VMLifter/codeSlicing.py at main · gal2xy/VMLifter · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
from copy import copy
from typing import List
from triton import *

from toolsFunc import debug
from unidbgTraceParser import InstructionInfo


def getMemoryBaseRegName(inst: Instruction):
    # Triton 会自动识别所有的操作数
    for op in inst.getOperands():
        if op.getType() == OPERAND.MEM:
            # 直接获取内存操作数的基址寄存器对象
            base_reg = op.getBaseRegister()
            return base_reg.getName()
    return None


def loadStoreSlicing(insn_info_list: List[InstructionInfo], vm_stack_addr: int) -> List[List[InstructionInfo]]:
    """
                    真实环境中的内存数据在虚拟机中的生命周期
                       load from real environment        (start)
                                  |
                                  |
                       |——>|——>register——>|——>|
                       |   |             |    |
                       |   |——operation——|    |
                       |                      |
                       <———————vmstack<————————
                                  |
                                  |
                               regiter
                                  |
                                  |
                       store into real environment        (end)
    """
    slice_list = []  # List[List[InstructionInfo]]
    inst_num = len(insn_info_list)

    index = 0
    flag = False
    ls_slice = []  # List[InstructionInfo]
    ctx = TritonContext(ARCH.AARCH64)

    while index < inst_num:
        inst_info = insn_info_list[index]
        mnemonic = inst_info.inst_str.split(" ")[0]
        if flag:
            ls_slice.append(insn_info_list[index])
        else:
            if mnemonic.startswith("ld"):  # load instruciton
                inst = Instruction(bytes.fromhex(inst_info.opcode))
                ctx.processing(inst)
                base_name = getMemoryBaseRegName(inst)
                base_value = inst_info.regs_before.get(base_name)
                if int(base_value, 16) != vm_stack_addr:
                    debug(f"find load real memory: {inst.getDisassembly()}")
                    # start new record
                    flag = True
                    ls_slice.append(insn_info_list[index])

        if mnemonic.startswith("st"):  # store instruciton
            inst = Instruction(bytes.fromhex(inst_info.opcode))
            ctx.processing(inst)
            base_name = getMemoryBaseRegName(inst)
            base_value = inst_info.regs_before.get(base_name)
            if int(base_value, 16) != vm_stack_addr:
                # end record
                debug(len(ls_slice))
                slice_list.append(copy(ls_slice))
                ls_slice = []
                flag = False

        index += 1

    # 未找到store指令仍加入，前提是使用extractVMCode
    # slice_list.append(copy(ls_slice))

    return slice_list