CVE-2015-0311 분석 2일차

trace_path = '/Users/314ckC47/Desktop/cve-2015-0311/trace_and_logs/trace.txt' result_path = '/Users/314ckC47/Desktop/cve-2015-0311/trace_and_logs/return.txt' img_base = 0x10000000 base_addr = 0x63260000 hlcolor = 0xe0e0e0 def Highlight(): global data data = open(trace_path,'r').readlines() ListOfHighlighted = [] ret = '' a = 1 b = len(data) for i in data: print b,a now = i.split() trace_addr = 0 call_addr = 0 org_addr = 0 jmp_addr = 0 org_addr = int(now[2],16) trace_addr = org_addr-base_addr+img_base ListOfHighlighted.append([org_addr,trace_addr]) if 'CALL' in now : if 'PTR' in now: call_addr = 0 ret += str(a) + '\t' +" | " + hex(trace_addr) + " " + hex(org_addr) + " | " + "CALL " + now[4] + " " + now[5] + " " + now[6] + "\n" continue try: call_addr = int(now[4],16)-base_addr+img_base ret += str(a) + '\t' +" | " + hex(trace_addr) + " " + hex(org_addr) + " | " + "CALL " + hex(call_addr) + "\n" except: for j in now: if now[4] in j: if j == now[4]: continue ret += str(a) + '\t' + " | " + hex(trace_addr) + " " + hex(org_addr) + " | " + "CALL " + now[4] + " " + j[:-1] + "\n" elif 'J' in now[3]: if 'PTR' in now: jmp_addr = 0 ret += str(a) + '\t' +" | " + hex(trace_addr) + " " + hex(org_addr) + " | " + now[3] + " " + now[4] + " " + now[5] + " " + now[6] + "\n" continue try: jmp_addr = int(now[5],16)-base_addr+img_base ret += str(a) + '\t' +" | " + hex(trace_addr) + " " + hex(org_addr) + " | " + now[3] + " " + now[4] + " " + hex(jmp_addr) + "\n" except: jmp_addr = int(now[4],16)-base_addr+img_base ret += str(a) + '\t' +" | " + hex(trace_addr) + " " + hex(org_addr) + " | " + now[3] + " " + hex(jmp_addr) + "\n" else: ret += str(a) + '\t' +" | " + hex(trace_addr) + " " + hex(org_addr) + " | " + now[3] + "\n" set_item_color(trace_addr,hlcolor) if Comment(trace_addr): MakeComm(trace_addr,Comment(trace_addr)+" => "+str(a)+" ") else: MakeComm(trace_addr," => "+str(a)+" ") a += 1 open(result_path,'w').write(ret) return ListOfHighlighted def UnHighlight(ListOfHighlighted): for i in ListOfHighlighted: set_item_color(i[1],0xffffff) MakeComm(i[1],"")

오늘은 로그 보면서 하나하나 따라가기 힘들겠다 싶어서 IDA랑 연동 해서 코드 하이라이팅을 할 수 있게 코오딩을 했다. 보람차다 XD

알게 된 점

1. IDAPython 간략한 사용 법 및 코드 하이라이팅/코멘팅

2. 로그 분석 및 파싱

힘들었던 점 

1. IDAPython 관련 문서 찾기

2. 도깨비 공유 쥬금 ㅠㅠ