forked from JonathanSalwan/Tigress_protection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsample1-virt-anti-branch-analysis-goto2push.py
157 lines (153 loc) · 6.51 KB
/
sample1-virt-anti-branch-analysis-goto2push.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_264 = SymVar_0
ref_279 = ref_264 # MOV operation
ref_17929 = ref_279 # MOV operation
ref_18314 = ref_17929 # MOV operation
ref_18322 = (ref_18314 >> (0x7 & 0x3F)) # SHR operation
ref_18329 = ref_18322 # MOV operation
ref_20143 = ref_279 # MOV operation
ref_20307 = ref_20143 # MOV operation
ref_20321 = ((ref_20307 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_20482 = ref_18329 # MOV operation
ref_20486 = ref_20321 # MOV operation
ref_20488 = (ref_20486 | ref_20482) # OR operation
ref_22141 = ref_20488 # MOV operation
ref_24012 = ref_22141 # MOV operation
ref_24134 = ref_24012 # MOV operation
ref_24136 = ((ref_24134 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_24551 = ref_24136 # MOV operation
ref_24553 = (ref_24551 & 0x1D5ABF66) # AND operation
ref_26159 = ref_279 # MOV operation
ref_26544 = ref_26159 # MOV operation
ref_26552 = (ref_26544 >> (0xB & 0x3F)) # SHR operation
ref_26559 = ref_26552 # MOV operation
ref_28373 = ref_279 # MOV operation
ref_28537 = ref_28373 # MOV operation
ref_28551 = ((ref_28537 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_28712 = ref_26559 # MOV operation
ref_28716 = ref_28551 # MOV operation
ref_28718 = (ref_28716 | ref_28712) # OR operation
ref_28871 = ref_28718 # MOV operation
ref_28883 = ref_24553 # MOV operation
ref_28885 = ((ref_28871 - ref_28883) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_28893 = ref_28885 # MOV operation
ref_30541 = ref_28893 # MOV operation
ref_32355 = ref_279 # MOV operation
ref_32483 = ref_32355 # MOV operation
ref_32497 = ((ref_32483 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_32505 = ref_32497 # MOV operation
ref_34153 = ref_32505 # MOV operation
ref_35811 = ref_22141 # MOV operation
ref_36142 = ref_35811 # MOV operation
ref_36148 = ((0x20453EE3 + ref_36142) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_37755 = ref_279 # MOV operation
ref_37883 = ref_37755 # MOV operation
ref_37895 = ref_36148 # MOV operation
ref_37897 = ((ref_37883 - ref_37895) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_37905 = ref_37897 # MOV operation
ref_39553 = ref_37905 # MOV operation
ref_43165 = ref_22141 # MOV operation
ref_45759 = ref_34153 # MOV operation
ref_47564 = ref_22141 # MOV operation
ref_47700 = ref_45759 # MOV operation
ref_47704 = ref_47564 # MOV operation
ref_47706 = (ref_47704 | ref_47700) # OR operation
ref_47895 = ref_47706 # MOV operation
ref_47909 = (0x3F & ref_47895) # AND operation
ref_48098 = ref_47909 # MOV operation
ref_48112 = ((ref_48098 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_48273 = ref_43165 # MOV operation
ref_48277 = ref_48112 # MOV operation
ref_48279 = (ref_48277 | ref_48273) # OR operation
ref_50099 = ref_48279 # MOV operation
ref_51757 = ref_30541 # MOV operation
ref_53775 = ref_50099 # MOV operation
ref_54160 = ref_53775 # MOV operation
ref_54168 = (ref_54160 >> (0x1 & 0x3F)) # SHR operation
ref_54175 = ref_54168 # MOV operation
ref_54359 = ref_54175 # MOV operation
ref_54373 = (0xF & ref_54359) # AND operation
ref_54747 = ref_54373 # MOV operation
ref_54753 = (0x1 | ref_54747) # OR operation
ref_54950 = ref_51757 # MOV operation
ref_54954 = ref_54753 # MOV operation
ref_54956 = (ref_54954 & 0xFFFFFFFF) # MOV operation
ref_54958 = (ref_54950 >> ((ref_54956 & 0xFF) & 0x3F)) # SHR operation
ref_54965 = ref_54958 # MOV operation
ref_57003 = ref_50099 # MOV operation
ref_57388 = ref_57003 # MOV operation
ref_57396 = (ref_57388 >> (0x1 & 0x3F)) # SHR operation
ref_57403 = ref_57396 # MOV operation
ref_57587 = ref_57403 # MOV operation
ref_57601 = (0xF & ref_57587) # AND operation
ref_57975 = ref_57601 # MOV operation
ref_57981 = (0x1 | ref_57975) # OR operation
ref_58359 = ref_57981 # MOV operation
ref_58361 = ((0x40 - ref_58359) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_58369 = ref_58361 # MOV operation
ref_60027 = ref_30541 # MOV operation
ref_60191 = ref_60027 # MOV operation
ref_60203 = ref_58369 # MOV operation
ref_60205 = ((ref_60191 << ((ref_60203 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_60366 = ref_54965 # MOV operation
ref_60370 = ref_60205 # MOV operation
ref_60372 = (ref_60370 | ref_60366) # OR operation
ref_62555 = ref_60372 # MOV operation
ref_64213 = ref_39553 # MOV operation
ref_66381 = ref_62555 # MOV operation
ref_66509 = ref_66381 # MOV operation
ref_66521 = ref_64213 # MOV operation
ref_66523 = ((ref_66509 - ref_66521) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_66531 = ref_66523 # MOV operation
ref_68179 = ref_66531 # MOV operation
ref_72669 = ref_68179 # MOV operation
ref_74307 = ref_39553 # MOV operation
ref_74443 = ref_72669 # MOV operation
ref_74447 = ref_74307 # MOV operation
ref_74449 = (ref_74447 | ref_74443) # OR operation
ref_74859 = ref_74449 # MOV operation
ref_74867 = (ref_74859 >> (0x1 & 0x3F)) # SHR operation
ref_74874 = ref_74867 # MOV operation
ref_75058 = ref_74874 # MOV operation
ref_75072 = (0x7 & ref_75058) # AND operation
ref_75446 = ref_75072 # MOV operation
ref_75452 = (0x1 | ref_75446) # OR operation
ref_77115 = ref_50099 # MOV operation
ref_78966 = ref_30541 # MOV operation
ref_79130 = ref_78966 # MOV operation
ref_79144 = (0xF & ref_79130) # AND operation
ref_79518 = ref_79144 # MOV operation
ref_79524 = (0x1 | ref_79518) # OR operation
ref_79721 = ref_77115 # MOV operation
ref_79725 = ref_79524 # MOV operation
ref_79727 = (ref_79725 & 0xFFFFFFFF) # MOV operation
ref_79729 = (ref_79721 >> ((ref_79727 & 0xFF) & 0x3F)) # SHR operation
ref_79736 = ref_79729 # MOV operation
ref_81607 = ref_30541 # MOV operation
ref_81771 = ref_81607 # MOV operation
ref_81785 = (0xF & ref_81771) # AND operation
ref_82159 = ref_81785 # MOV operation
ref_82165 = (0x1 | ref_82159) # OR operation
ref_82543 = ref_82165 # MOV operation
ref_82545 = ((0x40 - ref_82543) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_82553 = ref_82545 # MOV operation
ref_84211 = ref_50099 # MOV operation
ref_84375 = ref_84211 # MOV operation
ref_84387 = ref_82553 # MOV operation
ref_84389 = ((ref_84375 << ((ref_84387 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_84550 = ref_79736 # MOV operation
ref_84554 = ref_84389 # MOV operation
ref_84556 = (ref_84554 | ref_84550) # OR operation
ref_84745 = ref_84556 # MOV operation
ref_84757 = ref_75452 # MOV operation
ref_84759 = ((ref_84745 << ((ref_84757 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_86364 = ref_84759 # MOV operation
ref_86741 = ref_86364 # MOV operation
ref_86743 = ref_86741 # MOV operation
print ref_86743 & 0xffffffffffffffff