diff options
Diffstat (limited to 'python')
| -rw-r--r-- | python/__init__.py | 77 | ||||
| -rw-r--r-- | python/examples/nsf.py | 138 |
2 files changed, 212 insertions, 3 deletions
diff --git a/python/__init__.py b/python/__init__.py index 0ba0f1a5..5e147ad5 100644 --- a/python/__init__.py +++ b/python/__init__.py @@ -2490,6 +2490,19 @@ class BinaryView(object): return BasicBlock(self, block) def get_code_refs(self, addr, length = None): + """ + ``get_code_refs`` returns a list of ReferenceSource objects (xrefs or cross-references) that point to the provided virtual address. + + :param int addr: virtual address to query for references + :return: List of References for the given virtual address + :rtype: list(ReferenceSource) + :Example: + + >>> bv.get_code_refs(here) + [<ref: x86@0x4165ff>] + >>> + + """ count = ctypes.c_ulonglong(0) if length is None: refs = core.BNGetCodeReferences(self.handle, addr, count) @@ -2630,6 +2643,21 @@ class BinaryView(object): """ core.BNDefineAutoSymbol(self.handle, sym.handle) + def define_auto_symbol_and_var_or_function(self, sym, sym_type, platform = None): + """ + ``define_auto_symbol`` adds a symbol to the internal list of automatically discovered Symbol objects. + + :param Symbol sym: the symbol to define + :rtype: None + """ + if platform is None: + platform = self.platform + if platform is not None: + platform = platform.handle + if sym_type is not None: + sym_type = sym_type.handle + core.BNDefineAutoSymbolAndVariableOrFunction(self.handle, platform, sym.handle, sym_type) + def undefine_auto_symbol(self, sym): """ ``undefine_auto_symbol`` removes a symbol from the internal list of automatically discovered Symbol objects. @@ -3968,7 +3996,7 @@ class BinaryWriter(object): def write16(self, value): """ - ```` writes the lowest order two bytes from the integer ``value`` to the current offset, using internal endianness. + ``write16`` writes the lowest order two bytes from the integer ``value`` to the current offset, using internal endianness. :param int value: integer value to write. :return: boolean True on success, False on failure. @@ -3978,7 +4006,7 @@ class BinaryWriter(object): def write32(self, value): """ - ```` writes the lowest order four bytes from the integer ``value`` to the current offset, using internal endianness. + ``write32`` writes the lowest order four bytes from the integer ``value`` to the current offset, using internal endianness. :param int value: integer value to write. :return: boolean True on success, False on failure. @@ -3988,7 +4016,7 @@ class BinaryWriter(object): def write64(self, value): """ - ```` writes the lowest order eight bytes from the integer ``value`` to the current offset, using internal endianness. + ``write64`` writes the lowest order eight bytes from the integer ``value`` to the current offset, using internal endianness. :param int value: integer value to write. :return: boolean True on success, False on failure. @@ -4789,6 +4817,14 @@ class Function(object): return Architecture(arch) @property + def platform(self): + """Function platform (read-only)""" + platform = core.BNGetFunctionPlatform(self.handle) + if platform is None: + return None + return Platform(None, handle = platform) + + @property def start(self): """Function start (read-only)""" return core.BNGetFunctionStart(self.handle) @@ -6011,6 +6047,8 @@ class Architecture(object): self._cb.getDefaultIntegerSize = self._cb.getDefaultIntegerSize.__class__(self._get_default_integer_size) self._cb.getMaxInstructionLength = self._cb.getMaxInstructionLength.__class__(self._get_max_instruction_length) self._cb.getOpcodeDisplayLength = self._cb.getOpcodeDisplayLength.__class__(self._get_opcode_display_length) + self._cb.getAssociatedArchitectureByAddress = self._cb.getAssociatedArchitectureByAddress.__class__( + self._get_associated_arch_by_address) self._cb.getInstructionInfo = self._cb.getInstructionInfo.__class__(self._get_instruction_info) self._cb.getInstructionText = self._cb.getInstructionText.__class__(self._get_instruction_text) self._cb.freeInstructionText = self._cb.freeInstructionText.__class__(self._free_instruction_text) @@ -6200,6 +6238,15 @@ class Architecture(object): log_error(traceback.format_exc()) return 8 + def _get_associated_arch_by_address(self, ctxt, addr): + try: + result, new_addr = self.perform_get_associated_arch_by_address(addr[0]) + addr[0] = new_addr + return ctypes.cast(result.handle, ctypes.c_void_p).value + except: + log_error(traceback.format_exc()) + return ctypes.cast(self.handle, ctypes.c_void_p).value + def _get_instruction_info(self, ctxt, data, addr, max_len, result): try: buf = ctypes.create_string_buffer(max_len) @@ -6609,6 +6656,9 @@ class Architecture(object): log_error(traceback.format_exc()) return False + def perform_get_associated_arch_by_address(self, addr): + return self, addr + @abc.abstractmethod def perform_get_instruction_info(self, data, addr): """ @@ -6859,6 +6909,12 @@ class Architecture(object): """ return None + def get_associated_arch_by_address(self, addr): + new_addr = ctypes.c_ulonglong() + new_addr.value = addr + result = core.BNGetAssociatedArchitectureByAddress(self.handle, new_addr) + return Architecture(handle = result), new_addr.value + def get_instruction_info(self, data, addr): """ ``get_instruction_info`` returns an InstructionInfo object for the instruction at the given virtual address @@ -9693,6 +9749,21 @@ class Platform(object): """ core.BNRegisterPlatformCallingConvention(self.handle, cc.handle) + def get_related_platform(self, arch): + result = core.BNGetRelatedPlatform(self.handle, arch.handle) + if not result: + return None + return Platform(None, handle = result) + + def add_related_platform(self, arch, platform): + core.BNAddRelatedPlatform(self.handle, arch.handle, platform.handle) + + def get_associated_platform_by_address(self, addr): + new_addr = ctypes.c_ulonglong() + new_addr.value = addr + result = core.BNGetAssociatedPlatformByAddress(self.handle, new_addr) + return Platform(None, handle = result), new_addr.value + class ScriptingOutputListener(object): def _register(self, handle): self._cb = core.BNScriptingOutputListener() diff --git a/python/examples/nsf.py b/python/examples/nsf.py new file mode 100644 index 00000000..9d4ebd5c --- /dev/null +++ b/python/examples/nsf.py @@ -0,0 +1,138 @@ +# Copyright (c) 2015-2016 Vector 35 LLC +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to +# deal in the Software without restriction, including without limitation the +# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or +# sell copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS +# IN THE SOFTWARE. +# +# +# Simple NSF file loader, primarily for analyzing: +# https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromising-linux-desktop.html +# + +from binaryninja import * +import struct +import traceback +import os + +class NSFView(BinaryView): + name = "NSF" + long_name = "Nintendo Sound Format" + + def __init__(self, data): + BinaryView.__init__(self, parent_view = data, file_metadata = data.file) + + @classmethod + def is_valid_for_data(self, data): + hdr = data.read(0, 128) + if len(hdr) < 128: + return False + if hdr[0:5] != "NESM\x1a": + return False + song_count = struct.unpack("B", hdr[6])[0] + if song_count < 1: + log_info("Appears to be an NSF, but no songs.") + return False + return True + + def init(self): + try: + hdr = self.parent_view.read(0, 128) + self.version = struct.unpack("B", hdr[5])[0] + self.song_count = struct.unpack("B", hdr[6])[0] + self.starting_song = struct.unpack("B", hdr[7])[0] + self.load_address = struct.unpack("<H", hdr[8:10])[0] + self.init_address = struct.unpack("<H", hdr[10:12])[0] + self.play_address = struct.unpack("<H", hdr[12:14])[0] + self.song_name = hdr[15].split('\0')[0] + self.artist_name = hdr[46].split('\0')[0] + self.copyright_name = hdr[78].split('\0')[0] + self.play_speed_ntsc = struct.unpack("<H", hdr[110:112])[0] + self.bank_switching = hdr[112:120] + self.play_speed_pal = struct.unpack("<H", hdr[120:122])[0] + self.pal_ntsc_bits = struct.unpack("B", hdr[122])[0] + self.pal = True if (self.pal_ntsc_bits & 1) == 1 else False + self.ntsc = not self.pal + if self.pal_ntsc_bits & 2 == 2: + self.pal = True + self.ntsc = True + self.extra_sound_bits = struct.unpack("B", hdr[123])[0] + + if self.bank_switching == "\0"*8: + #no bank switching + self.load_address & 0xFFF + self.rom_offset = 128 + + else: + #bank switching not implemented + log_info("Bank switching not implemented in this loader.") + + # Add mapping for RAM and hardware registers, not backed by file contents + self.add_auto_segment(0, 0x8000, 0, 0, SegmentReadable | SegmentWritable | SegmentExecutable) + + # Add ROM mappings + self.add_auto_segment(0x8000, 0x4000, self.rom_offset, 0x4000, + SegmentReadable | SegmentExecutable) + + self.define_auto_symbol(Symbol(FunctionSymbol, self.play_address, "_play")) + self.define_auto_symbol(Symbol(FunctionSymbol, self.init_address, "_init")) + self.add_entry_point(Architecture['6502'].standalone_platform, self.init_address) + self.add_function(Architecture['6502'].standalone_platform, self.play_address) + + # Hardware registers + self.define_auto_symbol(Symbol(DataSymbol, 0x2000, "PPUCTRL")) + self.define_auto_symbol(Symbol(DataSymbol, 0x2001, "PPUMASK")) + self.define_auto_symbol(Symbol(DataSymbol, 0x2002, "PPUSTATUS")) + self.define_auto_symbol(Symbol(DataSymbol, 0x2003, "OAMADDR")) + self.define_auto_symbol(Symbol(DataSymbol, 0x2004, "OAMDATA")) + self.define_auto_symbol(Symbol(DataSymbol, 0x2005, "PPUSCROLL")) + self.define_auto_symbol(Symbol(DataSymbol, 0x2006, "PPUADDR")) + self.define_auto_symbol(Symbol(DataSymbol, 0x2007, "PPUDATA")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4000, "SQ1_VOL")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4001, "SQ1_SWEEP")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4002, "SQ1_LO")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4003, "SQ1_HI")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4004, "SQ2_VOL")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4005, "SQ2_SWEEP")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4006, "SQ2_LO")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4007, "SQ2_HI")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4008, "TRI_LINEAR")) + self.define_auto_symbol(Symbol(DataSymbol, 0x400a, "TRI_LO")) + self.define_auto_symbol(Symbol(DataSymbol, 0x400b, "TRI_HI")) + self.define_auto_symbol(Symbol(DataSymbol, 0x400c, "NOISE_VOL")) + self.define_auto_symbol(Symbol(DataSymbol, 0x400e, "NOISE_LO")) + self.define_auto_symbol(Symbol(DataSymbol, 0x400f, "NOISE_HI")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4010, "DMC_FREQ")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4011, "DMC_RAW")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4012, "DMC_START")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4013, "DMC_LEN")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4014, "OAMDMA")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4015, "SND_CHN")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4016, "JOY1")) + self.define_auto_symbol(Symbol(DataSymbol, 0x4017, "JOY2")) + + return True + except: + log_error(traceback.format_exc()) + return False + + def perform_is_executable(self): + return True + + def perform_get_entry_point(self): + return struct.unpack("<H", str(self.perform_read(0x0a, 2)))[0] + +NSFView.register() |