Skip to content

Instantly share code, notes, and snippets.

Created December 8, 2016 00:59
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save xpn/da4a497288d6e1ed066d47ff1b2ce2d7 to your computer and use it in GitHub Desktop.
Save xpn/da4a497288d6e1ed066d47ff1b2ce2d7 to your computer and use it in GitHub Desktop.
# r2pipe script using ESIL to decode the msfvenom x86/alpha_mixed encoder
import r2pipe
import sys
def dump(addr):
def startEsil():
r.cmd('e io.cache=true')
r.cmd('e asm.bits=32')
r.cmd('e asm.arch=x86')
r.cmd('aeim 0xffffd000 0x2000 stack')
def emulate():
# First we need to find our current address
cmd = r.cmdj('pdj 1')
base = cmd[0]['offset']
print "Base address: %x" % (base)
# Now we grab the size of the payload
cmd = r.cmdj('oj')
end = cmd[0]['size']
print "Size of payload: %x" % (end)
lastfpu = 0
# We need to fudge the FPU call, as Radare doesn't support this yet
for i in range(10000):
# Get reg values
regs = r.cmdj('aerj')
# Retrieve current EIP value
cmd = r.cmdj('pdj 1 @ ' + str(regs['eip']))[0]
if cmd['family'] == 'fpu':
if cmd['opcode'].startswith('fnstenv'):
# If we have our FPU instruction, we dump the location of the last FPU instruction (mock)
r.cmd('wv %d @ %d' % (lastfpu, regs['esp']))
lastfpu = cmd['offset']
# The 'jne' call is the final call before our payload
if cmd['opcode'].startswith('jne'):
decoded = cmd['offset'] + cmd['size']
# We can ask the emulator to break after the jne call, which will be our decoded payload
r.cmd('aecu ' + str(decoded))
# Finally, we extract the original payload
print r.cmd('pD %d @ %d' % (end - (decoded - base), base + (decoded - base)))
raw = r.cmdj('p8j %d @ %d' % (end - (decoded - base), decoded))
with open('out.bin', 'w') as f:
f.write(''.join(map(chr, raw)))
print "Raw code is now in ./out.bin"
r =[1])
r.cmd('e asm.comments=false');
r.cmd('e asm.lines=false');
r.cmd('e asm.flags=false');
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment