mirror of
https://github.com/qilingframework/qiling.git
synced 2026-10-12 02:21:40 +00:00
71 lines
2.0 KiB
Python
71 lines
2.0 KiB
Python
#!/usr/bin/env python3
|
|
#
|
|
# Cross Platform and Multi Architecture Advanced Binary Emulation Framework
|
|
#
|
|
|
|
import sys
|
|
sys.path.append("..")
|
|
|
|
from qiling.core import Qiling
|
|
from qiling.const import QL_VERBOSE
|
|
from qiling.os.const import STRING
|
|
|
|
def get_kaimendaji_password():
|
|
def my_getenv(ql, *args, **kwargs):
|
|
env = {"ID": b"000000000000000", "ethaddr": b"11:22:33:44:55:66"}
|
|
params = ql.os.resolve_fcall_params({'key': STRING})
|
|
value = env.get(params["key"], b"")
|
|
|
|
value_addr = ql.os.heap.alloc(len(value))
|
|
ql.mem.write(value_addr, value)
|
|
|
|
ql.reg.r0 = value_addr
|
|
ql.reg.arch_pc = ql.reg.lr
|
|
|
|
def get_password(ql, *args, **kwargs):
|
|
password_raw = ql.mem.read(ql.reg.r0, ql.reg.r2)
|
|
|
|
password = ''
|
|
for item in password_raw:
|
|
if 0 <= item <= 9:
|
|
password += chr(item + 48)
|
|
else:
|
|
password += chr(item + 87)
|
|
|
|
print("The password is: %s" % password)
|
|
|
|
def partial_run_init(ql):
|
|
# argv prepare
|
|
ql.reg.arch_sp -= 0x30
|
|
arg0_ptr = ql.reg.arch_sp
|
|
ql.mem.write(arg0_ptr, b"kaimendaji")
|
|
|
|
ql.reg.arch_sp -= 0x10
|
|
arg1_ptr = ql.reg.arch_sp
|
|
ql.mem.write(arg1_ptr, b"000000") # arbitrary password
|
|
|
|
ql.reg.arch_sp -= 0x20
|
|
argv_ptr = ql.reg.arch_sp
|
|
ql.mem.write(argv_ptr, ql.pack(arg0_ptr))
|
|
ql.mem.write(argv_ptr + ql.pointersize, ql.pack(arg1_ptr))
|
|
|
|
ql.reg.r2 = 2
|
|
ql.reg.r3 = argv_ptr
|
|
|
|
|
|
with open("../examples/rootfs/blob/u-boot.bin.img", "rb") as f:
|
|
uboot_code = f.read()
|
|
|
|
ql = Qiling(code=uboot_code[0x40:], archtype="arm", ostype="blob", profile="uboot_bin.ql", verbose=QL_VERBOSE.OFF)
|
|
|
|
image_base_addr = ql.loader.load_address
|
|
ql.hook_address(my_getenv, image_base_addr + 0x13AC0)
|
|
ql.hook_address(get_password, image_base_addr + 0x48634)
|
|
|
|
partial_run_init(ql)
|
|
|
|
ql.run(image_base_addr + 0x486B4, image_base_addr + 0x48718)
|
|
|
|
if __name__ == "__main__":
|
|
get_kaimendaji_password()
|