metasm 1.0.1 → 1.0.2

data/samples/metasm-shell.rb

@@ -31,8 +31,7 @@ class String
 
 	# encodes the current string as a Shellcode, returns the resulting EncodedData
 	def encode_edata
-		s = Metasm::Shellcode.assemble @@cpu, self
-		s.encoded
+		Metasm::Shellcode.assemble(@@cpu, self).encode.encoded
 	end
 
 	# encodes the current string as a Shellcode, returns the resulting binary String

data/samples/peldr.rb

@@ -148,7 +148,7 @@ class PeLdr
 			end
 		}
 
-		cp.numeric_constants.each { |k, v|
+		cp.numeric_constants.each { |k, v, f|
 			n = k.upcase
 			n = "C#{n}" if n !~ /^[A-Z]/
 			DL.const_set(n, v) if not DL.const_defined?(n) and v.kind_of? Integer
@@ -178,7 +178,7 @@ class PeLdr
 
 	def self.populate_peb
 		DL.memory_write(@@peb, 0.chr*4096)
-		set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) }
+		#set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) }
 	end
 
 	def self.teb ; @@teb ; end

data/tests/all.rb

@@ -4,5 +4,5 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-Dir['tests/*.rb'].each { |f| require f }
+Dir['tests/*.rb'].sort.each { |f| require f }
 

data/tests/arc.rb

@@ -0,0 +1,26 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'test/unit'
+require 'metasm'
+
+class TestArc < Test::Unit::TestCase
+	def test_arc_dec
+		hex_stream =  "\x0A\x23\x80\x0F\x80\x0\x60\x0D" # mov r3, 0x800D60
+		hex_stream += "\x40\x83"          # ld_s r2, [r3, 0]
+
+		dasm = Metasm::Shellcode.disassemble(Metasm::ARC.new, hex_stream)
+		assert_equal(2, dasm.decoded.length)
+
+		assert_equal('mov', dasm.decoded[0].instruction.opname)
+		assert_equal('r3', dasm.decoded[0].instruction.args[0].to_s)
+		assert_equal(0x800d60, dasm.decoded[0].instruction.args[1].reduce)
+
+		assert_equal('ld_s', dasm.decoded[8].instruction.opname)
+		assert_equal('r2', dasm.decoded[8].instruction.args[0].to_s)
+		assert_equal('r3', dasm.decoded[8].instruction.args[1].base.to_s)
+		assert_equal(0, dasm.decoded[8].instruction.args[1].disp.reduce)
+	end
+end

data/tests/dynldr.rb

@@ -7,29 +7,47 @@ require 'test/unit'
 require 'metasm'
 
 class TestDynldr < Test::Unit::TestCase
+	def d; Metasm::DynLdr; end
 
-	def test_dynldr
+	def test_new_api_c
 		str = "1234"
-		d = Metasm::DynLdr
 		d.new_api_c('int memcpy(char*, char*, int)')
 		d.memcpy(str, "9999", 2)
 		assert_equal('9934', str)
+	end
 
+	def test_new_func_c
 		c_src = <<EOS
-int sprintf(char*, char*, ...);
+int sprintf(char*, char*, ...);			// stdlib external
 void fufu(int i, char* ptr)
 {
-	sprintf(ptr, "lolzor %i\\n", i);
+	static int meh;				// .data
+	meh = i;
+	sprintf(ptr, "lolzor %i\\n", meh);	// string constant = .rodata
 }
 EOS
 		buf = 'aaaaaaaaaaaaaaaaaa'
 		d.new_func_c(c_src) { d.fufu(42, buf) }
 		assert_equal("lolzor 42\n\000aaaaaaa", buf)
+	end
 
+	def test_new_func_asm
 		if d.host_cpu.shortname == 'ia32'
 			ret = d.new_func_asm('int __fastcall bla(int)', "lea eax, [ecx+1]\nret") { d.bla(42) }
 			assert_equal(43, ret)
 			assert_equal(false, d.respond_to?(:bla))
 		end
 	end
+
+	def test_callback
+		c1 = d.callback_alloc_c('int lol(int);') { |i| i+1 }
+		c2 = d.callback_alloc_c('int lol(int);') { |i| i+2 }
+		c3 = d.callback_alloc_c('int lol(int);') { |i| i/2 }
+
+		d.new_func_c "int blop(int i, int (*fp)(int)) { return fp(i); }"
+		
+		assert_equal(2, d.blop(1, c1))
+		assert_equal(4, d.blop(2, c2))
+		assert_equal(6, d.blop(13, c3))
+	end
 end

data/tests/expression.rb

@@ -0,0 +1,55 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'test/unit'
+require 'metasm'
+
+class TestExpression < Test::Unit::TestCase
+	E = Metasm::Expression
+	def test_encode
+		assert_equal("\x04\0\0\0", E[4].encode(:u32, :little).data)
+	end
+
+	def test_numeric
+		assert_equal(5, E[4, :+, 1].reduce)
+	end
+
+	def test_reduce
+		assert_equal(0, E[:a, :-, :a].reduce)
+		assert_equal(0, E[:a, :^, :a].reduce)
+
+		assert_equal(E[:a, :^, 3], E[[1, :^, :a], :^, 2].reduce)
+		assert_equal(E[:a], E[[:b, :^, :a], :^, :b].reduce)
+
+		assert_equal(E[:a, :+, 2], E[:b, :+, [:a, :-, [4, :+, [:b, :-, 6]]]].reduce)
+		assert_equal(E[:a, :&, 0xff00], E[[[:a, :>>, 8], :&, 0xff], :<<, 8].reduce)
+
+		assert_equal(E[[:a, :>>, 1], :&, 0xff0], E[[[:a, :>>, 5], :&, 0xff], :<<, 4].reduce)
+
+		assert_equal(0, E[[:a, :&, 0xff00], :&, [:b, :&, 0xff]].reduce)
+		assert_equal(0, E[[:a, :&, 0xff], :>>, 8].reduce)
+
+		assert_equal(E[:a, :&, 0xffff], E[[:a, :&, 0x3333], :|, [[:a, :&, 0x8888], :+, [:a, :&, 0x4444]]].reduce)
+
+		assert_equal(E[:a, :&, 0xff], E[[:a, :|, [:b, :&, 0xff00]], :&, 0xff].reduce)
+
+		assert_equal(1, E[[2, :>, 1], :'||', [:a, :<=, :b]].reduce)
+		assert_equal(0, E[[:a, :>, :b], :'&&', [1, :>, 2]].reduce)
+
+		assert_equal(E[:a, :>, :b], E[[:'!', [:a, :<=, :b]], :==, 1].reduce)
+	end
+
+	def test_pattern
+		pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :|, 'b'], 'a', 'b')
+		assert_equal(false, pat)
+
+		pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :+, 'b'], 'a', 'b')
+		assert_equal(:a, pat['a'])
+		p2 = pat['b'].match(E[:a, :b, :c], :a, :b, :c)
+		assert_equal(0xffff, p2[:c])
+		assert_equal(:&, p2[:b])
+	end
+end

data/tests/graph_layout.rb

@@ -0,0 +1,285 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# special file to test the graph layout engine
+# call this file directly to run
+
+require 'metasm'
+include Metasm
+
+def test_layout(lo)
+	$cur ||= 0
+	$cur += 1
+	if $target.to_i != 0
+		return if $cur != $target
+	else
+		return if not lo.include? $target
+	end if $target
+	puts $cur, lo, '' if $VERBOSE
+	w = Gui::Window.new
+	ww = w.widget = Gui::GraphViewWidget.new(nil, nil)
+	ww.grab_focus
+	Gui.idle_add {
+		ww.load_dot(lo)
+		ww.curcontext.auto_arrange_boxes
+		ww.zoom_all
+		false
+	}
+	Gui.main
+end
+
+def test_all
+	test_layout <<EOS
+line -> 2 -> 3 -> 4 -> 5 -> 6 -> 7;
+EOS
+	test_layout <<EOS
+sep1 -> 1;
+sep2 -> 2;
+sep3 -> 3;
+sep4 -> 4;
+sep5 -> 5;
+EOS
+	test_layout <<EOS
+fork -> 2 -> 3;
+2 -> 4;
+EOS
+	test_layout <<EOS
+diamond -> 2 -> 3 -> 5;
+2 -> 4 -> 5;
+EOS
+	test_layout <<EOS
+ifthen -> 2 -> 3 -> 4;
+2 -> 4;
+EOS
+	test_layout <<EOS
+ufork -> 2 -> 3;
+1 -> 2;
+EOS
+	test_layout <<EOS
+multidiamond -> 2 -> 31 -> 32 -> 34 -> 5 -> 6 -> 8;
+2 -> 41 -> 42 -> 44 -> 5 -> 7 -> 8;
+41 -> 43 -> 44;
+31 -> 33 -> 34;
+EOS
+	test_layout <<EOS
+dmdout -> 2 -> 3a -> 4;
+2 -> 3b -> 4;
+3a -> 4a;
+3b -> 4b;
+EOS
+	test_layout <<EOS
+ifthenthen -> 2 -> 8;
+2 -> 3 -> 8;
+2 -> 4 -> 5 -> 8;
+2 -> 6 -> 7 -> 8;
+EOS
+	test_layout <<EOS
+multipod -> 2 -> 3;
+2 -> 4;
+2 -> 5;
+2 -> 6;
+2 -> 7;
+2 -> 8;
+EOS
+	test_layout <<EOS
+mplarge -> 1 -> 2;
+1 -> 3333333333333333333333333333333333;
+EOS
+	test_layout <<EOS
+multif -> 1
+1 -> a2 -> a3
+a2 -> a222222222 -> a3
+1 -> b2 -> b3
+b2 -> b222222222 -> b3
+EOS
+	test_layout <<EOS
+ifx -> 1 -> 2 -> 3 -> 4 -> 5
+4 -> eeeeeeeeeeee -> 5
+EOS
+	test_layout <<EOS
+llll -> 1 -> 22222222222222222222222222 -> e
+1 -> 33333333333333333333333333 -> e
+1 -> 4444444444444444444444 -> e
+1 -> 5 -> e
+5 -> 5t -> e
+1 -> 6 -> e
+6 -> 6t -> e
+1 -> 7 -> e
+7 -> 7t -> e
+EOS
+	test_layout <<EOS
+dangling -> 2 -> 11 -> 12 -> 13 -> 4;
+2 -> 21 -> 22 -> 23 -> 4;
+2 -> 31 -> 32 -> 33 -> 4;
+21 -> 2z;
+31 -> 3z;
+EOS
+	test_layout <<EOS
+dangin -> 2 -> 11 -> 12 -> 13;
+2 -> 21 -> 22 -> 13;
+2 -> 31 -> 32 -> 33;
+22 -> 33;
+21 -> z;
+EOS
+	test_layout <<EOS
+cascadeclean -> 2 -> 3 -> 4 -> 5 -> 6 -> 62 -> 52 -> 42 -> 32 -> 22 -> e;
+2 -> 21 -> 22;
+3 -> 31 -> 32;
+4 -> 41 -> 42;
+5 -> 51 -> 52;
+6 -> 61 -> 62;
+EOS
+	test_layout <<EOS
+cascade -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e;
+2 -> 21 -> e;
+3 -> 31 -> e;
+4 -> 41 -> e;
+5 -> 51 -> e;
+6 -> 61 -> e;
+EOS
+	test_layout <<EOS
+rstair -> 2 -> 3 -> 4 -> 5 -> 6;
+2 -> 4;
+2 -> 5;
+2 -> 6;
+EOS
+	test_layout <<EOS
+drstair -> 2a -> 3 -> 4 -> 5 -> 6;
+drstair -> 2b -> 4;
+2a -> 4;
+2a -> 5;
+2a -> 6;
+2b -> 4;
+2b -> 5;
+2b -> 6;
+EOS
+	test_layout <<EOS
+mrstair -> 2a -> 3a -> 4a -> 5a -> 6a;
+mrstair -> 2b -> 4a;
+2a -> 4a;
+2a -> 5a;
+2a -> 6a;
+2b -> 4a;
+2b -> 5a;
+2b -> 6a;
+2a -> 3b -> 4b -> 5b -> 6b;
+2a -> 4b;
+2a -> 5b;
+2a -> 6b;
+2b -> 3b;
+2b -> 4b;
+2b -> 5b;
+2b -> 6b;
+EOS
+	test_layout <<EOS
+loop -> 2 -> 3 -> 4;
+3 -> 2;
+EOS
+	test_layout <<EOS
+loopbreak -> 2 -> 3 -> e;
+2 -> 4 -> 5 -> 6 -> 8 -> e;
+5 -> 7 -> 4;
+EOS
+	test_layout <<EOS
+loopbreak2 -> 2 -> 3 -> e;
+2 -> 4 -> 5 -> 6 -> 8 -> e;
+5 -> 7 -> 4;
+7 -> 8;
+EOS
+	test_layout <<EOS
+unbalance -> 2 -> 3 -> 4 -> 5 -> e;
+2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e;
+EOS
+	test_layout <<EOS
+unbalance2 -> 2 -> 3 -> e;
+2 -> 4 -> e;
+2 -> 5 -> e;
+2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e;
+EOS
+	test_layout <<EOS
+unbalance3 -> 2 -> 3 -> e;
+2 -> 4 -> e;
+2 -> 5 -> e;
+2 -> 6 -> e;
+8 -> 9 -> e;
+2 -> 7 -> e;
+EOS
+	test_layout <<EOS
+disjoint -> 1 -> 2 -> 3 -> 4 -> 5 -> 6;
+l1 -> l2;
+l1 -> l3;
+l1 -> l4;
+l1 -> l5;
+l1 -> l6;
+EOS
+
+	test_layout <<EOS
+lol -> 2 -> 31 -> 41 -> 5;
+2 -> 32 -> 42 -> 5;
+31 -> 42;
+41 -> 32;
+EOS
+	test_layout <<EOS
+nestloop -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e;
+6 -> 4;
+7 -> 3;
+EOS
+	test_layout <<EOS
+escape -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> 8;
+2 -> 21;
+4 -> 6;
+EOS
+	test_layout <<EOS
+loophead -> 1 -> loophead;
+2 -> 3 -> 2;
+3 -> 4;
+1 -> 4;
+EOS
+	test_layout <<EOS
+1 -> e1;
+l00pz -> 1 -> l00pz;
+l2 -> 2 -> l2;
+2 -> e1;
+2 -> e2;
+l3 -> 3 -> l3;
+3 -> e2;
+EOS
+	test_layout <<EOS
+3loop -> 1 -> 3loop;
+1 -> 2 -> 3  -> 2;
+0 -> 00 -> 0 -> 2;
+EOS
+	test_layout <<EOS
+foo -> 0 -> 1
+0 -> 2 -> 3 -> 4 -> 5
+4 -> 6
+4 -> 7 -> 5
+4 -> 8 -> 6
+2 -> 1 -> 7
+3 -> 1 -> 8
+EOS
+	test_layout <<EOS
+dang -> 2 -> 3 -> 4 -> 5 -> 6 -> 4;
+2 -> 9;
+5 -> 9;
+EOS
+	test_layout <<EOS
+dang2 -> 2 -> 3 -> 4 -> 5 -> 6 -> 4
+2 -> 9
+5 -> 9
+9 -> a -> 9
+EOS
+	test_layout <<EOS
+onlyloop -> onlyloop
+EOS
+
+rescue Interrupt
+end
+
+if __FILE__ == $0
+	$target = ARGV[0]
+	test_all
+end