a demo show how to dump lldb info to ida.

Overview

用一个demo来聊聊动态trace

这个仓库能做什么?

帮助理解动态trace的思想。仓库内的demo,可操作,可实践。

动态trace核心思想:

动态记录一个函数内每一条指令的执行中产生的信息,并导入IDA,用来弥补IDA等静态分析工具的不足。

反编译看一下

  • 先clone仓库,把hellolldb.app拖到IDA里分析一下。这个hellolldb.app是我自己造的demo。demo只有按钮,点击按钮之后会触发回调onBtnClick,回调里会弹个窗,并打印一行log。我手动对demo加了一些常见的混淆。下面的截图是混淆后的代码。自己逆一下自己的demo,IDA7.0 :

    • Function Window里看不到函数名
    • 有DCQ
    • 有br切开整个函数的body
    • 整个函数(开头结尾)没被识别,无法F5

    1

开始动态执行:

把helllolldb.app拖到MonkeyDev里,并且在onBtnClick下个断点。点击按钮,断点断住。

把lldb-trace里的导出json的路径改成你自己的:

26	filename = "/Users/bliss_ddo/Desktop/%d.json"%(time.time())

输入script 进入交互式脚本执行环境:

(lldb)script

在交互式环境导入lldb-trace.py

exec(open('/Users/bliss_ddo/Desktop/lldb2ida/lldb-trace.py').read())

执行脚本里的函数:

 Tracer().tracehere(True)

2

回车,执行,得到一份运行时的json。把json改个名,叫1.json

这个脚本做了什么?

  • 记录函数的开头和结尾(后续在IDA里修复函数)
  • 对每一行指令打个断点,并注册断点hit的回调。
    • 记录每一行指令的内存地址,值
    • 对于br指令,记录读取br后寄存器的值,用来修复成b指令
    • 记录断点hit的count,后续修复用。
  • 找到当前断点的上级,也就是lr寄存器的值,在这个地方断点并注册回调,用来标记trace结束。trace结束时,把上述的运行记录导出到一份json里。

看一下json里的内容

用json-formatter.py来看一下这个json里的内容,终端运行

python /Users/bliss_ddo/Desktop/lldb2ida/json-formatter.py

3

第一列,index,

第二列,激发次数

第三列,带aslr的地址

第四列,不带aslr的地址

第五列,汇编助记词和操作数

第六列,内存里的值

第n列,任何逆向trace的值,脚本自己扩展

把这个JSON搞到IDA里

打开IDA,在下方的交互式环境里输入

 exec(open('/Users/bliss_ddo/Desktop/lldb2ida/ida-fix.py').read())

4

脚本做了什么事?看脚本的最后几行。

fixer = Fixer("/Users/bliss_ddo/Desktop/1.json") //读取动态trace的json
fixer.processJSON() //解析一下
fixer.fix_function_range() // 调用idc的函数,重新确定函数开始和结尾
fixer.fix_br() // 判断br的寄存器值是否落在函数内,如果在函数内,将其修复成b (reg-pc) b的计算规则见下文
fixer.fix_unknow_as_nop() // 讲DCQ里无法被mark as code的变成nop
# fixer.fix_unexec_as_nop() // 这句比较危险,把没被执行的代码变成nop,可以去掉虚假控制流,当然也有可能误杀。在逆一些签名加密之类的比较管用。这里就认为动态执行的路径,就是最最最正确的路径
# fixer.restore() //出错的时候的时候把IDA恢复回去。。。

记得把patch应用到原来的二进制里

IDA菜单-->Edit-->Patch program --> Apply.......

再次再MonkeyDev里运行一下修复后的二进制,ok能用。

后记

也就仅仅是用手头工具做了个demo。

这个过程中调研了很多的工具,也涨了很多姿势,工具没有十分趁手的,就自己做了个小demo。

道阻且长,一起加油。

🚧Useful shortcuts for simple task on windows

Windows Manager A tool containg useful utilities for performing simple shortcut tasks on Windows 10 OS. Features Lit Up - Turns up screen brightness t

Olawale Oyeyipo 0 Mar 24, 2022
Simple collection of GTPS Flood in Python.

GTPS Flood Simple collection of GTPS Flood in Python. NOTE Give me credit if you use this source, don't trade/sell this tool, And USE AT YOUR OWN RISK

PhynX 6 Dec 07, 2021
🦩 A Python tool to create comment-free Jupyter notebooks.

Pelikan Pelikan lets you convert notebooks to comment-free notebooks. In other words, It removes Python block and inline comments from source cells in

Hakan Özler 7 Nov 20, 2021
Extract the download URL from OneDrive or SharePoint share link and push it to aria2

OneDriveShareLinkPushAria2 Extract the download URL from OneDrive or SharePoint share link and push it to aria2 从OneDrive或SharePoint共享链接提取下载URL并将其推送到a

高玩梁 262 Jan 08, 2023
Export watched content from Tautulli to the Letterboxd CSV Import Format

Export watched content from Tautulli to the Letterboxd CSV Import Format

Evan J 5 Aug 31, 2022
A thing to simplify listening for PG notifications with asyncpg

asyncpg-listen This library simplifies usage of listen/notify with asyncpg: Handles loss of a connection Simplifies notifications processing from mult

ANNA 18 Dec 23, 2022
Small Python script to parse endlessh's output and print some neat statistics

endlessh_parser endlessh_parser is a small Python script that parses endlessh's output and prints some neat statistics about it Usage Install all the

ManicRobot 1 Oct 18, 2021
Python implementation of Gorilla time series compression

Gorilla Time Series Compression This is an implementation (with some adaptations) of the compression algorithm described in section 4.1 (Time series c

Ghiles Meddour 19 Jan 01, 2023
Python Classes Without Boilerplate

attrs is the Python package that will bring back the joy of writing classes by relieving you from the drudgery of implementing object protocols (aka d

The attrs Cabal 4.6k Jan 06, 2023
Aggregating gridded data (xarray) to polygons

A package to aggregate gridded data in xarray to polygons in geopandas using area-weighting from the relative area overlaps between pixels and polygons.

Kevin Schwarzwald 42 Nov 09, 2022
A Python script that transcript Arcaea chart file (.aff file) into AutoJS touchscreen script which automatically plays the Arcaea chart

ArcaeaAutoplay (AutoJS Version) A Python script that transcript Arcaea chart file (.aff file) into AutoJS touchscreen script which automatically plays

7 Dec 03, 2021
Runes - Simple Cookies You Can Extend (similar to Macaroons)

Runes - Simple Cookies You Can Extend (similar to Macaroons) is a paper called "Macaroons: Cookies with Context

Rusty Russell 22 Dec 11, 2022
Patch the pclntable from Go binaries

Pretrain and Fine-tune a T5 model with Flax on GCP This tutorial details how pretrain and fine-tune a FlaxT5 model from HuggingFace using a TPU VM ava

6 Oct 05, 2022
password generator

Password generator technologies used What is? It is Password generator How to Download? Download on releases Clone repo git clone https://github.com/m

1 Dec 16, 2021
Cleaning-utils - a collection of small Python functions and classes which make cleaning pipelines shorter and easier

cleaning-utils [] [] [] cleaning-utils is a collection of small Python functions

4 Aug 31, 2022
a tool for annotating table

table_annotate_tool a tool for annotating table motivated by wiki2bio,we create a tool to annoate all types of tables,this tool can annotate a table w

wisdom under lemon trees 4 Sep 23, 2021
Spacegit is a .git exposed finder

Spacegit Spacegit is a basic .git exposed finder Usage: You need python3 installed to run spacegit use: python3 spacegit.py (url) Disclaimer: **This i

2 Nov 30, 2021
A Python script that parses and checks public proxies. Multithreading is supported.

A Python script that parses and checks public proxies. Multithreading is supported.

LevPrav 7 Nov 25, 2022
iOS Snapchat parser for chats and cached files

ParseSnapchat iOS Snapchat parser for chats and cached files Tested on Windows and Linux install required libraries: pip install -r requirements.txt c

11 Dec 05, 2022
Obsidian tools - a Python package for analysing an Obsidian.md vault

obsidiantools is a Python package for getting structured metadata about your Obsidian.md notes and analysing your vault.

Mark Farragher 153 Jan 04, 2023