主要是作为个人笔记,自娱自乐,大手子们,不喜勿喷.
源自一个简单的想法,通过特征码匹配模式来识别反汇编除法。后续逐步收集switch-case和虚函数等特征码来完善现在的树结构。
下面是要匹配的三种模式:
按照规则,构建的属性结构如下(此处显示部分,完整版附件下载DivTree.json):
通过解析,提取关键数据计算除数,代码如下:
测试一个分析的代码片段:
分析的结果如下:
如果有感兴趣的朋友,可以私信我,一起探讨相关话题.
{
"div"
:{
"Left"
:{
"shr"
:{
"Left"
:{
"add"
:{
"Left"
:{
"shr"
:{
"Leaf"
:
"End"
,
"MethodModel"
:
"uargc/7=%u"
}
},
"Leaf"
:
"End"
,
"MethodModel"
:
"argc/7=%d"
,
"Right"
:null
}
},
"Right"
:null
}},
"Right"
: {
"Left"
:{
"sar"
:{
"Left"
:{
"neg"
:{
"Leaf"
:
"End"
,
"MethodModel"
:
"argc/-4=%d"
}
}
}
}
},
"Reverse"
:{
}
}}
{
"div"
:{
"Left"
:{
"shr"
:{
"Left"
:{
"add"
:{
"Left"
:{
"shr"
:{
"Leaf"
:
"End"
,
"MethodModel"
:
"uargc/7=%u"
}
},
"Leaf"
:
"End"
,
"MethodModel"
:
"argc/7=%d"
,
"Right"
:null
}
},
"Right"
:null
}},
"Right"
: {
"Left"
:{
"sar"
:{
"Left"
:{
"neg"
:{
"Leaf"
:
"End"
,
"MethodModel"
:
"argc/-4=%d"
}
}
}
}
},
"Reverse"
:{
}
}}
import
re
from
ASTCore
import
*
HelloASTCore()
def
div_argc_7_d():
print
(
"argc/7=%d"
)
bigNum
=
int
(lsInsUp[
-
1
].split(
","
)[
1
].replace(
'h'
,''),
16
)
matchKeyPos
=
[i
for
i, s
in
enumerate
(lsInsUp)
if
re.search(r
'sar\s+edx'
,s)]
if
len
(matchKeyPos)>
0
:
powerNum
=
32
+
int
(lsInsUp[matchKeyPos[
0
]].split(
","
)[
1
].replace(
'h'
,''),
16
)
print
(f
"div: /{2**powerNum/bigNum}"
)
def
div_argc_neg_4_d():
print
(
"argc/-4=%d"
)
num
=
int
(lsInsDown[
0
].split(
","
)[
1
],
16
)
print
(
"num="
,num)
print
(f
"div: /-{num**2}"
)
AnalyCaseTable
=
{
"argc/7=%d"
:div_argc_7_d,
"argc/-4=%d"
:div_argc_neg_4_d}
for
k,v
in
AnalyCaseTable.items():
if
k
=
=
methodMatched:
v()
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
最后于 2024-1-23 21:34
被_THINCT编辑
,原因: