mirror of
https://github.com/cea-sec/miasm
synced 2026-08-17 10:26:03 -04:00
53 lines
1.5 KiB
Python
53 lines
1.5 KiB
Python
from __future__ import print_function
|
|
import os
|
|
import logging
|
|
from miasm.analysis.sandbox import Sandbox_Win_x86_32
|
|
from miasm.jitter.loader.pe import vm2pe, ImpRecStrategy
|
|
from miasm.core.locationdb import LocationDB
|
|
from miasm.jitter.jitload import JitterException
|
|
|
|
parser = Sandbox_Win_x86_32.parser(description="Generic & dummy unpacker")
|
|
parser.add_argument("filename", help="PE Filename")
|
|
parser.add_argument("--oep", help="Stop and dump if this address is reached")
|
|
parser.add_argument('-v', "--verbose",
|
|
help="verbose mode", action="store_true")
|
|
options = parser.parse_args()
|
|
|
|
loc_db = LocationDB()
|
|
sb = Sandbox_Win_x86_32(
|
|
loc_db, options.filename, options, globals(),
|
|
parse_reloc=False
|
|
)
|
|
|
|
if options.verbose is True:
|
|
logging.basicConfig(level=logging.INFO)
|
|
else:
|
|
logging.basicConfig(level=logging.WARNING)
|
|
|
|
if options.verbose is True:
|
|
print(sb.jitter.vm)
|
|
|
|
def stop(jitter):
|
|
logging.info('User provided OEP reached')
|
|
# Stop execution
|
|
return False
|
|
|
|
if options.oep:
|
|
# Set callbacks
|
|
sb.jitter.add_breakpoint(int(options.oep, 0), stop)
|
|
|
|
# Run until an error is encountered - IT IS UNLIKELY THE ORIGINAL ENTRY POINT
|
|
try:
|
|
sb.run()
|
|
except (JitterException, ValueError) as e:
|
|
logging.exception(e)
|
|
|
|
out_fname = "%s.dump" % (options.filename)
|
|
|
|
# Try a generic approach to rebuild the Import Table
|
|
imprec = ImpRecStrategy(sb.jitter, sb.libs, 32)
|
|
imprec.recover_import()
|
|
|
|
# Rebuild the PE and dump it
|
|
print("Dump to %s" % out_fname)
|
|
vm2pe(sb.jitter, out_fname, libs=sb.libs, e_orig=sb.pe)
|