moneyshot/lolsled.py at master · blasty/moneyshot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
#!/usr/bin/python

import sys
import rop
import colors

# Yo DAWG, This is the most retarded
# and limitted x86 subset emulation
# out in the wild! Only here to cater
# some LOLsled generation, heheheh.

func = {
	'@' : lambda x: inc(x, 'eax'),
	'A' : lambda x: inc(x, 'ecx'),
	'B' : lambda x: inc(x, 'edx'),
	'C' : lambda x: inc(x, 'ebx'),
	'D' : lambda x: inc(x, 'esp'),
	'E' : lambda x: inc(x, 'ebp'),
	'F' : lambda x: inc(x, 'esi'),
	'G' : lambda x: inc(x, 'edi'),
	'H' : lambda x: dec(x, 'eax'),
	'I' : lambda x: dec(x, 'ecx'),
	'J' : lambda x: dec(x, 'edx'),
	'K' : lambda x: dec(x, 'ebx'),
	'L' : lambda x: dec(x, 'esp'),
	'M' : lambda x: dec(x, 'ebp'),
	'N' : lambda x: dec(x, 'esi'),
	'O' : lambda x: dec(x, 'edi'),
	'P' : lambda x: dec(x, 'esp', 4),
	'Q' : lambda x: dec(x, 'esp', 4),
	'R' : lambda x: dec(x, 'esp', 4),
	'S' : lambda x: dec(x, 'esp', 4),
	'T' : lambda x: dec(x, 'esp', 4),
	'U' : lambda x: dec(x, 'esp', 4),
	'V' : lambda x: dec(x, 'esp', 4),
	'W' : lambda x: dec(x, 'esp', 4),
	'X' : lambda x: inc(x, 'esp', 4),
	'Y' : lambda x: inc(x, 'esp', 4),
	'Z' : lambda x: inc(x, 'esp', 4),
	'[' : lambda x: inc(x, 'esp', 4),
	'\\' : lambda x: inc(x, 'esp', 4),
	']' : lambda x: inc(x, 'esp', 4),
	'^' : lambda x: inc(x, 'esp', 4),
	'_' : lambda x: inc(x, 'esp', 4),
}

def inc(ctx, reg, n=1):
	ctx[reg] = ctx[reg]+n
	return ctx

def dec(ctx, reg, n=1):
	ctx[reg] = ctx[reg]-n
	return ctx;

def emu(input_code):
	regs = {
		'eax' : 0,
		'ebx' : 0,
		'ecx' : 0,
		'edx' : 0,
		'esi' : 0,
		'edi' : 0,
		'ebp' : 0,
		'esp' : 0
	}

	for c in input_code:
		if c not in func:
			print "*** ILLEGAL OPCODE '%c' *** :(" % (c)
			return

		regs = func[c](regs)

	#print regs

	return regs


def main(args):
	if len(args) != 1 and len(args) != 2:
		print "usage:"
		print "  moneyshot lolsled <length> <words>"
		print "  moneyshot lolsled <dictionary>"

		return

	# some 'harmless' x86 insns, just inc's and dec's
	whitelist=[
		"A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O"
	]

	# length?
	if args[0].isdigit():
		rs = emu(args[1])
		fstr = " CLOBBER: "
		cl = False
		for reg in rs:
			if rs[reg] != 0:
				fstr += "%s=%08x " % (reg, rs[reg])
				cl = True

		if cl == False:
			fstr += "No clobbering, yay!"

		print fstr

	# assume dictfile (find mode)
	else:
		words = open(args[0]).readlines()
		for word in words:
			ok = True
			word = word.strip().upper()

			for c in word:
				if c not in whitelist:
					ok = False

			if not ok:
				continue

			fstr = colors.fg('cyan')
			fstr += ">> "
			fstr += colors.fg('green')
			fstr += "'%15s' %s--> " % (word, colors.fg('white')+colors.bold())
			fstr += colors.end() + colors.fg('red')
			r = rop.disas_str(0, word)
			fstr += ' ; '.join(r).lower()
			rs = emu(word)
			fstr += " CLOBBER: "
			cl = False
			for reg in rs:
				if rs[reg] != 0:
					fstr += "%s=%08x " % (reg, rs[reg])
					cl = True

			print fstr

	print colors.end()