metasm 1.0.0

data/samples/compilation-steps.rb

@@ -0,0 +1,49 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+# shows the compilation phase step by step: c, simplified c, asm
+
+require 'metasm'
+require 'optparse'
+
+opts = { :cpu => 'Ia32', :exe => 'Shellcode', :macros => {} }
+OptionParser.new { |opt|
+	opt.on('--pic', 'generate position-independant code') { opts[:pic] = true }
+	opt.on('--cpu cpu') { |c| opts[:cpu] = c }
+	opt.on('--exe exe') { |e| opts[:exe] = e }
+	opt.on('-D var=val', 'define a preprocessor macro') { |v| v0, v1 = v.split('=', 2) ; opts[:macros][v0] = v1 }
+	opt.on('-v') { $VERBOSE = true }
+	opt.on('-d') { $VERBOSE = $DEBUG = true }
+	opt.on('-e src') { |s| opts[:src] = s }
+}.parse!(ARGV)
+
+src = opts[:src] || (ARGV.empty? ? <<EOS : ARGF.read)
+void foo(int);
+void bla()
+{
+	int i = 10;
+	while (--i)
+		foo(i);
+}
+EOS
+
+pp = opts[:macros].map { |k, v| "#define #{k} #{v}" }.join("\n")
+
+cpu = Metasm.const_get(opts[:cpu]).new
+exe = Metasm.const_get(opts[:exe]).new(cpu)
+cpu.generate_PIC = false unless opts[:pic]
+
+cp = Metasm::C::Parser.new(exe)
+cp.parse pp
+cp.parse src
+puts cp, '', ' ----', ''
+
+cp.precompile
+puts cp, '', ' ----', ''
+
+cp = Metasm::C::Parser.new(exe)
+cp.parse pp
+cp.parse src
+puts cpu.new_ccompiler(cp).compile

data/samples/cparser_makestackoffset.rb

@@ -0,0 +1,55 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+#
+# This script takes a C header or a path to a Visual Studio install and
+# outputs a ruby source file defining StackOffsets, a hash used by the disassembler
+# In verbose mode (ruby -v), instead dumps the parsed header (+ warnings)
+#
+
+require 'metasm'
+
+filename = ARGV.shift
+abort "usage: #$0 filename" if not File.exist? filename
+
+# path to visual studio install directory
+if File.directory? filename
+	src = <<EOS
+// add the path to the visual studio std headers
+#ifdef __METASM__
+ #pragma include_dir #{(filename+'/VC/platformsdk/include').inspect}
+ #pragma include_dir #{(filename+'/VC/include').inspect}
+ #pragma prepare_visualstudio
+ #pragma no_warn_redefinition
+#endif
+
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+EOS
+else
+	# standalone header
+	src = File.read(filename)
+end
+
+include Metasm
+
+cp = Ia32.new.new_cparser.parse(src)
+
+if not $VERBOSE
+funcs = cp.toplevel.symbol.values.grep(C::Variable).reject { |v| v.initializer or not v.type.kind_of? C::Function }
+
+puts 'module Metasm'
+puts 'StackOffsets = {'
+align = lambda { |val| (val + cp.typesize[:ptr] - 1) / cp.typesize[:ptr] * cp.typesize[:ptr] }
+puts funcs.find_all { |f| f.attributes and f.attributes.include? 'stdcall' and f.type.args }.sort_by { |f| f.name }.map { |f|
+	"#{f.name.inspect} => #{f.type.args.inject(0) { |sum, arg| sum + align[cp.sizeof(arg)] }}"
+}.join(",\n")
+puts '}'
+puts 'end'
+else
+	# dump the full parsed header
+	puts cp.lexer.dump_macros(cp.lexer.definition.keys, false), '', '', cp
+end

data/samples/dasm-backtrack.rb

@@ -0,0 +1,38 @@
+#!/usr/bin/env ruby
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+#
+# quick demonstration that the disassembler's backtracker works
+#
+
+require 'metasm'
+Metasm.require 'samples/metasm-shell'
+
+puts <<EOS.encode.decode
+.base_addr 0
+
+; compute jump target
+mov ebx, 0x12345678
+mov eax, ((toto + 12) ^ 0x12345678)
+xor eax, ebx
+sub eax, 12
+
+; jump
+call eax
+
+; trap
+add eax, 42
+; die, you vile reverser !
+db 0e9h
+
+; real target
+toto:
+mov eax, 28h
+pop ebx
+ret
+
+EOS

data/samples/dasmnavig.rb

@@ -0,0 +1,318 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+#
+# this is a little script to navigate in a disassembler dump
+#
+
+# copypasted from lindebug.rb
+module Ansi
+	CursHome = "\e[H".freeze
+	ClearLineAfter  = "\e[0K"
+	ClearLineBefore = "\e[1K"
+	ClearLine = "\e[2K"
+	ClearScreen = "\e[2J"
+	def self.set_cursor_pos(y=1,x=1) "\e[#{y};#{x}H" end
+	Reset = "\e[m"
+	Colors = [:black, :red, :green, :yellow, :blue, :magenta, :cyan, :white, :aoeu, :reset]
+	def self.color(*args)
+		fg = true
+		"\e[" << args.map { |a|
+			case a
+			when :bold; 2
+			when :negative; 7
+			when :normal; 22
+			when :positive; 27
+			else
+				if col = Colors.index(a)
+					add = (fg ? 30 : 40)
+					fg = false
+					col+add
+				end
+			end
+		}.compact.join(';') << 'm'
+	end
+	def self.hline(len) "\e(0"<<'q'*len<<"\e(B" end
+
+	TIOCGWINSZ = 0x5413
+	TCGETS = 0x5401
+	TCSETS = 0x5402
+	CANON = 2
+	ECHO  = 8
+	def self.get_terminal_size
+		s = ''.ljust(8)
+		$stdin.ioctl(TIOCGWINSZ, s) >= 0 ? s.unpack('SS') : [80, 25]
+	end
+	def self.set_term_canon(bool)
+		tty = ''.ljust(256)
+		$stdin.ioctl(TCGETS, tty)
+		if bool
+			tty[12] &= ~(ECHO|CANON)
+		else
+			tty[12] |= ECHO|CANON
+		end
+		$stdin.ioctl(TCSETS, tty)
+	end
+
+	ESC_SEQ = {'A' => :up, 'B' => :down, 'C' => :right, 'D' => :left,
+		'1~' => :home, '2~' => :inser, '3~' => :suppr, '4~' => :end,
+		'5~' => :pgup, '6~' => :pgdown,
+		'P' => :f1, 'Q' => :f2, 'R' => :f3, 'S' => :f4,
+		'15~' => :f5, '17~' => :f6, '18~' => :f7, '19~' => :f8,
+		'20~' => :f9, '21~' => :f10, '23~' => :f11, '24~' => :f12,
+		'[A' => :f1, '[B' => :f2, '[C' => :f3, '[D' => :f4, '[E' => :f5,
+		'H' => :home, 'F' => :end,
+	}
+	def self.getkey
+		c = $stdin.getc
+		return c if c != ?\e
+		c = $stdin.getc
+		if c != ?[ and c != ?O
+			$stdin.ungetc c
+			return ?\e
+		end
+		seq = ''
+		loop do
+			c = $stdin.getc
+			seq << c
+			case c; when ?a..?z, ?A..?Z, ?~; break end
+		end
+		ESC_SEQ[seq] || seq
+	end
+end
+
+class Viewer
+	attr_accessor :text, :pos, :x, :y
+
+	Color = {
+		:normal  => Ansi.color(:white, :black, :normal),
+		:comment => Ansi.color(:blue),
+		:label   => Ansi.color(:green),
+		:hilight => Ansi.color(:yellow),
+	}
+
+
+	def initialize(text)
+		text = File.read(text) if File.exist? text rescue nil
+		@text = text.gsub("\t", " "*8).to_a.map { |l| l.chomp }
+		@pos = @posh = 0
+		@x = @y = 0
+		@mode = :navig
+		@searchtext = 'x'
+		@posstack = []
+		@h, @w = Ansi.get_terminal_size
+		@h -= 2
+		@w -= 1
+		if y = @text.index('entrypoint:')
+			view(0, y)
+		end
+	end
+
+	def main_loop
+		Ansi.set_term_canon(true)
+		$stdout.write Ansi::ClearScreen
+		begin
+			loop do
+				refresh if not s = IO.select([$stdin], nil, nil, 0)
+				handle_key(Ansi.getkey)
+			end
+		ensure
+			Ansi.set_term_canon(false)
+			$stdout.write Ansi.set_cursor_pos(@h+2, 0) + Ansi::ClearLineAfter
+		end
+	end
+
+	def refresh
+		case @mode
+		when :navig
+			refresh_navig
+		when :search
+			refresh_search
+		end
+	end
+
+	def refresh_navig
+		str = ''
+		#str << Ansi::ClearScreen
+		str << Ansi.set_cursor_pos(0, 0)
+		hl = readtext
+		(0..@h).each { |h|
+			l = @text[@pos+h] || ''
+			str << outline(l, hl) << Ansi::ClearLineAfter << "\n"
+		}
+		str << Ansi.set_cursor_pos(@y+1, @x+1)
+		$stdout.write str
+	end
+
+	def refresh_search
+		$stdout.write '' << Ansi.set_cursor_pos(@h+2, 1) << '/' << @searchtext << Ansi::ClearLineAfter
+	end
+
+	def outline(l, hl=nil)
+		l = l[@posh, @w] || ''
+		hlr = /\b#{Regexp.escape(hl)}\b/i if hl
+		case l
+		when /^\/\//; Color[:comment] + l + Color[:normal]
+		when /^\S+:$/; Color[:label] + l + Color[:normal]
+		when /^(.*)(;.*)$/
+			str = $1
+			cmt = $2
+			str.gsub!(hlr, Color[:hilight]+hl+Color[:normal]) if hl
+			str + Color[:comment] + cmt + Color[:normal]
+		else
+			l = l.gsub(hlr, Color[:hilight]+hl+Color[:normal]) if hl
+			l
+		end
+	end
+
+	def search_prev
+		return if @searchtext == ''
+		y = @pos+@y-1
+		loop do
+			y = @text.length-1 if not @text[y] or y < 0
+			if x = (@text[y] =~ /#@searchtext/i)
+				view(x, y)
+				return
+			end
+			y -= 1
+			break if y == @pos+@y
+		end
+	end
+
+	def search_next
+		return if @searchtext == ''
+		y = @pos+@y+1
+		loop do
+			y = 0 if not @text[y]
+			if x = (@text[y] =~ /#@searchtext/i)
+				view(x, y)
+				return
+			end
+			break if y == @pos+@y or (y >= @text.length and not @text[@pos+@y])
+			y += 1
+		end
+	end
+
+	def view(x, y)
+		@posh, @x = 0, x
+		if @x > @w
+			@posh = @w-@x
+			@x = @w
+		end
+		if @pos+@h < y
+			@y = @h/2-1
+			@pos = y-@y
+		elsif @pos > y
+			@y = 1
+			@pos = y-@y
+		else
+			@y = y-@pos
+		end
+	end
+
+	def readtext
+		return if not l = @text[@pos+@y]
+		x = (l.rindex(/\W/, [@posh+@x-1, 0].max) || -1)+1
+		t = l[x..-1][/^\w+/]
+		t if t and @posh+@x < x+t.length
+	end
+
+	def handle_key(k)
+		case @mode
+		when :navig
+			handle_key_navig(k)
+		when :search
+			handle_key_search(k)
+		end
+	end
+
+	def handle_key_search(k)
+		case k
+		when ?\n; @mode = :navig ; @posstack << [@posh, @pos, @x, @y] ; search_next
+		when 0x20..0x7e; @searchtext << k
+		when :backspace, 0x7f; @searchtext.chop!
+		end
+	end
+
+	def handle_key_navig(k)
+		case k
+		when :f1
+			if not @posstack.empty?
+				@posh, @pos, @x, @y = @posstack.pop
+			end
+		when ?\n
+			return if not label = readtext
+			return if label.empty? or not newy = @text.index(@text.find { |l| l[0, label.length] == label }) or newy == @pos+@y
+			@posstack << [@posh, @pos, @x, @y]
+			view(0, newy)
+		when :up
+			if @y > 0; @y -= 1
+			elsif @pos > 0; @pos -= 1
+			end
+		when :down
+			if @y < @h; @y += 1
+			elsif @pos < text.length-@h; @pos += 1
+			end
+		when :home
+			@x = @posh = 0
+		when :end
+			@x = @text[@pos+@y].length
+			@posh, @x = @x-@w, @w if @x > @w
+		when :left
+			x = @text[@pos+@y].rindex(/\W\w/, [@posh+@x-2, 0].max)
+			x = x ? x+1 : @posh+@x-1
+			x = @posh+@x-3 if x < @posh+@x-3
+			x = 0 if x < 0
+			if x < @posh; @posh, @x = x, 0
+			else @x = x-@posh
+			end
+			#if @x > 0; @x -= 1
+			#elsif @posh > 0; @posh -= 1
+			#end
+		when :right
+			x = @text[@pos+@y].index(/\W\w/, @posh+@x)
+			x = x ? x+1 : @posh+@x+1
+			x = @posh+@x+3 if x > @posh+@x+3
+			if x > @posh+@w; @posh, @x = x-@w, @w
+			else
+				@x = x-@posh
+				@posh, @x = @x-@w, @w if @x > @w
+			end
+			#if @x < @w; @x += 1
+			#elsif @posh+@w < (@text[@pos, @h].map { |l| l.length }.max); @posh += 1
+			#end
+		when :pgdown
+			if @y < @h/2; @y += @h/2
+			elsif @pos < @text.length-3*@h/2; @pos += @h/2 ; @y = @h
+			else @pos = [0, @text.length-@h].max ; @y = @h
+			end
+		when :pgup
+			if @y > @h/2; @y -= @h/2
+			elsif @pos > @h/2; @pos -= @h/2 ; @y = 0
+			else @pos = @y = 0
+			end
+		when ?q; exit
+		when ?o; @text.insert(@pos+@y+1, '')
+		when ?O; @text.insert(@pos+@y, '') ; handle_key_navig(:down)
+		when :suppr; @text.delete_at(@pos+@y) if @text[@pos+@y] == ''
+		when ?D; @text.delete_at(@pos+@y)
+		when ?/
+			@mode = :search
+			@searchtext = ''
+		when ?*
+			@searchtext = readtext || ''
+			search_next
+		when ?n; search_next
+		when ?N; search_prev
+		when :f5
+			ARGV << '--reload'
+			load $0
+		end
+	end
+end
+
+if $0 == __FILE__ and not ARGV.delete '--reload'
+	Viewer.new(ARGF.read).main_loop
+end