|
1 |
| -import struct |
| 1 | +# |
| 2 | +# Example: Run in bochscpu Fibonacci sequence in long mode |
| 3 | +# Requires: keystone-engine, capstone |
| 4 | +# |
| 5 | + |
2 | 6 | import time
|
3 | 7 |
|
4 | 8 | import capstone
|
@@ -31,27 +35,6 @@ def dbg(x: str):
|
31 | 35 | print(f"[Py] {x}")
|
32 | 36 |
|
33 | 37 |
|
34 |
| -def dump_page_table(addr: int, level: int = 0): |
35 |
| - level_str = ("PML", "PDPT", "PD", "PT") |
36 |
| - if level == 4: |
37 |
| - data = bytes(bochscpu.memory.phy_read(addr, 8)) |
38 |
| - entry = struct.unpack("<Q", data[:8])[0] & ~0xFFF |
39 |
| - print(f"{' '*level} {entry:#x}") |
40 |
| - return |
41 |
| - |
42 |
| - print(f"Dumping {level_str[level]} @ {addr:#x}") |
43 |
| - |
44 |
| - for i in range(0, PAGE_SIZE, 8): |
45 |
| - data = bytes(bochscpu.memory.phy_read(addr + i, 8)) |
46 |
| - entry = struct.unpack("<Q", data[:8])[0] |
47 |
| - flags = entry & 0xFFF |
48 |
| - entry = entry & ~0xFFF |
49 |
| - if entry == 0: |
50 |
| - continue |
51 |
| - print(f"{' '*level} #{i//8} - {hex(entry)}|{flags=:#x}") |
52 |
| - dump_page_table(entry, level + 1) |
53 |
| - |
54 |
| - |
55 | 38 | def missing_page_cb(gpa):
|
56 | 39 | raise Exception(f"missing_page_cb({gpa=:#x})")
|
57 | 40 |
|
@@ -136,10 +119,10 @@ def emulate(code: bytes):
|
136 | 119 | evaled_gpa = bochscpu.memory.virt_translate(pml4, stack_gva)
|
137 | 120 | assert evaled_gpa == stack_gpa, f"{evaled_gpa=:#x} != {stack_gpa=:#x}"
|
138 | 121 |
|
139 |
| - # dump_page_table(pml4) |
| 122 | + bochscpu.utils.dump_page_table(pml4) |
140 | 123 |
|
141 | 124 | dbg(f"copy code to {shellcode_gva=:#x}")
|
142 |
| - assert bochscpu.memory.virt_write(pml4, shellcode_gva, bytes(code)) |
| 125 | + assert bochscpu.memory.virt_write(pml4, shellcode_gva, bytearray(code)) |
143 | 126 | dbg(f"copied to {shellcode_gva=:#x}, testing...")
|
144 | 127 | data = bochscpu.memory.virt_read(pml4, shellcode_gva, len(code))
|
145 | 128 | assert data
|
|
0 commit comments