Пример #1
0
     bool operator()(InputIterator& next, InputIterator end,Token& tok) {
     tok = Token();

     // skip past all nonreturnable delims
     // skip past the returnable only if we are not returning delims
     for (;next!=end && ( is_nonret(*next) || (is_ret(*next) 
       && !return_delims_ ) );++next) { }

     if (next == end) {
       return false;
     }

     // if we are to return delims and we are one a returnable one
     // move past it and stop
     if (is_ret(*next) && return_delims_) {
       tok+=*next;
       ++next;
     }
     else
       // append all the non delim characters
       for (;next!=end && !is_nonret(*next) && !is_ret(*next);++next)
         tok+=*next;


     return true;
   }
Пример #2
0
//------------------------------------------------------------------------------
// Name: on_tableWidgetCallStack_cellClicked
// Desc: Enables the "Run To Return" button if the selected cell is in the
//			column for return addresses.  Disables it, otherwise.
//------------------------------------------------------------------------------
void DialogBacktrace::on_tableWidgetCallStack_cellClicked(int row, int column)
{
	row = row;	//Not used, and the warning is annoying.

	QPushButton *return_to = ui->pushButtonReturnTo;
	if (is_ret(column)) {
		return_to->setEnabled(true);
	} else {
		return_to->setDisabled(true);
	}
}
Пример #3
0
//------------------------------------------------------------------------------
// Name: on_pushButtonReturnTo_clicked()
// Desc: Ensures that the selected item is a return address.  If so, sets a
//			breakpoint at that address and continues execution.
//------------------------------------------------------------------------------
void DialogBacktrace::on_pushButtonReturnTo_clicked()
{
	//Make sure our current item is in the RETURN_COLUMN
	QTableWidgetItem *item = table_->currentItem();
	if (!is_ret(item)) { return; }

	bool ok;
	edb::address_t address = address_from_table(&ok, item);

	//If we didn't get a valid address, then fail.
	//TODO: Make sure "ok" actually signifies success of getting an address...
	if (!ok) {
		int base = 16;
		QString msg("Could not return to 0x%x" + QString().number(address, base));
		QMessageBox::information( this,	"Error", msg);
		return;
	}

	//Now that we got the address, we can run.  First check if bp @ that address
	//already exists.
	IBreakpoint::pointer bp = edb::v1::debugger_core->find_breakpoint(address);
	if (bp) {
		edb::v1::debugger_core->resume(edb::DEBUG_CONTINUE);
		return;
	}

	//Using the non-debugger_core version ensures bp is set in a valid region
	edb::v1::create_breakpoint(address);
	bp = edb::v1::debugger_core->find_breakpoint(address);
	if (bp) {
		bp->set_internal(true);
		bp->set_one_time(true);
		edb::v1::debugger_core->resume(edb::DEBUG_CONTINUE);
		return;
	}


}
Пример #4
0
//------------------------------------------------------------------------------
// Name: do_find
// Desc:
//------------------------------------------------------------------------------
void DialogROPTool::do_find() {

	const QItemSelectionModel *const selModel = ui->tableView->selectionModel();
	const QModelIndexList sel = selModel->selectedRows();

	if(sel.size() == 0) {
		QMessageBox::critical(
			this,
			tr("No Region Selected"),
			tr("You must select a region which is to be scanned for gadgets."));
	} else {

		unique_results_.clear();

		if(IProcess *process = edb::v1::debugger_core->process()) {
			for(const QModelIndex &selected_item: sel) {

				const QModelIndex index = filter_model_->mapToSource(selected_item);
				if(auto region = *reinterpret_cast<const IRegion::pointer *>(index.internalPointer())) {

					edb::address_t start_address     = region->start();
					const edb::address_t end_address = region->end();
					const edb::address_t orig_start  = start_address;

					ByteShiftArray bsa(32);

					while(start_address < end_address) {

						// read in the next byte
						quint8 byte;
						if(process->read_bytes(start_address, &byte, 1)) {
							bsa << byte;

							const quint8       *p = bsa.data();
							const quint8 *const l = p + bsa.size();
							edb::address_t    rva = start_address - bsa.size() + 1;

							QList<edb::Instruction> instruction_list;

							// eat up any NOPs in front...
							Q_FOREVER {
								edb::Instruction inst(p, l, rva);
								if(!is_nop(inst)) {
									break;
								}

								instruction_list << inst;
								p += inst.size();
								rva += inst.size();
							}


							edb::Instruction inst1(p, l, rva);
							if(inst1) {
								instruction_list << inst1;

								if(inst1.operation() == edb::Instruction::Operation::X86_INS_INT && inst1.operands()[0].general_type() == edb::Operand::TYPE_IMMEDIATE && (inst1.operands()[0].immediate() & 0xff) == 0x80) {
									add_gadget(instruction_list);
								} else if(inst1.operation() == edb::Instruction::Operation::X86_INS_SYSENTER) {
									add_gadget(instruction_list);
								} else if(inst1.operation() == edb::Instruction::Operation::X86_INS_SYSCALL) {
									add_gadget(instruction_list);
								} else if(is_ret(inst1)) {
									ui->progressBar->setValue(util::percentage(start_address - orig_start, region->size()));
									++start_address;
									continue;
								} else {

									p += inst1.size();
									rva += inst1.size();

									// eat up any NOPs in between...
									Q_FOREVER {
										edb::Instruction inst(p, l, rva);
										if(!is_nop(inst)) {
											break;
										}

										instruction_list << inst;
										p += inst.size();
										rva += inst.size();
									}

									edb::Instruction inst2(p, l, rva);
									if(is_ret(inst2)) {
										instruction_list << inst2;
										add_gadget(instruction_list);
									} else if(inst2 && inst2.operation() == edb::Instruction::Operation::X86_INS_POP) {
										instruction_list << inst2;
										p += inst2.size();
										rva += inst2.size();

										edb::Instruction inst3(p, l, rva);
										if(inst3 && inst3.operation() == edb::Instruction::Operation::X86_INS_JMP) {

											instruction_list << inst3;

											if(inst2.operand_count() == 1 && inst2.operands()[0].general_type() == edb::Operand::TYPE_REGISTER) {
												if(inst3.operand_count() == 1 && inst3.operands()[0].general_type() == edb::Operand::TYPE_REGISTER) {
													if(inst2.operands()[0].reg() == inst3.operands()[0].reg()) {
														add_gadget(instruction_list);
													}
												}
											}
										}
									}
								}

								// TODO(eteran): catch things like "add rsp, 8; jmp [rsp - 8]" and similar, it's rare,
								// but could happen
							}
						}

						ui->progressBar->setValue(util::percentage(start_address - orig_start, region->size()));
						++start_address;
					}
				}
			}
		}
	}