使用 unicorn 和 capstone 库来模拟 ARM Thumb 指令的执行，并实现多个钩子（hook）来监控代码执行、系统调用和内存读写操作（二）

原创

已于 2024-11-13 17:28:15 修改 · 1k 阅读

7 ·

CC 4.0 BY-SA版权

文章标签：

#arm开发 #python #java

于 2024-11-13 17:24:29 首次发布

import unicorn
import capstone
import binascii

def printArm32Regs(mu):
    for i in range(66,78):
        print("R%d,value:%x"%(i-66,mu.reg_read(i)))

#typedef void (*uc_cb_hookcode_t)(uc_engine *uc, uint64_t address, uint32_t size, void *user_data);
def hook_code(mu,address,size,user_data):
    code=mu.mem_read(address,size)
    CP=capstone.Cs(capstone.CS_ARCH_ARM,capstone.CS_MODE_THUMB)
    for i in CP.disasm(code,0,len(code)):
        print("[addr:%x]:%s %s\n"%(address,i.mnemonic,i.op_str))
    print("-----------------------------")
    printArm32Regs(mu)
    print("-----------------------------")
    return

#typedef void (*uc_cb_hookintr_t)(uc_engine *uc, uint32_t intno, void *user_data);
def hook_syscall(mu,intno,user_data):
    print("syscall num:0x%d is called!!"%intno)
    if intno==2:
        print("exit syscall is called!!")
    print("-----------------------------")
    printArm32Regs(mu)
    print("-----------------------------")
    return

#void (*uc_cb_hookmem_t)(uc_engine *uc, uc_mem_type type,uint64_t address, int size, int64_t value, void *user_data);
def hook_mem_write_unmapped(mu,type,address,size,value,user_data):
    if type==unicorn.UC_MEM_WRITE_UNMAPPED:
       print("UC_HOOK_MEM_WRITE_UNMAPPED addr:0x%x,size:%d,value:0x%x"%(address,size,value))
       mu.mem_map(0x0,0x1000)
    print("hook_mem type:%d addr:0x%x,size:%d,value:0x%x" % (type, address, size, value))
    return True


def hook_mem(mu,type,address,size,value,user_data):
    if type==unicorn.UC_MEM_WRITE:
       print("write addr:0x%x,size:%d,value:0x%x"%(address,size,value))
    if type==unicorn.UC_MEM_READ:
       print("read addr:0x%x,size:%d,value:0x%x"%(address,size,value))