Module il_reil
[hide private]
[frames] | no frames]

Source Code for Module il_reil

  1  # This file is part of Androguard. 
  2  # 
  3  # Copyright (C) 2010, Anthony Desnos <desnos at t0t0.org> 
  4  # All rights reserved. 
  5  # 
  6  # Androguard is free software: you can redistribute it and/or modify 
  7  # it under the terms of the GNU Lesser General Public License as published by 
  8  # the Free Software Foundation, either version 3 of the License, or 
  9  # (at your option) any later version. 
 10  # 
 11  # Androguard is distributed in the hope that it will be useful, 
 12  # but WITHOUT ANY WARRANTY; without even the implied warranty of   
 13  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the 
 14  # GNU Lesser General Public License for more details. 
 15  # 
 16  # You should have received a copy of the GNU Lesser General Public License 
 17  # along with Androguard.  If not, see <http://www.gnu.org/licenses/>. 
 18   
 19  import random, string 
 20  import opaque 
 21   
 22  REIL_TYPE_REGISTER = 0 
 23  REIL_TYPE_LITERAL = 1 
 24  REIL_TYPE_OFFSET = 2 
 25   
26 -class REIL_REGISTER :
27 - def __init__(self, name, size=4, value=0) :
28 self.__name = name 29 self.__size = size 30 self.__type = REIL_TYPE_REGISTER 31 self.__value = value
32
33 - def get_name(self) :
34 return self.__name
35
36 - def get_size(self) :
37 return self.__size
38
39 - def get_type(self) :
40 return self.__type
41
42 - def get_value(self) :
43 return self.__value
44
45 - def get_str(self) :
46 return "%s (%d)" % (self.__name, self.__size)
47
48 -class REIL_LITERAL :
49 - def __init__(self, value, size=4) :
50 self.__value = value 51 self.__size = size 52 self.__type = REIL_TYPE_LITERAL
53
54 - def get_value(self) :
55 return self.__value
56
57 - def get_size(self) :
58 return self.__size
59
60 - def get_type(self) :
61 return self.__type
62
63 - def get_str(self) :
64 return "0x%x (%d)" % (self.__value, self.__size)
65
66 -class REIL_OFFSET :
67 - def __init__(self, value, size=4) :
68 self.__value = value 69 self.__size = size 70 self.__type = REIL_TYPE_OFFSET
71
72 - def get_value(self) :
73 return self.__value
74
75 - def get_size(self) :
76 return self.__size
77
78 - def get_type(self) :
79 return self.__type
80
81 - def get_str(self) :
82 return "0x%x (%d)" % (self.__value, self.__size)
83
84 -class REIL_BASE(object) :
85 - def get_registers(self) :
86 l = [] 87 88 if isinstance( self.rcv0, REIL_REGISTER ) : 89 l.append( self.rcv0 ) 90 91 92 if isinstance( self.rcv1, REIL_REGISTER ) : 93 l.append( self.rcv1 ) 94 95 if isinstance( self.rcvout, REIL_REGISTER ) : 96 l.append( self.rcvout ) 97 98 return l
99
100 - def get_size(self) :
101 return 1
102
103 - def get_name(self) :
104 return self.name
105
106 - def view(self) :
107 if self.rcv0 == None and self.rcv1 == None and self.rcvout == None : 108 print "%s ( , , , )" % (self.name) 109 elif self.rcv1 == None : 110 print "%s ( %s, , %s )" % (self.name, self.rcv0.get_str(), self.rcvout.get_str()) 111 else : 112 print "%s ( %s, %s, %s )" % (self.name, self.rcv0.get_str(), self.rcv1.get_str(), self.rcvout.get_str())
113
114 -class REIL_ADD(REIL_BASE) :
115 - def __init__(self, rcv0, rcv1, rcvout) :
116 self.name = "ADD" 117 118 self.rcv0 = rcv0 119 self.rcv1 = rcv1 120 self.rcvout = rcvout
121
122 -class REIL_AND(REIL_BASE) :
123 - def __init__(self, rcv0, rcv1, rcvout) :
124 self.name = "AND" 125 126 self.rcv0 = rcv0 127 self.rcv1 = rcv1 128 self.rcvout = rcvout
129
130 -class REIL_BISZ(REIL_BASE) :
131 - def __init__(self, rcv0, rcvout) :
132 self.name = "BISZ" 133 134 self.rcv0 = rcv0 135 self.rcv1 = None 136 self.rcvout = rcvout
137
138 -class REIL_BRSH(REIL_BASE) :
139 - def __init__(self, rcv0, rcv1, rcvout) :
140 self.name = "BRSH" 141 142 self.rcv0 = rcv0 143 self.rcv1 = rcv1 144 self.rcvout = rcvout
145
146 -class REIL_BLSH(REIL_BASE) :
147 - def __init__(self, rcv0, rcv1, rcvout) :
148 self.name = "BLSH" 149 150 self.rcv0 = rcv0 151 self.rcv1 = rcv1 152 self.rcvout = rcvout
153
154 -class REIL_DIV(REIL_BASE) :
155 - def __init__(self, rcv0, rcv1, rcvout) :
156 self.name = "DIV" 157 158 raise("OOPS")
159
160 -class REIL_JCC(REIL_BASE) :
161 - def __init__(self, rcv0, rcvout) :
162 self.name = "JCC" 163 164 self.rcv0 = rcv0 165 self.rcv1 = None 166 self.rcvout = rcvout
167
168 -class REIL_LDM(REIL_BASE) :
169 - def __init__(self, rcv0, rcvout) :
170 self.name = "LDM" 171 172 self.rcv0 = rcv0 173 self.rcv1 = None 174 self.rcvout = rcvout
175
176 -class REIL_MOD(REIL_BASE) :
177 - def __init__(self, rcv0, rcv1, rcvout) :
178 self.name = "MOD" 179 180 self.rcv0 = rcv0 181 self.rcv1 = rcv1 182 self.rcvout = rcvout
183
184 -class REIL_MUL(REIL_BASE) :
185 - def __init__(self, rcv0, rcv1, rcvout) :
186 self.name = "MUL" 187 188 self.rcv0 = rcv0 189 self.rcv1 = rcv1 190 self.rcvout = rcvout
191
192 -class REIL_NOP(REIL_BASE) :
193 - def __init__(self) :
194 self.name = "NOP" 195 196 self.rcv0 = None 197 self.rcv1 = None 198 self.rcvout = None
199
200 -class REIL_OR(REIL_BASE) :
201 - def __init__(self, rcv0, rcv1, rcvout) :
202 self.name = "OR" 203 204 self.rcv0 = rcv0 205 self.rcv1 = rcv1 206 self.rcvout = rcvout
207
208 -class REIL_STM(REIL_BASE) :
209 - def __init__(self, rcv0, rcvout) :
210 self.name = "STM" 211 212 self.rcv0 = rcv0 213 self.rcv1 = None 214 self.rcvout = rcvout
215
216 -class REIL_STR(REIL_BASE) :
217 - def __init__(self, rcv0, rcvout) :
218 self.name = "STR" 219 220 self.rcv0 = rcv0 221 self.rcv1 = None 222 self.rcvout = rcvout
223
224 -class REIL_SUB(REIL_BASE) :
225 - def __init__(self, rcv0, rcv1, rcvout) :
226 self.name = "SUB" 227 228 self.rcv0 = rcv0 229 self.rcv1 = rcv1 230 self.rcvout = rcvout
231
232 -class REIL_UNDEF(REIL_BASE) :
233 - def __init__(self) :
234 self.name = "UNDEF" 235 236 self.rcv0 = None 237 self.rcv1 = None 238 self.rcvout = None
239
240 -class REIL_UNKN(REIL_BASE) :
241 - def __init__(self) :
242 self.name = "UNKN" 243 244 self.rcv0 = None 245 self.rcv1 = None 246 self.rcvout = None
247
248 -class REIL_XOR(REIL_BASE) :
249 - def __init__(self, rcv0, rcv1, rcvout) :
250 self.name = "XOR" 251 252 self.rcv0 = rcv0 253 self.rcv1 = rcv1 254 self.rcvout = rcvout
255
256 -def INIT_VAR(l) :
257 return [ REIL_STR( REIL_LITERAL(i.get_value(), i.get_size()), i) for i in l ]
258
259 -class BPTR :
260 - def __init__(self, prng) :
261 self.__RI = [] 262 263 var_j = REIL_REGISTER( "j", 4, 0 ) 264 var_germe = REIL_REGISTER( "GERME", 4, prng["GERME"] ) 265 var_a = REIL_REGISTER( "A", 4, prng["A"] ) 266 var_c = REIL_REGISTER( "C", 4, prng["C"] ) 267 var_m = REIL_REGISTER( "M", 4, prng["M"] ) 268 var_iter = REIL_REGISTER( "ITER", 4, prng["ITER"] ) 269 var_tmp = REIL_REGISTER( "TMP", 4 ) 270 271 for i in INIT_VAR( [ var_j, var_germe, var_a, var_c, var_m, var_iter ] ) : 272 self.__RI.append( i ) 273 274 275 self.__RI.append( REIL_SUB(var_j, var_iter, var_tmp) ) 276 self.__RI.append( REIL_BISZ(var_tmp, var_tmp) ) 277 branch_1 = [ REIL_JCC(var_tmp, REIL_LITERAL(0)), len(self.__RI) - 2 ] 278 279 self.__RI.append( branch_1[0] ) 280 281 # GERME = (A * GERME + C) % M 282 self.__RI.append( REIL_MUL(var_a, var_germe, var_germe) ) 283 self.__RI.append( REIL_ADD(var_germe, var_c, var_germe) ) 284 self.__RI.append( REIL_MOD(var_germe, var_m, var_germe) ) 285 286 self.__RI.append( REIL_ADD(var_j, REIL_LITERAL(1), var_j) ) 287 branch_2 = [ REIL_JCC(REIL_LITERAL(1), REIL_OFFSET( branch_1[1] ) ) ] 288 289 self.__RI.append( branch_2[0] ) 290 291 branch_1[0].rcvout = REIL_OFFSET( len(self.__RI) ) 292 293 nb = 0 294 for i in self.__RI : 295 print "0x%x" % nb, 296 i.view() 297 nb += 1 298 299 self.__result = var_germe
300
301 - def get(self) :
302 return [ "int", "", self.__RI, self.__result ]
303
304 -class MTR :
305 - def __init__(self, math) :
306 self.__math = math 307 self.__RI = [] 308 self.__RR = {} 309 self.__result = "" 310 311 self.__b_op = { '+' : REIL_ADD, 312 '-' : REIL_SUB 313 } 314 315 self.run()
316
317 - def run(self) :
318 for i in self.__math : 319 if i[0] not in self.__RR : 320 self.__RR[ i[0] ] = REIL_REGISTER( i[0], 4 ) 321 322 if len(i) == 3 : 323 r = REIL_STR( REIL_LITERAL( i[2], 4 ), self.__RR[ i[0] ] ) 324 elif len(i) == 5 : 325 r = self.__b_op[i[3]]( self.__RR[ i[2] ], REIL_LITERAL( i[4], 4 ), self.__RR[ i[0] ] ) 326 else : 327 raise('ooops') 328 329 self.__RI.append( r ) 330 331 for i in self.__RI : 332 if i.rcvout.get_name() == self.__math[-1][0] : 333 self.__result = i.rcvout 334 break
335
336 - def get(self) :
337 return [ "int", "", self.__RI, self.__result ]
338 339 # STR LX, , RX --> BASIC MATH RX
340 -class MetaREIL :
341 - def __init__(self, ori) :
342 self.__ORI = ori 343 self.__RI = [] 344 self.__NEW_RI = [] 345 346 if self.__ORI[2][0].get_name() == "STR" : 347 if self.__ORI[2][0].rcv0.get_type() == REIL_TYPE_LITERAL : 348 oint = opaque.INT( self.__ORI[2][0].rcv0.get_value(), \ 349 prefix=random.choice( string.letters ) + ''.join([ random.choice(string.letters + string.digits) for i in range(10 - 1) ] ),\ 350 size=2 ).run() 351 print oint 352 mtir = MTR( oint ) 353 print mtir.get() 354 355 _, _, ins, ret = mtir.get() 356 for i in ins : 357 self.__NEW_RI.append( i ) 358 359 self.__NEW_RI.append( REIL_STR( ret, self.__ORI[2][0].rcvout ) ) 360 361 self.__RI = self.__NEW_RI + self.__ORI[2] 362 363 for i in self.__RI : 364 i.view()
365
366 - def get(self) :
367 return [ self.__ORI[0], self.__ORI[1], self.__RI, self.__ORI[3] ]
368
369 -class MetaPolyREIL :
370 - def __init__(self, ori) :
371 self.__ORI = ori 372 self.__RI = [] 373 self.__NEW_RI = [] 374 375 376 self.__RI = self.__NEW_RI + self.__ORI[2]
377
378 - def get(self) :
379 return [ self.__ORI[0], self.__ORI[1], self.__RI, self.__ORI[3] ]
380
381 -class STR_TO_JAVA :
382 - def __init__(self, VM) :
383 self.__buff = "int x = 0;\n" 384 self.__buff += "int value = 0;\n" 385 386 self.__buff += VM.get_pos_reg( 3, "x" ) 387 self.__buff += VM.get_value( 1, "value" ) 388 self.__buff += VM.set_reg( "x", "value" )
389
390 - def get_raw(self) :
391 return self.__buff + "\n"
392
393 -class ADD_TO_JAVA :
394 - def __init__(self, VM) :
395 self.__buff = "int x = 0;\n" 396 self.__buff += "int value1 = 0, value2 = 0;\n" 397 398 self.__buff += VM.get_pos_reg( 3, "x" ) 399 400 self.__buff += VM.get_value( 1, "value1") 401 self.__buff += VM.get_value( 2, "value2") 402 403 self.__buff += "value1 = value1 + value2;\n" 404 self.__buff += VM.set_reg( "x", "value1" )
405
406 - def get_raw(self) :
407 return self.__buff + "\n"
408
409 -class SUB_TO_JAVA :
410 - def __init__(self, VM) :
411 self.__buff = "int x = 0;\n" 412 self.__buff += "int value1 = 0, value2 = 0;\n" 413 414 self.__buff += VM.get_pos_reg( 3, "x" ) 415 416 self.__buff += VM.get_value( 1, "value1") 417 self.__buff += VM.get_value( 2, "value2") 418 419 self.__buff += "value1 = value1 - value2;\n" 420 self.__buff += VM.set_reg( "x", "value1" )
421
422 - def get_raw(self) :
423 return self.__buff + "\n"
424
425 -class BISZ_TO_JAVA :
426 - def __init__(self, VM) :
427 self.__buff = "int x = 0;\n" 428 self.__buff += "int value = 0;\n" 429 430 self.__buff += VM.get_pos_reg( 3, "x" ) 431 432 self.__buff += VM.get_value( 1, "value") 433 434 self.__buff += "if (value != 0) { " + VM.set_reg( "x", "0" ) + "}" 435 self.__buff += "else {" + VM.set_reg( "x", "1" ) + "}"
436
437 - def get_raw(self) :
438 return self.__buff + "\n"
439
440 -class JCC_TO_JAVA :
441 - def __init__(self, VM) :
442 self.__buff = "int x = 0;\n" 443 self.__buff += "int value = 0;\n" 444 445 self.__buff += VM.get_value( 1, "value") 446 447 448 self.__buff += "if (value != 0) {" + VM.set_idx( 3 ) + "}"
449
450 - def get_raw(self) :
451 return self.__buff + "\n"
452
453 -class MUL_TO_JAVA :
454 - def __init__(self, VM) :
455 self.__buff = "int x = 0;\n" 456 self.__buff += "int value1 = 0, value2 = 0;\n" 457 458 self.__buff += VM.get_pos_reg( 3, "x" ) 459 460 self.__buff += VM.get_value( 1, "value1") 461 self.__buff += VM.get_value( 2, "value2") 462 463 self.__buff += "value1 = value1 * value2;\n" 464 self.__buff += VM.set_reg( "x", "value1" )
465
466 - def get_raw(self) :
467 return self.__buff + "\n"
468
469 -class MOD_TO_JAVA :
470 - def __init__(self, VM) :
471 self.__buff = "int x = 0;\n" 472 self.__buff += "int value1 = 0, value2 = 0;\n" 473 474 self.__buff += VM.get_pos_reg( 3, "x" ) 475 476 self.__buff += VM.get_value( 1, "value1") 477 self.__buff += VM.get_value( 2, "value2") 478 479 self.__buff += "value1 = value1 % value2;\n" 480 self.__buff += VM.set_reg( "x", "value1" )
481
482 - def get_raw(self) :
483 return self.__buff + "\n"
484
485 -class REIL_TO_JAVA :
486 - def __init__(self, op, VM, debug=False) :
487 self.__debug = debug 488 self.__OP = { "STR" : STR_TO_JAVA, 489 "ADD" : ADD_TO_JAVA, 490 "SUB" : SUB_TO_JAVA, 491 "BISZ" : BISZ_TO_JAVA, 492 "JCC" : JCC_TO_JAVA, 493 "MUL" : MUL_TO_JAVA, 494 "MOD" : MOD_TO_JAVA, 495 } 496 497 if op in self.__OP : 498 self.__buff = self.__OP[op]( VM ).get_raw() 499 if self.__debug == True : 500 self.__buff += "System.out.println(\"----- %s\\n\");\n" % op 501 else : 502 print op 503 raise("oops")
504
505 - def get_raw(self) :
506 return self.__buff + "\n"
507