summaryrefslogtreecommitdiffstats
path: root/sploit/symtbl.py (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2023-02-24symtbl: Refactor module as an improved container type (and more)Malfurious1-51/+182
This effort was triggered by three immediate wants of the module: An improved data container interface to support things like key iteration and better key management. This is primarily wanted by the ROP module (which is still in development). The introduction of package documentation across the project. This module is now fully documented. To fix a bug in the Symtbl constructor, which would not allow a caller to supply "self" as an initial symbol name, even though it is legal in every other context. This problem was caused by the constructor's bound instance parameter sharing this name. This patch addresses all of these concerns, and also introduces some fringe / QoL improvements that were discovered during the API refactor. Element access may now be done via subscripting, as well as the previous (and still generally perferred) .attribute notation. The syntax for storing subtables within a parent Symtbl is now greatly streamlined due to some implementation-level changes to the class. You may now directly assign just a Symtbl object or a normal int, and you don't have to fuss with tuples anymore. The subtable's base is taken as its offset in the parent, and the new operator replacement for the .map() method may be used to define a desired value for the parent. This detail is actually a breaking change compared to the previous version. While not technically a bug, it is unintuitive that the previous version would not remove subtables when their offset was changed by a simple assignment - the table would just move. This patch make it such that any symbol assignment to a regular int will replace an old mounted subtable if one exists. There are now no normal instance methods on the Symtbl type (only dunder method overrides). This is to free up the available symbol namespace as much as possible. The previous methods map(), adjust(), and rebase() are now implemented as operators which, in every case, yield a new derivative object, rather than mutating the original. All operators are listed here: @ remap to absolute address + remap to relative address - remap to negated relative address >> adjust all symbol offsets upward << adjust all symbol offsets downward % rebase all symbol offsets around an absolute zero point Additionally, Symtbl objects will convert to an integer via int(), hex(), oct(), or bin(), yielding the base value. The addition of these operators presents another breaking change to the previous version. Previously, symbol adjustments or rebases affected the tracked offsets and caused symbols to shift around in linked tables as well. Since these operators now preserve the state of their source object, this is no longer the case. The amount of shift due to adjustment or rebasing is localized in a specific Symtbl instance (and is affected the the use of the related operators), however this value is inherited by derivatives of that object. There is a third breaking change caused by the use of operators as well. Previously, the map() function allowed the caller to specify that the given absolute address is not that of the table base, but of some offset in the table, from which the new base is calculated. However, the remapping operators take only a single numeric value as their right hand side operand, which is the absolute or relative address. The new intended way of accomplishing this (which is _nearly_ equivalent) is through the combined use of the rebase and remap operations: # The address of the puts() function in a libc tbl is leaked sym = sym % sym.puts @ leak aka: adjust offsets such that the known point is at the base, then move that base to the known location. The way in which this is different to what you would end up with before is that previously, following a map(abs, off) the base of the table would be accurately valued according to the known information. Now, the 'base' is considered to be the leaked value, but internal offsets are shifted such that they still resolve correctly. Finally, a few new pieces of functionality are added to build out the container API: - symbol key deletion - iteration over symbol:offset pairs - can now check for symbol existence with the "in" keyword - len(symtbl) returns the number of symbols defined Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2023-02-24symtbl: Rename file to match class nameMalfurious1-0/+0
I assume that the preferred style is to leave one major class each to a file. In this case, synchronize the names of the Symtbl class and its containing module. Per PEP8, the module is lowercase, and the class remains Pascal case. If other memory-oriented utilities are introduced in the future, we may wish to move them, as well as Symtbl, back into a subpackage named 'mem'. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: Fix bugs involving Symtbl base valueMalfurious1-1/+1
Some code previously assumed a Symtbl's base value to always be zero. This was often the case, however the assumption would break (for example) when attempting to rebase() a mapped Symtbl. As of the previous patch enabling freer modification of base, the potentiality of these bugs will be higher. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: mem: Allow Symtbl base to be modifiedMalfurious1-6/+8
Allow a Symtbl's base to be modified in-place, without mapping into a new object. This is useful when working with the Symtbl aspect of a Payload. This includes setting a non-zero base on construction. As usual, when defining base on construction, any additional kwargs symbols are interpreted relative to the given base. The order of arguments does not matter. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-17sploit: Fix bugs and simplify SymtblMalfurious1-82/+45
The recent implementation of the new design for Symtbl contained a few bugs: - Attempting to access .base on a Symtbl or intermediate __InnerTable__ caused an exception. - Symtbl objects all used the same static collection of nested subtables, rather than an instanced one. If two table objects contained the same named key, they would refer to the same nested table from both locations. - Printing the contents of a table accessed via an absolute nesting (aka: via an __InnerTable__ object) would not show the offsets adjusted for the curent context. In addition to these fixes, the class implementation is largely simplified as well. This is in part due to the removal of unnecessary logic, such as the way our __getattribute__ overloads were implemented. Mainly, this came down to merging the redundant abstractions in our original design. Over time, the differences between these interfaces became blurred to the point where simply reusing one is not at all problematic. It is very much the intent of this patch to preserve the semantics of the tool's design (that being: flexable, nestable tables, to which a separate, but linked, mapped view may be obtained), but to state it as cleanly as possible. Note that all of the working state of a Symtbl is kept in its new _namesp member. This is primarily done to enable subclassing the Symtbl class. Ordinarily, setattr() on self would force the incoming value into the actual symbol table, making it impossible for subclasses to store separate instance data. Furthermore, the consolidation of properties into this object creates fewer potential collisions with user-defined symbols. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-13sploit: Move __attr_filter__ to a general place in utildusoleil1-2/+2
Found a spot to use __attr_filter__ in the rev module, so moving it out of mem and into a shared place (util). Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-13sploit: Filter all magic python members by default in mem moduledusoleil1-3/+6
In the various __getattribute__() overloads in the mem module, we should filter all of the built-in magic members to do the default object.__getattribute__() behavior. This is opposed to the earlier stance of just caring about the ones that I saw as realistically being called. Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-13sploit: Add support for nested Symtblsdusoleil1-3/+45
Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-13sploit: Instantiate Memmap with integer offsetdusoleil1-6/+6
Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-13sploit: remove length calculation from Symtbldusoleil1-13/+1
length() fails on local stack frames (where it was originally intended to be useful) when register based locals (like arguments) are present. Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-12sploit: code reuse for mem string methodsdusoleil1-12/+14
Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-12sploit: add len func to memdusoleil1-0/+11
len() will calculate the length of the symtbl in bytes rather than the number of symbols Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-12sploit: move adjust and rebase into member funcsdusoleil1-7/+6
Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-10Add adjust and rebase functions to mem moduledusoleil1-0/+8
Add the ability to shift all Symtbl offsets by a fixed amount with adjust(). Add the ability to shift all Symtbl offsets so that a designated symbol is now at offset 0 and all other symbols maintain their relative offsets to that symbol with rebase(). Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-10sploit: Add string cast for Symtbl and Memmapdusoleil1-0/+16
Add string cast to mem module types so that they can be printed out in a human readable format. Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-03-10sploit: Split Symtbl funcionality with Memmapdusoleil1-11/+15
Symtbl now only deals with offets. A read-only view of a symtbl can be created via the Memmap class. This view also takes an absolute address for a symbol and will return adjusted addresses based on this. This replaces the addr() method. Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2021-09-02Add mem module for calculating memory offsetsdusoleil1-0/+15
Signed-off-by: dusoleil <howcansocksbereal@gmail.com>