1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
#!/usr/bin/env python
tests_mfcr = [
# mfcr 0
(b'\x7c\x00\x00\x26', 'LLIL_SET_REG.d{none}(r0,LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(lt,31),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(gt,30),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(eq,29),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(so,28),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_lt,27),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_gt,26),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_eq,25),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_so,24),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_lt,23),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_gt,22),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_eq,21),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_so,20),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_lt,19),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_gt,18),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_eq,17),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_so,16),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_lt,15),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_gt,14),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_eq,13),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_so,12),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_lt,11),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_gt,10),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_eq,9),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_so,8),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_lt,7),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_gt,6),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_eq,5),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_so,4),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_lt,3),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_gt,2),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_eq,1),LLIL_FLAG_BIT.d{none}(cr7_so,0)))))))))))))))))))))))))))))))))'),
# mfcr 15
(b'\x7d\xe0\x00\x26', 'LLIL_SET_REG.d{none}(r15,LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(lt,31),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(gt,30),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(eq,29),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(so,28),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_lt,27),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_gt,26),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_eq,25),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_so,24),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_lt,23),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_gt,22),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_eq,21),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_so,20),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_lt,19),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_gt,18),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_eq,17),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_so,16),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_lt,15),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_gt,14),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_eq,13),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_so,12),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_lt,11),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_gt,10),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_eq,9),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_so,8),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_lt,7),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_gt,6),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_eq,5),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_so,4),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_lt,3),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_gt,2),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_eq,1),LLIL_FLAG_BIT.d{none}(cr7_so,0)))))))))))))))))))))))))))))))))'),
# mfcr 31
(b'\x7f\xe0\x00\x26', 'LLIL_SET_REG.d{none}(r31,LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(lt,31),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(gt,30),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(eq,29),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(so,28),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_lt,27),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_gt,26),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_eq,25),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr1_so,24),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_lt,23),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_gt,22),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_eq,21),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr2_so,20),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_lt,19),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_gt,18),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_eq,17),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr3_so,16),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_lt,15),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_gt,14),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_eq,13),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr4_so,12),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_lt,11),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_gt,10),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_eq,9),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr5_so,8),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_lt,7),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_gt,6),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_eq,5),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr6_so,4),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_lt,3),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_gt,2),LLIL_OR.d{none}(LLIL_FLAG_BIT.d{none}(cr7_eq,1),LLIL_FLAG_BIT.d{none}(cr7_so,0)))))))))))))))))))))))))))))))))')
]
tests_basics = [
# li 3, 100
(b'\x38\x60\x00\x64', 'LLIL_SET_REG.d{none}(r3,LLIL_CONST.d(0x64))'),
# xori r12, r12, 0x1431
(b'\x69\x8c\x14\x31', 'LLIL_SET_REG.d{none}(r12,LLIL_XOR.d{none}(LLIL_REG.d{none}(r12),LLIL_CONST.d(0x1431)))')
]
test_cases = \
tests_mfcr + \
tests_basics
import re
import sys
import binaryninja
from binaryninja import binaryview
from binaryninja import lowlevelil
from binaryninja.enums import LowLevelILOperation
def il2str(il):
sz_lookup = {1:'.b', 2:'.w', 4:'.d', 8:'.q', 16:'.o'}
if isinstance(il, lowlevelil.LowLevelILInstruction):
size_code = sz_lookup.get(il.size, '?') if il.size else ''
flags_code = '' if not hasattr(il, 'flags') or not il.flags else '{%s}'%il.flags
# print size-specified IL constants in hex
if il.operation in [LowLevelILOperation.LLIL_CONST, LowLevelILOperation.LLIL_CONST_PTR] and il.size:
tmp = il.operands[0]
if tmp < 0: tmp = (1<<(il.size*8))+tmp
tmp = '0x%X' % tmp if il.size else '%d' % il.size
return 'LLIL_CONST%s(%s)' % (size_code, tmp)
else:
return '%s%s%s(%s)' % (il.operation.name, size_code, flags_code, ','.join([il2str(o) for o in il.operands]))
elif isinstance(il, list):
return '[' + ','.join([il2str(x) for x in il]) + ']'
else:
return str(il)
# TODO: make this less hacky
def instr_to_il(data):
platform = binaryninja.Platform['linux-ppc32']
# make a pretend function that returns
bv = binaryview.BinaryView.new(data)
bv.add_function(0, plat=platform)
assert len(bv.functions) == 1
result = []
for block in bv.functions[0].lifted_il:
for il in block:
result.append(il2str(il))
result = '; '.join(result)
try:
result = result[0:result.rindex('; LLIL_UNDEF{none}()')]
except:
pass
return result
def il_str_to_tree(ilstr):
result = ''
depth = 0
for c in ilstr:
if c == '(':
result += '\n'
depth += 1
result += ' '*depth
elif c == ')':
depth -= 1
elif c == ',':
result += '\n'
result += ' '*depth
pass
else:
result += c
return result
def test_all():
for (test_i, (data, expected)) in enumerate(test_cases):
actual = instr_to_il(data)
if actual != expected:
print('MISMATCH AT TEST %d!' % test_i)
print('\t input: %s' % data.hex())
print('\texpected: %s' % expected)
print('\t actual: %s' % actual)
print('\t tree:')
print(il_str_to_tree(actual))
return False
return True
if __name__ == '__main__':
if test_all():
print('success!')
sys.exit(0)
else:
sys.exit(-1)
if __name__ == 'test_lifting':
if test_all():
print('success!')
|
