1 Star 0 Fork 0

stesen / gef

Create your Gitee Account
Explore and code with more than 8 million developers,Free private repositories !:)
Sign up
This repository doesn't specify license. Please pay attention to the specific project description and its upstream code dependency when using it.
Clone or Download
gef.py 281.06 KB
Copy Edit Web IDE Raw Blame History
m00194513 authored 2019-07-22 11:01 . dump fix
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342534353445345534653475348534953505351535253535354535553565357535853595360536153625363536453655366536753685369537053715372537353745375537653775378537953805381538253835384538553865387538853895390539153925393539453955396539753985399540054015402540354045405540654075408540954105411541254135414541554165417541854195420542154225423542454255426542754285429543054315432543354345435543654375438543954405441544254435444544554465447544854495450545154525453545454555456545754585459546054615462546354645465546654675468546954705471547254735474547554765477547854795480548154825483548454855486548754885489549054915492549354945495549654975498549955005501550255035504550555065507550855095510551155125513551455155516551755185519552055215522552355245525552655275528552955305531553255335534553555365537553855395540554155425543554455455546554755485549555055515552555355545555555655575558555955605561556255635564556555665567556855695570557155725573557455755576557755785579558055815582558355845585558655875588558955905591559255935594559555965597559855995600560156025603560456055606560756085609561056115612561356145615561656175618561956205621562256235624562556265627562856295630563156325633563456355636563756385639564056415642564356445645564656475648564956505651565256535654565556565657565856595660566156625663566456655666566756685669567056715672567356745675567656775678567956805681568256835684568556865687568856895690569156925693569456955696569756985699570057015702570357045705570657075708570957105711571257135714571557165717571857195720572157225723572457255726572757285729573057315732573357345735573657375738573957405741574257435744574557465747574857495750575157525753575457555756575757585759576057615762576357645765576657675768576957705771577257735774577557765777577857795780578157825783578457855786578757885789579057915792579357945795579657975798579958005801580258035804580558065807580858095810581158125813581458155816581758185819582058215822582358245825582658275828582958305831583258335834583558365837583858395840584158425843584458455846584758485849585058515852585358545855585658575858585958605861586258635864586558665867586858695870587158725873587458755876587758785879588058815882588358845885588658875888588958905891589258935894589558965897589858995900590159025903590459055906590759085909591059115912591359145915591659175918591959205921592259235924592559265927592859295930593159325933593459355936593759385939594059415942594359445945594659475948594959505951595259535954595559565957595859595960596159625963596459655966596759685969597059715972597359745975597659775978597959805981598259835984598559865987598859895990599159925993599459955996599759985999600060016002600360046005600660076008600960106011601260136014601560166017601860196020602160226023602460256026602760286029603060316032603360346035603660376038603960406041604260436044604560466047604860496050605160526053605460556056605760586059606060616062606360646065606660676068606960706071607260736074607560766077607860796080608160826083608460856086608760886089609060916092609360946095609660976098609961006101610261036104610561066107610861096110611161126113611461156116611761186119612061216122612361246125612661276128612961306131613261336134613561366137613861396140614161426143614461456146614761486149615061516152615361546155615661576158615961606161616261636164616561666167616861696170617161726173617461756176617761786179618061816182618361846185618661876188618961906191619261936194619561966197619861996200620162026203620462056206620762086209621062116212621362146215621662176218621962206221622262236224622562266227622862296230623162326233623462356236623762386239624062416242624362446245624662476248624962506251625262536254625562566257625862596260626162626263626462656266626762686269627062716272627362746275627662776278627962806281628262836284628562866287628862896290629162926293629462956296629762986299630063016302630363046305630663076308630963106311631263136314631563166317631863196320632163226323632463256326632763286329633063316332633363346335633663376338633963406341634263436344634563466347634863496350635163526353635463556356635763586359636063616362636363646365636663676368636963706371637263736374637563766377637863796380638163826383638463856386638763886389639063916392639363946395639663976398639964006401640264036404640564066407640864096410641164126413641464156416641764186419642064216422642364246425642664276428642964306431643264336434643564366437643864396440644164426443644464456446644764486449645064516452645364546455645664576458645964606461646264636464646564666467646864696470647164726473647464756476647764786479648064816482648364846485648664876488648964906491649264936494649564966497649864996500650165026503650465056506650765086509651065116512651365146515651665176518651965206521652265236524652565266527652865296530653165326533653465356536653765386539654065416542654365446545654665476548654965506551655265536554655565566557655865596560656165626563656465656566656765686569657065716572657365746575657665776578657965806581658265836584658565866587658865896590659165926593659465956596659765986599660066016602660366046605660666076608660966106611661266136614661566166617661866196620662166226623662466256626662766286629663066316632663366346635663666376638663966406641664266436644664566466647664866496650665166526653665466556656665766586659666066616662666366646665666666676668666966706671667266736674667566766677667866796680668166826683668466856686668766886689669066916692669366946695669666976698669967006701670267036704670567066707670867096710671167126713671467156716671767186719672067216722672367246725672667276728672967306731673267336734673567366737673867396740674167426743674467456746674767486749675067516752675367546755675667576758675967606761676267636764676567666767676867696770677167726773677467756776677767786779678067816782678367846785678667876788678967906791679267936794679567966797679867996800680168026803680468056806680768086809681068116812681368146815681668176818681968206821682268236824682568266827682868296830683168326833683468356836683768386839684068416842684368446845684668476848684968506851685268536854685568566857685868596860686168626863686468656866686768686869687068716872687368746875687668776878687968806881688268836884688568866887688868896890689168926893689468956896689768986899690069016902690369046905690669076908690969106911691269136914691569166917691869196920692169226923692469256926692769286929693069316932693369346935693669376938693969406941694269436944694569466947694869496950695169526953695469556956695769586959696069616962696369646965696669676968696969706971697269736974697569766977697869796980698169826983698469856986698769886989699069916992699369946995699669976998699970007001700270037004700570067007700870097010701170127013701470157016701770187019702070217022702370247025702670277028702970307031703270337034703570367037703870397040704170427043704470457046704770487049705070517052705370547055705670577058705970607061706270637064706570667067706870697070707170727073707470757076707770787079708070817082708370847085708670877088708970907091709270937094709570967097709870997100710171027103710471057106710771087109711071117112711371147115711671177118711971207121712271237124712571267127712871297130713171327133713471357136713771387139714071417142714371447145714671477148714971507151715271537154715571567157715871597160716171627163716471657166716771687169717071717172717371747175717671777178717971807181718271837184718571867187718871897190719171927193719471957196719771987199720072017202720372047205720672077208720972107211721272137214721572167217721872197220722172227223722472257226722772287229723072317232723372347235723672377238723972407241724272437244724572467247724872497250725172527253725472557256725772587259726072617262726372647265726672677268726972707271727272737274727572767277727872797280728172827283728472857286728772887289729072917292729372947295729672977298729973007301730273037304730573067307730873097310731173127313731473157316731773187319732073217322732373247325732673277328732973307331733273337334733573367337733873397340734173427343734473457346734773487349735073517352735373547355735673577358735973607361736273637364736573667367736873697370737173727373737473757376737773787379738073817382738373847385738673877388738973907391739273937394739573967397739873997400740174027403740474057406740774087409741074117412741374147415741674177418741974207421742274237424742574267427742874297430743174327433743474357436743774387439744074417442744374447445744674477448744974507451745274537454745574567457745874597460746174627463746474657466746774687469747074717472747374747475747674777478747974807481748274837484748574867487748874897490749174927493749474957496749774987499750075017502750375047505750675077508750975107511751275137514751575167517751875197520752175227523752475257526752775287529753075317532753375347535753675377538753975407541754275437544754575467547754875497550755175527553755475557556755775587559756075617562756375647565756675677568756975707571757275737574757575767577757875797580758175827583758475857586758775887589759075917592759375947595759675977598759976007601760276037604760576067607760876097610761176127613761476157616761776187619762076217622762376247625762676277628762976307631763276337634763576367637763876397640764176427643764476457646764776487649765076517652765376547655765676577658765976607661766276637664766576667667766876697670767176727673767476757676767776787679768076817682768376847685768676877688768976907691769276937694769576967697769876997700770177027703770477057706770777087709771077117712771377147715771677177718771977207721772277237724772577267727772877297730773177327733773477357736773777387739774077417742774377447745774677477748774977507751775277537754775577567757775877597760776177627763776477657766776777687769777077717772777377747775777677777778777977807781778277837784778577867787778877897790779177927793779477957796779777987799780078017802780378047805780678077808780978107811781278137814781578167817781878197820782178227823782478257826782778287829783078317832783378347835783678377838783978407841784278437844784578467847784878497850785178527853785478557856785778587859786078617862786378647865786678677868786978707871787278737874787578767877787878797880788178827883788478857886788778887889789078917892789378947895789678977898789979007901790279037904790579067907790879097910791179127913791479157916791779187919792079217922792379247925792679277928792979307931793279337934793579367937793879397940794179427943794479457946794779487949795079517952795379547955795679577958795979607961796279637964796579667967796879697970797179727973797479757976797779787979798079817982798379847985798679877988798979907991799279937994799579967997799879998000800180028003800480058006800780088009801080118012801380148015801680178018801980208021802280238024802580268027802880298030803180328033803480358036803780388039804080418042804380448045804680478048804980508051805280538054805580568057805880598060806180628063806480658066806780688069807080718072807380748075807680778078807980808081808280838084808580868087808880898090809180928093809480958096809780988099810081018102810381048105810681078108810981108111811281138114811581168117811881198120812181228123812481258126812781288129813081318132813381348135813681378138813981408141814281438144814581468147814881498150815181528153815481558156815781588159816081618162816381648165816681678168816981708171817281738174
# -*- coding: utf-8 -*-
#
#
#######################################################################################
# GEF - Multi-Architecture GDB Enhanced Features for Exploiters & Reverse-Engineers
#
# by @_hugsy_
#
#######################################################################################
#
# GEF is a kick-ass set of commands for X86, ARM, MIPS, PowerPC and SPARC to
# make GDB cool again for exploit dev. It is aimed to be used mostly by exploit
# devs and reversers, to provides additional features to GDB using the Python
# API to assist during the process of dynamic analysis.
#
# GEF fully relies on GDB API and other Linux-specific sources of information
# (such as /proc/<pid>). As a consequence, some of the features might not work
# on custom or hardened systems such as GrSec.
#
# It has full support for both Python2 and Python3 and works on
# * x86-32 & x86-64
# * arm v5,v6,v7
# * aarch64 (armv8)
# * mips & mips64
# * powerpc & powerpc64
# * sparc & sparc64(v9)
#
# Requires GDB 7.x compiled with Python (2.x, or 3.x)
#
# To start: in gdb, type `source /path/to/gef.py`
#
#######################################################################################
#
# gef is distributed under the MIT License (MIT)
# Copyright (c) 2013-2017 crazy rabbidz
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
#
#
from __future__ import print_function, division
import abc
import binascii
import codecs
import collections
import ctypes
import fcntl
import functools
import getopt
import hashlib
import imp
import inspect
import itertools
import os
import platform
import re
import resource
import socket
import string
import struct
import subprocess
import sys
import tempfile
import termios
import time
import traceback
import types
PYTHON_MAJOR = sys.version_info[0]
GDB_MIN_VERSION = (7, 7)
if PYTHON_MAJOR == 2:
from HTMLParser import HTMLParser
from cStringIO import StringIO
from urllib import urlopen
import ConfigParser as configparser
import xmlrpclib
# Compat Py2/3 hacks
range = xrange
FileNotFoundError = IOError
ConnectionRefusedError = socket.error
left_arrow = "<-"
right_arrow = "->"
down_arrow = "\\->"
horizontal_line = "-"
vertical_line = "|"
cross = "x"
tick = "v"
gef_prompt = "gef-stesen> "
gef_prompt_on = "\001\033[1;32m\002{0:s}\001\033[0m\002".format(gef_prompt)
gef_prompt_off = "\001\033[1;31m\002{0:s}\001\033[0m\002".format(gef_prompt)
elif PYTHON_MAJOR == 3:
from html.parser import HTMLParser
from io import StringIO
from urllib.request import urlopen
import configparser
import xmlrpc.client as xmlrpclib
# Compat Py2/3 hack
long = int
unicode = str
oss = os.environ.get('ANDROID_ROOT')
if (oss and oss == "/system"):
left_arrow = "<-"
right_arrow = "->"
down_arrow = "\\->"
horizontal_line = "-"
vertical_line = "|"
cross = "x"
tick = "v"
gef_prompt = "gef-stesen@android> "
gef_prompt_on = "\001\033[1;32m\002{0:s}\001\033[0m\002".format(gef_prompt)
gef_prompt_off = "\001\033[1;31m\002{0:s}\001\033[0m\002".format(gef_prompt)
else:
left_arrow = " \u2190 "
right_arrow = " \u2192 "
down_arrow = "\u21b3"
horizontal_line = "\u2500"
vertical_line = "\u2502"
cross = "\u2718 "
tick = "\u2713 "
gef_prompt = "gef-stesen\u27a4 "
gef_prompt_on = "\001\033[1;32m\002{0:s}\001\033[0m\002".format(gef_prompt)
gef_prompt_off = "\001\033[1;31m\002{0:s}\001\033[0m\002".format(gef_prompt)
else:
raise Exception("WTF is this Python version??")
def http_get(url):
"""Basic HTTP wrapper for GET request. Return the body of the page if HTTP code is OK,
otherwise return None."""
try:
http = urlopen(url)
if http.getcode() != 200:
return None
return http.read()
except Exception:
return None
def update_gef(argv):
"""Try to update `gef` to the latest version pushed on GitHub. Return 0 on success,
1 on failure. """
gef_local = os.path.realpath(argv[0])
hash_gef_local = hashlib.sha512(open(gef_local, "rb").read()).digest()
gef_remote = "https://raw.githubusercontent.com/hugsy/gef/master/gef.py"
gef_remote_data = http_get(gef_remote)
if gef_remote_data is None:
print("[-] Failed to get remote gef")
return 1
hash_gef_remote = hashlib.sha512(gef_remote_data).digest()
if hash_gef_local == hash_gef_remote:
print("[-] No update")
else:
with open(gef_local, "wb") as f:
f.write(gef_remote_data)
print("[+] Updated")
return 0
try:
import gdb
except ImportError:
# if out of gdb, the only action allowed is to update gef.py
if len(sys.argv)==2 and sys.argv[1]=="--update":
sys.exit( update_gef(sys.argv) )
print("[-] gef cannot run as standalone")
sys.exit(0)
__gef__ = None
__commands__ = []
__aliases__ = []
__config__ = {}
__infos_files__ = []
__gef_convenience_vars_index__ = 0
__context_messages__ = []
__heap_allocated_list__ = []
__heap_freed_list__ = []
__heap_uaf_watchpoints__ = []
DEFAULT_PAGE_ALIGN_SHIFT = 12
DEFAULT_PAGE_SIZE = 1 << DEFAULT_PAGE_ALIGN_SHIFT
GEF_RC = os.path.join(os.getenv("HOME"), ".gef.rc")
GEF_TEMP_DIR = os.path.join(tempfile.gettempdir(), "gef")
GEF_MAX_STRING_LENGTH = 50
############ add by stesen start ##########
__maps_file__ = "NONE"
############ add by stesen end ##########
___default_aliases___ = {
# WinDBG style breakpoints
"bl" : "info breakpoints",
"bc" : "delete breakpoints",
"bp" : "break",
"bd" : "disable breakpoints",
"be" : "enable breakpoints",
"tbp" : "tbreak",
"pa" : "advance",
"ptc" : "finish",
"uf" : "disassemble",
"kp" : "info stack",
}
current_elf = None
current_arch = None
qemu_mode = False
if PYTHON_MAJOR==3:
lru_cache = functools.lru_cache
else:
def lru_cache(maxsize = 128):
"""Portage of the Python3 LRU cache mechanism provided by itertools."""
class GefLruCache(object):
"""Local LRU cache for Python2"""
def __init__(self, input_func, max_size):
self._input_func = input_func
self._max_size = max_size
self._caches_dict = {}
self._caches_info = {}
return
def cache_info(self, caller=None):
"""Return a string with statistics of cache usage."""
if caller not in self._caches_dict:
return ""
hits = self._caches_info[caller]["hits"]
missed = self._caches_info[caller]["missed"]
cursz = len(self._caches_dict[caller])
return "CacheInfo(hits={}, misses={}, maxsize={}, currsize={})".format(hits, missed, self._max_size, cursz)
def cache_clear(self, caller=None):
"""Clear a cache."""
if caller in self._caches_dict:
self._caches_dict[caller] = collections.OrderedDict()
return
def __get__(self, obj, objtype):
"""Cache getter."""
return_func = functools.partial(self._cache_wrapper, obj)
return_func.cache_clear = functools.partial(self.cache_clear, obj)
return functools.wraps(self._input_func)(return_func)
def __call__(self, *args, **kwargs):
"""Invoking the wrapped function, by attempting to get its value from cache if existing."""
return self._cache_wrapper(None, *args, **kwargs)
__call__.cache_clear = cache_clear
__call__.cache_info = cache_info
def _cache_wrapper(self, caller, *args, **kwargs):
"""Defines the caching mechanism."""
kwargs_key = "".join(map(lambda x : str(x) + str(type(kwargs[x])) + str(kwargs[x]), sorted(kwargs)))
key = "".join(map(lambda x : str(type(x)) + str(x) , args)) + kwargs_key
if caller not in self._caches_dict:
self._caches_dict[caller] = collections.OrderedDict()
self._caches_info[caller] = {"hits":0, "missed":0}
cur_caller_cache_dict = self._caches_dict[caller]
if key in cur_caller_cache_dict:
self._caches_info[caller]["hits"] += 1
return cur_caller_cache_dict[key]
self._caches_info[caller]["missed"] += 1
if self._max_size is not None:
if len(cur_caller_cache_dict) >= self._max_size:
cur_caller_cache_dict.popitem(False)
cur_caller_cache_dict[key] = self._input_func(caller, *args, **kwargs) if caller != None else self._input_func(*args, **kwargs)
return cur_caller_cache_dict[key]
return (lambda input_func : functools.wraps(input_func)(GefLruCache(input_func, maxsize)))
def reset_all_caches():
"""Free all caches. If an object is cached, it will have a callable attribute `cache_clear`
which will be invoked to purge the function cache."""
for mod in dir(sys.modules["__main__"]):
obj = getattr(sys.modules["__main__"], mod)
if hasattr(obj, "cache_clear"):
obj.cache_clear()
qemu_mode = False
return
class Color:
"""Colorify class."""
colors = {
"normal" : "\033[0m",
"gray" : "\033[1;30m",
"red" : "\033[31m",
"green" : "\033[32m",
"yellow" : "\033[33m",
"blue" : "\033[34m",
"pink" : "\033[35m",
"bold" : "\033[1m",
"underline" : "\033[4m",
"underline_off" : "\033[24m",
"highlight" : "\033[3m",
"highlight_off" : "\033[23m",
"blink" : "\033[5m",
"blink_off" : "\033[25m",
}
@staticmethod
def redify(msg): return Color.colorify(msg, attrs="red")
@staticmethod
def greenify(msg): return Color.colorify(msg, attrs="green")
@staticmethod
def blueify(msg): return Color.colorify(msg, attrs="blue")
@staticmethod
def yellowify(msg): return Color.colorify(msg, attrs="yellow")
@staticmethod
def grayify(msg): return Color.colorify(msg, attrs="gray")
@staticmethod
def pinkify(msg): return Color.colorify(msg, attrs="pink")
@staticmethod
def boldify(msg): return Color.colorify(msg, attrs="bold")
@staticmethod
def underlinify(msg): return Color.colorify(msg, attrs="underline")
@staticmethod
def highlightify(msg): return Color.colorify(msg, attrs="highlight")
@staticmethod
def blinkify(msg): return Color.colorify(msg, attrs="blink")
@staticmethod
def colorify(text, attrs):
"""Color a text following the given attributes."""
do_disable = __config__.get("gef.disable_color", False)
do_disable = do_disable[0] if do_disable else False
if do_disable: return text
colors = Color.colors
msg = [colors[attr] for attr in attrs.split() if attr in colors]
msg.append(text)
if colors["highlight"] in msg : msg.append(colors["highlight_off"])
if colors["underline"] in msg : msg.append(colors["underline_off"])
if colors["blink"] in msg : msg.append(colors["blink_off"])
msg.append(colors["normal"])
return "".join(msg)
class Address:
"""GEF representation of memory addresses."""
def __init__(self, *args, **kwargs):
self.value = kwargs.get("value", 0)
self.section = kwargs.get("section", None)
self.info = kwargs.get("info", None)
self.valid = kwargs.get("valid", True)
return
def __str__(self):
return hex(self.value)
def is_in_text_segment(self):
return hasattr(self.info, "name") and ".text" in self.info.name
def is_in_stack_segment(self):
return hasattr(self.info, "name") and "[stack]" in self.info.name
def is_in_heap_segment(self):
return hasattr(self.info, "name") and "[heap]" in self.info.name
def dereference(self):
addr = align_address(long(self.value))
try:
addr = dereference(addr)
return long(addr)
except gdb.MemoryError:
return None
class Permission:
"""GEF representation of Linux permission."""
NONE = 0
READ = 1
WRITE = 2
EXECUTE = 4
ALL = READ | WRITE | EXECUTE
def __init__(self, *args, **kwargs):
self.value = kwargs.get("value", 0)
return
def __or__(self, value):
return self.value | value
def __and__(self, value):
return self.value & value
def __xor__(self, value):
return self.value ^ value
def __eq__(self, value):
return self.value == value
def __ne__(self, value):
return self.value != value
def __str__(self):
perm_str = ""
perm_str += "r" if self & Permission.READ else "-"
perm_str += "w" if self & Permission.WRITE else "-"
perm_str += "x" if self & Permission.EXECUTE else "-"
return perm_str
@staticmethod
def from_info_sections(*args):
perm = Permission()
for arg in args:
if "READONLY" in arg:
perm.value += Permission.READ
if "DATA" in arg:
perm.value += Permission.WRITE
if "CODE" in arg:
perm.value += Permission.EXECUTE
return perm
@staticmethod
def from_process_maps(perm_str):
perm = Permission()
if perm_str[0] == "r":
perm.value += Permission.READ
if perm_str[1] == "w":
perm.value += Permission.WRITE
if perm_str[2] == "x":
perm.value += Permission.EXECUTE
return perm
class Section:
"""GEF representation of process memory sections."""
page_start = None
page_end = None
offset = None
permission = None
inode = None
path = None
def __init__(self, *args, **kwargs):
attrs = ["page_start", "page_end", "offset", "permission", "inode", "path"]
for attr in attrs:
value = kwargs.get(attr)
setattr(self, attr, value)
return
def is_readable(self):
return self.permission.value and self.permission.value&Permission.READ
def is_writable(self):
return self.permission.value and self.permission.value&Permission.WRITE
def is_executable(self):
return self.permission.value and self.permission.value&Permission.EXECUTE
@property
def size(self):
if self.page_end is None or self.page_start is None:
return -1
return self.page_end - self.page_start
class Zone:
name = None
zone_start = None
zone_end = None
filename = None
class Elf:
""" Basic ELF parsing.
Ref:
- http://www.skyfree.org/linux/references/ELF_Format.pdf
- http://refspecs.freestandards.org/elf/elfspec_ppc.pdf
- http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html
"""
BIG_ENDIAN = 0
LITTLE_ENDIAN = 1
ELF_32_BITS = 0x01
ELF_64_BITS = 0x02
X86_64 = 0x3e
X86_32 = 0x03
ARM = 0x28
MIPS = 0x08
POWERPC = 0x14
POWERPC64 = 0x15
SPARC = 0x02
SPARC64 = 0x2b
AARCH64 = 0xb7
ET_EXEC = 2
ET_DYN = 3
ET_CORE = 4
e_magic = b'\x7fELF'
e_class = ELF_32_BITS
e_endianness = LITTLE_ENDIAN
e_eiversion = None
e_osabi = None
e_abiversion = None
e_pad = None
e_type = ET_EXEC
e_machine = X86_32
e_version = None
e_entry = 0x00
e_phoff = None
e_shoff = None
e_flags = None
e_ehsize = None
e_phentsize = None
e_phnum = None
e_shentsize = None
e_shnum = None
e_shstrndx = None
def __init__(self, elf="", minimalist=False):
"""Instanciates an Elf object. The default behavior is to create the object by parsing the ELF file on FS.
But on some cases (QEMU-stub), we may just want a simply minimal object with default values."""
if minimalist:
return
if not os.access(elf, os.R_OK):
err("'{0}' not found/readable".format(elf))
err("Failed to get file debug information, most of gef features will not work")
return
with open(elf, "rb") as fd:
# off 0x0
self.e_magic, self.e_class, self.e_endianness, self.e_eiversion = struct.unpack(">IBBB", fd.read(7))
# adjust endianness in bin reading
endian = "<" if self.e_endianness == Elf.LITTLE_ENDIAN else ">"
# off 0x7
self.e_osabi, self.e_abiversion = struct.unpack("{}BB".format(endian), fd.read(2))
# off 0x9
self.e_pad = fd.read(7)
# off 0x10
self.e_type, self.e_machine, self.e_version = struct.unpack("{}HHI".format(endian), fd.read(8))
# off 0x18
if self.e_class == Elf.ELF_64_BITS:
# if arch 64bits
self.e_entry, self.e_phoff, self.e_shoff = struct.unpack("{}QQQ".format(endian), fd.read(24))
else:
# else arch 32bits
self.e_entry, self.e_phoff, self.e_shoff = struct.unpack("{}III".format(endian), fd.read(12))
self.e_flags, self.e_ehsize, self.e_phentsize, self.e_phnum = struct.unpack("{}HHHH".format(endian), fd.read(8))
self.e_shentsize, self.e_shnum, self.e_shstrndx = struct.unpack("{}HHH".format(endian), fd.read(6))
return
class Instruction:
"""GEF representation of instruction."""
def __init__(self, address, location, mnemo, operands):
self.address, self.location, self.mnemo, self.operands = address, location, mnemo, operands
return
def __str__(self):
return "{:#10x} {:16} {:6} {:s}".format(self.address,
self.location,
self.mnemo,
", ".join(self.operands))
def is_valid(self):
return "(bad)" not in self.mnemo
class GlibcArena:
"""Glibc arena class
Ref: https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1671 """
def __init__(self, addr=None):
arena = gdb.parse_and_eval(addr)
malloc_state_t = cached_lookup_type("struct malloc_state")
self.__arena = arena.cast(malloc_state_t)
self.__addr = long(arena.address)
return
def __getitem__(self, item):
return self.__arena[item]
def __getattr__(self, item):
return self.__arena[item]
def __int__(self):
return self.__addr
def dereference_as_long(self, addr):
return long(dereference(addr).address)
def fastbin(self, i):
addr = self.dereference_as_long(self.fastbinsY[i])
if addr == 0:
return None
return GlibcChunk(addr + 2 * current_arch.ptrsize)
def bin(self, i):
idx = i * 2
fd = self.dereference_as_long(self.bins[idx])
bw = self.dereference_as_long(self.bins[idx + 1])
return fd, bw
def get_next(self):
addr_next = self.dereference_as_long(self.next)
arena_main = GlibcArena("main_arena")
if addr_next == arena_main.__addr:
return None
return GlibcArena("*{:#x} ".format(addr_next))
def __str__(self):
top = self.dereference_as_long(self.top)
last_remainder = self.dereference_as_long(self.last_remainder)
n = self.dereference_as_long(self.next)
nfree = self.dereference_as_long(self.next_free)
sysmem = long(self.system_mem)
fmt = "Arena (base={:#x}, top={:#x}, last_remainder={:#x}, next={:#x}, next_free={:#x}, system_mem={:#x})"
return fmt.format(self.__addr, top, last_remainder, n, nfree, sysmem)
class GlibcChunk:
"""Glibc chunk class.
Ref: https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/"""
def __init__(self, addr, from_base=False):
self.ptrsize = current_arch.ptrsize
if from_base:
self.start_addr = addr
self.addr = addr + 2 * self.ptrsize
else:
self.start_addr = int(addr - 2 * self.ptrsize)
self.addr = addr
self.size_addr = int(self.addr - self.ptrsize)
self.prev_size_addr = self.start_addr
return
def get_chunk_size(self):
return read_int_from_memory(self.size_addr) & (~0x03)
def get_usable_size(self):
# https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L4537
cursz = self.get_chunk_size()
if cursz == 0: return cursz
if self.has_M_bit(): return cursz - 2 * self.ptrsize
return cursz - self.ptrsize
def get_prev_chunk_size(self):
return read_int_from_memory(self.prev_size_addr)
def get_next_chunk(self):
addr = self.addr + self.get_chunk_size()
return GlibcChunk(addr)
# if free-ed functions
def get_fwd_ptr(self):
return read_int_from_memory(self.addr)
@property
def fwd(self):
return self.get_fwd_ptr()
def get_bkw_ptr(self):
return read_int_from_memory(self.addr + self.ptrsize)
@property
def bck(self):
return self.get_bkw_ptr()
# endif free-ed functions
def has_P_bit(self):
"""Check for in PREV_INUSE bit
Ref: https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1267"""
return read_int_from_memory(self.size_addr) & 0x01
def has_M_bit(self):
"""Check for in IS_MMAPPED bit
Ref: https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1274"""
return read_int_from_memory(self.size_addr) & 0x02
def has_N_bit(self):
"""Check for in NON_MAIN_ARENA bit.
Ref: https://github.com/sploitfun/lsploits/blob/master/glibc/malloc/malloc.c#L1283"""
return read_int_from_memory(self.size_addr) & 0x04
def is_used(self):
"""Check if the current block is used by:
- checking the M bit is true
- or checking that next chunk PREV_INUSE flag is true """
if self.has_M_bit():
return True
next_chunk = self.get_next_chunk()
return True if next_chunk.has_P_bit() else False
def str_chunk_size_flag(self):
msg = []
msg.append("PREV_INUSE flag: {}".format(Color.greenify("On") if self.has_P_bit() else Color.redify("Off")))
msg.append("IS_MMAPPED flag: {}".format(Color.greenify("On") if self.has_M_bit() else Color.redify("Off")))
msg.append("NON_MAIN_ARENA flag: {}".format(Color.greenify("On") if self.has_N_bit() else Color.redify("Off")))
return "\n".join(msg)
def _str_sizes(self):
msg = []
failed = False
try:
msg.append("Chunk size: {0:d} ({0:#x})".format(self.get_chunk_size()))
msg.append("Usable size: {0:d} ({0:#x})".format(self.get_usable_size()))
failed = True
except gdb.MemoryError:
msg.append("Chunk size: Cannot read at {:#x} (corrupted?)".format(self.size_addr))
try:
msg.append("Previous chunk size: {0:d} ({0:#x})".format(self.get_prev_chunk_size()))
failed = True
except gdb.MemoryError:
msg.append("Previous chunk size: Cannot read at {:#x} (corrupted?)".format(self.start_addr))
if failed:
msg.append(self.str_chunk_size_flag())
return "\n".join(msg)
def _str_pointers(self):
fwd = self.addr
bkw = self.addr + self.ptrsize
msg = []
try:
msg.append("Forward pointer: {0:#x}".format(self.get_fwd_ptr()))
except gdb.MemoryError:
msg.append("Forward pointer: {0:#x} (corrupted?)".format(fwd))
try:
msg.append("Backward pointer: {0:#x}".format(self.get_bkw_ptr()))
except gdb.MemoryError:
msg.append("Backward pointer: {0:#x} (corrupted?)".format(bkw))
return "\n".join(msg)
def str_as_alloced(self):
return self._str_sizes()
def str_as_freed(self):
return "{}\n\n{}".format(self._str_sizes(), self._str_pointers())
def flags_as_string(self):
flags = []
if self.has_P_bit():
flags.append(Color.colorify("PREV_INUSE", attrs="red bold"))
if self.has_M_bit():
flags.append(Color.colorify("IS_MMAPPED", attrs="red bold"))
if self.has_N_bit():
flags.append(Color.colorify("NON_MAIN_ARENA", attrs="red bold"))
return "|".join(flags)
def __str__(self):
msg = "{:s}(addr={:#x}, size={:#x}, flags={:s})".format(Color.colorify("Chunk", attrs="yellow bold underline"),
long(self.addr),self.get_chunk_size(), self.flags_as_string())
return msg
def pprint(self):
msg = []
msg.append(str(self))
if self.is_used():
msg.append(self.str_as_alloced())
else:
msg.append(self.str_as_freed())
gdb.write("\n".join(msg) + "\n")
gdb.flush()
return
@lru_cache()
def get_main_arena():
try:
arena = GlibcArena("main_arena")
except gdb.error as e:
err("Failed to get `main_arena` symbol, heap commands may not work properly: {}".format(e))
warn("Did you install `libc6-dbg`?")
arena = None
return arena
def titlify(text, color=None, msg_color=None):
"""Print a title."""
cols = get_terminal_size()[1]
nb = (cols - len(text) - 4)//2
if color is None:
color = __config__.get("theme.default_title_line")[0]
if msg_color is None:
msg_color = __config__.get("theme.default_title_message")[0]
msg = []
msg.append(Color.colorify(horizontal_line * nb + '[ ', attrs=color))
msg.append(Color.colorify(text, attrs=msg_color))
msg.append(Color.colorify(' ]' + horizontal_line * nb, attrs=color))
return "".join(msg)
def _xlog(text, stream, cr=True):
"""Logging core function."""
text += "\n" if cr else ""
gdb.write(text, stream)
if cr:
gdb.flush()
return 0
def err(msg, cr=True): return _xlog("{} {}".format(Color.colorify("[!]", attrs="bold red"), msg), gdb.STDERR, cr)
def warn(msg, cr=True): return _xlog("{} {}".format(Color.colorify("[*]", attrs="bold yellow"), msg), gdb.STDLOG, cr)
def ok(msg, cr=True): return _xlog("{} {}".format(Color.colorify("[+]", attrs="bold green"), msg), gdb.STDLOG, cr)
def info(msg, cr=True): return _xlog("{} {}".format(Color.colorify("[+]", attrs="bold blue"), msg), gdb.STDLOG, cr)
def push_context_message(level, message):
"""Push the message to be displayed the next time the context is invoked."""
global __context_messages__
if level not in ("error", "warn", "ok", "info"):
err("Invalid level '{}', discarding message".format(level))
return
__context_messages__.append((level, message))
return
def show_last_exception():
"""Display the last Python exception."""
print("")
exc_type, exc_value, exc_traceback = sys.exc_info()
print(" Exception raised ".center(80, horizontal_line))
print("{}: {}".format(Color.colorify(exc_type.__name__, attrs="bold underline red"), exc_value))
print(" Detailed stacktrace ".center(80, horizontal_line))
for fs in traceback.extract_tb(exc_traceback)[::-1]:
if PYTHON_MAJOR==2:
filename, lineno, method, code = fs
else:
filename, lineno, method, code = fs.filename, fs.lineno, fs.name, fs.line
print("""{} File "{}", line {:d}, in {}()""".format(down_arrow, Color.yellowify(filename),
lineno, Color.greenify(method)))
print(" {} {}".format(right_arrow, code))
print(" Last 10 GDB commands ".center(80, horizontal_line))
gdb.execute("show commands")
print(" Runtime environment ".center(80, horizontal_line))
print("* GDB: {}".format(gdb.VERSION))
print("* Python: {:d}.{:d}.{:d} - {:s}".format(sys.version_info.major, sys.version_info.minor,
sys.version_info.micro, sys.version_info.releaselevel))
print("* OS: {:s} - {:s} ({:s}) on {:s}".format(platform.system(), platform.release(),
platform.architecture()[0],
" ".join(platform.dist())))
print(horizontal_line*80)
print("")
return
def gef_pystring(x):
"""Python 2 & 3 compatibility function for strings handling."""
res = str(x, encoding="utf-8") if PYTHON_MAJOR == 3 else x
substs = [('\n','\\n'), ('\r','\\r'), ('\t','\\t'), ('\v','\\v'), ('\b','\\b'), ]
for x,y in substs: res = res.replace(x,y)
return res
def gef_pybytes(x):
"""Python 2 & 3 compatibility function for bytes handling."""
return bytes(str(x), encoding="utf-8") if PYTHON_MAJOR == 3 else x
@lru_cache()
def which(program):
"""Locate a command on FS."""
def is_exe(fpath):
return os.path.isfile(fpath) and os.access(fpath, os.X_OK)
fpath = os.path.split(program)[0]
if fpath:
if is_exe(program):
return program
else:
for path in os.environ["PATH"].split(os.pathsep):
path = path.strip('"')
exe_file = os.path.join(path, program)
if is_exe(exe_file):
return exe_file
raise FileNotFoundError("Missing file `{:s}`".format(program))
def hexdump(source, length=0x10, separator=".", show_raw=False, base=0x00):
"""Return the hexdump of `src` argument.
@param source *MUST* be of type bytes or bytearray
@param length is the length of items per line
@param separator is the default character to use if one byte is not printable
@param show_raw if True, do not add the line nor the text translation
@param base is the start address of the block being hexdump
@param func is the function to use to parse bytes (int for Py3, chr for Py2)
@return a string with the hexdump """
result = []
for i in range(0, len(source), length):
s = source[i:i + length]
if PYTHON_MAJOR == 3:
hexa = " ".join(["{:02x}".format(c) for c in s])
text = "".join([chr(c) if 0x20 <= c < 0x7F else separator for c in s])
else:
hexa = " ".join(["{:02x}".format(ord(c)) for c in s])
text = "".join([c if 0x20 <= ord(c) < 0x7F else separator for c in s])
if show_raw:
result.append(hexa)
else:
align = get_memory_alignment()*2+2 if is_alive() else 18
result.append("{addr:#0{aw}x} {data:<{dw}} {text}".format(aw=align, addr=base+i,
dw=3*length, data=hexa,
text=text))
return "\n".join(result)
def is_debug():
"""Checks if debug mode is enabled."""
return get_gef_setting("gef.debug") == True
def enable_redirect_output(to_file="/dev/null"):
"""Redirect all GDB output to `to_file` parameter. By default, `to_file` redirects to `/dev/null`."""
gdb.execute("set logging overwrite")
gdb.execute("set logging file {:s}".format(to_file))
gdb.execute("set logging redirect on")
gdb.execute("set logging on")
return
def disable_redirect_output():
"""Disable the output redirection, if any."""
gdb.execute("set logging redirect off")
gdb.execute("set logging off")
return
def get_gef_setting(name):
"""Read globally gef settings. Returns None if not found. A valid config setting can never return None,
but False, 0 or "". So using None as a retval on error is fine."""
global __config__
key = __config__.get(name, None)
if not key:
return None
return __config__[name][0]
def set_gef_setting(name, value, _type=None, _desc=None):
"""Set globally gef settings. Raise ValueError if `name` doesn't exist and `type` and `desc`
are not provided."""
global __config__
if name not in __config__:
# setting creation
if _type is None or _desc is None:
raise ValueError("Setting '{}' is undefined, need to provide type and description".format(name))
__config__[name] = [_type(value), _type, _desc]
return
# setting value affectation
func = __config__[name][1]
__config__[name][0] = func(value)
__config__[name][1] = func
return
def gef_makedirs(path, mode=0o755):
"""Recursive mkdir() creation. If successful, return the absolute path of the directory created."""
abspath = os.path.realpath(path)
if os.path.isdir(abspath):
return abspath
if PYTHON_MAJOR == 3:
os.makedirs(path, mode=mode, exist_ok=True)
else:
try:
os.makedirs(path, mode=mode)
except os.error:
pass
return abspath
@lru_cache()
def gdb_lookup_symbol(sym):
"""Fetch the proper symbol or none is not defined."""
try:
return gdb.decode_line(sym)[1]
except gdb.error:
return None
@lru_cache(maxsize=512)
def gdb_get_location_from_symbol(address):
"""Retrieve the location of the `address` argument from the symbol table.
Return a tuple with the name and offset if found, None otherwise."""
# this is horrible, ugly hack and shitty perf...
# find a *clean* way to get gdb.Location from an address
name, off = None, 0
sym = gdb.execute("info symbol {:#x}".format(address), to_string=True)
if sym.startswith("No symbol matches"):
return None
i = sym.find(" in section ")
sym = sym[:i].split()
name, offset = sym[0], 0
if len(sym) == 3 and sym[2].isdigit():
offset = int(sym[2])
return name, offset
def gdb_disassemble(start_pc, **kwargs):
"""Disassemble instructions from `start_pc` (Integer). Accepts the following named parameters:
- `end_pc` (Integer) to disassemble until this address
- `count` (Integer) to disassemble this number of instruction.
If `end_pc` and `count` are not provided, the function will behave as if `count=1`.
Return an iterator of Instruction objects
"""
frame = gdb.selected_frame()
arch = frame.architecture()
for insn in arch.disassemble(start_pc, **kwargs):
address = insn["addr"]
asm = insn["asm"].rstrip().split(None, 1)
if len(asm) > 1:
mnemo, operands = asm
operands = operands.split(",")
else:
mnemo, operands = asm[0], []
loc = gdb_get_location_from_symbol(address)
location = "<{}+{}>".format(*loc) if loc else ""
yield Instruction(address, location, mnemo, operands)
def gdb_get_nth_previous_instruction_address(addr, n):
"""Return the address (Integer) of the `n`-th instruction before `addr`."""
# fixed-length ABI
if not (is_x86_32() or is_x86_64()):
return addr - n*current_arch.instruction_length
# variable-length ABI
next_insn_addr = gef_next_instruction(addr).address
cur_insn_addr = gef_current_instruction(addr).address
# we try to find a good set of previous instructions by "guessing" disassembling backwards
# the 15 comes from the longest instruction valid size
for i in range(15*n, 1, -1):
try:
insns = list(gdb_disassemble(addr-i, end_pc=next_insn_addr))
except gdb.MemoryError:
# this is because we can hit an unmapped page trying to read backward
break
# 1. check that the disassembled instructions list size is correct
if len(insns)!=n:
continue
# 2. check all instructions are valid
for insn in insns:
if not insn.is_valid():
continue
# 3. if cur_insn is at the end of the set
if insns[-1].address==cur_insn_addr:
return insns[0].address
return -1
def gdb_get_nth_next_instruction_address(addr, n):
"""Return the address (Integer) of the `n`-th instruction after `addr`."""
# fixed-length ABI
if not (is_x86_32() or is_x86_64()):
return addr + n*current_arch.instruction_length
# variable-length ABI
insn = list(gdb_disassemble(addr, count=n))[-1]
return insn.address
def gef_instruction_n(addr, n):
"""Return the `n`-th instruction after `addr` as an Instruction object."""
return list(gdb_disassemble(addr, count=n+1))[n-1]
def gef_current_instruction(addr):
"""Return the current instruction as an Instruction object."""
return gef_instruction_n(addr, 0)
def gef_next_instruction(addr):
"""Return the next instruction as an Instruction object."""
return gef_instruction_n(addr, 1)
def gef_disassemble(addr, nb_insn, from_top=False):
"""Disassemble `nb_insn` instructions after `addr`. If `from_top` is False (default), it will
also disassemble the `nb_insn` instructions before `addr`.
Return an iterator of Instruction objects."""
if nb_insn & 1:
count = nb_insn + 1
if not from_top:
start_addr = gdb_get_nth_previous_instruction_address(addr, count)
if start_addr > 0:
for insn in gdb_disassemble(start_addr, count=count):
if insn.address == addr: break
yield insn
for insn in gdb_disassemble(addr, count=count):
yield insn
def capstone_disassemble(location, nb_insn, **kwargs):
"""Disassemble `nb_insn` instructions after `addr` using the Capstone-Engine disassembler, if available.
If `kwargs["from_top"]` is False (default), it will also disassemble the `nb_insn` instructions before
`addr`. Return an iterator of Instruction objects."""
def cs_insn_to_gef_insn(cs_insn):
sym_info = gdb_get_location_from_symbol(cs_insn.address)
loc = "<{}+{}>".format(*sym_info) if sym_info else ""
ops = [] + cs_insn.op_str.split(', ')
return Instruction(cs_insn.address, loc, cs_insn.mnemonic, ops)
capstone = sys.modules["capstone"]
arch, mode = get_capstone_arch()
cs = capstone.Cs(arch, mode)
cs.detail = True
page_start = align_address_to_page(location)
offset = location - page_start
pc = current_arch.pc
from_top = kwargs.get("from_top", True)
if from_top in (False, "0", "false", "False"):
location = gdb_get_nth_previous_instruction_address(pc, nb_insn)
nb_insn *= 2
code = kwargs.get("code", read_memory(location, DEFAULT_PAGE_SIZE - offset - 1))
code = bytes(code)
for insn in cs.disasm(code, location):
nb_insn -= 1
yield cs_insn_to_gef_insn(insn)
if nb_insn==0:
break
return
def gef_execute_external(command, as_list=False, *args, **kwargs):
"""Executes an external command and retrieves the result."""
res = subprocess.check_output(command, stderr=subprocess.STDOUT, shell=kwargs.get("shell", False))
return [gef_pystring(_) for _ in res.splitlines()] if as_list else gef_pystring(res)
def gef_execute_gdb_script(commands):
"""Executes the parameter `source` as GDB command. This is done by writing `commands` to
a temporary file, which is then executed via GDB `source` command. The tempfile is then deleted."""
fd, fname = tempfile.mkstemp(suffix=".gdb", prefix="gef_")
with os.fdopen(fd, "w") as f:
f.write(commands)
f.flush()
if os.access(fname, os.R_OK):
gdb.execute("source {:s}".format(fname))
os.unlink(fname)
return
@lru_cache(32)
def checksec(filename):
"""Check the security property of the ELF binary. The following properties are:
- Canary
- NX
- PIE
- Fortify
- Partial/Full RelRO.
Return a Python dict() with the different keys mentioned above, and the boolean
associated whether the protection was found."""
try:
readelf = which("readelf")
except IOError:
err("Missing `readelf`")
return
def __check_security_property(opt, filename, pattern):
cmd = [readelf,]
cmd += opt.split()
cmd += [filename,]
lines = gef_execute_external(cmd, as_list=True)
for line in lines:
if re.search(pattern, line):
return True
return False
results = collections.OrderedDict()
results["Canary"] = __check_security_property("-s", filename, r"__stack_chk_fail") is True
has_gnu_stack = __check_security_property("-W -l", filename, r"GNU_STACK") is True
if has_gnu_stack:
results["NX"] = __check_security_property("-W -l", filename, r"GNU_STACK.*RWE") is False
else:
results["NX"] = False
results["PIE"] = __check_security_property("-h", filename, r"Type:.*EXEC") is False
results["Fortify"] = __check_security_property("-s", filename, r"_chk@GLIBC") is True
results["Partial RelRO"] = __check_security_property("-l", filename, r"GNU_RELRO") is True
results["Full RelRO"] = __check_security_property("-d", filename, r"BIND_NOW") is True
return results
@lru_cache()
def get_arch():
"""Return the binary's architecture."""
if is_alive():
arch = gdb.selected_frame().architecture()
return arch.name()
arch_str = gdb.execute("show architecture", to_string=True).strip()
if "The target architecture is set automatically (currently " in arch_str:
# architecture can be auto detected
arch_str = arch_str.split("(currently ", 1)[1]
arch_str = arch_str.split(")", 1)[0]
elif "The target architecture is assumed to be " in arch_str:
# architecture can be assumed
arch_str = arch_str.replace("The target architecture is assumed to be ", "")
else:
# unknown, we throw an exception to be safe
raise RuntimeError("Unknown architecture: {}".format(arch_str))
return arch_str
@lru_cache()
def get_endian():
"""Return the binary endianness."""
if is_alive():
return get_elf_headers().e_endianness
if gdb.execute("show endian", to_string=True).strip().split()[7] == "little" :
return Elf.LITTLE_ENDIAN
raise EnvironmentError("Invalid endianess")
def is_big_endian(): return get_endian() == Elf.BIG_ENDIAN
def is_little_endian(): return not is_big_endian()
def flags_to_human(reg_value, value_table):
"""Return a human readable string showing the flag states."""
flags = []
for i in value_table:
flag_str = Color.boldify(value_table[i].upper()) if reg_value & (1<<i) else value_table[i].lower()
flags.append(flag_str)
return "[{}]".format(" ".join(flags))
class Architecture(object):
"""Generic metaclass for the architecture supported by GEF."""
__metaclass__ = abc.ABCMeta
@abc.abstractproperty
def all_registers(self): pass
@abc.abstractproperty
def instruction_length(self): pass
@abc.abstractproperty
def nop_insn(self): pass
@abc.abstractproperty
def return_register(self): pass
@abc.abstractproperty
def flag_register(self): pass
@abc.abstractproperty
def flags_table(self): pass
@abc.abstractproperty
def function_parameters(self): pass
@abc.abstractmethod
def flag_register_to_human(self, val=None): pass
@abc.abstractmethod
def is_call(self, insn): pass
@abc.abstractmethod
def is_conditional_branch(self, insn): pass
@abc.abstractmethod
def is_branch_taken(self, insn): pass
@property
def pc(self):
return get_register("$pc")
@property
def sp(self):
return get_register("$sp")
@property
def ptrsize(self):
return get_memory_alignment()
class ARM(Architecture):
arch = "ARM"
mode = "ARM"
all_registers = ["$r0 ", "$r1 ", "$r2 ", "$r3 ", "$r4 ", "$r5 ", "$r6 ",
"$r7 ", "$r8 ", "$r9 ", "$r10 ", "$r11 ", "$r12 ", "$sp ",
"$lr ", "$pc ", "$cpsr ",]
# http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0041c/Caccegih.html
# return b"\x00\x00\xa0\xe1" # mov r0,r0
nop_insn = b"\x01\x10\xa0\xe1" # mov r1,r1
return_register = "$r0"
flag_register = "$cpsr"
flags_table = {
31: "negative",
30: "zero",
29: "carry",
28: "overflow",
7: "interrupt",
6: "fast",
5: "thumb"
}
function_parameters = ["$r0", "$r1", "$r2", "$r3"]
@property
def instruction_length(self):
return 2 if is_arm_thumb() else 4
def is_call(self, insn):
mnemo = insn.mnemo
call_mnemos = {"bl", "blx"}
return mnemo in call_mnemos
def flag_register_to_human(self, val=None):
# http://www.botskool.com/user-pages/tutorials/electronics/arm-7-tutorial-part-1
if val is None:
reg = self.flag_register
val = get_register(reg)
return flags_to_human(val, self.flags_table)
def is_conditional_branch(self, insn):
branch_mnemos = {"beq", "bne", "bleq", "blt", "bgt", "bgez", "bvs", "bvc",
"jeq", "jne", "jleq", "jlt", "jgt", "jgez", "jvs", "jvc"}
return insn.mnemo in branch_mnemos
def is_branch_taken(self, insn):
mnemo = insn.mnemo
# ref: http://www.davespace.co.uk/arm/introduction-to-arm/conditional.html
flags = dict((self.flags_table[k], k) for k in self.flags_table)
val = get_register(self.flag_register)
taken, reason = False, ""
if mnemo.endswith("eq"): taken, reason = val&(1<<flags["zero"]), "Z"
elif mnemo.endswith("ne"): taken, reason = val&(1<<flags["zero"]) == 0, "!Z"
elif mnemo.endswith("lt"): taken, reason = val&(1<<flags["negative"])!=val&(1<<flags["overflow"]), "N!=O"
elif mnemo.endswith("le"): taken, reason = val&(1<<flags["zero"]) or val&(1<<flags["negative"])!=val&(1<<flags["overflow"]), "Z || N!=O"
elif mnemo.endswith("gt"): taken, reason = val&(1<<flags["zero"]) == 0 and val&(1<<flags["negative"]) == val&(1<<flags["overflow"]), "!Z && N==O"
elif mnemo.endswith("ge"): taken, reason = val&(1<<flags["negative"]) == val&(1<<flags["overflow"]), "N==O"
elif mnemo.endswith("bvs"): taken, reason = val&(1<<flags["overflow"]), "O"
elif mnemo.endswith("bvc"): taken, reason = val&(1<<flags["overflow"]) == 0, "!O"
return taken, reason
def mprotect_asm(self, addr, size, perm):
_NR_mprotect = 125
insns = [
"push {r0-r2, r7}",
"mov r0, {:d}".format(addr),
"mov r1, {:d}".format(size),
"mov r2, {:d}".format(perm),
"mov r7, {:d}".format(_NR_mprotect),
"svc 0",
"pop {r0-r2, r7}",]
return "; ".join(insns)
class AARCH64(ARM):
arch = "ARM64"
mode = "ARM"
all_registers = [
"$x0 ", "$x1 ", "$x2 ", "$x3 ", "$x4 ", "$x5 ", "$x6 ", "$x7 ",
"$x8 ", "$x9 ", "$x10 ", "$x11 ", "$x12 ", "$x13 ", "$x14 ", "$x15 ",
"$x16 ", "$x17 ", "$x18 ", "$x19 ", "$x20 ", "$x21 ", "$x22 ", "$x23 ",
"$x24 ", "$x25 ", "$x26 ", "$x27 ", "$x28 ", "$x29 ", "$x30 ", "$sp ",
"$pc ", "$cpsr ", "$fpsr ", "$fpcr ",]
return_register = "$x0"
flag_register = "$cpsr"
flags_table = {
31: "negative",
30: "zero",
29: "carry",
28: "overflow",
7: "interrupt",
6: "fast"
}
function_parameters = ["$x0", "$x1", "$x2", "$x3"]
def is_call(self, insn):
mnemo = insn.mnemo
call_mnemos = {"bl", "blr"}
return mnemo in call_mnemos
def flag_register_to_human(self, val=None):
# http://events.linuxfoundation.org/sites/events/files/slides/KoreaLinuxForum-2014.pdf
reg = self.flag_register
if not val:
val = get_register(reg)
return flags_to_human(val, self.flags_table)
def mprotect_asm(self, addr, size, perm):
raise OSError("Architecture {:s} not supported yet".format(self.arch))
return
def is_conditional_branch(self, insn):
# https://www.element14.com/community/servlet/JiveServlet/previewBody/41836-102-1-229511/ARM.Reference_Manual.pdf
# sect. 5.1.1
mnemo = insn.mnemo
branch_mnemos = {"cbnz", "cbz", "tbnz", "tbz"}
return mnemo.startswith("b.") or mnemo in branch_mnemos
def is_branch_taken(self, insn):
mnemo, operands = insn.mnemo, insn.operands
flags = dict((self.flags_table[k], k) for k in self.flags_table)
val = get_register(self.flag_register)
taken, reason = False, ""
if mnemo in {"cbnz", "cbz", "tbnz", "tbz"}:
reg = operands[0]
op = get_register(reg)
if mnemo=="cbnz":
if op!=0: taken, reason = True, "{}!=0".format(reg)
else: taken, reason = False, "{}==0".format(reg)
elif mnemo=="cbz":
if op==0: taken, reason = True, "{}==0".format(reg)
else: taken, reason = False, "{}!=0".format(reg)
elif mnemo=="tbnz":
i = int(operands[1])
if (op & 1<<i) != 0: taken, reason = True, "{}&1<<{}!=0".format(reg,i)
else: taken, reason = False, "{}&1<<{}==0".format(reg,i)
elif mnemo=="tbz":
i = int(operands[1])
if (op & 1<<i) == 0: taken, reason = True, "{}&1<<{}==0".format(reg,i)
else: taken, reason = False, "{}&1<<{}!=0".format(reg,i)
elif mnemo.endswith("eq"): taken, reason = val&(1<<flags["zero"]), "Z"
elif mnemo.endswith("ne"): taken, reason = val&(1<<flags["zero"]) == 0, "!Z"
elif mnemo.endswith("lt"): taken, reason = val&(1<<flags["negative"])!=val&(1<<flags["overflow"]), "N!=O"
elif mnemo.endswith("le"): taken, reason = val&(1<<flags["zero"]) or val&(1<<flags["negative"])!=val&(1<<flags["overflow"]), "Z || N!=O"
elif mnemo.endswith("gt"): taken, reason = val&(1<<flags["zero"]) == 0 and val&(1<<flags["negative"]) == val&(1<<flags["overflow"]), "!Z && N==O"
elif mnemo.endswith("ge"): taken, reason = val&(1<<flags["negative"]) == val&(1<<flags["overflow"]), "N==O"
return taken, reason
class X86(Architecture):
arch = "X86"
mode = "32"
nop_insn = b"\x90"
all_registers = [
"$eax ", "$ebx ", "$ecx ", "$edx ", "$esp ", "$ebp ", "$esi ",
"$edi ", "$eip ", "$cs ", "$ss ", "$ds ", "$es ",
"$fs ", "$gs ", "$eflags",]
instruction_length = None
return_register = "$eax"
function_parameters = ["$esp", ]
flag_register = "$eflags"
flags_table = {
6: "zero",
0: "carry",
2: "parity",
4: "adjust",
7: "sign",
8: "trap",
9: "interrupt",
10: "direction",
11: "overflow",
16: "resume",
17: "virtualx86",
21: "identification",
}
def flag_register_to_human(self, val=None):
reg = self.flag_register
if not val:
val = get_register(reg)
return flags_to_human(val, self.flags_table)
def is_call(self, insn):
mnemo = insn.mnemo
call_mnemos = {"call", "callq"}
return mnemo in call_mnemos
def is_conditional_branch(self, insn):
mnemo = insn.mnemo
branch_mnemos = {
"ja", "jnbe", "jae", "jnb", "jnc", "jb", "jc", "jnae", "jbe", "jna",
"jcxz", "jecxz", "jrcxz", "je", "jz", "jg", "jnle", "jge", "jnl",
"jl", "jnge", "jle", "jng", "jne", "jnz", "jno", "jnp", "jpo", "jns",
"jo", "jp", "jpe", "js"
}
return mnemo in branch_mnemos
def is_branch_taken(self, insn):
mnemo = insn.mnemo
# all kudos to fG! (https://github.com/gdbinit/Gdbinit/blob/master/gdbinit#L1654)
flags = dict((self.flags_table[k], k) for k in self.flags_table)
val = get_register(self.flag_register)
cx = get_register("$rcx") if self.mode == 64 else get_register("$ecx")
taken, reason = False, ""
if mnemo in ("ja", "jnbe"):
taken, reason = val&(1<<flags["carry"]) == 0 and val&(1<<flags["zero"]) == 0, "!C && !Z"
elif mnemo in ("jae", "jnb", "jnc"):
taken, reason = val&(1<<flags["carry"]) == 0, "!C"
elif mnemo in ("jb", "jc", "jnae"):
taken, reason = val&(1<<flags["carry"]), "C"
elif mnemo in ("jbe", "jna"):
taken, reason = val&(1<<flags["carry"]) or val&(1<<flags["zero"]), "C || Z"
elif mnemo in ("jcxz", "jecxz", "jrcxz"):
taken, reason = cx == 0, "!$CX"
elif mnemo in ("je", "jz"):
taken, reason = val&(1<<flags["zero"]), "Z"
elif mnemo in ("jg", "jnle"):
taken, reason = val&(1<<flags["zero"]) == 0 and val&(1<<flags["overflow"]) == val&(1<<flags["sign"]), "!Z && O==S"
elif mnemo in ("jge", "jnl"):
taken, reason = val&(1<<flags["sign"]) == val&(1<<flags["overflow"]), "S==O"
elif mnemo in ("jl", "jnge"):
taken, reason = val&(1<<flags["overflow"])!=val&(1<<flags["sign"]), "S!=O"
elif mnemo in ("jle", "jng"):
taken, reason = val&(1<<flags["zero"]) or val&(1<<flags["overflow"])!=val&(1<<flags["sign"]), "Z || S!=0"
elif mnemo in ("jne", "jnz"):
taken, reason = val&(1<<flags["zero"]) == 0, "!Z"
elif mnemo in ("jno",):
taken, reason = val&(1<<flags["overflow"]) == 0, "!O"
elif mnemo in ("jnp", "jpo"):
taken, reason = val&(1<<flags["parity"]) == 0, "!P"
elif mnemo in ("jns",):
taken, reason = val&(1<<flags["sign"]) == 0, "!S"
elif mnemo in ("jo",):
taken, reason = val&(1<<flags["overflow"]), "O"
elif mnemo in ("jpe", "jp"):
taken, reason = val&(1<<flags["parity"]), "P"
elif mnemo in ("js",):
taken, reason = val&(1<<flags["sign"]), "S"
return taken, reason