diff options
Diffstat (limited to 'sploit/arch.py')
| -rw-r--r-- | sploit/arch.py | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/sploit/arch.py b/sploit/arch.py index 97c1140..a9dea61 100644 --- a/sploit/arch.py +++ b/sploit/arch.py @@ -22,10 +22,10 @@ def __define_architectures(): # All predefined architectures should be listed here # These will also be added to the module's namespace __arch_list = { - 'x86' : Arch( 'x86', 4, 'little', 16, b'\x90'), - 'x86_64' : Arch( 'x86', 8, 'little', 16, b'\x90'), - 'ARM' : Arch( 'arm', 4, 'little', 8, b'\xe1\xa0\x00\x00'), - 'THUMB' : Arch( 'arm', 4, 'little', 8, b'\x46\xc0') + 'x86' : Arch('x86', 4, 'little', 16, 'ret', 'int 0x80', b'\x90', ['pop {}','ret'], [r'add esp, (\w+)','ret'], [r'mov dword \[(?P<dst>\w+)\], (?P<src>\w+)','ret'], [], ['eax','ebx','ecx','edx','esi','edi','ebp']), + 'x86_64' : Arch('x86', 8, 'little', 16, 'ret', 'syscall', b'\x90', ['pop {}','ret'], [r'add rsp, (\w+)','ret'], [r'mov qword \[(?P<dst>\w+)\], (?P<src>\w+)','ret'], ['rdi','rsi','rdx','rcx','r8','r9'], ['rax','rdi','rsi','rdx','r10','r8','r9']), + 'ARM' : Arch('arm', 4, 'little', 8, 'pop {pc}', 'svc 0', b'\xe1\xa0\x00\x00', ['pop {{{}, pc}}'], [r'add sp, sp, ([^r]\w*)','pop {pc}'], [r'str (?P<src>\w+), \[(?P<dst>\w+)\]','pop {pc}'], ['r0','r1','r2','r3'], ['r7','r0','r1','r2','r3','r4','r5']), + 'THUMB' : Arch('arm', 4, 'little', 8, 'pop {pc}', 'svc 0', b'\x46\xc0', ['pop {{{}, pc}}'], [r'add sp, sp, ([^r]\w*)','pop {pc}'], [r'str (?P<src>\w+), \[(?P<dst>\w+)\]','pop {pc}'], ['r0','r1','r2','r3'], ['r7','r0','r1','r2','r3','r4','r5']), } globals().update(__arch_list) global __arch_lookup @@ -41,14 +41,30 @@ class Arch: endianness (str): byte order. either "little" or "big" alignment (int): the multiple, in bytes, that return addresses must exist on the stack + ret (str): mnemonic for a "return" instruction + syscall (str): mnemonic for a "syscall" or "service call" instruction nopcode (bytes): the exact bytes of a "do nothing" instruction + popgad (list[str]): ROP gadget template used to pop a value into a register + cleangad (list[str]): ROP gadget template used to remove values from the + stack + writegad (list[str]): ROP gadget template used to write data to memory + funcargs (list[str]): function argument registers used by the architecture + calling convention + kernargs (list[str]): kernel syscall argument registers """ arch_string: str wordsize: int endianness: str alignment: int + ret: str + syscall: str nopcode: bytes + popgad: list + cleangad: list + writegad: list + funcargs: list + kernargs: list def set(self,new_arch): """Copy the given Arch into this instance.""" |