From 71a1a997e9be461a841a0f801bd19a23ad62f106 Mon Sep 17 00:00:00 2001 From: Rusty Wagner Date: Thu, 24 Aug 2017 22:26:16 -0400 Subject: Add MLIL instruction for dealing with direct access to GOT/IAT entries --- python/function.py | 6 ++++++ python/mediumlevelil.py | 1 + 2 files changed, 7 insertions(+) (limited to 'python') diff --git a/python/function.py b/python/function.py index 553b156f..4af95738 100644 --- a/python/function.py +++ b/python/function.py @@ -67,6 +67,8 @@ class RegisterValue(object): self.is_constant = True elif value.state == RegisterValueType.StackFrameOffset: self.offset = value.value + elif value.state == RegisterValueType.ImportedAddressValue: + self.value = value.value self.confidence = confidence def __repr__(self): @@ -80,6 +82,8 @@ class RegisterValue(object): return "" % self.offset if self.type == RegisterValueType.ReturnAddressValue: return "" + if self.type == RegisterValueType.ImportedAddressValue: + return "" % self.value return "" def _to_api_object(self): @@ -95,6 +99,8 @@ class RegisterValue(object): result.value = self.value elif self.type == RegisterValueType.StackFrameOffset: result.value = self.offset + elif self.type == RegisterValueType.ImportedAddressValue: + result.value = self.value return result diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py index 3e7a6997..07759a47 100644 --- a/python/mediumlevelil.py +++ b/python/mediumlevelil.py @@ -89,6 +89,7 @@ class MediumLevelILInstruction(object): MediumLevelILOperation.MLIL_ADDRESS_OF_FIELD: [("src", "var"), ("offset", "int")], MediumLevelILOperation.MLIL_CONST: [("constant", "int")], MediumLevelILOperation.MLIL_CONST_PTR: [("constant", "int")], + MediumLevelILOperation.MLIL_IMPORT: [("constant", "int")], MediumLevelILOperation.MLIL_ADD: [("left", "expr"), ("right", "expr")], MediumLevelILOperation.MLIL_ADC: [("left", "expr"), ("right", "expr"), ("carry", "expr")], MediumLevelILOperation.MLIL_SUB: [("left", "expr"), ("right", "expr")], -- cgit v1.3.1