forked from JonathanSalwan/Tigress_protection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sample1-virt-anti-branch-analysis-goto2call.py
157 lines (153 loc) · 6.52 KB
/
sample1-virt-anti-branch-analysis-goto2call.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_264 = SymVar_0
ref_279 = ref_264 # MOV operation
ref_18267 = ref_279 # MOV operation
ref_18730 = ref_18267 # MOV operation
ref_18738 = (ref_18730 >> (0x7 & 0x3F)) # SHR operation
ref_18745 = ref_18738 # MOV operation
ref_20936 = ref_279 # MOV operation
ref_21139 = ref_20936 # MOV operation
ref_21153 = ((ref_21139 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_21353 = ref_18745 # MOV operation
ref_21357 = ref_21153 # MOV operation
ref_21359 = (ref_21357 | ref_21353) # OR operation
ref_23324 = ref_21359 # MOV operation
ref_25546 = ref_23324 # MOV operation
ref_25707 = ref_25546 # MOV operation
ref_25709 = ((ref_25707 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_26202 = ref_25709 # MOV operation
ref_26204 = (ref_26202 & 0x1D5ABF66) # AND operation
ref_28148 = ref_279 # MOV operation
ref_28611 = ref_28148 # MOV operation
ref_28619 = (ref_28611 >> (0xB & 0x3F)) # SHR operation
ref_28626 = ref_28619 # MOV operation
ref_30817 = ref_279 # MOV operation
ref_31020 = ref_30817 # MOV operation
ref_31034 = ((ref_31020 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_31234 = ref_28626 # MOV operation
ref_31238 = ref_31034 # MOV operation
ref_31240 = (ref_31238 | ref_31234) # OR operation
ref_31432 = ref_31240 # MOV operation
ref_31444 = ref_26204 # MOV operation
ref_31446 = ((ref_31432 - ref_31444) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_31454 = ref_31446 # MOV operation
ref_33414 = ref_31454 # MOV operation
ref_35605 = ref_279 # MOV operation
ref_35772 = ref_35605 # MOV operation
ref_35786 = ((ref_35772 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_35794 = ref_35786 # MOV operation
ref_37754 = ref_35794 # MOV operation
ref_39724 = ref_23324 # MOV operation
ref_40133 = ref_39724 # MOV operation
ref_40139 = ((0x20453EE3 + ref_40133) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_42084 = ref_279 # MOV operation
ref_42251 = ref_42084 # MOV operation
ref_42263 = ref_40139 # MOV operation
ref_42265 = ((ref_42251 - ref_42263) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_42273 = ref_42265 # MOV operation
ref_44233 = ref_42273 # MOV operation
ref_48573 = ref_23324 # MOV operation
ref_51674 = ref_37754 # MOV operation
ref_53830 = ref_23324 # MOV operation
ref_54005 = ref_51674 # MOV operation
ref_54009 = ref_53830 # MOV operation
ref_54011 = (ref_54009 | ref_54005) # OR operation
ref_54239 = ref_54011 # MOV operation
ref_54253 = (0x3F & ref_54239) # AND operation
ref_54481 = ref_54253 # MOV operation
ref_54495 = ((ref_54481 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_54695 = ref_48573 # MOV operation
ref_54699 = ref_54495 # MOV operation
ref_54701 = (ref_54699 | ref_54695) # OR operation
ref_56872 = ref_54701 # MOV operation
ref_58842 = ref_33414 # MOV operation
ref_61250 = ref_56872 # MOV operation
ref_61713 = ref_61250 # MOV operation
ref_61721 = (ref_61713 >> (0x1 & 0x3F)) # SHR operation
ref_61728 = ref_61721 # MOV operation
ref_61951 = ref_61728 # MOV operation
ref_61965 = (0xF & ref_61951) # AND operation
ref_62417 = ref_61965 # MOV operation
ref_62423 = (0x1 | ref_62417) # OR operation
ref_62659 = ref_58842 # MOV operation
ref_62663 = ref_62423 # MOV operation
ref_62665 = (ref_62663 & 0xFFFFFFFF) # MOV operation
ref_62667 = (ref_62659 >> ((ref_62665 & 0xFF) & 0x3F)) # SHR operation
ref_62674 = ref_62667 # MOV operation
ref_65102 = ref_56872 # MOV operation
ref_65565 = ref_65102 # MOV operation
ref_65573 = (ref_65565 >> (0x1 & 0x3F)) # SHR operation
ref_65580 = ref_65573 # MOV operation
ref_65803 = ref_65580 # MOV operation
ref_65817 = (0xF & ref_65803) # AND operation
ref_66269 = ref_65817 # MOV operation
ref_66275 = (0x1 | ref_66269) # OR operation
ref_66731 = ref_66275 # MOV operation
ref_66733 = ((0x40 - ref_66731) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_66741 = ref_66733 # MOV operation
ref_68711 = ref_33414 # MOV operation
ref_68914 = ref_68711 # MOV operation
ref_68926 = ref_66741 # MOV operation
ref_68928 = ((ref_68914 << ((ref_68926 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_69128 = ref_62674 # MOV operation
ref_69132 = ref_68928 # MOV operation
ref_69134 = (ref_69132 | ref_69128) # OR operation
ref_71746 = ref_69134 # MOV operation
ref_73716 = ref_44233 # MOV operation
ref_76313 = ref_71746 # MOV operation
ref_76480 = ref_76313 # MOV operation
ref_76492 = ref_73716 # MOV operation
ref_76494 = ((ref_76480 - ref_76492) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_76502 = ref_76494 # MOV operation
ref_78462 = ref_76502 # MOV operation
ref_83875 = ref_78462 # MOV operation
ref_85825 = ref_44233 # MOV operation
ref_86000 = ref_83875 # MOV operation
ref_86004 = ref_85825 # MOV operation
ref_86006 = (ref_86004 | ref_86000) # OR operation
ref_86494 = ref_86006 # MOV operation
ref_86502 = (ref_86494 >> (0x1 & 0x3F)) # SHR operation
ref_86509 = ref_86502 # MOV operation
ref_86732 = ref_86509 # MOV operation
ref_86746 = (0x7 & ref_86732) # AND operation
ref_87198 = ref_86746 # MOV operation
ref_87204 = (0x1 | ref_87198) # OR operation
ref_89179 = ref_56872 # MOV operation
ref_91381 = ref_33414 # MOV operation
ref_91584 = ref_91381 # MOV operation
ref_91598 = (0xF & ref_91584) # AND operation
ref_92050 = ref_91598 # MOV operation
ref_92056 = (0x1 | ref_92050) # OR operation
ref_92292 = ref_89179 # MOV operation
ref_92296 = ref_92056 # MOV operation
ref_92298 = (ref_92296 & 0xFFFFFFFF) # MOV operation
ref_92300 = (ref_92292 >> ((ref_92298 & 0xFF) & 0x3F)) # SHR operation
ref_92307 = ref_92300 # MOV operation
ref_94529 = ref_33414 # MOV operation
ref_94732 = ref_94529 # MOV operation
ref_94746 = (0xF & ref_94732) # AND operation
ref_95198 = ref_94746 # MOV operation
ref_95204 = (0x1 | ref_95198) # OR operation
ref_95660 = ref_95204 # MOV operation
ref_95662 = ((0x40 - ref_95660) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_95670 = ref_95662 # MOV operation
ref_97640 = ref_56872 # MOV operation
ref_97843 = ref_97640 # MOV operation
ref_97855 = ref_95670 # MOV operation
ref_97857 = ((ref_97843 << ((ref_97855 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_98057 = ref_92307 # MOV operation
ref_98061 = ref_97857 # MOV operation
ref_98063 = (ref_98061 | ref_98057) # OR operation
ref_98291 = ref_98063 # MOV operation
ref_98303 = ref_87204 # MOV operation
ref_98305 = ((ref_98291 << ((ref_98303 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_100248 = ref_98305 # MOV operation
ref_100703 = ref_100248 # MOV operation
ref_100705 = ref_100703 # MOV operation
print ref_100705 & 0xffffffffffffffff