Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #define _GNU_SOURCE
- #include <stdio.h>
- #include <stdio.h>
- #include <dlfcn.h>
- #include <capstone/capstone.h>
- #include <signal.h>
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <fcntl.h>
- #include <string.h>
- char* bp_addr;
- char saved_bp;
- csh handle;
- cs_insn* insn;
- void disass(void* addr){
- cs_disasm(handle, addr, 15, addr, 0, &insn);
- printf("Disassembly : %s %s\n", insn[0].mnemonic, insn[0].op_str);
- }
- void handler(int sig, siginfo_t *info, void *ucontext)
- {
- ucontext_t *uc = (ucontext_t *)ucontext;
- char command[0x100];
- if (info->si_addr == NULL){
- //int3
- puts("BP Hit");
- printf("RIP : %p\n", uc->uc_mcontext.gregs[16] - 1);
- *bp_addr = saved_bp;
- disass(uc->uc_mcontext.gregs[16] - 1);
- uc->uc_mcontext.gregs[16] = bp_addr;
- scanf("%s", command);
- //continue
- if (!strcmp(command, "c")){
- size_t eflags = uc->uc_mcontext.gregs[17];
- eflags &= ~0x100; //single step disable
- uc->uc_mcontext.gregs[17] = eflags;
- }
- else if(!strcmp(command, "si")){
- size_t eflags = uc->uc_mcontext.gregs[17];
- eflags |= 0x100; //single step enable
- uc->uc_mcontext.gregs[17] = eflags;
- }
- }
- else{
- //single step
- printf("RIP : %p\n", info->si_addr);
- disass(info->si_addr);
- scanf("%s", command);
- //continue
- if (!strcmp(command, "c")){
- size_t eflags = uc->uc_mcontext.gregs[17];
- eflags &= ~0x100; //single step disable
- uc->uc_mcontext.gregs[17] = eflags;
- }
- else if(!strcmp(command, "si")){
- size_t eflags = uc->uc_mcontext.gregs[17];
- eflags |= 0x100; //single step enable
- uc->uc_mcontext.gregs[17] = eflags;
- }
- }
- }
- void __attribute__((constructor)) my_init() {
- cs_open(CS_ARCH_X86, CS_MODE_64, &handle);
- printf("debugger start!\n");
- struct sigaction sa;
- sa.sa_sigaction = handler;
- sa.sa_flags = SA_SIGINFO;
- if (sigaction(SIGTRAP, &sa, NULL) == -1) {
- perror("sigaction");
- return 1;
- }
- printf("bp > ");
- scanf("%llx", &bp_addr); //bp_addr = bp 걸 주소
- printf("%llx\n", ((size_t)bp_addr >> 12) << 12);
- mprotect(((size_t)bp_addr >> 12) << 12, 0x1000, 7);
- saved_bp = *bp_addr;
- *bp_addr = 0xCC;
- getchar(); //개행제거
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement