mirror of
https://github.com/cea-sec/miasm
synced 2026-08-17 10:26:03 -04:00
56 lines
2 KiB
Python
56 lines
2 KiB
Python
from __future__ import print_function
|
|
import logging
|
|
from miasm.analysis.sandbox import Sandbox_Win_x86_32
|
|
from miasm.core.locationdb import LocationDB
|
|
from miasm.jitter.csts import PAGE_WRITE, PAGE_READ, EXCEPT_BREAKPOINT_MEMORY
|
|
|
|
|
|
parser = Sandbox_Win_x86_32.parser(description="Displays accesses to a specified memory space")
|
|
parser.add_argument("filename", help="PE Filename")
|
|
parser.add_argument("memory_address",
|
|
help="Starting address of the memory space")
|
|
parser.add_argument("size",
|
|
help="Size of the address space")
|
|
parser.add_argument("--access",
|
|
help="Access type",
|
|
choices=["r", "w", "rw"],
|
|
default="rw")
|
|
options = parser.parse_args()
|
|
|
|
# Create sandbox
|
|
loc_db = LocationDB()
|
|
sb = Sandbox_Win_x86_32(loc_db, options.filename, options, globals())
|
|
|
|
# Add a memory breakpoint
|
|
address = int(options.memory_address, 0)
|
|
size = int(options.size, 0)
|
|
access_type = 0
|
|
if 'r' in options.access:
|
|
access_type |= PAGE_WRITE
|
|
if 'w' in options.access:
|
|
access_type |= PAGE_READ
|
|
sb.jitter.vm.add_memory_breakpoint(address, size, access_type)
|
|
# And add a custom handler for memory breakpoints
|
|
def memory_breakpoint_handler(jitter):
|
|
memory_read = jitter.vm.get_memory_read()
|
|
if len(memory_read) > 0:
|
|
print("Read at instruction 0x%x:" % jitter.pc)
|
|
for start_address, end_address in memory_read:
|
|
print("- from 0x%x to 0x%x" % (start_address, end_address))
|
|
|
|
memory_write = jitter.vm.get_memory_write()
|
|
if len(memory_write) > 0:
|
|
print("Write at instruction 0x%x:" % jitter.pc)
|
|
for start_address, end_address in memory_write:
|
|
print("- from 0x%x to 0x%x" % (start_address, end_address))
|
|
|
|
# Cleanup
|
|
jitter.vm.set_exception(jitter.vm.get_exception() ^ EXCEPT_BREAKPOINT_MEMORY)
|
|
jitter.vm.reset_memory_access()
|
|
|
|
# Stop the jitter
|
|
return False
|
|
sb.jitter.add_exception_handler(EXCEPT_BREAKPOINT_MEMORY, memory_breakpoint_handler)
|
|
|
|
# Run
|
|
sb.run()
|