disasm thumb with capstone

Author: tesuji

pwnlib/asm.py

@@ -1014,7 +1014,7 @@ def disasm(data, vma = 0, byte = True, offset = True, instructions = True):
     return re.sub(',([^ ])', r', \1', '\n'.join(lines))
 
 @LocalContext
-def get_cs_disassembler():
+def get_cs_disassembler(eabi=None):
     import capstone as cs
     E = {
         'big':    cs.CS_MODE_BIG_ENDIAN,
@@ -1023,14 +1023,14 @@ def get_cs_disassembler():
 
     B = {16: cs.CS_MODE_16, 32: cs.CS_MODE_32, 64: cs.CS_MODE_64}[context.bits]
 
-    print("context:", context)
+    # print("context:", context)
     params = {
         'i386'   : (cs.CS_ARCH_X86, B),
         'amd64'  : (cs.CS_ARCH_X86, B),
         'thumb'  : (cs.CS_ARCH_ARM, cs.CS_MODE_THUMB + E),
         'arm'    : (cs.CS_ARCH_ARM, cs.CS_MODE_ARM + E),
-        'aarch64': (cs.CS_ARCH_ARM64, cs.CS_MODE_ARM + E),
-        'armhf'  : (cs.CS_ARCH_ARM, cs.CS_MODE_ARM + cs.CS_MODE_V8 + cs.CS_MODE_THUMB + E),
+        'aarch64': (cs.CS_ARCH_AARCH64, cs.CS_MODE_ARM + E),
+        'armhf'  : (cs.CS_ARCH_ARM, cs.CS_MODE_ARM + cs.CS_MODE_THUMB + E),
         'mips'   : (cs.CS_ARCH_MIPS, cs.CS_MODE_32 + E),
         'mips64' : (cs.CS_ARCH_MIPS, cs.CS_MODE_64 + E),
         'sparc':   (cs.CS_ARCH_SPARC, cs.CS_MODE_32 + E),
@@ -1053,10 +1053,13 @@ def get_cs_disassembler():
         #'sh': cs.CS_ARCH_SH,
     }
 
-    param = params.get(context.arch)
+    arch = context.arch
+    if arch == 'arm' and eabi == 'hf': arch = 'armhf'
+    # print("arch:", arch)
+    param = params.get(arch)
     if not param:
         raise Exception(f"unsupported {context.arch} for capstone")
-    print("param:", param)
     arch, mode = param
     md = cs.Cs(arch, mode)
+    md.detail = True
     return md

pwnlib/elf/elf.py

@@ -54,6 +54,7 @@
 import re
 import subprocess
 import tempfile
+import capstone as cs
 
 from io import BytesIO
 
@@ -1143,6 +1144,12 @@ def _populate_kernel_version(self):
 
         self.config['version'] = self.version
 
+    def cs_disasm(self, md: cs.Cs, address, n_bytes):
+        if self.arch == 'arm' and address & 1:
+            address -= 1
+
+        return md.disasm(self.read(address, n_bytes), address)
+
     @property
     def libc_start_main_return(self):
         """:class:`int`: Address of the return address into __libc_start_main from main.
@@ -1163,21 +1170,20 @@ def libc_start_main_return(self):
         if 'exit' not in self.symbols:
             return 0
 
-        import capstone as cs
-
+        eabi = None
         # If there's no delay slot, execution continues on the next instruction after a call.
         call_return_offset = 1
         if self.arch in ['arm', 'thumb']:
-            # if b'armhf' in self.linker:
-            #     self.arch = 'armhf'
-            #     self.bits = 16
+            if b'armhf' in self.linker:
+                eabi = 'hf'
+                # self.bits = 16
             call_instructions = set([cs.CS_GRP_CALL])
         elif self.arch == 'aarch64':
             call_instructions = set([cs.CS_GRP_CALL])
         elif self.arch in ['mips', 'mips64']:
             # FIXME: `bal` was not included in CS_GRP_CALL. This is fixed on capstone v6.alpha
-            call_instructions = set([cs.CS_GRP_CALL, cs.CS_GRP_BRANCH_RELATIVE])
-            # call_instructions = set([cs.CS_GRP_CALL])
+            #call_instructions = set([cs.CS_GRP_CALL, cs.CS_GRP_BRANCH_RELATIVE])
+            call_instructions = set([cs.CS_GRP_CALL])
             # Account for the delay slot.
             call_return_offset = 2
         elif self.arch in ['i386', 'amd64', 'ia64']:
@@ -1186,14 +1192,15 @@ def libc_start_main_return(self):
             call_instructions = set([cs.CS_GRP_CALL])
 
         from pwnlib.asm import get_cs_disassembler
-        md = get_cs_disassembler(arch=self.arch, endian=self.endian, bits=self.bits)
-        md.detail = True
+        md = get_cs_disassembler(arch=self.arch, endian=self.endian, bits=self.bits, eabi=eabi)
         func = self.functions['__libc_start_main']
-        code = self.read(func.address, func.size)
-        dis = list(md.disasm(code, func.address))
+        # print("func:", func)
+        dis = list(self.cs_disasm(md, func.address, func.size))
         # print("dis:", dis)
 
         exit_addr = self.symbols['exit']
+        if self.arch == 'arm' and exit_addr & 1: exit_addr -= 1
+        # print("exit:", hex(exit_addr))
 
         calls = [(i, x) for i, x in enumerate(dis) if call_instructions & set(x.groups)]
         # print("calls:", calls)
@@ -1224,7 +1231,7 @@ def find_ret_main_addr(caller_dis, calls):
             target_addr = op.imm
             # `__libc_start_call_main` is usually smaller than `__libc_start_main`, so
             # we might disassemble a bit too much, but it's a good dynamic estimate.
-            callee_dis = list(md.disasm(self.read(target_addr, func.size), target_addr))
+            callee_dis = list(self.cs_disasm(md, target_addr, func.size))
             callee_calls = [(i, x) for i, x in enumerate(callee_dis) if call_instructions & set(x.groups)]
             ret_addr = find_ret_main_addr(callee_dis, callee_calls)
             if ret_addr: