forked from JonathanSalwan/Tigress_protection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sample1-virt-add-opaque-to-vpc-true.py
166 lines (162 loc) · 6.86 KB
/
sample1-virt-add-opaque-to-vpc-true.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_264 = SymVar_0
ref_279 = ref_264 # MOV operation
ref_7320 = ref_279 # MOV operation
ref_7658 = ref_7320 # MOV operation
ref_7666 = ((ref_7658 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_7673 = ref_7666 # MOV operation
ref_9064 = ref_279 # MOV operation
ref_9357 = ref_9064 # MOV operation
ref_9365 = (ref_9357 >> (0x7 & 0x3F)) # SHR operation
ref_9372 = ref_9365 # MOV operation
ref_9528 = ref_9372 # MOV operation
ref_9540 = ref_7673 # MOV operation
ref_9542 = (ref_9540 | ref_9528) # OR operation
ref_9693 = ref_9542 # MOV operation
ref_12610 = ref_9693 # MOV operation
ref_12940 = ref_12610 # MOV operation
ref_12942 = ((ref_12940 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_13118 = ref_12942 # MOV operation
ref_13120 = (ref_13118 & 0x1D5ABF66) # AND operation
ref_14516 = ref_279 # MOV operation
ref_14854 = ref_14516 # MOV operation
ref_14862 = ((ref_14854 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_14869 = ref_14862 # MOV operation
ref_16260 = ref_279 # MOV operation
ref_16553 = ref_16260 # MOV operation
ref_16561 = (ref_16553 >> (0xB & 0x3F)) # SHR operation
ref_16568 = ref_16561 # MOV operation
ref_16724 = ref_16568 # MOV operation
ref_16736 = ref_14869 # MOV operation
ref_16738 = (ref_16736 | ref_16724) # OR operation
ref_16896 = ref_16738 # MOV operation
ref_16908 = ref_13120 # MOV operation
ref_16910 = ((ref_16896 - ref_16908) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_16918 = ref_16910 # MOV operation
ref_17064 = ref_16918 # MOV operation
ref_19925 = ref_279 # MOV operation
ref_20058 = ref_19925 # MOV operation
ref_20072 = ((ref_20058 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_20080 = ref_20072 # MOV operation
ref_20226 = ref_20080 # MOV operation
ref_23143 = ref_9693 # MOV operation
ref_23276 = ref_23143 # MOV operation
ref_23290 = ((0x20453EE3 + ref_23276) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_24687 = ref_279 # MOV operation
ref_24820 = ref_24687 # MOV operation
ref_24832 = ref_23290 # MOV operation
ref_24834 = ((ref_24820 - ref_24832) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_24842 = ref_24834 # MOV operation
ref_24988 = ref_24842 # MOV operation
ref_29653 = ref_9693 # MOV operation
ref_31618 = ref_20226 # MOV operation
ref_31754 = ref_31618 # MOV operation
ref_31766 = ref_29653 # MOV operation
ref_31768 = (ref_31766 | ref_31754) # OR operation
ref_32124 = ref_31768 # MOV operation
ref_32130 = (0x3F & ref_32124) # AND operation
ref_32493 = ref_32130 # MOV operation
ref_32501 = ((ref_32493 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_32508 = ref_32501 # MOV operation
ref_34135 = ref_9693 # MOV operation
ref_34271 = ref_34135 # MOV operation
ref_34283 = ref_32508 # MOV operation
ref_34285 = (ref_34283 | ref_34271) # OR operation
ref_34436 = ref_34285 # MOV operation
ref_37706 = ref_17064 # MOV operation
ref_39498 = ref_34436 # MOV operation
ref_39791 = ref_39498 # MOV operation
ref_39799 = (ref_39791 >> (0x1 & 0x3F)) # SHR operation
ref_39806 = ref_39799 # MOV operation
ref_40157 = ref_39806 # MOV operation
ref_40163 = (0xF & ref_40157) # AND operation
ref_40324 = ref_40163 # MOV operation
ref_40338 = (0x1 | ref_40324) # OR operation
ref_40693 = ref_40338 # MOV operation
ref_40695 = ((0x40 - ref_40693) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_40703 = ref_40695 # MOV operation
