forked from JonathanSalwan/Tigress_protection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sample1-virt-duplicate-opcodes-3.py
150 lines (146 loc) · 6.19 KB
/
sample1-virt-duplicate-opcodes-3.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_264 = SymVar_0
ref_279 = ref_264 # MOV operation
ref_5349 = ref_279 # MOV operation
ref_5517 = ref_5349 # MOV operation
ref_5525 = ((ref_5517 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_5532 = ref_5525 # MOV operation
ref_6337 = ref_279 # MOV operation
ref_6397 = ref_6337 # MOV operation
ref_6411 = (ref_6397 >> (0x7 & 0x3F)) # SHR operation
ref_6496 = ref_6411 # MOV operation
ref_6508 = ref_5532 # MOV operation
ref_6510 = (ref_6508 | ref_6496) # OR operation
ref_7313 = ref_6510 # MOV operation
ref_8913 = ref_7313 # MOV operation
ref_8985 = ref_8913 # MOV operation
ref_8987 = ((ref_8985 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_9185 = ref_8987 # MOV operation
ref_9187 = (ref_9185 & 0x1D5ABF66) # AND operation
ref_9897 = ref_279 # MOV operation
ref_10065 = ref_9897 # MOV operation
ref_10073 = ((ref_10065 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_10080 = ref_10073 # MOV operation
ref_10885 = ref_279 # MOV operation
ref_10945 = ref_10885 # MOV operation
ref_10959 = (ref_10945 >> (0xB & 0x3F)) # SHR operation
ref_11044 = ref_10959 # MOV operation
ref_11056 = ref_10080 # MOV operation
ref_11058 = (ref_11056 | ref_11044) # OR operation
ref_11143 = ref_11058 # MOV operation
ref_11155 = ref_9187 # MOV operation
ref_11157 = ((ref_11143 - ref_11155) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_11165 = ref_11157 # MOV operation
ref_11253 = ref_11165 # MOV operation
ref_12668 = ref_279 # MOV operation
ref_12836 = ref_12668 # MOV operation
ref_12842 = ((ref_12836 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_12850 = ref_12842 # MOV operation
ref_12938 = ref_12850 # MOV operation
ref_13643 = ref_279 # MOV operation
ref_14513 = ref_7313 # MOV operation
ref_14573 = ref_14513 # MOV operation
ref_14587 = ((0x20453EE3 + ref_14573) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_14681 = ref_13643 # MOV operation
ref_14685 = ref_14587 # MOV operation
ref_14687 = ((ref_14681 - ref_14685) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_14695 = ref_14687 # MOV operation
ref_15493 = ref_14695 # MOV operation
ref_18078 = ref_7313 # MOV operation
ref_19120 = ref_12938 # MOV operation
ref_19180 = ref_19120 # MOV operation
ref_19192 = ref_18078 # MOV operation
ref_19194 = (ref_19192 | ref_19180) # OR operation
ref_19387 = ref_19194 # MOV operation
ref_19393 = (0x3F & ref_19387) # AND operation
ref_19478 = ref_19393 # MOV operation
ref_19492 = ((ref_19478 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_20359 = ref_7313 # MOV operation
ref_20419 = ref_20359 # MOV operation
ref_20431 = ref_19492 # MOV operation
ref_20433 = (ref_20431 | ref_20419) # OR operation
ref_20526 = ref_20433 # MOV operation
ref_22570 = ref_20526 # MOV operation
ref_22630 = ref_22570 # MOV operation
ref_22644 = (ref_22630 >> (0x1 & 0x3F)) # SHR operation
ref_22729 = ref_22644 # MOV operation
ref_22743 = (0xF & ref_22729) # AND operation
ref_22936 = ref_22743 # MOV operation
ref_22942 = (0x1 | ref_22936) # OR operation
ref_23139 = ref_22942 # MOV operation
ref_23141 = ((0x40 - ref_23139) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_23149 = ref_23141 # MOV operation
ref_23939 = ref_11253 # MOV operation
ref_23999 = ref_23939 # MOV operation
ref_24011 = ref_23149 # MOV operation
ref_24013 = ((ref_23999 << ((ref_24011 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_24980 = ref_20526 # MOV operation
ref_25040 = ref_24980 # MOV operation
ref_25054 = (ref_25040 >> (0x1 & 0x3F)) # SHR operation
ref_25247 = ref_25054 # MOV operation
ref_25253 = (0xF & ref_25247) # AND operation
ref_25446 = ref_25253 # MOV operation
ref_25452 = (0x1 | ref_25446) # OR operation
ref_26247 = ref_11253 # MOV operation
ref_26307 = ref_26247 # MOV operation
ref_26319 = ref_25452 # MOV operation
ref_26321 = (ref_26307 >> ((ref_26319 & 0xFF) & 0x3F)) # SHR operation
ref_26406 = ref_26321 # MOV operation
ref_26418 = ref_24013 # MOV operation
ref_26420 = (ref_26418 | ref_26406) # OR operation
ref_26513 = ref_26420 # MOV operation
ref_28285 = ref_26513 # MOV operation
ref_29055 = ref_15493 # MOV operation
ref_29123 = ref_28285 # MOV operation
ref_29127 = ref_29055 # MOV operation
ref_29129 = ((ref_29123 - ref_29127) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_29137 = ref_29129 # MOV operation
ref_29225 = ref_29137 # MOV operation
ref_32191 = ref_15493 # MOV operation
ref_32961 = ref_29225 # MOV operation
ref_33021 = ref_32961 # MOV operation
ref_33033 = ref_32191 # MOV operation
ref_33035 = (ref_33033 | ref_33021) # OR operation
ref_33120 = ref_33035 # MOV operation
ref_33134 = (ref_33120 >> (0x1 & 0x3F)) # SHR operation
ref_33219 = ref_33134 # MOV operation
ref_33233 = (0x7 & ref_33219) # AND operation
ref_33318 = ref_33233 # MOV operation
ref_33332 = (0x1 | ref_33318) # OR operation
ref_34127 = ref_11253 # MOV operation
ref_34295 = ref_34127 # MOV operation
ref_34301 = (0xF & ref_34295) # AND operation
ref_34494 = ref_34301 # MOV operation
ref_34500 = (0x1 | ref_34494) # OR operation
ref_35295 = ref_20526 # MOV operation
ref_35355 = ref_35295 # MOV operation
ref_35367 = ref_34500 # MOV operation
ref_35369 = (ref_35355 >> ((ref_35367 & 0xFF) & 0x3F)) # SHR operation
ref_36164 = ref_11253 # MOV operation
ref_36332 = ref_36164 # MOV operation
ref_36338 = (0xF & ref_36332) # AND operation
ref_36531 = ref_36338 # MOV operation
ref_36537 = (0x1 | ref_36531) # OR operation
ref_36734 = ref_36537 # MOV operation
ref_36736 = ((0x40 - ref_36734) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_36744 = ref_36736 # MOV operation
ref_37534 = ref_20526 # MOV operation
ref_37594 = ref_37534 # MOV operation
ref_37606 = ref_36744 # MOV operation
ref_37608 = ((ref_37594 << ((ref_37606 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_37701 = ref_35369 # MOV operation
ref_37705 = ref_37608 # MOV operation
ref_37707 = (ref_37705 | ref_37701) # OR operation
ref_37792 = ref_37707 # MOV operation
ref_37804 = ref_33332 # MOV operation
ref_37806 = ((ref_37792 << ((ref_37804 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_37899 = ref_37806 # MOV operation
ref_38078 = ref_37899 # MOV operation
ref_38080 = ref_38078 # MOV operation
print ref_38080 & 0xffffffffffffffff