Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Something wrong with aarch64 LDR instruction generating #1391

Open
Erich8200 opened this issue Oct 20, 2021 · 0 comments
Open

Something wrong with aarch64 LDR instruction generating #1391

Erich8200 opened this issue Oct 20, 2021 · 0 comments

Comments

@Erich8200
Copy link

Erich8200 commented Oct 20, 2021

Hello, I have a piece of code at the bottom, the output should be something like:

    LDR             X1, [SP, 0x18]
    ADRP            X0, 0
    ADD             X0, X0, 0xB44
    LDR             X8, [SP]
    LDR             X8, [X8, 0x28]
    LDR             X9, [SP, 0x28]
    CMP             X8, X9

roughly the same as variable real_asm_text

However, I got the following result instead:

main
LDR        X1, [SP, 0x18]!
ADRP       X0, 0x0
ADD        X0, X0, 0xB44
LDR        X8, [SP]
LDR        X8, [X8, 0x28]!
LDR        X9, [SP, 0x28]!
CMP        X8, X9
->      c_next:end 
loc_key_1
        Bad block: Unable to disassemble
loc_key_0 -> loc_key_1

which means all LDR instructions have been misinterpreted, and may be something wrong with the aarch64 compilation function.
Last but not the least, I enjoyed this project very much, any of your feedback is appreciated!

from __future__ import print_function
from pprint import pprint
from miasm.analysis.machine import Machine
from miasm.arch import aarch64
from miasm.arch.aarch64.arch import mn_aarch64
from miasm.core import parse_asm, asmblock
from miasm.arch.aarch64.lifter_model_call import Lifter_Aarch64l
from miasm.core import locationdb
from miasm.core.locationdb import LocationDB
from miasm.loader.strpatchwork import StrPatchwork
from miasm.analysis.binary import Container
from miasm.ir.ir import IRCFG, AssignBlock
from miasm.expression.expression import *
from miasm.ir.symbexec import SymbolicExecutionEngine
import sys

from future.utils import viewvalues
from miasm.analysis.binary import Container
from miasm.analysis.machine import Machine
from miasm.core.locationdb import LocationDB

import logging

# Quiet warnings
asmblock.log_asmblock.setLevel(logging.ERROR)


def gen_arm64_asmcfg(asm):
    # First, asm code
    machine = Machine("aarch64l")

    # Add dummy label "end" at code's end
    code = asm + "\nend:\n"
    loc_db = LocationDB()
    # The main will be at address 0
    loc_db.set_location_offset(loc_db.get_or_create_name_location("main"), 0x0)
    # The second param should be 'l' for little endian or 'b' for big endian
    asmcfg = parse_asm.parse_txt(mn_aarch64, 'l', code, loc_db)

    # Assemble shellcode
    virt = StrPatchwork()
    patches = asmblock.asm_resolve_final(machine.mn, asmcfg)

    # Put shellcode in a string
    for offset, raw in patches.items():
        virt[offset] = raw
    data = bytes(virt)

    cont = Container.fallback_container(
        data,
        vm=None, addr=0,
        loc_db=loc_db,
    )

    dis_engine = machine.dis_engine
    # Disassemble back the shellcode
    # Now, basic blocks are at known position, determined by
    # the assembled version
    mdis = dis_engine(cont.bin_stream, loc_db=cont.loc_db)
    asmcfg = mdis.dis_multiblock(0)
    return asmcfg


def lift_arm64_asm(asmcfg, model_call=False, lifter_custom=None):
    machine = Machine("aarch64l")
    # Get a lifter
    lifter = None
    if model_call and lifter_custom is None:
        lifter = Lifter_Aarch64l(asmcfg.loc_db)
    elif lifter_custom is not None:
        lifter = lifter_custom(asmcfg.loc_db)
    else:
        lifter = machine.lifter(asmcfg.loc_db)

    # Translate to IR
    ircfg = lifter.new_ircfg_from_asmcfg(asmcfg)
    return ircfg,lifter


real_asm_text = \
'''
main:
    LDR             X1, [SP, 0x18]
    ADRP            X0, 0
    ADD             X0, X0, 0xB44
    LDR             X8, [SP]
    LDR             X8, [X8, 0x28]
    LDR             X9, [SP, 0x28]
    CMP             X8, X9
'''


asmcfg = gen_arm64_asmcfg(real_asm_text)
print(asmcfg)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant