Skip to content

Instantly share code, notes, and snippets.

@Stolas
Created October 16, 2019 07:24
Show Gist options
  • Save Stolas/e3ecaebaa7369b2d8d6c539b9ac2908e to your computer and use it in GitHub Desktop.
Save Stolas/e3ecaebaa7369b2d8d6c539b9ac2908e to your computer and use it in GitHub Desktop.
PoC Mobicore for r2
/* radare - LGPL - Copyright 2019 - stolas */
#include <r_types.h>
#include <r_util.h>
#include <r_lib.h>
#include <r_bin.h>
#include <r_magic.h>
typedef struct {
ut32 magic;
ut32 version;
ut32 flags ;
ut32 memType;
ut32 serviceType;
ut32 numInstances;
ut128 uuid;
ut32 driverId;
ut32 numThreads;
ut32 textVA;
ut32 textLen;
ut32 dataVA;
ut32 dataLen;
ut32 bssLen;
ut32 entry;
} r_bin_mobicore_obj_t;
//this needs to move
static char *get_filetype(RBuffer *b) {
ut8 buf[4096] = { 0 };
char *res = NULL;
RMagic *ck = r_magic_new (0);
if (!ck) {
return NULL;
}
const char *tmp = NULL;
// TODO: dir.magic not honored here
r_magic_load (ck, R2_SDB_MAGIC);
r_buf_read_at (b, 0, buf, sizeof (buf));
tmp = r_magic_buffer (ck, buf, sizeof (buf));
if (tmp) {
res = strdup (tmp);
}
r_magic_free (ck);
return res;
}
static RBinInfo *info(RBinFile *bf) {
RBinInfo *ret = R_NEW0 (RBinInfo);
if (!ret) {
return NULL;
}
ret->lang = "";
ret->file = bf->file? strdup (bf->file): NULL;
ret->type = get_filetype (bf->buf);
ret->has_pi = 0;
ret->has_canary = 0;
ret->has_retguard = -1;
if (R_SYS_BITS & R_SYS_BITS_64) {
ret->bits = 64;
} else {
ret->bits = 32;
}
ret->big_endian = 0;
ret->has_va = 0;
ret->has_nx = 0;
ret->dbg_info = 0;
ret->dbg_info = 0;
ret->dbg_info = 0;
return ret;
}
#define READ32(x, i) r_read_ble32((x) + (i), bin->endian); (i) += 4
#define READ64(x, i) r_read_ble64((x) + (i), bin->endian); (i) += 8
#define READWORD(x, i) READ32 (x, i)
static bool load_buffer(RBinFile *bf, void **bin_obj, RBuffer *buf, ut64 loadaddr, Sdb *sdb) {
int i = 0;
char *magic = READWORD (buf, i);
char *version = READWORD (buf, i);
char *flags = READWORD (buf, i);
char *memType = READWORD (buf, i);
char *serviceType = READWORD (buf, i);
char *numInstances = READWORD (buf, i);
char *uuid_lower = READ64 (buf, i);
char *uuid_higher = READ64 (buf, i);
char *driverId = READWORD (buf, i);
char *numThreads = READWORD (buf, i);
char *textVA = READWORD (buf, i);
char *textLen = READWORD (buf, i);
char *dataVA = READWORD (buf, i);
char *dataLen = READWORD (buf, i);
char *bssLen = READWORD (buf, i);
char *entry = READWORD (buf, i);
//if (res) {
// sdb_ns_set (sdb, "info", res->kv);
// *bin_obj = res;
return true;
// }
//return false;
}
static bool check_buffer(RBuffer *b) {
r_return_val_if_fail (b, false);
ut64 b_size = r_buf_size (b);
// Dunno the minimal size
// if (b_size <= 0x3d) {
// return false;
// }
// Check for MCLF magic.
ut8 h[4];
if (r_buf_read_at (b, 0, h, 4) != 4) {
return false;
}
if (memcmp (h, "MCLF", 4)) {
return false;
}
return true;
}
static void destroy(RBinFile *bf) {
r_buf_free (bf->o->bin_obj);
}
static ut64 baddr(RBinFile *bf) {
return 0LL;
}
static RList* sections(RBinFile *bf)
{
r_bin_mobicore_obj_t *obj = bf->o->bin_obj;
RList *ret;
int i;
if (!bf) {
return NULL;
}
ret = r_list_new();
if (!ret ) {
return NULL;
}
if (!bf->buf) {
free (ret);
return NULL;
}
ret->free = free;
RBinSection *textSegment = R_NEW0(RBinSection);
textSegment->paddr = obj->textVA;
textSegment->vaddr = obj->textVA;
textSegment->size = obj->textLen;
textSegment->vsize = obj->textLen;
RBinSection *dataSegment = R_NEW0(RBinSection);
dataSegment->paddr = obj->dataVA;
dataSegment->vaddr = obj->dataVA;
dataSegment->size = obj->dataLen;
dataSegment->vsize = obj->dataLen;
r_list_append (ret, textSegment);
r_list_append (ret, dataSegment);
return ret;
}
RBinPlugin r_bin_plugin_mobicore = {
.name = "mobicore",
.desc = "Mobicore trustlet and drive binary loader for r2",
.license = "LGPL3",
//.load_buffer = &load_buffer,
.check_buffer = &check_buffer,
.sections = &sections,
.destroy = &destroy,
.baddr = &baddr,
.info = info,
.minstrlen = 0,
};
#ifndef R2_PLUGIN_INCORE
R_API RLibStruct radare_plugin = {
.type = R_LIB_TYPE_BIN,
.data = &r_bin_plugin_mobicore,
.version = R2_VERSION
};
#endif
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment