a demo show how to dump lldb info to ida.

Overview

用一个demo来聊聊动态trace

这个仓库能做什么?

帮助理解动态trace的思想。仓库内的demo,可操作,可实践。

动态trace核心思想:

动态记录一个函数内每一条指令的执行中产生的信息,并导入IDA,用来弥补IDA等静态分析工具的不足。

反编译看一下

  • 先clone仓库,把hellolldb.app拖到IDA里分析一下。这个hellolldb.app是我自己造的demo。demo只有按钮,点击按钮之后会触发回调onBtnClick,回调里会弹个窗,并打印一行log。我手动对demo加了一些常见的混淆。下面的截图是混淆后的代码。自己逆一下自己的demo,IDA7.0 :

    • Function Window里看不到函数名
    • 有DCQ
    • 有br切开整个函数的body
    • 整个函数(开头结尾)没被识别,无法F5

    1

开始动态执行:

把helllolldb.app拖到MonkeyDev里,并且在onBtnClick下个断点。点击按钮,断点断住。

把lldb-trace里的导出json的路径改成你自己的:

26	filename = "/Users/bliss_ddo/Desktop/%d.json"%(time.time())

输入script 进入交互式脚本执行环境:

(lldb)script

在交互式环境导入lldb-trace.py

exec(open('/Users/bliss_ddo/Desktop/lldb2ida/lldb-trace.py').read())

执行脚本里的函数:

 Tracer().tracehere(True)

2

回车,执行,得到一份运行时的json。把json改个名,叫1.json

这个脚本做了什么?

  • 记录函数的开头和结尾(后续在IDA里修复函数)
  • 对每一行指令打个断点,并注册断点hit的回调。
    • 记录每一行指令的内存地址,值
    • 对于br指令,记录读取br后寄存器的值,用来修复成b指令
    • 记录断点hit的count,后续修复用。
  • 找到当前断点的上级,也就是lr寄存器的值,在这个地方断点并注册回调,用来标记trace结束。trace结束时,把上述的运行记录导出到一份json里。

看一下json里的内容

用json-formatter.py来看一下这个json里的内容,终端运行

python /Users/bliss_ddo/Desktop/lldb2ida/json-formatter.py

3

第一列,index,

第二列,激发次数

第三列,带aslr的地址

第四列,不带aslr的地址

第五列,汇编助记词和操作数

第六列,内存里的值

第n列,任何逆向trace的值,脚本自己扩展

把这个JSON搞到IDA里

打开IDA,在下方的交互式环境里输入

 exec(open('/Users/bliss_ddo/Desktop/lldb2ida/ida-fix.py').read())

4

脚本做了什么事?看脚本的最后几行。

fixer = Fixer("/Users/bliss_ddo/Desktop/1.json") //读取动态trace的json
fixer.processJSON() //解析一下
fixer.fix_function_range() // 调用idc的函数,重新确定函数开始和结尾
fixer.fix_br() // 判断br的寄存器值是否落在函数内,如果在函数内,将其修复成b (reg-pc) b的计算规则见下文
fixer.fix_unknow_as_nop() // 讲DCQ里无法被mark as code的变成nop
# fixer.fix_unexec_as_nop() // 这句比较危险,把没被执行的代码变成nop,可以去掉虚假控制流,当然也有可能误杀。在逆一些签名加密之类的比较管用。这里就认为动态执行的路径,就是最最最正确的路径
# fixer.restore() //出错的时候的时候把IDA恢复回去。。。

记得把patch应用到原来的二进制里

IDA菜单-->Edit-->Patch program --> Apply.......

再次再MonkeyDev里运行一下修复后的二进制,ok能用。

后记

也就仅仅是用手头工具做了个demo。

这个过程中调研了很多的工具,也涨了很多姿势,工具没有十分趁手的,就自己做了个小demo。

道阻且长,一起加油。

Plone Interface contracts, plus basic features and utilities

plone.base This package is the base package of the CMS Plone https://plone.org. It contains only interface contracts and basic features and utilitie

Plone Foundation 1 Oct 03, 2022
Python script to launch burp scans automatically

SimpleAutoBurp Python script that takes a config.json file as config and uses Burp Suite Pro to scan a list of websites.

Adan Álvarez 26 Jul 18, 2022
This tool analyzes the json files generated by stream-lnd-htlcs to find hidden channel demand.

analyze_lnd_htlc Introduction Rebalancing channels is an important part of running a Lightning Network node. While it would be great if all channels c

Marimox 4 Dec 08, 2022
JavaScript-style async programming for Python.

promisio JavaScript-style async programming for Python. Examples Create a promise-based async function using the promisify decorator. It works on both

Miguel Grinberg 191 Dec 30, 2022
🦩 A Python tool to create comment-free Jupyter notebooks.

Pelikan Pelikan lets you convert notebooks to comment-free notebooks. In other words, It removes Python block and inline comments from source cells in

Hakan Özler 7 Nov 20, 2021
Prime Path Generator is a prime path generator used to generate prime paths.

Prime Path Generator is a prime path generator used to generate prime paths.

1 Nov 06, 2021
pydsinternals - A Python native library containing necessary classes, functions and structures to interact with Windows Active Directory.

pydsinternals - Directory Services Internals Library A Python native library containing necessary classes, functions and structures to interact with W

Podalirius 36 Dec 14, 2022
Pampy: The Pattern Matching for Python you always dreamed of.

Pampy: Pattern Matching for Python Pampy is pretty small (150 lines), reasonably fast, and often makes your code more readable and hence easier to rea

Claudio Santini 3.5k Jan 06, 2023
NFT-Generator is the best way to generate thousands of NFTs quick and easily with Python.

NFT-Generator is the best way to generate thousands of NFTs quick and easily with Python. Just add your files, set your configuration and run the scri

78 Dec 27, 2022
A clock app, which helps you with routine tasks.

Clock This app helps you with routine tasks. Alarm Clock Timer Stop Watch World Time (Which city you want) About me Full name: Matin Ardestani Age: 14

Matin Ardestani 13 Jul 30, 2022
A meme error handler for python

Pwython OwO what's this? Pwython is project aiming to fill in one of the biggest problems with python, which is that it is slow lacks owoified text. N

SystematicError 23 Jan 15, 2022
A quick username checker to see if a username is available on a list of assorted websites.

A quick username checker to see if a username is available on a list of assorted websites.

Maddie 4 Jan 04, 2022
The producer-consumer problem implemented with threads in Python

This was developed using a Python virtual environment, I would strongly recommend to do the same if you want to clone this repository. How to run this

Omar Beltran 1 Oct 30, 2021
A multipurpose python module

pysherlock pysherlock is a Python library for dealing with web scraping using images, it's a Python application of the rendertron headless browser API

Sachit 2 Nov 11, 2021
A small utility that sorts your files.

FileSorter A small utility that sorts your files. TODO: Scan directory to find files(thanks @corruptmemry for this!) Split extensions to determine fil

2 Jun 16, 2022
💉 코로나 잔여백신 예약 매크로 커스텀 빌드 (속도 향상 버전)

Korea-Covid-19-Vaccine-Reservation 코로나 잔여 백신 예약 매크로를 기반으로 한 커스텀 빌드입니다. 더 빠른 백신 예약을 목표로 하며, 속도를 우선하기 때문에 사용자는 이에 대처가 가능해야 합니다. 지정한 좌표 내 대기중인 병원에서 잔여 백신

Queue.ri 21 Aug 15, 2022
A repository containing several general purpose Python scripts to automate daily and common tasks.

General Purpose Scripts Introduction This repository holds a curated list of Python scripts which aim to help us automate daily and common tasks. You

GDSC RCCIIT 46 Dec 25, 2022
ZX Spectrum Utilities: (zx-spectrum-utils)

Here are a few utility programs that can be used with the zx spectrum. The ZX Spectrum is one of the first home computers from the early 1980s.

Graham Oakes 4 Mar 07, 2022
Report Bobcat Status to Google Sheets

bobcat-status-reporter Report Bobcat Status to Google Sheets Why? I recently relocated my miner from my root into the attic. Bobcat recommends operati

Jasmit Tarang 3 Sep 22, 2021
Pass arguments by reference—in Python!

byref Pass arguments by reference—in Python! byrefis a decorator that allows Python functions to declare reference parameters, with similar semantics

9 Feb 10, 2022