55 lines
1.7 KiB
Go
55 lines
1.7 KiB
Go
// pe_multitool tours the static-analysis side of winpwn: checksec, section
|
|
// entropy, IAT/EAT navigation with forwarder resolution, and the native ROP
|
|
// gadget scanner. Run from: workspace/demos/pe_multitool -> go run .
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"winpwn"
|
|
)
|
|
//const target = "../../../../Users/lee/Desktop/win_sems/Seminar/2019_Winter_WinPwn/200108/Lab1/simple_rop.exe"
|
|
const target = "../../../../Windows/SysWOW64/kernel32.dll"
|
|
|
|
func main() {
|
|
pe, err := winpwn.OpenPE(target)
|
|
if err != nil {
|
|
log.Fatalf("OpenPE: %v", err)
|
|
}
|
|
defer pe.Close()
|
|
|
|
// --- native ROP gadget scan, no rp++/Ropper required ---
|
|
rop, err := winpwn.NewROP(target)
|
|
if err != nil {
|
|
log.Fatalf("NewROP: %v", err)
|
|
}
|
|
defer rop.Close()
|
|
|
|
fmt.Println("--- gadgets ---")
|
|
if g, err := rop.Search("pop ecx ; ret"); err == nil {
|
|
fmt.Printf("pop ecx ; ret: 0x%X (%d candidates)\n", g[0].Address, len(g))
|
|
if lines, err := rop.Disassemble(g[0].Address, 2); err == nil {
|
|
fmt.Printf(" verified: %v\n", lines)
|
|
}
|
|
}
|
|
|
|
if g, err := rop.Search("pop eax ; ret"); err == nil {
|
|
fmt.Printf("pop eax ; ret: 0x%X (%d candidates)\n", g[0].Address, len(g))
|
|
if lines, err := rop.Disassemble(g[0].Address, 2); err == nil {
|
|
fmt.Printf(" verified: %v\n", lines)
|
|
}
|
|
}
|
|
|
|
if g, err := rop.Search("mov dword ptr [ecx], eax ; mov eax, esi ; pop esi ; pop ebp ; ret"); err == nil {
|
|
fmt.Printf("mov dword ptr [ecx], eax ; mov eax, esi ; pop esi ; pop ebp ; ret: 0x%X (%d candidates)\n", g[0].Address, len(g))
|
|
if lines, err := rop.Disassemble(g[0].Address, 2); err == nil {
|
|
fmt.Printf(" verified: %v\n", lines)
|
|
}
|
|
}
|
|
|
|
if g, err := rop.SearchRegex(`^pop r\w+ ; pop r\w+ ; ret$`); err == nil {
|
|
fmt.Printf("pop r.. ; pop r.. ; ret: %d candidates, first at 0x%X\n", len(g), g[0].Address)
|
|
}
|
|
|
|
}
|