Advertisement
Guest User

Untitled

a guest
Mar 29th, 2020
536
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 1.62 KB | None | 0 0
  1. def ggetr(name):
  2.     return int(gdb.parse_and_eval(name))
  3.  
  4. def ggeta(addr):
  5.     return int(gdb.parse_and_eval('*(unsigned long long *){}'.format(addr)))
  6.  
  7. def gseta(name, value):
  8.     gdb.execute('set *(unsigned long long *){} = {}'.format(name, value))
  9.  
  10. def gsetr(name, value):
  11.     gdb.execute('set {} = {}'.format(name, value))
  12.  
  13. def gst():
  14.     return int(gdb.parse_and_eval('*(unsigned long long*)$rsp'))
  15.  
  16. def ret():
  17.     rsp = ggetr('$rsp')
  18.     ret_addr = gst()
  19.     gsetr('$rip', ret_addr)
  20.     gsetr('$rsp', rsp + 8)
  21.  
  22. cache = {}
  23. states = []
  24.  
  25. class BrB(gdb.Breakpoint):
  26.     def __init__(self, location):
  27.         super(BrB, self).__init__(spec=location, type=gdb.BP_BREAKPOINT, internal=False, temporary=False)
  28.  
  29.     def stop(self):
  30.  
  31.         rdi, rsi, rdx, rcx = ggetr('$rdi'), ggetr('$rsi'), ggetr('$rdx'), ggetr('$rcx')
  32.  
  33.         state = (rsi, rdx, rcx)
  34.         states.append((rdi, state))
  35.  
  36.         print('in', state)
  37.  
  38.         if state in cache:
  39.             print('!!!!')
  40.             a, b, c = cache[state]
  41.             gseta(rdi, a)
  42.             gseta(rdi + 8, b)
  43.             gseta(rdi + 16, c)
  44.             ret()
  45.  
  46.         return False
  47.  
  48. class BrE(gdb.Breakpoint):
  49.     def __init__(self, location):
  50.         super(BrE, self).__init__(spec=location, type=gdb.BP_BREAKPOINT, internal=False, temporary=False)
  51.  
  52.     def stop(self):
  53.  
  54.         rdi, state = states[-1]
  55.         states.pop()
  56.  
  57.         a, b, c = ggeta(rdi), ggeta(rdi + 8), ggeta(rdi + 16)
  58.  
  59.         print('out', state)
  60.         cache[state] = (a, b, c)
  61.  
  62.         return False
  63.  
  64. BrB('*0x00005555555553b0')
  65. BrE('*0x0000555555555424')
  66.  
  67. gdb.execute('run')
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement