metasm 1.0.0

data/lib/metasm/exe_format/shellcode.rb

@@ -0,0 +1,114 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/exe_format/main'
+
+module Metasm
+# a shellcode is a simple sequence of instructions
+class Shellcode < ExeFormat
+	# the array of source elements (Instr/Data etc)
+	attr_accessor :source
+	# the base address of the shellcode (nil if unspecified)
+	attr_accessor :base_addr
+
+	def initialize(cpu=nil, base_addr=nil)
+		@base_addr = base_addr
+		@source = []
+		super(cpu)
+	end
+
+	def parse_init
+		@cursource = @source
+		super()
+	end
+
+	# allows definition of the base address
+	def parse_parser_instruction(instr)
+		case instr.raw.downcase
+		when '.base', '.baseaddr', '.base_addr'
+			# ".base_addr <expression>"
+			# expression should #reduce to integer
+			@lexer.skip_space
+			raise instr, 'syntax error' if not @base_addr = Expression.parse(@lexer).reduce
+			raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol
+		else super(instr)
+		end
+	end
+
+	def get_section_at(addr)
+		base = @base_addr || 0
+		if not addr.kind_of? Integer
+			[@encoded, addr] if @encoded.ptr = @encoded.export[addr]
+		elsif addr >= base and addr < base + @encoded.virtsize
+			@encoded.ptr = addr - base
+			[@encoded, addr]
+		end
+	end
+
+	def each_section
+		yield @encoded, (@base_addr || 0)
+	end
+
+	def addr_to_fileoff(addr)
+		addr - (base_addr || 0)
+	end
+
+	def fileoff_to_addr(foff)
+		foff + (base_addr || 0)
+	end
+
+	# encodes the source found in self.source
+	# appends it to self.encoded
+	# clears self.source
+	# the optional parameter may contain a binding used to fixup! self.encoded
+	# uses self.base_addr if it exists
+	def assemble(*a)
+		parse(*a) if not a.empty?
+		@encoded << assemble_sequence(@source, @cpu)
+		@source.clear
+		encode
+	end
+
+	def encode(binding={})
+		@encoded.fixup! binding
+		@encoded.fixup @encoded.binding(@base_addr)
+		@encoded.fill @encoded.rawsize
+		self
+	end
+
+	def decode
+	end
+
+	def self.disassemble(cpu, str, eip=0)
+		sc = decode(str, cpu)
+		sc.disassemble(eip)
+	end
+
+	def init_disassembler
+		d = super()
+		d.function[:default] = @cpu.disassembler_default_func
+		d
+	end
+
+	def compile_setsection(src, section)
+	end
+
+	def dump_section_header(addr, edata)
+		''
+	end
+
+	def get_default_entrypoints
+		[@base_addr || 0]
+	end
+
+	# returns a virtual subclass of Shellcode whose cpu_from_headers will return cpu
+	def self.withcpu(cpu)
+		c = Class.new(self)
+		c.send(:define_method, :cpu_from_headers) { cpu }
+		c
+	end
+end
+end

data/lib/metasm/exe_format/xcoff.rb

@@ -0,0 +1,167 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+
+module Metasm
+class XCoff < ExeFormat
+	FLAGS = { 1 => 'RELFLG', 2 => 'EXEC', 4 => 'LNNO',
+		0x200 => 'AR32W', 0x400 => 'PATCH', 0x1000 => 'DYNLOAD',
+		0x2000 => 'SHROBJ', 0x4000 => 'LOADONLY' }
+
+	SECTION_FLAGS = { 8 => 'PAD', 0x20 => 'TEXT', 0x40 => 'DATA', 0x80 => 'BSS',
+		0x100 => 'EXCEPT', 0x200 => 'INFO', 0x1000 => 'LOADER',
+		0x2000 => 'DEBUG', 0x4000 => 'TYPCHK', 0x8000 => 'OVRFLO' }
+
+	class SerialStruct < Metasm::SerialStruct
+		new_int_field :xword, :xhalf
+	end
+
+	class Header < SerialStruct
+		mem :sig, 2
+		decode_hook { |exe, hdr|
+			exe.endianness, exe.intsize =
+			case @sig
+			when "\1\xdf"; [:big,    32]
+			when "\xdf\1"; [:little, 32]
+			when "\1\xef"; [:big,    64]
+			when "\xef\1"; [:little, 64]
+			else raise InvalidExeFormat, "invalid a.out signature"
+			end
+		}
+		half :nsec
+		word :timdat
+		xword :symptr
+		word :nsym
+		half :opthdr
+		half :flags
+		fld_bits :flags, FLAGS
+
+		def set_default_values(xcoff)
+			@sig ||= case [xcoff.endianness, xcoff.intsize]
+				when [:big,    32]; "\1\xdf"
+				when [:little, 32]; "\xdf\1"
+				when [:big,    64]; "\1\xef"
+				when [:little, 64]; "\xef\1"
+				end
+			@nsec   ||= xcoff.sections.size
+			@symptr ||= xcoff.symbols ? xcoff.new_label('symptr') : 0
+			@nsym   ||= xcoff.symbols ? xcoff.symbols.length : 0
+			@opthdr ||= xcoff.optheader ? OptHeader.size(xcoff) : 0
+			super(xcoff)
+		end
+	end
+
+	class OptHeader < SerialStruct
+		halfs :magic, :vstamp
+		xwords :tsize, :dsize, :bsize, :entry, :text_start, :data_start, :toc
+		halfs :snentry, :sntext, :sndata, :sntoc, :snloader, :snbss, :aligntext, :aligndata, :modtype, :cpu
+		xwords :maxstack, :maxdata
+		new_field(:res, lambda { |exe, me| exe.encoded.read(exe.intsize == 32 ? 8 : 120) }, lambda { |exe, me, val| val }, '')
+
+
+		def self.size(xcoff)
+			xcoff.intsize == 32 ? 2*2+7*4+10*2+2*4+2+8 : 2*2+7*8+10*2+2*8+2+120
+		end
+
+		def set_default_values(xcoff)
+			@vstamp  ||= 1
+			@snentry ||= 1
+			@sntext  ||= 1
+			@sndata  ||= 2
+			@sntoc   ||= 3
+			@snloader||= 4
+			@snbss   ||= 5
+			super(xcoff)
+		end
+	end
+
+	class Section < SerialStruct
+		str :name, 8
+		xwords :paddr, :vaddr, :size, :scnptr, :relptr, :lnnoptr
+		xhalfs :nreloc, :nlnno, :flags
+		fld_bits :flags, SECTION_FLAGS
+
+		def set_defalut_values(xcoff)
+			@name   ||= @flags.kind_of?(::Array) ? ".#{@flags.first.to_s.downcase}" : ''
+			@vaddr  ||= @paddr ? @paddr : @encoded ? xcoff.label_at(@encoded, 0, 's_vaddr') : 0
+			@paddr  ||= @vaddr
+			@size   ||= @encoded ? @encoded.size : 0
+			@scnptr ||= xcoff.new_label('s_scnptr')
+			super(xcoff)
+		end
+	end
+
+	# basic immediates decoding functions
+	def decode_half( edata = @encoded) edata.decode_imm(:u16, @endianness) end
+	def decode_word( edata = @encoded) edata.decode_imm(:u32, @endianness) end
+	def decode_xhalf(edata = @encoded) edata.edoced_imm((@intsize == 32 ? :u16 : :u32), @endianness) end
+	def decode_xword(edata = @encoded) edata.decode_imm((@intsize == 32 ? :u32 : :u64), @endianness) end
+	def encode_half(w)  Expression[w].encode(:u16, @endianness) end
+	def encode_word(w)  Expression[w].encode(:u32, @endianness) end
+	def encode_xhalf(w) Expression[w].encode((@intsize == 32 ? :u16 : :u32), @endianness) end
+	def encode_xword(w) Expression[w].encode((@intsize == 32 ? :u32 : :u64), @endianness) end
+
+
+	attr_accessor :header, :segments, :relocs, :intsize, :endianness
+
+	def initialize(cpu=nil)
+		@header = Header.new
+		@sections = []
+		if @cpu
+			@intsize = @cpu.size
+			@endianness = @cpu.endianness
+		else
+			@intsize = 32
+			@endianness = :little
+		end
+		super(cpu)
+	end
+
+	def decode_header(off = 0)
+		@encoded.ptr = off
+		@header.decode(self)
+		if @header.opthdr != 0
+			@optheader = OptHeader.decode(self)
+		end
+		@header.nsec.times { @sections << Section.decode(self) }
+	end
+
+	def decode
+		decode_header
+		@sections.each { |s| s.encoded = @encoded[s.scnptr, s.size] }
+	end
+
+	def encode
+		@encoded = EncodedData.new
+		@encoded << @header.encode(self)
+		@encoded << @optheader.encode(self) if @optheader
+		@sections.each { |s| @encoded << s.encode(self) }
+		va = @encoded.size
+		binding = {}
+		@sections.each { |s|
+			if s.scnptr.kind_of? ::String
+				binding[s.scnptr] = @encoded.size
+			else
+				raise 'scnptr too low' if @encoded.virtsize > s.scnptr
+				@encoded.virtsize = s.scnptr
+			end
+			va = (va + 4096 - 1)/4096*4096
+			if s.vaddr.kind_of? ::String
+				binding[s.vaddr] = va
+			else
+				va = s.vaddr
+			end
+			binding.update s.encoded.binding(va)
+			va += s.encoded.size
+			@encoded << s.encoded
+		}
+		@encoded.fixup!(binding)
+		@encoded.data
+	end
+end
+end

data/lib/metasm/gui.rb

@@ -0,0 +1,23 @@
+backend = case ENV['METASM_GUI']
+when 'gtk'; 'gtk'
+when 'qt'; 'qt'
+when 'win32'; 'win32'
+else
+	puts "Unsupported METASM_GUI #{ENV['METASM_GUI'].inspect}" if $VERBOSE and ENV['METASM_GUI']
+	if RUBY_PLATFORM =~ /(i.86|x(86_)?64)-(mswin|mingw|cygwin)/i
+		'win32'
+	else
+	begin
+		require 'gtk2'
+		'gtk'
+	rescue LoadError
+		#begin
+		#	require 'Qt4'
+		#	'qt'
+		#rescue LoadError
+			raise LoadError, 'No GUI ruby binding installed - please install libgtk2-ruby'
+		#end
+	end
+	end
+end
+require "metasm/gui/#{backend}"

data/lib/metasm/gui/cstruct.rb

@@ -0,0 +1,373 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+module Metasm
+module Gui
+class CStructWidget < DrawableWidget
+	attr_accessor :dasm, :view_x, :view_y
+
+	def initialize_widget(dasm, parent_widget)
+		@dasm = dasm
+		@parent_widget = parent_widget
+
+		@line_text_col = []	# each line is [[:col, 'text'], [:col, 'text']]
+		@line_text = []
+		@line_dereference = []	# linenr => [addr, struct] (args to focus_addr)
+		@curaddr = nil
+		@curstruct = nil
+		@tabwidth = 8
+		@view_x = @view_y = 0
+		@caret_x = @caret_y = 0
+		@cwidth = @cheight = 1	# widget size in chars
+		@structdepth = 2
+
+		@default_color_association = { :text => :black, :keyword => :blue, :caret => :black,
+			  :background => :white, :hl_word => :palered, :comment => :darkblue }
+	end
+
+	def click(x, y)
+		@caret_x = (x-1).to_i / @font_width + @view_x
+		@caret_y = y.to_i / @font_height + @view_y
+		update_caret
+	end
+
+	def rightclick(x, y)
+		click(x, y)
+		@parent_widget.clone_window(@hl_word) if @hl_word
+	end
+
+	def doubleclick(x, y)
+		click(x, y)
+		keypress(:enter)
+	end
+
+	def mouse_wheel(dir, x, y)
+		case dir
+		when :up
+			if @caret_y > 0
+				@view_y -= 4
+				@view_y = 0 if @view_y < 0
+				@caret_y -= 4
+				@caret_y = 0 if @caret_y < 0
+			end
+		when :down
+			if @caret_y < @line_text.length - 1
+				@view_y += 4
+				@caret_y += 4
+			end
+		end
+		redraw
+	end
+
+	def paint
+		@cwidth = width/@font_width
+		@cheight = height/@font_height
+
+		# adjust viewport to cursor
+		sz_x = @line_text.map { |l| l.length }.max.to_i + 1
+		sz_y = @line_text.length.to_i + 1
+		@view_x = @caret_x - @cwidth + 1 if @caret_x > @view_x + @cwidth - 1
+		@view_x = @caret_x if @caret_x < @view_x
+		@view_x = sz_x - @cwidth - 1 if @view_x >= sz_x - @cwidth
+		@view_x = 0 if @view_x < 0
+
+		@view_y = @caret_y - @cheight + 1 if @caret_y > @view_y + @cheight - 1
+		@view_y = @caret_y if @caret_y < @view_y
+		@view_y = sz_y - @cheight - 1 if @view_y >= sz_y - @cheight
+		@view_y = 0 if @view_y < 0
+
+		# current cursor position
+		x = 1
+		y = 0
+
+		@line_text_col[@view_y, @cheight + 1].each { |l|
+			cx = 0
+			l.each { |c, t|
+				cx += t.length
+				if cx-t.length > @view_x + @cwidth + 1
+				elsif cx < @view_x
+				else
+					t = t[(@view_x - cx + t.length)..-1] if cx-t.length < @view_x
+					if @hl_word
+						stmp = t
+						pre_x = 0
+						while stmp =~ /^(.*?)(\b#{Regexp.escape @hl_word}\b)/
+							s1, s2 = $1, $2
+							pre_x += s1.length*@font_width
+							hl_w = s2.length*@font_width
+							draw_rectangle_color(:hl_word, x+pre_x, y, hl_w, @font_height)
+							pre_x += hl_w
+							stmp = stmp[s1.length+s2.length..-1]
+						end
+					end
+					draw_string_color(c, x, y, t)
+					x += t.length * @font_width
+				end
+			}
+			x = 1
+			y += @font_height
+		}
+
+		if focus?
+			# draw caret
+			cx = (@caret_x-@view_x)*@font_width+1
+			cy = (@caret_y-@view_y)*@font_height
+			draw_line_color(:caret, cx, cy, cx, cy+@font_height-1)
+		end
+	
+		@oldcaret_x, @oldcaret_y = @caret_x, @caret_y
+	end
+
+	def keypress(key)
+		case key
+		when :left
+			if @caret_x >= 1
+				@caret_x -= 1
+				update_caret
+			end
+		when :up
+			if @caret_y > 0
+				@caret_y -= 1
+				update_caret
+			end
+		when :right
+			if @caret_x < @line_text[@caret_y].to_s.length
+				@caret_x += 1
+				update_caret
+			end
+		when :down
+			if @caret_y < @line_text.length
+				@caret_y += 1
+				update_caret
+			end
+		when :home
+			@caret_x = @line_text[@caret_y].to_s[/^\s*/].length
+			update_caret
+		when :end
+			@caret_x = @line_text[@caret_y].to_s.length
+			update_caret
+		when :pgup
+			@caret_y -= @cheight/2
+			@caret_y = 0 if @caret_y < 0
+			update_caret
+		when :pgdown
+			@caret_y += @cheight/2
+			@caret_y = @line_text.length if @caret_y > @line_text.length
+			update_caret
+		when :enter
+			if l = @line_dereference[@caret_y]
+				if @parent_widget
+					@parent_widget.focus_addr(l[0], :cstruct, false, l[1])
+				else
+					focus_addr(l[0], l[1])
+				end
+			end
+		when ?+
+			@structdepth += 1
+			gui_update
+		when ?-
+			@structdepth -= 1
+			gui_update
+		when ?/
+			@structdepth = 1
+			gui_update
+		when ?*
+			@structdepth =  50
+			gui_update
+		when ?l
+			liststructs
+		when ?t
+			inputbox('new struct name to use', :text => (@curstruct.name rescue '')) { |n|
+				lst = @dasm.c_parser.toplevel.struct.keys.grep(String)
+				if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase }
+					focus_addr(@curaddr, @dasm.c_parser.toplevel.struct[fn])
+				else
+					lst = @dasm.c_parser.toplevel.symbol.keys.grep(String).find_all { |ln|
+						s = @dasm.c_parser.toplevel.symbol[ln]
+						s.kind_of?(C::TypeDef) and s.untypedef.kind_of?(C::Union)
+					}
+					if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase }
+						focus_addr(@curaddr, @dasm.c_parser.toplevel.symbol[fn].untypedef)
+					else
+						liststructs(n)
+					end
+				end
+			}
+		else return false
+		end
+		true
+	end
+
+	def liststructs(partname=nil)
+		tl = @dasm.c_parser.toplevel
+		list = [['name', 'size']]
+		list += tl.struct.keys.grep(String).sort.map { |stn|
+			next if partname and stn !~ /#{partname}/i
+			st = tl.struct[stn]
+			[stn, @dasm.c_parser.sizeof(st)] if st.members
+		}.compact
+		list += tl.symbol.keys.grep(String).sort.map { |stn|
+			next if partname and stn !~ /#{partname}/i
+			st = tl.symbol[stn]
+			next unless st.kind_of?(C::TypeDef) and st.untypedef.kind_of?(C::Union)
+			[stn, @dasm.c_parser.sizeof(st)] if st.untypedef.members
+		}.compact
+
+		if partname and list.length == 2
+			focus_addr(@curaddr, tl.struct[list[1][0]] || tl.symbol[list[1][0]].untypedef)
+			return
+		end
+
+		listwindow('structs', list) { |stn|
+			focus_addr(@curaddr, tl.struct[stn[0]] || tl.symbol[stn[0]].untypedef)
+		}
+	end
+
+	def get_cursor_pos
+		[@curaddr, @curstruct, @caret_x, @caret_y, @view_y]
+	end
+
+	def set_cursor_pos(p)
+		focus_addr p[0], p[1]
+		@caret_x, @caret_y, @view_y = p[2, 3]
+		update_caret
+	end
+
+	# hint that the caret moved
+	# redraws the caret, change the hilighted word, redraw if needed
+	def update_caret
+		if @caret_x < @view_x or @caret_x >= @view_x + @cwidth or @caret_y < @view_y or @caret_y >= @view_y + @cheight
+			redraw
+		elsif update_hl_word(@line_text[@caret_y], @caret_x)
+			redraw
+		else
+			invalidate_caret(@oldcaret_x-@view_x, @oldcaret_y-@view_y)
+			invalidate_caret(@caret_x-@view_x, @caret_y-@view_y)
+		end
+		@oldcaret_x, @oldcaret_y = @caret_x, @caret_y
+	end
+
+	# focus on addr
+	# returns true on success
+	def focus_addr(addr, struct=@curstruct)
+		return if @parent_widget and not addr = @parent_widget.normalize(addr)
+		@curaddr = addr
+		@curstruct = struct
+		@caret_x = @caret_y = 0
+		gui_update
+		true
+	end
+
+	# returns the address of the data under the cursor
+	def current_address
+		@curaddr
+	end
+
+	def render_struct(obj=nil, off=nil, maxdepth=@structdepth)
+		render = lambda { |str, col|
+			if @line_text_col.last[0] == col
+				@line_text_col.last[1] << str
+			else
+				@line_text_col.last << [col, str]
+			end
+		}
+		indent = ' ' * @tabwidth
+		nl = lambda {
+			@line_text_col << []
+			render[indent * [@structdepth - maxdepth, 0].max, :text]
+		}
+		
+		if not obj
+			@line_text_col = [[]]
+			@line_dereference = []
+
+			struct = @curstruct
+			if str = @dasm.get_section_at(@curaddr)
+				obj = @dasm.c_parser.decode_c_struct(struct, str[0].read(@dasm.c_parser.sizeof(struct)))
+			else
+				render["/* unmapped area #{Expression[@curaddr]} */", :text]
+				return
+			end
+		else
+			struct = obj.struct
+		end
+
+		if maxdepth <= 0
+			render['{ /* type "+" to expand */ }', :text]
+			return
+		end
+
+		# from AllocCStruct#to_s
+		if struct.kind_of?(C::Array)
+			render["#{struct.type} ar_#{Expression[@curaddr]}[#{struct.length}] = ", :text] if not off
+			mlist = (0...struct.length)
+			el = @dasm.c_parser.sizeof(struct.type)
+			fldoff = mlist.inject({}) { |h, i| h.update i => i*el }
+		elsif struct.kind_of?(C::Struct)
+			render["struct #{struct.name || '_'} st_#{Expression[@curaddr]} = ", :text] if not off
+			fldoff = struct.fldoffset
+			fbo = struct.fldbitoffset || {}
+		else
+			render["union #{struct.name || '_'} un_#{Expression[@curaddr]} = ", :text] if not off
+		end
+		mlist ||= struct.members
+		render['{', :text]
+		mlist.each { |k|
+			if k.kind_of? C::Variable
+				ct = k.type
+				curoff = off.to_i + (fldoff && k.name ? fldoff[k.name].to_i : struct.offsetof(@dasm.c_parser, k))
+				val = obj[k]
+			else
+				ct = struct.type
+				curoff = off.to_i + fldoff[k].to_i
+				val = obj[k]
+			end
+			nl[]
+			render[indent, :text]
+			render[k.kind_of?(Integer) ? "[#{k}]" : ".#{k.name || '?'}", :text]
+			render[' = ', :text]
+			if val.kind_of?(Integer)
+				if ct.pointer? and ct.pointed.untypedef.kind_of?(C::Union)
+					@line_dereference[@line_text_col.length-1] = [val, ct.pointed.untypedef]
+				end
+				if val >= 0x100
+					val = '0x%X' % val
+				elsif val <= -0x100
+					val = '-0x%X' % -val
+				else
+					val = val.to_s
+				end
+			elsif val.kind_of?(C::AllocCStruct)
+				render_struct(val, curoff, maxdepth-1)
+				next
+			elsif not val
+				val = 'NULL' # pointer with NULL value
+			else
+				raise "unknown value #{val.inspect}"
+			end
+			render[val, :text]
+			render[',', :text]
+			render['   // +%x' % curoff, :comment]
+		}
+		nl[]
+		render['}', :text]
+		render[(off ? ',' : ';'), :text]
+	end
+
+
+	def gui_update
+		if @curstruct
+			render_struct
+		else
+			@line_text_col = [[[:text, '/* no struct selected (list with "l") */']]]
+		end
+		
+		@line_text = @line_text_col.map { |l| l.map { |c, s| s }.join }
+		update_caret
+		redraw
+	end
+end
+end
+end