metasm 1.0.0 → 1.0.5

data/samples/metasm-shell.rb

@@ -4,7 +4,7 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
-# modifies the standard ruby class String to add #decode and #encode methods
+# modifies the standard ruby class String to add #asm_decode and #asm_encode methods
 # they will respectively disassemble binary data / assemble asm source
 # the default CPU is x86 32bits, change it using eg String.cpu = Metasm::MIPS.new(:big) (mips bigendian)
 #
@@ -18,74 +18,85 @@
 # > exit
 
 require 'metasm'
+require 'readline'
 
 class String
-	@@cpu = Metasm::Ia32.new
-	class << self
-		def cpu()   @@cpu   end
-		def cpu=(c)
-			c = Metasm.const_get(c).new if c.kind_of? String
-			@@cpu=c
-		end
-	end
+  @@cpu = Metasm::Ia32.new
+  class << self
+    def cpu()   @@cpu   end
+    def cpu=(c)
+      c = Metasm.const_get(c).new if c.kind_of? String
+      @@cpu=c
+    end
+  end
 
-	# encodes the current string as a Shellcode, returns the resulting EncodedData
-	def encode_edata
-		s = Metasm::Shellcode.assemble @@cpu, self
-		s.encoded
-	end
+  # encodes the current string as a Shellcode, returns the resulting EncodedData
+  def asm_encode_edata
+    Metasm::Shellcode.assemble(@@cpu, self).encode.encoded
+  end
 
-	# encodes the current string as a Shellcode, returns the resulting binary String
-	# outputs warnings on unresolved relocations
-	def encode
-		ed = encode_edata
-		if not ed.reloc.empty?
-			puts 'W: encoded string has unresolved relocations: ' + ed.reloc.map { |o, r| r.target.inspect }.join(', ')
-		end
-		ed.fill
-		ed.data
-	end
+  # encodes the current string as a Shellcode, returns the resulting binary String
+  # outputs warnings on unresolved relocations
+  def asm_encode
+    ed = asm_encode_edata
+    if not ed.reloc.empty?
+      puts 'W: encoded string has unresolved relocations: ' + ed.reloc.map { |o, r| r.target.inspect }.join(', ')
+    end
+    ed.fill
+    ed.data
+  end
 
-	# decodes the current string as a Shellcode, with specified base address
-	# returns the resulting Disassembler
-	def decode_blocks(base_addr=0, eip=base_addr)
-		sc = Metasm::Shellcode.decode(self, @@cpu)
-		sc.base_addr = base_addr
-		sc.disassemble(eip)
-	end
+  # decodes the current string as a Shellcode, with specified base address
+  # returns the resulting Disassembler
+  def asm_decode_blocks(base_addr=0, eip=base_addr)
+    sc = Metasm::Shellcode.decode(self, @@cpu)
+    sc.base_addr = base_addr
+    sc.disassemble(eip)
+  end
 
-	# decodes the current string as a Shellcode, with specified base address
-	# returns the asm source equivallent
-	def decode(base_addr=0, eip=base_addr)
-		decode_blocks(base_addr, eip).to_s
-	end
+  # decodes the current string as a Shellcode, with specified base address
+  # returns the asm source equivallent
+  def asm_decode(base_addr=0, eip=base_addr)
+    asm_decode_blocks(base_addr, eip).to_s
+  end
 end
 
 # get in interactive assembler mode
 def asm
-	puts 'type "exit" or "quit" to quit', 'use ";" for newline', ''
-	while (print "asm> " ; $stdout.flush ; l = gets)
-		break if %w[quit exit].include? l.chomp
-		if l.chomp == 'help'
-			puts "Metasm assembly shell: type in opcodes to see their binary form",
-				"You can use ';' to type multi-line stuff",
-				"e.g. 'nop nop' will display \"\\x90\\x90\""
-			next
-		end
-	
-		begin
-			data = l.gsub(';', "\n")
-			next if data.strip.empty?
-			data = data.encode
-			puts '"' + data.unpack('C*').map { |c| '\\x%02x' % c }.join + '"'
-		rescue Metasm::Exception => e
-			puts "Error: #{e.class} #{e.message}"
-		end
-	end
+  puts "[+] Metasm assembly shell"
+  puts "type help for usage..\n\n"
 
-	puts
+  Readline.completion_proc = lambda { |line| %w[help exit quit].find_all { |w| line.downcase == w[0, line.length] } }
+  Readline.completion_append_character = ' '
+
+  while line = Readline.readline('asm> ', true)
+    case line
+    when /^help(\W|$)/
+      puts "",
+           "Type in opcodes to see their binary form",
+           "You can use ';' to type multi-line stuff",
+           "e.g. 'nop nop' will display \"\\x90\\x90\"",
+           "",
+           "exit/quit    Quit the console",
+           "help         Show this screen",
+           ""
+    when /^(quit|exit)(\W|$)/
+      break
+    else
+      begin
+        data = line.gsub(';', "\n")
+        next if data.strip.empty?
+        e_data = data.asm_encode
+        puts '"' + e_data.unpack('C*').map { |c| '\\x%02x' % c }.join + '"'
+      rescue Metasm::Exception => e
+        puts "Error: #{e.class} #{e.message}"
+      end
+    end
+  end
+
+  puts
 end
 
 if __FILE__ == $0
-	asm
+  asm
 end

data/samples/peldr.rb

@@ -148,7 +148,7 @@ class PeLdr
 			end
 		}
 
-		cp.numeric_constants.each { |k, v|
+		cp.numeric_constants.each { |k, v, f|
 			n = k.upcase
 			n = "C#{n}" if n !~ /^[A-Z]/
 			DL.const_set(n, v) if not DL.const_defined?(n) and v.kind_of? Integer
@@ -178,7 +178,7 @@ class PeLdr
 
 	def self.populate_peb
 		DL.memory_write(@@peb, 0.chr*4096)
-		set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) }
+		#set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) }
 	end
 
 	def self.teb ; @@teb ; end

data/tests/all.rb

@@ -4,5 +4,5 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-Dir['tests/*.rb'].each { |f| require f }
+Dir[File.expand_path('../*.rb', __FILE__)].sort.each { |f| require f }
 

data/tests/arc.rb

@@ -0,0 +1,26 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'test/unit'
+require 'metasm'
+
+class TestArc < Test::Unit::TestCase
+	def test_arc_dec
+		hex_stream =  "\x0A\x23\x80\x0F\x80\x0\x60\x0D" # mov r3, 0x800D60
+		hex_stream += "\x40\x83"          # ld_s r2, [r3, 0]
+
+		dasm = Metasm::Shellcode.disassemble(Metasm::ARC.new, hex_stream)
+		assert_equal(2, dasm.decoded.length)
+
+		assert_equal('mov', dasm.decoded[0].instruction.opname)
+		assert_equal('r3', dasm.decoded[0].instruction.args[0].to_s)
+		assert_equal(0x800d60, dasm.decoded[0].instruction.args[1].reduce)
+
+		assert_equal('ld_s', dasm.decoded[8].instruction.opname)
+		assert_equal('r2', dasm.decoded[8].instruction.args[0].to_s)
+		assert_equal('r3', dasm.decoded[8].instruction.args[1].base.to_s)
+		assert_equal(0, dasm.decoded[8].instruction.args[1].disp.reduce)
+	end
+end

data/tests/dynldr.rb

@@ -7,29 +7,47 @@ require 'test/unit'
 require 'metasm'
 
 class TestDynldr < Test::Unit::TestCase
+	def d; Metasm::DynLdr; end
 
-	def test_dynldr
+	def test_new_api_c
 		str = "1234"
-		d = Metasm::DynLdr
 		d.new_api_c('int memcpy(char*, char*, int)')
 		d.memcpy(str, "9999", 2)
 		assert_equal('9934', str)
+	end
 
+	def test_new_func_c
 		c_src = <<EOS
-int sprintf(char*, char*, ...);
+int sprintf(char*, char*, ...);			// stdlib external
 void fufu(int i, char* ptr)
 {
-	sprintf(ptr, "lolzor %i\\n", i);
+	static int meh;				// .data
+	meh = i;
+	sprintf(ptr, "lolzor %i\\n", meh);	// string constant = .rodata
 }
 EOS
 		buf = 'aaaaaaaaaaaaaaaaaa'
 		d.new_func_c(c_src) { d.fufu(42, buf) }
 		assert_equal("lolzor 42\n\000aaaaaaa", buf)
+	end
 
+	def test_new_func_asm
 		if d.host_cpu.shortname == 'ia32'
 			ret = d.new_func_asm('int __fastcall bla(int)', "lea eax, [ecx+1]\nret") { d.bla(42) }
 			assert_equal(43, ret)
 			assert_equal(false, d.respond_to?(:bla))
 		end
 	end
+
+	def test_callback
+		c1 = d.callback_alloc_c('int lol(int);') { |i| i+1 }
+		c2 = d.callback_alloc_c('int lol(int);') { |i| i+2 }
+		c3 = d.callback_alloc_c('int lol(int);') { |i| i/2 }
+
+		d.new_func_c "int blop(int i, int (*fp)(int)) { return fp(i); }"
+		
+		assert_equal(2, d.blop(1, c1))
+		assert_equal(4, d.blop(2, c2))
+		assert_equal(6, d.blop(13, c3))
+	end
 end

data/tests/expression.rb

@@ -0,0 +1,57 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'test/unit'
+require 'metasm'
+
+class TestExpression < Test::Unit::TestCase
+	E = Metasm::Expression
+	def test_encode
+		assert_equal("\x04\0\0\0", E[4].encode(:u32, :little).data)
+	end
+
+	def test_numeric
+		assert_equal(5, E[4, :+, 1].reduce)
+		assert_equal(4, E[5].reduce { |e| e == 5 ? 4 : e })
+		assert_equal(5, E[5].reduce)	# test the previous lambda does not linger around
+	end
+
+	def test_reduce
+		assert_equal(0, E[:a, :-, :a].reduce)
+		assert_equal(0, E[:a, :^, :a].reduce)
+
+		assert_equal(E[:a, :^, 3], E[[1, :^, :a], :^, 2].reduce)
+		assert_equal(E[:a], E[[:b, :^, :a], :^, :b].reduce)
+
+		assert_equal(E[:a, :+, 2], E[:b, :+, [:a, :-, [4, :+, [:b, :-, 6]]]].reduce)
+		assert_equal(E[:a, :&, 0xff00], E[[[:a, :>>, 8], :&, 0xff], :<<, 8].reduce)
+
+		assert_equal(E[[:a, :>>, 1], :&, 0xff0], E[[[:a, :>>, 5], :&, 0xff], :<<, 4].reduce)
+
+		assert_equal(0, E[[:a, :&, 0xff00], :&, [:b, :&, 0xff]].reduce)
+		assert_equal(0, E[[:a, :&, 0xff], :>>, 8].reduce)
+
+		assert_equal(E[:a, :&, 0xffff], E[[:a, :&, 0x3333], :|, [[:a, :&, 0x8888], :+, [:a, :&, 0x4444]]].reduce)
+
+		assert_equal(E[:a, :&, 0xff], E[[:a, :|, [:b, :&, 0xff00]], :&, 0xff].reduce)
+
+		assert_equal(1, E[[2, :>, 1], :'||', [:a, :<=, :b]].reduce)
+		assert_equal(0, E[[:a, :>, :b], :'&&', [1, :>, 2]].reduce)
+
+		assert_equal(E[:a, :>, :b], E[[:'!', [:a, :<=, :b]], :==, 1].reduce)
+	end
+
+	def test_pattern
+		pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :|, 'b'], 'a', 'b')
+		assert_equal(false, pat)
+
+		pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :+, 'b'], 'a', 'b')
+		assert_equal(:a, pat['a'])
+		p2 = pat['b'].match(E[:a, :b, :c], :a, :b, :c)
+		assert_equal(0xffff, p2[:c])
+		assert_equal(:&, p2[:b])
+	end
+end

