Module: PWN::Plugins::Emulator

Defined in:
lib/pwn/plugins/emulator.rb

Overview

Unicorn-backed single-function emulation with a stub backend for tests.

Class Method Summary collapse

Class Method Details

.authors ⇒ Object 



37
38
39
 
# File 'lib/pwn/plugins/emulator.rb', line 37

public_class_method def self.authors
  "AUTHOR(S):\n  0day Inc. <[email protected]>\n"
end

.emulate(opts = {}) ⇒ Object 



9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/pwn/plugins/emulator.rb', line 9

public_class_method def self.emulate(opts = {})
  path = (opts[:binary] || opts[:path]).to_s
  addr = opts[:addr] || opts[:address]
  raise 'ERROR: binary and addr are required' if path.empty? || addr.to_s.empty?

  max = (opts[:max_insns] || 10_000).to_i
  args = Array(opts[:args])
  if opts[:backend].to_s == 'stub' || opts[:plaintext]
    return {
      backend: 'stub',
      addr: addr,
      ret: opts[:plaintext] || opts[:ret],
      mem_writes: Array(opts[:mem_writes]),
      trace_tail: [],
      max_insns: max,
      args: args
    }
  end

  begin
    require 'unicorn_engine'
  rescue LoadError
    return { error: 'unicorn-engine gem missing', hint: 'gem install unicorn-engine', path: path }
  end

  { error: 'unicorn mapping not configured for this binary', path: path, addr: addr }
end

.help ⇒ Object 



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/pwn/plugins/emulator.rb', line 41

public_class_method def self.help
  puts "USAGE:
    # Emulate one function under Unicorn, or a stub backend for tests.
    #{self}.emulate(
      binary: 'required - filesystem path of the binary',
      path: 'optional - alias for binary',
      addr: 'required - function address',
      address: 'optional - alias for addr',
      args: 'optional - Array of integer/string arguments',
      max_insns: 'optional - instruction cap (defaults to 10000)',
      backend: 'optional - stub to skip Unicorn',
      plaintext: 'optional - stub return value',
      ret: 'optional - alias for plaintext',
      mem_writes: 'optional - Array of stub memory writes'
    )

    # Print the AUTHOR(S) string for this module.
    #{self}.authors
  "
  constants.sort
end