            // f.Inject(
            //     new[]
            //     {
            //         "mov, eax 7",
            //         "push 0",
            //         "add esp, 4",
            //         "retn"
            //     },
            //     (IntPtr) 0x400310);
            //
            // var v = f.Execute<int>((IntPtr)0x400310);
            // Console.WriteLine("Return: " + v);


            //f.InjectAndExecute(
            //    new[]
            //    {
            //        "alloc(storage, 1000)",
            //        "label(caption)",
            //        "label(message)",
            //        "push 0",
            //        "push caption",
            //        "push message",
            //        "push 0",
            //        "call MessageBoxA",
            //        "push 0",
            //        "add esp, 4",
            //        "retn",
            //        // storage zone
            //        "storage:",
            //        "caption:",
            //        "    db 'caption', 00",
            //        "message:",
            //        "    db 'message', 00",
            //    },
            //    (IntPtr)0x400300);

            Console.ReadKey();
            //aa.AutoAssemble(m, code, false, false, false, false, info, false, scr);
            Environment.Exit(1);
        }