ref_40876 = ref_37706 # MOV operation
ref_40880 = ref_40703 # MOV operation
ref_40882 = (ref_40880 & 0xFFFFFFFF) # MOV operation
ref_40884 = ((ref_40876 << ((ref_40882 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_40891 = ref_40884 # MOV operation
ref_42338 = ref_17064 # MOV operation
ref_44130 = ref_34436 # MOV operation
ref_44423 = ref_44130 # MOV operation
ref_44431 = (ref_44423 >> (0x1 & 0x3F)) # SHR operation
ref_44438 = ref_44431 # MOV operation
ref_44789 = ref_44438 # MOV operation
ref_44795 = (0xF & ref_44789) # AND operation
ref_44956 = ref_44795 # MOV operation
ref_44970 = (0x1 | ref_44956) # OR operation
ref_45103 = ref_42338 # MOV operation
ref_45107 = ref_44970 # MOV operation
ref_45109 = (ref_45107 & 0xFFFFFFFF) # MOV operation
ref_45111 = (ref_45103 >> ((ref_45109 & 0xFF) & 0x3F)) # SHR operation
ref_45118 = ref_45111 # MOV operation
ref_45274 = ref_45118 # MOV operation
ref_45286 = ref_40891 # MOV operation
ref_45288 = (ref_45286 | ref_45274) # OR operation
ref_45439 = ref_45288 # MOV operation
ref_48171 = ref_24988 # MOV operation
ref_50136 = ref_45439 # MOV operation
ref_50269 = ref_50136 # MOV operation
ref_50281 = ref_48171 # MOV operation
ref_50283 = ((ref_50269 - ref_50281) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_50291 = ref_50283 # MOV operation
ref_50437 = ref_50291 # MOV operation
ref_55400 = ref_34436 # MOV operation
ref_57012 = ref_17064 # MOV operation
ref_57343 = ref_57012 # MOV operation
ref_57349 = (0xF & ref_57343) # AND operation
ref_57510 = ref_57349 # MOV operation
ref_57524 = (0x1 | ref_57510) # OR operation
ref_57879 = ref_57524 # MOV operation
ref_57881 = ((0x40 - ref_57879) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_57889 = ref_57881 # MOV operation
ref_58062 = ref_55400 # MOV operation
ref_58066 = ref_57889 # MOV operation
ref_58068 = (ref_58066 & 0xFFFFFFFF) # MOV operation
ref_58070 = ((ref_58062 << ((ref_58068 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_58077 = ref_58070 # MOV operation
ref_59524 = ref_34436 # MOV operation
ref_61136 = ref_17064 # MOV operation
ref_61467 = ref_61136 # MOV operation
ref_61473 = (0xF & ref_61467) # AND operation
ref_61634 = ref_61473 # MOV operation
ref_61648 = (0x1 | ref_61634) # OR operation
ref_61781 = ref_59524 # MOV operation
ref_61785 = ref_61648 # MOV operation
ref_61787 = (ref_61785 & 0xFFFFFFFF) # MOV operation
ref_61789 = (ref_61781 >> ((ref_61787 & 0xFF) & 0x3F)) # SHR operation
ref_61796 = ref_61789 # MOV operation
ref_61952 = ref_61796 # MOV operation
ref_61964 = ref_58077 # MOV operation
ref_61966 = (ref_61964 | ref_61952) # OR operation
ref_63603 = ref_24988 # MOV operation
ref_65030 = ref_50437 # MOV operation
ref_65166 = ref_65030 # MOV operation
ref_65178 = ref_63603 # MOV operation
ref_65180 = (ref_65178 | ref_65166) # OR operation
ref_65498 = ref_65180 # MOV operation
ref_65506 = (ref_65498 >> (0x1 & 0x3F)) # SHR operation
ref_65513 = ref_65506 # MOV operation
ref_65864 = ref_65513 # MOV operation
ref_65870 = (0x7 & ref_65864) # AND operation
ref_66031 = ref_65870 # MOV operation
ref_66045 = (0x1 | ref_66031) # OR operation
ref_66223 = ref_61966 # MOV operation
ref_66227 = ref_66045 # MOV operation
ref_66229 = (ref_66227 & 0xFFFFFFFF) # MOV operation
ref_66231 = ((ref_66223 << ((ref_66229 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_66238 = ref_66231 # MOV operation
ref_66384 = ref_66238 # MOV operation
ref_66689 = ref_66384 # MOV operation
ref_66691 = ref_66689 # MOV operation
print ref_66691 & 0xffffffffffffffff