reorganizing functions
parent
bed9b1806c
commit
4cb44525dc
|
@ -0,0 +1,49 @@
|
||||||
|
#! /usr/bin/env python3
|
||||||
|
from multiprocessing import Queue
|
||||||
|
from random import randint
|
||||||
|
import ctypes
|
||||||
|
import mmap
|
||||||
|
|
||||||
|
template_shell = b''.join([
|
||||||
|
b'\x55', # push rbp
|
||||||
|
b'\x48\x89\xe5', # mov rbp,rsp
|
||||||
|
b'\x48\x89\x7d\xf8', # mov QWORD [rbp-0x8],rdi
|
||||||
|
b'\x48\x8b\x45\xf8', # mov rax,QWORD [rbp-0x8]
|
||||||
|
b'\x5d', # pop rbp
|
||||||
|
b'\xc3']) # ret
|
||||||
|
|
||||||
|
seed_shell = b''.join([
|
||||||
|
b'\x55',
|
||||||
|
b'\x48\x89\xe5',
|
||||||
|
b'\x90' * randint(8, 64),
|
||||||
|
b'\x48\x89\x7d\xf8',
|
||||||
|
b'\x90' * randint(8, 64),
|
||||||
|
b'\x48\x8b\x45\xf8',
|
||||||
|
b'\x5d',
|
||||||
|
b'\xc3'])
|
||||||
|
|
||||||
|
|
||||||
|
def flip(shellcode: bytes):
|
||||||
|
shellcode = bytearray(shellcode)
|
||||||
|
offset = randint(0, len(shellcode) - 1)
|
||||||
|
flip = randint(0, 255)
|
||||||
|
shellcode[offset] ^= flip
|
||||||
|
return bytes(shellcode)
|
||||||
|
|
||||||
|
|
||||||
|
def generation(queue: Queue, shellcode: bytes):
|
||||||
|
prot = mmap.PROT_READ | mmap.PROT_WRITE | mmap.PROT_EXEC
|
||||||
|
flags = mmap.MAP_ANONYMOUS | mmap.MAP_PRIVATE
|
||||||
|
exec_mem = mmap.mmap(-1, len(shellcode), prot=prot, flags=flags)
|
||||||
|
|
||||||
|
exec_mem.write(shellcode)
|
||||||
|
ctypes_buffer = ctypes.c_int.from_buffer(exec_mem)
|
||||||
|
addr = ctypes.addressof(ctypes_buffer)
|
||||||
|
|
||||||
|
function = ctypes.CFUNCTYPE(ctypes.c_uint, ctypes.c_uint)(addr)
|
||||||
|
function._avoid_gc_for_mmap = exec_mem
|
||||||
|
|
||||||
|
shellcode_len = ctypes.c_uint(len(shellcode))
|
||||||
|
result = function(shellcode_len)
|
||||||
|
|
||||||
|
queue.put(result)
|
52
sins/run.py
52
sins/run.py
|
@ -1,58 +1,12 @@
|
||||||
#! /usr/bin/env python3
|
#! /usr/bin/env python3
|
||||||
from argparse import ArgumentParser
|
from argparse import ArgumentParser
|
||||||
from datetime import datetime
|
from datetime import datetime
|
||||||
from pathlib import Path
|
|
||||||
from random import randint
|
|
||||||
from multiprocessing import Process, Queue
|
from multiprocessing import Process, Queue
|
||||||
|
from pathlib import Path
|
||||||
from queue import Empty
|
from queue import Empty
|
||||||
import binascii
|
|
||||||
import ctypes
|
|
||||||
import logging
|
import logging
|
||||||
import mmap
|
|
||||||
|
|
||||||
template_shell = b''.join([
|
from .mutation import generation, flip, seed_shell
|
||||||
b'\x55', # push rbp
|
|
||||||
b'\x48\x89\xe5', # mov rbp,rsp
|
|
||||||
b'\x48\x89\x7d\xf8', # mov QWORD [rbp-0x8],rdi
|
|
||||||
b'\x48\x8b\x45\xf8', # mov rax,QWORD [rbp-0x8]
|
|
||||||
b'\x5d', # pop rbp
|
|
||||||
b'\xc3']) # ret
|
|
||||||
|
|
||||||
seed_shell = b''.join([
|
|
||||||
b'\x55',
|
|
||||||
b'\x48\x89\xe5',
|
|
||||||
b'\x90' * randint(8, 64),
|
|
||||||
b'\x48\x89\x7d\xf8',
|
|
||||||
b'\x90' * randint(8, 64),
|
|
||||||
b'\x48\x8b\x45\xf8',
|
|
||||||
b'\x5d',
|
|
||||||
b'\xc3'])
|
|
||||||
|
|
||||||
|
|
||||||
def flip(shellcode: bytes):
|
|
||||||
shellcode = bytearray(shellcode)
|
|
||||||
offset = randint(0, len(shellcode) -1)
|
|
||||||
flip = randint(0, 255)
|
|
||||||
shellcode[offset] ^= flip
|
|
||||||
return bytes(shellcode)
|
|
||||||
|
|
||||||
|
|
||||||
def generation(queue: Queue, shellcode: bytes):
|
|
||||||
prot = mmap.PROT_READ | mmap.PROT_WRITE | mmap.PROT_EXEC
|
|
||||||
flags = mmap.MAP_ANONYMOUS | mmap.MAP_PRIVATE
|
|
||||||
exec_mem = mmap.mmap(-1, len(shellcode), prot=prot, flags=flags)
|
|
||||||
|
|
||||||
exec_mem.write(shellcode)
|
|
||||||
ctypes_buffer = ctypes.c_int.from_buffer(exec_mem)
|
|
||||||
addr = ctypes.addressof(ctypes_buffer)
|
|
||||||
|
|
||||||
function = ctypes.CFUNCTYPE(ctypes.c_uint, ctypes.c_uint)(addr)
|
|
||||||
function._avoid_gc_for_mmap = exec_mem
|
|
||||||
|
|
||||||
shellcode_len = ctypes.c_uint(len(shellcode))
|
|
||||||
result = function(shellcode_len)
|
|
||||||
|
|
||||||
queue.put(result)
|
|
||||||
|
|
||||||
|
|
||||||
def sins():
|
def sins():
|
||||||
|
@ -63,7 +17,7 @@ def sins():
|
||||||
parser.add_argument('-s', '--seed', help='path to PIC image.')
|
parser.add_argument('-s', '--seed', help='path to PIC image.')
|
||||||
parser.add_argument('-o', '--output', help='path to results directory.')
|
parser.add_argument('-o', '--output', help='path to results directory.')
|
||||||
parser.add_argument('-l', '--lineage', default=10,
|
parser.add_argument('-l', '--lineage', default=10,
|
||||||
help='max count of unsuccessful generation.')
|
help='max count of unsuccessful generation.')
|
||||||
args = parser.parse_args()
|
args = parser.parse_args()
|
||||||
|
|
||||||
log_level = logging.INFO
|
log_level = logging.INFO
|
||||||
|
|
Loading…
Reference in New Issue