关于python:LyScript-寻找ROP漏洞指令片段

31次阅读

共计 4204 个字符,预计需要花费 11 分钟才能阅读完成。

ROP 绕过片段简略科普一下,你能够了解成一个能够关闭系统本身内存保护的一段机器指令,这段代码须要咱们本人结构,这就波及到在对端内存搜查这样的指令,LyScript 插件加强了指令片段的查找性能,但须要咱们在 LyScript 插件根底上封装一些办法,实现起来也不难。

  • 插件地址:https://github.com/lyshark/Ly…

封装机器码获取性能: 首先封装一个办法,当用户传入指定汇编指令的时候,主动的将其转换成对应的机器码,这是为搜寻 ROP 片段做铺垫的,代码很简略,首先 dbg.create_alloc(1024) 在过程内存中开拓堆空间,用于寄存咱们的机器码,而后调用 dbg.assemble_write_memory(alloc_address,"sub esp,10") 将一条汇编指令变成机器码写到对端内存,而后再 op = dbg.read_memory_byte(alloc_address + index) 顺次将其读取进去即可。

from LyScript32 import MyDebug

# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
    pass

if __name__ == "__main__":
    dbg = MyDebug()
    connect_flag = dbg.connect()
    print("连贯状态: {}".format(connect_flag))

    machine_code_list = []

    # 开拓堆空间
    alloc_address = dbg.create_alloc(1024)
    print("调配堆: {}".format(hex(alloc_address)))

    # 失去汇编机器码
    machine_code = dbg.assemble_write_memory(alloc_address,"sub esp,10")
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 失去汇编指令长度
    machine_code_size = dbg.assemble_code_size("sub esp,10")
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 读取机器码
    for index in range(0,machine_code_size):
        op = dbg.read_memory_byte(alloc_address + index)
        machine_code_list.append(op)

    # 开释堆空间
    dbg.delete_alloc(alloc_address)

    # 输入机器码
    print(machine_code_list)
    dbg.close()

咱们持续封装如上办法,封装成一个能够间接应用的 get_assembly_machine_code 函数。

from LyScript32 import MyDebug

# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
    machine_code_list = []

    # 开拓堆空间
    alloc_address = dbg.create_alloc(1024)
    print("调配堆: {}".format(hex(alloc_address)))

    # 失去汇编机器码
    machine_code = dbg.assemble_write_memory(alloc_address,asm)
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 失去汇编指令长度
    machine_code_size = dbg.assemble_code_size(asm)
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 读取机器码
    for index in range(0,machine_code_size):
        op = dbg.read_memory_byte(alloc_address + index)
        machine_code_list.append(op)

    # 开释堆空间
    dbg.delete_alloc(alloc_address)
    return machine_code_list

if __name__ == "__main__":
    dbg = MyDebug()
    connect_flag = dbg.connect()
    print("连贯状态: {}".format(connect_flag))

    # 转换第一对
    opcode = get_assembly_machine_code(dbg,"mov eax,1")
    for index in opcode:
        print("0x{:02X}".format(index),end="")
    print()

    # 转换第二对
    opcode = get_assembly_machine_code(dbg,"sub esp,10")
    for index in opcode:
        print("0x{:02X}".format(index),end="")
    print()

    dbg.close()

执行后即可失去后果:

扫描符合条件的内存: 通过应用上方封装的 get_assembly_machine_code() 并配合 scan_memory_one(scan_string) 函数,在对端内存搜寻是否存在符合条件的指令。

from LyScript32 import MyDebug

# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
    machine_code_list = []

    # 开拓堆空间
    alloc_address = dbg.create_alloc(1024)
    print("调配堆: {}".format(hex(alloc_address)))

    # 失去汇编机器码
    machine_code = dbg.assemble_write_memory(alloc_address,asm)
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 失去汇编指令长度
    machine_code_size = dbg.assemble_code_size(asm)
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 读取机器码
    for index in range(0,machine_code_size):
        op = dbg.read_memory_byte(alloc_address + index)
        machine_code_list.append(op)

    # 开释堆空间
    dbg.delete_alloc(alloc_address)
    return machine_code_list

if __name__ == "__main__":
    dbg = MyDebug()
    connect_flag = dbg.connect()
    print("连贯状态: {}".format(connect_flag))

    # 转换成列表
    opcode = get_assembly_machine_code(dbg,"push eax")
    print("失去机器码列表:",opcode)

    # 列表转换成字符串
    scan_string = " ".join([str(_) for _ in opcode])
    print("搜寻机器码字符串:", scan_string)

    address = dbg.scan_memory_one(scan_string)
    print("第一个符合条件的内存块: {}".format(hex(address)))

    dbg.close()

扫描后果如下:

将咱们须要搜寻的 ROP 指令集片段放到数组内间接搜寻,即可间接返回 ROP 内存地址。

from LyScript32 import MyDebug

# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
    machine_code_list = []

    # 开拓堆空间
    alloc_address = dbg.create_alloc(1024)
    print("调配堆: {}".format(hex(alloc_address)))

    # 失去汇编机器码
    machine_code = dbg.assemble_write_memory(alloc_address,asm)
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 失去汇编指令长度
    machine_code_size = dbg.assemble_code_size(asm)
    if machine_code == False:
        dbg.delete_alloc(alloc_address)

    # 读取机器码
    for index in range(0,machine_code_size):
        op = dbg.read_memory_byte(alloc_address + index)
        machine_code_list.append(op)

    # 开释堆空间
    dbg.delete_alloc(alloc_address)
    return machine_code_list

if __name__ == "__main__":
    dbg = MyDebug()
    connect_flag = dbg.connect()
    print("连贯状态: {}".format(connect_flag))

    for item in ["push eax","mov eax,1","jmp eax","pop eax"]:
        # 转换成列表
        opcode = get_assembly_machine_code(dbg,item)
        #print("失去机器码列表:",opcode)

        # 列表转换成字符串
        scan_string = " ".join([str(_) for _ in opcode])
        #print("搜寻机器码字符串:", scan_string)

        address = dbg.scan_memory_one(scan_string)
        print("第一个符合条件的内存块: {}".format(hex(address)))

    dbg.close()

检索成果如下:

正文完
 0