data/tests/graph_layout.rb

@@ -0,0 +1,285 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# special file to test the graph layout engine
+# call this file directly to run
+
+require 'metasm'
+include Metasm
+
+def test_layout(lo)
+	$cur ||= 0
+	$cur += 1
+	if $target.to_i != 0
+		return if $cur != $target.to_i
+	else
+		return if not lo.include? $target
+	end if $target
+	puts $cur, lo, '' if $VERBOSE
+	w = Gui::Window.new
+	ww = w.widget = Gui::GraphViewWidget.new(nil, nil)
+	ww.grab_focus
+	Gui.idle_add {
+		ww.load_dot(lo)
+		ww.curcontext.auto_arrange_boxes
+		ww.zoom_all
+		false
+	}
+	Gui.main
+end
+
+def test_all
+	test_layout <<EOS
+line -> 2 -> 3 -> 4 -> 5 -> 6 -> 7;
+EOS
+	test_layout <<EOS
+sep1 -> 1;
+sep2 -> 2;
+sep3 -> 3;
+sep4 -> 4;
+sep5 -> 5;
+EOS
+	test_layout <<EOS
+fork -> 2 -> 3;
+2 -> 4;
+EOS
+	test_layout <<EOS
+diamond -> 2 -> 3 -> 5;
+2 -> 4 -> 5;
+EOS
+	test_layout <<EOS
+ifthen -> 2 -> 3 -> 4;
+2 -> 4;
+EOS
+	test_layout <<EOS
+ufork -> 2 -> 3;
+1 -> 2;
+EOS
+	test_layout <<EOS
+multidiamond -> 2 -> 31 -> 32 -> 34 -> 5 -> 6 -> 8;
+2 -> 41 -> 42 -> 44 -> 5 -> 7 -> 8;
+41 -> 43 -> 44;
+31 -> 33 -> 34;
+EOS
+	test_layout <<EOS
+dmdout -> 2 -> 3a -> 4;
+2 -> 3b -> 4;
+3a -> 4a;
+3b -> 4b;
+EOS
+	test_layout <<EOS
+ifthenthen -> 2 -> 8;
+2 -> 3 -> 8;
+2 -> 4 -> 5 -> 8;
+2 -> 6 -> 7 -> 8;
+EOS
+	test_layout <<EOS
+multipod -> 2 -> 3;
+2 -> 4;
+2 -> 5;
+2 -> 6;
+2 -> 7;
+2 -> 8;
+EOS
+	test_layout <<EOS
+mplarge -> 1 -> 2;
+1 -> 3333333333333333333333333333333333;
+EOS
+	test_layout <<EOS
+multif -> 1
+1 -> a2 -> a3
+a2 -> a222222222 -> a3
+1 -> b2 -> b3
+b2 -> b222222222 -> b3
+EOS
+	test_layout <<EOS
+ifx -> 1 -> 2 -> 3 -> 4 -> 5
+4 -> eeeeeeeeeeee -> 5
+EOS
+	test_layout <<EOS
+llll -> 1 -> 22222222222222222222222222 -> e
+1 -> 33333333333333333333333333 -> e
+1 -> 4444444444444444444444 -> e
+1 -> 5 -> e
+5 -> 5t -> e
+1 -> 6 -> e
+6 -> 6t -> e
+1 -> 7 -> e
+7 -> 7t -> e
+EOS
+	test_layout <<EOS
+dangling -> 2 -> 11 -> 12 -> 13 -> 4;
+2 -> 21 -> 22 -> 23 -> 4;
+2 -> 31 -> 32 -> 33 -> 4;
+21 -> 2z;
+31 -> 3z;
+EOS
+	test_layout <<EOS
+dangin -> 2 -> 11 -> 12 -> 13;
+2 -> 21 -> 22 -> 13;
+2 -> 31 -> 32 -> 33;
+22 -> 33;
+21 -> z;
+EOS
+	test_layout <<EOS
+cascadeclean -> 2 -> 3 -> 4 -> 5 -> 6 -> 62 -> 52 -> 42 -> 32 -> 22 -> e;
+2 -> 21 -> 22;
+3 -> 31 -> 32;
+4 -> 41 -> 42;
+5 -> 51 -> 52;
+6 -> 61 -> 62;
+EOS
+	test_layout <<EOS
+cascade -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e;
+2 -> 21 -> e;
+3 -> 31 -> e;
+4 -> 41 -> e;
+5 -> 51 -> e;
+6 -> 61 -> e;
+EOS
+	test_layout <<EOS
+rstair -> 2 -> 3 -> 4 -> 5 -> 6;
+2 -> 4;
+2 -> 5;
+2 -> 6;
+EOS
+	test_layout <<EOS
+drstair -> 2a -> 3 -> 4 -> 5 -> 6;
+drstair -> 2b -> 4;
+2a -> 4;
+2a -> 5;
+2a -> 6;
+2b -> 4;
+2b -> 5;
+2b -> 6;
+EOS
+	test_layout <<EOS
+mrstair -> 2a -> 3a -> 4a -> 5a -> 6a;
+mrstair -> 2b -> 4a;
+2a -> 4a;
+2a -> 5a;
+2a -> 6a;
+2b -> 4a;
+2b -> 5a;
+2b -> 6a;
+2a -> 3b -> 4b -> 5b -> 6b;
+2a -> 4b;
+2a -> 5b;
+2a -> 6b;
+2b -> 3b;
+2b -> 4b;
+2b -> 5b;
+2b -> 6b;
+EOS
+	test_layout <<EOS
+loop -> 2 -> 3 -> 4;
+3 -> 2;
+EOS
+	test_layout <<EOS
+loopbreak -> 2 -> 3 -> e;
+2 -> 4 -> 5 -> 6 -> 8 -> e;
+5 -> 7 -> 4;
+EOS
+	test_layout <<EOS
+loopbreak2 -> 2 -> 3 -> e;
+2 -> 4 -> 5 -> 6 -> 8 -> e;
+5 -> 7 -> 4;
+7 -> 8;
+EOS
+	test_layout <<EOS
+unbalance -> 2 -> 3 -> 4 -> 5 -> e;
+2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e;
+EOS
+	test_layout <<EOS
+unbalance2 -> 2 -> 3 -> e;
+2 -> 4 -> e;
+2 -> 5 -> e;
+2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e;
+EOS
+	test_layout <<EOS
+unbalance3 -> 2 -> 3 -> e;
+2 -> 4 -> e;
+2 -> 5 -> e;
+2 -> 6 -> e;
+8 -> 9 -> e;
+2 -> 7 -> e;
+EOS
+	test_layout <<EOS
+disjoint -> 1 -> 2 -> 3 -> 4 -> 5 -> 6;
+l1 -> l2;
+l1 -> l3;
+l1 -> l4;
+l1 -> l5;
+l1 -> l6;
+EOS
+
+	test_layout <<EOS
+lol -> 2 -> 31 -> 41 -> 5;
+2 -> 32 -> 42 -> 5;
+31 -> 42;
+41 -> 32;
+EOS
+	test_layout <<EOS
+nestloop -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e;
+6 -> 4;
+7 -> 3;
+EOS
+	test_layout <<EOS
+escape -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> 8;
+2 -> 21;
+4 -> 6;
+EOS
+	test_layout <<EOS
+loophead -> 1 -> loophead;
+2 -> 3 -> 2;
+3 -> 4;
+1 -> 4;
+EOS
+	test_layout <<EOS
+1 -> e1;
+l00pz -> 1 -> l00pz;
+l2 -> 2 -> l2;
+2 -> e1;
+2 -> e2;
+l3 -> 3 -> l3;
+3 -> e2;
+EOS
+	test_layout <<EOS
+3loop -> 1 -> 3loop;
+1 -> 2 -> 3  -> 2;
+0 -> 00 -> 0 -> 2;
+EOS
+	test_layout <<EOS
+foo -> 0 -> 1
+0 -> 2 -> 3 -> 4 -> 5
+4 -> 6
+4 -> 7 -> 5
+4 -> 8 -> 6
+2 -> 1 -> 7
+3 -> 1 -> 8
+EOS
+	test_layout <<EOS
+dang -> 2 -> 3 -> 4 -> 5 -> 6 -> 4;
+2 -> 9;
+5 -> 9;
+EOS
+	test_layout <<EOS
+dang2 -> 2 -> 3 -> 4 -> 5 -> 6 -> 4
+2 -> 9
+5 -> 9
+9 -> a -> 9
+EOS
+	test_layout <<EOS
+onlyloop -> onlyloop
+EOS
+
+rescue Interrupt
+end
+
+if __FILE__ == $0
+	$target = ARGV[0]
+	test_all
+end