Last active
August 29, 2015 14:13
-
-
Save gucchan22/5a16545538ea9286dbd4 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#-*- coding:utf-8 -*- | |
require "net/http" | |
require "json" | |
require "nokogiri" | |
class ODA | |
ODA_hdr = { | |
"Host" => "www2.onlinedisassembler.com", | |
"Content-Type" => "application/x-www-form-urlencoded; charset=UTF-8", | |
"Referer" => "http://www2.onlinedisassembler.com/odaweb/", | |
"User-Agent" => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:12.0) Gecko/20100101 Firefox/12.0" | |
} | |
def initialize | |
self.generate_cookie | |
end | |
def generate_cookie | |
Net::HTTP.start(ODA_hdr["Host"]) do |oda| | |
oda_res = oda.get("/odaweb/").get_fields("Set-Cookie").join | |
oda_cookie = {} | |
_,v = oda_res.split(";").first.split("=") | |
ENV["ODA_SID"] = v | |
end | |
end | |
def generate_payload(d) | |
d.map{|k,v| "#{k}=#{v}" }.join("&") | |
end | |
def disasm(args) | |
Net::HTTP.start(ODA_hdr["Host"], 80) do |oda| | |
ODA_hdr.merge!({ "Cookie" => "sessionid=#{ENV['ODA_SID']};" }) | |
oda.post("/odaweb/_set", | |
generate_payload({ | |
:arch => args[:arch], | |
:base_address => "0", | |
:hex_val => args[:binary].join("+"), | |
:endian => args[:endian] | |
}), | |
ODA_hdr | |
) | |
oda.post("/odaweb/_refresh", "", ODA_hdr) do |refresh| | |
if refresh =~ /503/ | |
ENV.delete("ODA_SID") | |
self.generate_cookie | |
else | |
puts refresh | |
end | |
end | |
end | |
end | |
def analyze_disasm_html(json) | |
json = JSON.parse(json)["disassembly"] | |
html_parser = Nokogiri::HTML.parse(json) | |
html_parser.xpath("//tr").each do |disasm| | |
addr = disasm.children.children[1].text | |
raw = disasm.children.children[2].text | |
dis = disasm.children.children[3].text | |
puts "#{addr}: #{raw} #{dis}" | |
end | |
end | |
end | |
# [Rk@23:32:34] ruby oda.rb | tr -d '\n' | ruby oda.rb --in | |
oda = ODA.new | |
if ARGV.first == "--in" | |
oda.analyze_disasm_html(STDIN.gets) | |
else | |
binary = "55 31 D2 89 E5 8B 45 08 56 8B 75 0C 53 8D 58 FF 0F" | |
binary += "B6 0C 16 88 4C 13 01 83 C2 01 84 C9 75 F1 5B 5E 5D C3" | |
binary = binary.split(" ") | |
oda.disasm( | |
:arch => "armv3", | |
:binary => binary, | |
:endian => "DEFAULT" #DEFAULT(little-endian), BIG(big-endian), LITTLE(little-endian) | |
) | |
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
r0:desktop ryouma$ ruby oda.rb | tr -d '\n' | ruby oda.rb --in | |
.data:0x00000000: 3155 adds r1, #85 ; 0x55 | |
.data:0x00000002: 89d2 ldrh r2, [r2, #14] | |
.data:0x00000004: 8be5 ldrh r5, [r4, #30] | |
.data:0x00000006: 0845 lsrs r5, r0, #1 | |
.data:0x00000008: 8b56 ldrh r6, [r2, #26] | |
.data:0x0000000a: 0c75 lsrs r5, r6, #17 | |
.data:0x0000000c: 8d53 ldrh r3, [r2, #42] ; 0x2a | |
.data:0x0000000e: b60fff58 vmax.u16 d27, d8, d15 | |
.data:0x00000012: 160c asrs r4, r1, #24 | |
.data:0x00000014: 4c88 ldr r4, [pc, #544] ; (0x00000238) | |
.data:0x00000016: 0113 lsls r3, r2, #4 | |
.data:0x00000018: c283 stmia r2!, {r0, r1, r7} | |
.data:0x0000001a: 8401 strh r1, [r0, #32] | |
.data:0x0000001c: 75c9 strb r1, [r1, #23] | |
.data:0x0000001e: 5bf1 ldrh r1, [r6, r7] | |
.data:0x00000020: 5d5e ldrb r6, [r3, r5] | |
.data:0x00000022: Address 0x0000000000000022 is out of bounds. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment