samples/dasm-plugins/selfmodify.rb in metasm-1.0.3 vs samples/dasm-plugins/selfmodify.rb in metasm-1.0.4

- old
+ new

@@ -98,13 +98,13 @@ # expression checking if we get out of the loop loop_again_cond = dasm.cpu.get_jump_condition(dasm.decoded[a_cond]) loop_again_cond = Expression[:'!', loop_again_cond] if dasm.decoded[a_cond].next_addr != a_out init_bd = {} - loop_bd.keys.grep(Symbol).each { |reg| - bt = dasm.backtrace(reg, a_pre, :include_start => true) - init_bd[reg] = bt.first if bt.length == 1 and bt.first != Metasm::Expression::Unknown and bt.first != Metasm::Expression[reg] + loop_bd.values.map { |v| v.externals }.flatten.uniq.each { |ext| + bt = dasm.backtrace(ext, a_pre, :include_start => true) + init_bd[ext] = bt.first if bt.length == 1 and bt.first != Metasm::Expression::Unknown and bt.first != Metasm::Expression[ext] } # reject non-determinist memory write loop_bd.delete_if { |k, v| k.kind_of? Metasm::Indirection and not dasm.get_section_at(k.pointer.bind(init_bd).reduce) } @@ -113,15 +113,15 @@ puts "emulation running..." if $VERBOSE pre_bd = init_bd loop do # the effects of the loop post_bd = loop_bd.inject({}) { |bd, (k, v)| - if k.kind_of? Metasm::Indirection + if k.kind_of? Metasm::Indirection k = k.bind(pre_bd).reduce_rec raise "bad ptr #{k}" if not dasm.get_section_at(k.pointer.reduce) end - bd.update k => Metasm::Expression[v.bind(pre_bd).reduce] + bd.update k => Metasm::Expression[v.bind(pre_bd).reduce] } # the indirections used by the loop # read mem from cow_data # ignores stacked indirections & keys @@ -137,11 +137,11 @@ cow_data[k.pointer.reduce, k.len] = Metasm::Expression.encode_imm(v.bind(ind_bd).reduce, "u#{k.len*8}".to_sym, dasm.cpu.endianness) } break if loop_again_cond.bind(post_bd).reduce == 0 - pre_bd = post_bd + pre_bd.update(post_bd) pre_bd.delete_if { |k, v| not k.kind_of? Symbol } end puts "emulation done (#{cow_data.data.length} bytes)" if $VERBOSE @@ -164,11 +164,11 @@ pre = (b1.from_normal - [b2.list.last.address]).first first = b1.address last = b2.list.last.address post = (b2.to_normal - [b1.address]).first - loop_bd = dasm.code_binding(first, post) + loop_bd = dasm.code_binding(first, post, :include_flags => true) [pre, first, last, post, loop_bd] end # redirects the code flow from addr to the decoded section @@ -177,10 +177,10 @@ dasm.each_instructionblock { |b| next if not b.to_normal.to_a.include? addr b.to_normal.map! { |tn| dasm.normalize(tn) == addr ? newto : tn } dasm.add_xref(newto, Metasm::Xref.new(:x, b.list.last.address)) b.list.last.add_comment "x:#{newto}" - dasm.addrs_todo << [newto, b.list.last.address] + dasm.addrs_todo << { :addr => newto, :from => b.list.last.address } } end end if self.kind_of? Metasm::Disassembler