Advertisement
Guest User

Untitled

a guest
Apr 19th, 2018
63
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 1.69 KB | None | 0 0
  1. def hook_code(uc, address, size, user_data):
  2.     if 'ebp' in tmp[0].regs_const:
  3.         eax = uc.reg_read(tmp[0].regs_const['eax'])
  4.         ebx = uc.reg_read(tmp[0].regs_const['ebx'])
  5.         ecx = uc.reg_read(tmp[0].regs_const['ecx'])
  6.         edx = uc.reg_read(tmp[0].regs_const['edx'])
  7.         esi = uc.reg_read(tmp[0].regs_const['esi'])
  8.         edi = uc.reg_read(tmp[0].regs_const['edi'])
  9.         ebp = uc.reg_read(tmp[0].regs_const['ebp'])
  10.         esp = uc.reg_read(tmp[0].regs_const['esp'])
  11.         eip = uc.reg_read(tmp[0].regs_const['eip'])
  12.         ip = tmp[0].regs_const['eip']
  13.         head = ebp
  14.         tail = esp
  15.    
  16.     else:
  17.         rax = uc.reg_read(self.regs_const['rax'])
  18.         rbx = uc.reg_read(self.regs_const['rbx'])
  19.         rcx = uc.reg_read(self.regs_const['rcx'])
  20.         rdx = uc.reg_read(self.regs_const['rdx'])
  21.         rsi = uc.reg_read(self.regs_const['rsi'])
  22.         rdi = uc.reg_read(self.regs_const['rdi'])
  23.         r8 = uc.reg_read(self.regs_const['r8'])
  24.         r9 = uc.reg_read(self.regs_const['r9'])
  25.         r10 = uc.reg_read(self.regs_const['r10'])
  26.         r11 = uc.reg_read(self.regs_const['r11'])
  27.         r12 = uc.reg_read(self.regs_const['r12'])
  28.         r13 = uc.reg_read(self.regs_const['r13'])
  29.         r14 = uc.reg_read(self.regs_const['r14'])
  30.         r15 = uc.reg_read(self.regs_const['r15'])
  31.         rbp = uc.reg_read(tmp[0].regs_const['rbp'])
  32.         rsp = uc.reg_read(tmp[0].regs_const['rsp'])
  33.         rip = uc.reg_read(tmp[0].regs_const['rip'])
  34.         ip = tmp[0].regs_const['rip']
  35.         head = rbp
  36.         tail = rsp
  37.  
  38.     regex = r'(dword|qword|word|byte) ptr (.*)\[(.*)\]'
  39.     match = re.search(regex, code.op_str)
  40.     if match:
  41.         expression = match.group(3)
  42.         result = eval(expression)
  43.         print 'Result', hex(result).strip('L')
  44.         if tail > result or result > head:
  45.             resultMem[0].visitIndirect(result)
  46.             uc.reg_write(ip, uc.reg_read(ip) + length)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement