Advertisement
Guest User

Untitled

a guest
Apr 23rd, 2017
62
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.75 KB | None | 0 0
  1. const r2promise = require(`r2pipe-promise`);
  2. const program = require(`commander`);
  3. const exec = require(`child-process-promise`).exec;
  4.  
  5. program
  6. .version(`0.0.1`)
  7. .parse(process.argv);
  8.  
  9.  
  10. async function main() {
  11. //accepts shellcode from command line in same form as the shell32 arg from the silverlight app
  12. //outputs to binary then reads it with radare
  13. const binary = await exec(`echo ${process.argv[2]} | xxd -r -p - test.bin`);
  14.  
  15. const r2 = await r2promise.open(`/home/mj/emulator/test.bin`);
  16.  
  17. await r2.cmd(`e asm.comments=false`);
  18. await r2.cmd(`e asm.lines=false`);
  19. await r2.cmd(`e asm.flags=false`);
  20.  
  21. await r2.cmd(`e io.cache=true`);
  22. await r2.cmd(`e asm.bits=32`);
  23. await r2.cmd(`e asm.arch=x86`);
  24. await r2.cmd(`aei`);
  25. await r2.cmd(`aeim 0xffffd000 0x2000 stack`);
  26.  
  27. //pdj print disassembly to find base of code
  28. // let cmd = await r2.cmdj(`pdj 1`);
  29. // const base = cmd[0].offset;
  30.  
  31. //we know the base already though because we made the binary
  32. const base = 0;
  33.  
  34. //grab file size from the file info
  35. let cmd = await r2.cmdj(`oj`);
  36. const end = cmd[0].size;
  37.  
  38. //can be used to automate decoding rig shellcodes
  39. // //look for loop opcode
  40. // cmd = await r2.cmdj(`pdj 100`);
  41. // let decoded = null;
  42. //
  43. // for (let c of cmd) {
  44. // if (c.opcode.match(`call`)) {
  45. // decoded = c.offset + 5;
  46. // break;
  47. // }
  48. // }
  49.  
  50. //continue until byte 25 which is the beginning of the decoded shellcode
  51. await r2.cmd(`aecu 25`);
  52.  
  53. //print disassembly of the remainder of the size of the shellcode minus the decoder, starting at the decoder
  54. //aka disassemble the decoded
  55. const raw = await r2.cmd(`pD ${end - 25} @ 25`);
  56.  
  57. console.log(raw);
  58. }
  59.  
  60. main();
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement