forked from JonathanSalwan/Tigress_protection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sample1-virt-dispatcher-call.py
166 lines (162 loc) · 6.9 KB
/
sample1-virt-dispatcher-call.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_5408 = SymVar_0
ref_5423 = ref_5408 # MOV operation
ref_13231 = ref_5423 # MOV operation
ref_13673 = ref_13231 # MOV operation
ref_13683 = ((ref_13673 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_13690 = ref_13683 # MOV operation
ref_15493 = ref_5423 # MOV operation
ref_15935 = ref_15493 # MOV operation
ref_15945 = (ref_15935 >> (0x7 & 0x3F)) # SHR operation
ref_15952 = ref_15945 # MOV operation
ref_16169 = ref_15952 # MOV operation
ref_16183 = ref_13690 # MOV operation
ref_16185 = (ref_16183 | ref_16169) # OR operation
ref_16415 = ref_16185 # MOV operation
ref_20201 = ref_16415 # MOV operation
ref_20649 = ref_20201 # MOV operation
ref_20651 = ((ref_20649 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_20888 = ref_20651 # MOV operation
ref_20890 = (ref_20888 & 0x1D5ABF66) # AND operation
ref_22698 = ref_5423 # MOV operation
ref_23140 = ref_22698 # MOV operation
ref_23150 = ((ref_23140 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_23157 = ref_23150 # MOV operation
ref_24960 = ref_5423 # MOV operation
ref_25402 = ref_24960 # MOV operation
ref_25412 = (ref_25402 >> (0xB & 0x3F)) # SHR operation
ref_25419 = ref_25412 # MOV operation
ref_25636 = ref_25419 # MOV operation
ref_25650 = ref_23157 # MOV operation
ref_25652 = (ref_25650 | ref_25636) # OR operation
ref_25874 = ref_25652 # MOV operation
ref_25888 = ref_20890 # MOV operation
ref_25890 = ((ref_25874 - ref_25888) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_25898 = ref_25890 # MOV operation
ref_26123 = ref_25898 # MOV operation
ref_29828 = ref_5423 # MOV operation
ref_30027 = ref_29828 # MOV operation
ref_30043 = ((ref_30027 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_30051 = ref_30043 # MOV operation
ref_30276 = ref_30051 # MOV operation
ref_34062 = ref_16415 # MOV operation
ref_34261 = ref_34062 # MOV operation
ref_34277 = ((0x20453EE3 + ref_34261) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_36086 = ref_5423 # MOV operation
ref_36285 = ref_36086 # MOV operation
ref_36299 = ref_34277 # MOV operation
ref_36301 = ((ref_36285 - ref_36299) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_36309 = ref_36301 # MOV operation
ref_36534 = ref_36309 # MOV operation
ref_42599 = ref_16415 # MOV operation
ref_45150 = ref_30276 # MOV operation
ref_45349 = ref_45150 # MOV operation
ref_45363 = ref_42599 # MOV operation
ref_45365 = (ref_45363 | ref_45349) # OR operation
ref_45830 = ref_45365 # MOV operation
ref_45838 = (0x3F & ref_45830) # AND operation
ref_46303 = ref_45838 # MOV operation
ref_46313 = ((ref_46303 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_46320 = ref_46313 # MOV operation
ref_48415 = ref_16415 # MOV operation
ref_48614 = ref_48415 # MOV operation
ref_48628 = ref_46320 # MOV operation
ref_48630 = (ref_48628 | ref_48614) # OR operation
ref_48860 = ref_48630 # MOV operation
ref_53096 = ref_26123 # MOV operation
ref_55408 = ref_48860 # MOV operation
ref_55850 = ref_55408 # MOV operation
ref_55860 = (ref_55850 >> (0x1 & 0x3F)) # SHR operation
ref_55867 = ref_55860 # MOV operation
ref_56327 = ref_55867 # MOV operation
ref_56335 = (0xF & ref_56327) # AND operation
ref_56557 = ref_56335 # MOV operation
ref_56573 = (0x1 | ref_56557) # OR operation
ref_57044 = ref_56573 # MOV operation
ref_57046 = ((0x40 - ref_57044) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_57054 = ref_57046 # MOV operation
ref_57279 = ref_53096 # MOV operation
ref_57285 = ref_57054 # MOV operation
ref_57287 = (ref_57285 & 0xFFFFFFFF) # MOV operation
ref_57289 = ((ref_57279 << ((ref_57287 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_57296 = ref_57289 # MOV operation
ref_59180 = ref_26123 # MOV operation
ref_61492 = ref_48860 # MOV operation
ref_61934 = ref_61492 # MOV operation
ref_61944 = (ref_61934 >> (0x1 & 0x3F)) # SHR operation
ref_61951 = ref_61944 # MOV operation
ref_62411 = ref_61951 # MOV operation
ref_62419 = (0xF & ref_62411) # AND operation
ref_62641 = ref_62419 # MOV operation
ref_62657 = (0x1 | ref_62641) # OR operation
ref_62887 = ref_59180 # MOV operation
ref_62893 = ref_62657 # MOV operation
ref_62895 = (ref_62893 & 0xFFFFFFFF) # MOV operation
ref_62897 = (ref_62887 >> ((ref_62895 & 0xFF) & 0x3F)) # SHR operation
ref_62904 = ref_62897 # MOV operation
ref_63121 = ref_62904 # MOV operation
ref_63135 = ref_57296 # MOV operation
ref_63137 = (ref_63135 | ref_63121) # OR operation
ref_63367 = ref_63137 # MOV operation
ref_66918 = ref_36534 # MOV operation
ref_69469 = ref_63367 # MOV operation
ref_69668 = ref_69469 # MOV operation
ref_69682 = ref_66918 # MOV operation
ref_69684 = ((ref_69668 - ref_69682) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_69692 = ref_69684 # MOV operation
ref_69917 = ref_69692 # MOV operation
ref_76583 = ref_48860 # MOV operation
ref_78684 = ref_26123 # MOV operation
ref_79126 = ref_78684 # MOV operation
ref_79134 = (0xF & ref_79126) # AND operation
ref_79356 = ref_79134 # MOV operation
ref_79372 = (0x1 | ref_79356) # OR operation
ref_79843 = ref_79372 # MOV operation
ref_79845 = ((0x40 - ref_79843) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_79853 = ref_79845 # MOV operation
ref_80078 = ref_76583 # MOV operation
ref_80084 = ref_79853 # MOV operation
ref_80086 = (ref_80084 & 0xFFFFFFFF) # MOV operation
ref_80088 = ((ref_80078 << ((ref_80086 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_80095 = ref_80088 # MOV operation
ref_81979 = ref_48860 # MOV operation
ref_84080 = ref_26123 # MOV operation
ref_84522 = ref_84080 # MOV operation
ref_84530 = (0xF & ref_84522) # AND operation
ref_84752 = ref_84530 # MOV operation
ref_84768 = (0x1 | ref_84752) # OR operation
ref_84998 = ref_81979 # MOV operation
ref_85004 = ref_84768 # MOV operation
ref_85006 = (ref_85004 & 0xFFFFFFFF) # MOV operation
ref_85008 = (ref_84998 >> ((ref_85006 & 0xFF) & 0x3F)) # SHR operation
ref_85015 = ref_85008 # MOV operation
ref_85232 = ref_85015 # MOV operation
ref_85246 = ref_80095 # MOV operation
ref_85248 = (ref_85246 | ref_85232) # OR operation
ref_87372 = ref_36534 # MOV operation
ref_89238 = ref_69917 # MOV operation
ref_89437 = ref_89238 # MOV operation
ref_89451 = ref_87372 # MOV operation
ref_89453 = (ref_89451 | ref_89437) # OR operation
ref_89918 = ref_89453 # MOV operation
ref_89928 = (ref_89918 >> (0x1 & 0x3F)) # SHR operation
ref_89935 = ref_89928 # MOV operation
ref_90395 = ref_89935 # MOV operation
ref_90403 = (0x7 & ref_90395) # AND operation
ref_90625 = ref_90403 # MOV operation
ref_90641 = (0x1 | ref_90625) # OR operation
ref_90871 = ref_85248 # MOV operation
ref_90877 = ref_90641 # MOV operation
ref_90879 = (ref_90877 & 0xFFFFFFFF) # MOV operation
ref_90881 = ((ref_90871 << ((ref_90879 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_90888 = ref_90881 # MOV operation
ref_91113 = ref_90888 # MOV operation
ref_91603 = ref_91113 # MOV operation
ref_91605 = ref_91603 # MOV operation
print ref_91605 & 0xffffffffffffffff