Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Syscalls linux32 #1170

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Syscalls linux32 #1170

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1a8b917
add several syscalls
Te-k Mar 28, 2020
20e9a75
Merge branch 'master' into syscall_linux32
Te-k Mar 28, 2020
eca3635
fixes bugs in socket
Te-k Mar 30, 2020
13e8a4f
Improve linux syscalls
Te-k Apr 7, 2020
c3854c5
add example script of shellcode emulation on linux
Te-k Apr 7, 2020
84d96a1
Add additional test
Te-k Apr 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 20 additions & 6 deletions miasm/os_dep/linux/syscall.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,13 +153,20 @@ def sys_x86_32_socket(jitter, linux_env):
# socklen_t addrlen);
fd = jitter.vm.get_u32(jitter.cpu.ESP)
socklen = jitter.vm.get_u32(jitter.cpu.ESP+8)
sockaddr = jitter.vm.get_mem(jitter.cpu.ESP+4, socklen)
sockaddr = jitter.vm.get_mem(
jitter.vm.get_u32(jitter.cpu.ESP+4),
socklen)
family = struct.unpack("H", sockaddr[0:2])[0]
if family == 2:
# IPv4
port = struct.unpack(">H", sockaddr[2:4])[0]
ip = ".".join([str(i) for i in struct.unpack("BBBB", sockaddr[4:8])])
log.debug("socket_bind(fd, [%s, %i, %s], %i)", SOCKET_DOMAINS[family],
log.debug("socket_bind(fd, [%s, %i, %s], %i)", "AF_INET",
port, ip, socklen)
elif family == 10:
port = struct.unpack(">H", sockaddr[2:4])[0]
ip = ".".join([str(i) for i in struct.unpack("B"*16, sockaddr[8:24])])
log.debug("socket_bind(fd, [%s, %i, %s], %i)", "AF_INET6",
port, ip, socklen)
else:
log.debug("socket_bind(fd, sockaddr, socklen_t)")
Expand All @@ -169,14 +176,22 @@ def sys_x86_32_socket(jitter, linux_env):
# socklen_t addrlen);
fd = jitter.vm.get_u32(jitter.cpu.ESP)
socklen = jitter.vm.get_u32(jitter.cpu.ESP+8)
# Not the exact size because shellcodes won't provide the full struct
sockaddr = jitter.vm.get_mem(jitter.vm.get_u32(jitter.cpu.ESP+4), 8)
try:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about using the socklen instead of a fixed length?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In some cases, a shellcode would not have a full sockaddr struct but just the needed fields, what I have done in the next commit is getting the socklen and if it fails, I only get the first 8 bytes. Is that an ok trick to have it work ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In fact, maybe we should behave like the kernel does so we will be close to a real environment.
If the kernel is ok with semi structures, maybe your patch is ok.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have added a first get_mem for the full structure and fallback to 8 bytes if the memory if not that large, it should be close to what the kernel is doing I guess

sockaddr = jitter.vm.get_mem(jitter.vm.get_u32(jitter.cpu.ESP+4), 28)
except RuntimeError:
# Not the exact size because shellcodes won't provide the full struct
sockaddr = jitter.vm.get_mem(jitter.vm.get_u32(jitter.cpu.ESP+4), 8)
family = struct.unpack("H", sockaddr[0:2])[0]
if family == 2:
# IPv4
port = struct.unpack(">H", sockaddr[2:4])[0]
ip = ".".join([str(i) for i in struct.unpack("BBBB", sockaddr[4:8])])
log.debug("socket_connect(fd, [%s, %i, %s], %i)", SOCKET_DOMAINS[family],
log.debug("socket_connect(fd, [%s, %i, %s], %i)", "AF_INET",
port, ip, socklen)
elif family == 10:
port = struct.unpack(">H", sockaddr[2:4])[0]
ip = ".".join([str(i) for i in struct.unpack("B"*16, sockaddr[8:24])])
log.debug("socket_connect(fd, [%s, %i, %s], %i)", "AF_INET6",
port, ip, socklen)
else:
log.debug("socket_connect(fd, sockaddr, socklen)")
Expand Down Expand Up @@ -207,7 +222,6 @@ def sys_x86_32_socket(jitter, linux_env):
optval_addr, optlen)
jitter.syscall_ret_systemv(0)
else:
print(jitter.cpu.EBX)
raise NotImplemented()


Expand Down