Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
#!/usr/bin/env python
# diff
from __future__ import print_function
from unicorn import *
from unicorn.arm_const import *
import binascii
import sys
# code to be emulated
ARM_CODE = b"\x42\x1E" + \
b"\x12\xF8\x01\x0F\x80\xB1\x20\xF0\x20\x03\xA3\xF1\x41\x01\x19\x29\xF6\xD9\xA0\xF1\x30\x03\x09\x2B" + \
b"\xF2\xD9" + \
b"\x5F\x28" + \
b"\xF0\xD0" + \
b"\x2E\x28\xEE\xD0\x6F\xF4\x7A\x70" + \
b"\x00\x46\x00\x46" #b"\x70\x47\x70\x47" # We can't have bx lr since lr won't be defined, so I changed it to mv r0, r0 (NOP)
# memory address where emulation starts
ADDRESS = 0x10000
SCRATCH_ADDRESS = 0x1000
def executeFunction(string):
code = ARM_CODE
try:
# Initialize emulator in thumb mode
mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
# map 2MB memory for this emulation
mu.mem_map(ADDRESS, 4 * 1024 * 1024)
# write machine code to be emulated to memory
mu.mem_write(ADDRESS, code)
# map 10K scratch memory for this emulation
mu.mem_map(SCRATCH_ADDRESS, 10 * 1024)
# write dummy data to be emulated to memory
mu.mem_write(SCRATCH_ADDRESS, string)
# initialize machine registers
for i in range(UC_ARM_REG_R0, UC_ARM_REG_R12):
val = mu.reg_write(i, 0)
mu.reg_write(UC_ARM_REG_R0, SCRATCH_ADDRESS)
# emulate machine code in infinite time
mu.emu_start(ADDRESS + 1, ADDRESS + len(code))
return mu.reg_read(UC_ARM_REG_R0)
except UcError as e:
print("ERROR: %s" % e)
if __name__ == '__main__':
if len(sys.argv) < 2:
print("Enter a potential file path")
ret = executeFunction(sys.argv[1])
if ret != 0:
print("Failed to validate")
else:
print("Passed validation")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment