forked from JonathanSalwan/Tigress_protection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sample1-virt-bogus-functions-1.py
166 lines (162 loc) · 6.87 KB
/
sample1-virt-bogus-functions-1.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_264 = SymVar_0
ref_279 = ref_264 # MOV operation
ref_6605 = ref_279 # MOV operation
ref_6790 = ref_6605 # MOV operation
ref_6808 = (ref_6790 >> (0x7 & 0x3F)) # SHR operation
ref_6815 = ref_6808 # MOV operation
ref_8617 = ref_279 # MOV operation
ref_9037 = ref_8617 # MOV operation
ref_9047 = ((ref_9037 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_9054 = ref_9047 # MOV operation
ref_9299 = ref_6815 # MOV operation
ref_9305 = ref_9054 # MOV operation
ref_9307 = (ref_9305 | ref_9299) # OR operation
ref_11132 = ref_9307 # MOV operation
ref_13112 = ref_279 # MOV operation
ref_13313 = ref_13112 # MOV operation
ref_13331 = (ref_13313 >> (0xB & 0x3F)) # SHR operation
ref_13338 = ref_13331 # MOV operation
ref_15099 = ref_279 # MOV operation
ref_15532 = ref_15099 # MOV operation
ref_15542 = ((ref_15532 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_15549 = ref_15542 # MOV operation
ref_15766 = ref_13338 # MOV operation
ref_15772 = ref_15549 # MOV operation
ref_15774 = (ref_15772 | ref_15766) # OR operation
ref_17852 = ref_11132 # MOV operation
ref_18067 = ref_17852 # MOV operation
ref_18069 = ((ref_18067 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_18539 = ref_18069 # MOV operation
ref_18541 = (ref_18539 & 0x1D5ABF66) # AND operation
ref_18770 = ref_15774 # MOV operation
ref_18776 = ref_18541 # MOV operation
ref_18778 = ((ref_18770 - ref_18776) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_18786 = ref_18778 # MOV operation
ref_20624 = ref_18786 # MOV operation
ref_22419 = ref_279 # MOV operation
ref_22845 = ref_22419 # MOV operation
ref_22853 = ((ref_22845 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_22861 = ref_22853 # MOV operation
ref_24734 = ref_22861 # MOV operation
ref_26474 = ref_279 # MOV operation
ref_28330 = ref_11132 # MOV operation
ref_28724 = ref_28330 # MOV operation
ref_28732 = ((0x20453EE3 + ref_28724) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_28964 = ref_26474 # MOV operation
ref_28970 = ref_28732 # MOV operation
ref_28972 = ((ref_28964 - ref_28970) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_28980 = ref_28972 # MOV operation
ref_30869 = ref_28980 # MOV operation
ref_34989 = ref_11132 # MOV operation
ref_37690 = ref_24734 # MOV operation
ref_39740 = ref_11132 # MOV operation
ref_39907 = ref_37690 # MOV operation
ref_39913 = ref_39740 # MOV operation
ref_39915 = (ref_39913 | ref_39907) # OR operation
ref_40136 = ref_39915 # MOV operation
ref_40152 = (0x3F & ref_40136) # AND operation
ref_40637 = ref_40152 # MOV operation
ref_40647 = ((ref_40637 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_40654 = ref_40647 # MOV operation
ref_40839 = ref_34989 # MOV operation
ref_40845 = ref_40654 # MOV operation
ref_40847 = (ref_40845 | ref_40839) # OR operation
ref_42922 = ref_40847 # MOV operation
ref_45461 = ref_42922 # MOV operation
ref_45656 = ref_45461 # MOV operation
ref_45674 = (ref_45656 >> (0x1 & 0x3F)) # SHR operation
ref_45681 = ref_45674 # MOV operation
ref_45894 = ref_45681 # MOV operation
ref_45910 = (0xF & ref_45894) # AND operation
ref_46359 = ref_45910 # MOV operation
ref_46367 = (0x1 | ref_46359) # OR operation
ref_48237 = ref_20624 # MOV operation
ref_48396 = ref_48237 # MOV operation
ref_48410 = ref_46367 # MOV operation
ref_48412 = (ref_48410 & 0xFFFFFFFF) # MOV operation
ref_48414 = (ref_48396 >> ((ref_48412 & 0xFF) & 0x3F)) # SHR operation
ref_48421 = ref_48414 # MOV operation
ref_50284 = ref_20624 # MOV operation
ref_53011 = ref_42922 # MOV operation
ref_53212 = ref_53011 # MOV operation
ref_53230 = (ref_53212 >> (0x1 & 0x3F)) # SHR operation
ref_53237 = ref_53230 # MOV operation
ref_53454 = ref_53237 # MOV operation
ref_53470 = (0xF & ref_53454) # AND operation
ref_53931 = ref_53470 # MOV operation
ref_53939 = (0x1 | ref_53931) # OR operation
ref_54171 = ref_53939 # MOV operation
ref_54173 = ((0x40 - ref_54171) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_54181 = ref_54173 # MOV operation
ref_54405 = ref_50284 # MOV operation
ref_54411 = ref_54181 # MOV operation
ref_54413 = (ref_54411 & 0xFFFFFFFF) # MOV operation
ref_54415 = ((ref_54405 << ((ref_54413 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_54422 = ref_54415 # MOV operation
ref_54647 = ref_48421 # MOV operation
ref_54653 = ref_54422 # MOV operation
ref_54655 = (ref_54653 | ref_54647) # OR operation
ref_57144 = ref_54655 # MOV operation
ref_59653 = ref_57144 # MOV operation
ref_61480 = ref_30869 # MOV operation
ref_61695 = ref_59653 # MOV operation
ref_61701 = ref_61480 # MOV operation
ref_61703 = ((ref_61695 - ref_61701) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_61711 = ref_61703 # MOV operation
ref_63554 = ref_61711 # MOV operation
ref_68665 = ref_20624 # MOV operation
ref_68872 = ref_68665 # MOV operation
ref_68888 = (0xF & ref_68872) # AND operation
ref_69299 = ref_68888 # MOV operation
ref_69307 = (0x1 | ref_69299) # OR operation
ref_71157 = ref_42922 # MOV operation
ref_71344 = ref_71157 # MOV operation
ref_71358 = ref_69307 # MOV operation
ref_71360 = (ref_71358 & 0xFFFFFFFF) # MOV operation
ref_71362 = (ref_71344 >> ((ref_71360 & 0xFF) & 0x3F)) # SHR operation
ref_71369 = ref_71362 # MOV operation
ref_73147 = ref_42922 # MOV operation
ref_75389 = ref_20624 # MOV operation
ref_75596 = ref_75389 # MOV operation
ref_75612 = (0xF & ref_75596) # AND operation
ref_76071 = ref_75612 # MOV operation
ref_76079 = (0x1 | ref_76071) # OR operation
ref_76323 = ref_76079 # MOV operation
ref_76325 = ((0x40 - ref_76323) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_76333 = ref_76325 # MOV operation
ref_76544 = ref_73147 # MOV operation
ref_76550 = ref_76333 # MOV operation
ref_76552 = (ref_76550 & 0xFFFFFFFF) # MOV operation
ref_76554 = ((ref_76544 << ((ref_76552 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_76561 = ref_76554 # MOV operation
ref_76794 = ref_71369 # MOV operation
ref_76800 = ref_76561 # MOV operation
ref_76802 = (ref_76800 | ref_76794) # OR operation
ref_79074 = ref_63554 # MOV operation
ref_80868 = ref_30869 # MOV operation
ref_81061 = ref_79074 # MOV operation
ref_81067 = ref_80868 # MOV operation
ref_81069 = (ref_81067 | ref_81061) # OR operation
ref_81261 = ref_81069 # MOV operation
ref_81279 = (ref_81261 >> (0x1 & 0x3F)) # SHR operation
ref_81286 = ref_81279 # MOV operation
ref_81511 = ref_81286 # MOV operation
ref_81527 = (0x7 & ref_81511) # AND operation
ref_81944 = ref_81527 # MOV operation
ref_81952 = (0x1 | ref_81944) # OR operation
ref_82188 = ref_76802 # MOV operation
ref_82194 = ref_81952 # MOV operation
ref_82196 = (ref_82194 & 0xFFFFFFFF) # MOV operation
ref_82198 = ((ref_82188 << ((ref_82196 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_82205 = ref_82198 # MOV operation
ref_83959 = ref_82205 # MOV operation
ref_84441 = ref_83959 # MOV operation
ref_84443 = ref_84441 # MOV operation
print ref_84443 & 0xffffffffffffffff