blog_matrixvm_1

parse_matrixvm.py

from pwn import *

f = open("prob.mv", "rb")
code = f.read()
f.close()

idx = 0
while True:
    print("*"*100)
    if (len(code) == idx):
        break
    opcode = code[idx]
    print("opcode : ", opcode)
    idx += 1
    if opcode == 0x0:
        print("[ALLOCATE] Allocate new matrix")
        print(hexdump(code[idx:idx+24]))
        id = u64(code[idx:idx+8])
        x = u64(code[idx+8:idx+16])
        y = u64(code[idx+16:idx+24])
        print("id, x, y : ", hex(id), x,y)
        idx += 24
        print(hexdump(code[idx:idx+(8*x*y)]))
        idx += 8*x*y
    elif opcode >= 1 and opcode <= 3:
        if opcode == 1:
            print("[MUL]")
        elif opcode == 2:
            print("[READ]")
        elif opcode == 3:
            print("[PRINT]")
        print("copy data into new malloc")
        print(hexdump(code[idx:idx+24]))
        idx += 24
    elif opcode == 4:
        print("[MOVE DATA]")
        dst_id = u64(code[idx:idx+8])
        dst_x = u64(code[idx+8:idx+16])
        dst_y = u64(code[idx+16:idx+24])
        src_id = u64(code[idx+24:idx+32])
        src_x = u64(code[idx+32:idx+40])
        src_y = u64(code[idx+40:idx+48])
        print("dst", hex(dst_id), dst_x, dst_y, "src", hex(src_id), src_x, src_y)

        print(hexdump(code[idx:idx+48]))
        idx += 48
    elif opcode == 5:
        print("COMPARE")
        print("copy data into new malloc")
        print(hexdump(code[idx:idx+16]))
        idx += 16
    else:
        print("unknown opcode", opcode)
        print(hexdump(code[idx:idx+32]))
        print(opcode)
        break