qiling/tests/test_shellcode.py at 47f13767e375a4b6033c0365dc8aba4b4073c7e2 · qilingframework/qiling · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
#!/usr/bin/env python3
#
# Cross Platform and Multi Architecture Advanced Binary Emulation Framework
#

import unittest

import sys
sys.path.append("..")

from qiling import Qiling
from qiling.const import QL_ARCH, QL_OS, QL_ENDIAN, QL_INTERCEPT, QL_VERBOSE


# test = bytes.fromhex('cccc')

X86_LIN = bytes.fromhex('31c050682f2f7368682f62696e89e3505389e1b00bcd80')
X8664_LIN = bytes.fromhex('31c048bbd19d9691d08c97ff48f7db53545f995257545eb03b0f05')

MIPS32EL_LIN = bytes.fromhex('''
    ffff0628ffffd004ffff05280110e4270ff08424ab0f02240c0101012f62696e
    2f7368
''')

# big-endian counterpart of MIPS32EL_LIN: the instruction words are byte-swapped
# while the trailing '/bin/sh' string is left as-is
MIPS32EB_LIN = bytes.fromhex('''
    2806ffff04d0ffff2805ffff27e410012484f00f24020fab0101010c2f62696e
    2f7368
''')

X86_WIN = bytes.fromhex('''
    fce8820000006089e531c0648b50308b520c8b52148b72280fb74a2631ffac3c
    617c022c20c1cf0d01c7e2f252578b52108b4a3c8b4c1178e34801d1518b5920
    01d38b4918e33a498b348b01d631ffacc1cf0d01c738e075f6037df83b7d2475
    e4588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ff
    e05f5f5a8b12eb8d5d6a01eb2668318b6f87ffd5bbf0b5a25668a695bd9dffd5
    3c067c0a80fbe07505bb4713726f6a0053ffd5e8d5ffffff63616c6300
''')

X8664_WIN = bytes.fromhex('''
    fc4881e4f0ffffffe8d0000000415141505251564831d265488b52603e488b52
    183e488b52203e488b72503e480fb74a4a4d31c94831c0ac3c617c022c2041c1
    c90d4101c1e2ed5241513e488b52203e8b423c4801d03e8b80880000004885c0
    746f4801d0503e8b48183e448b40204901d0e35c48ffc93e418b34884801d64d
    31c94831c0ac41c1c90d4101c138e075f13e4c034c24084539d175d6583e448b
    40244901d0663e418b0c483e448b401c4901d03e418b04884801d0415841585e
    595a41584159415a4883ec204152ffe05841595a3e488b12e949ffffff5d49c7
    c1000000003e488d95fe0000003e4c8d850f0100004831c941ba45835607ffd5
    4831c941baf0b5a256ffd548656c6c6f2c2066726f6d204d534621004d657373
    616765426f7800
''')

ARM_LIN = bytes.fromhex('''
    01308fe213ff2fe178460e300190491a921a0827c251033701df2f62696e2f2f
    7368
''')

ARM_THUMB = bytes.fromhex('401c01464fea011200bf')

ARM64_LIN = bytes.fromhex('''
    420002ca210080d2400080d2c81880d2010000d4e60300aa01020010020280d2
    681980d2010000d4410080d2420002cae00306aa080380d2010000d4210400f1
    65ffff54e0000010420002ca210001caa81b80d2010000d4020004d27f000001
    2f62696e2f736800
''')

X8664_FBSD = bytes.fromhex('''
    6a61586a025f6a015e990f054897baff02aaaa80f2ff524889e699046680c210
    0f05046a0f05041e4831f6990f0548976a035852488d7424f080c2100f0548b8
    523243427730637257488d3e48af74084831c048ffc00f055f4889d04889fe48
    ffceb05a0f0575f799043b48bb2f62696e2f2f73685253545f5257545e0f05
''')

X8664_MACOS = bytes.fromhex('''
    4831f65648bf2f2f62696e2f7368574889e74831d24831c0b00248c1c828b03b
    0f05
''')


# some shellcodes call execve, which under normal circumstences, does not return.
# however, those shellcodes attempt to run a non-exsting '/bin/sh' binary and do
# not bother to handle failures gracefully.
#
# the execution then continues to the next bytes, which are usually the '/bin/sh'
# string and not valid code. that causes Qiling to raise an exception, and this is
# why we need a way to thwart those execve failures and end the emulation gracefully
def graceful_execve(ql: Qiling, pathname: int, argv: int, envp: int, retval: int):
    assert retval != 0, f'execve is not expected to return on success'

    vpath = ql.os.utils.read_cstring(pathname)

    ql.log.debug(f'failed to call execve("{vpath}"), ending emulation gracefully')
    ql.stop()


class TestShellcode(unittest.TestCase):
    def test_linux_x86(self):
        print("Linux X86 32bit Shellcode")
        ql = Qiling(code=X86_LIN, archtype=QL_ARCH.X86, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
        ql.run()

    def test_linux_x64(self):
        print("Linux X86 64bit Shellcode")
        ql = Qiling(code=X8664_LIN, archtype=QL_ARCH.X8664, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
        ql.run()

    def test_linux_mips32(self):
        print("Linux MIPS 32bit EL Shellcode")
        ql = Qiling(code=MIPS32EL_LIN, archtype=QL_ARCH.MIPS, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)

        ql.os.set_syscall('execve', graceful_execve, QL_INTERCEPT.EXIT)
        ql.run()

    def test_linux_mips32eb(self):
        print("Linux MIPS 32bit EB Shellcode")
        ql = Qiling(code=MIPS32EB_LIN, archtype=QL_ARCH.MIPS, ostype=QL_OS.LINUX, endian=QL_ENDIAN.EB, verbose=QL_VERBOSE.OFF)

        ql.os.set_syscall('execve', graceful_execve, QL_INTERCEPT.EXIT)
        ql.run()

    # This shellcode needs to be changed to something non-blocking
    def test_linux_arm(self):
        print("Linux ARM 32bit Shellcode")
        ql = Qiling(code=ARM_LIN, archtype=QL_ARCH.ARM, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)
        ql.run()

    def test_linux_arm_thumb(self):
        print("Linux ARM Thumb Shllcode")
        ql = Qiling(code=ARM_THUMB, archtype=QL_ARCH.ARM, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF, thumb=True)
        ql.run()

    def test_linux_arm64(self):
        print("Linux ARM 64bit Shellcode")
        ql = Qiling(code=ARM64_LIN, archtype=QL_ARCH.ARM64, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.OFF)

        ql.os.set_syscall('execve', graceful_execve, QL_INTERCEPT.EXIT)
        ql.run()

    # #This shellcode needs to be changed to something simpler not requiring rootfs
    # def test_windows_x86(self):
    #     print("Windows X86 32bit Shellcode")
    #     ql = Qiling(code=X86_WIN, archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS, rootfs="../examples/rootfs/x86_reactos", verbose=QL_VERBOSE.OFF)
    #     ql.run()

    # #This shellcode needs to be changed to something simpler not requiring rootfs
    # def test_windows_x64(self):
    #    print("\nWindows X8664 64bit Shellcode")
    #    ql = Qiling(code=X8664_WIN, archtype=QL_ARCH.X8664, ostype=QL_OS.WINDOWS, rootfs="../examples/rootfs/x86_reactos", verbose=QL_VERBOSE.OFF)
    #    ql.run()

    # #This shellcode needs to be changed to something simpler, listen is blocking
    # def test_freebsd_x64(self):
    #    print("FreeBSD X86 64bit Shellcode")
    #    ql = Qiling(code=X8664_FBSD, archtype=QL_ARCH.X8664, ostype=QL_OS.FREEBSD, verbose=QL_VERBOSE.OFF)
    #    ql.run()

    # def test_macos_x64(self):
    #     print("macos X86 64bit Shellcode")
    #     ql = Qiling(code=X8664_macos, archtype=QL_ARCH.X8664, ostype=QL_OS.MACOS, verbose=QL_VERBOSE.OFF)
    #     ql.run()

    # def test_invalid_output(self):
    #     print("Testing Invalid output")
    #     self.assertRaises(QlErrorOutput, Qiling, code=test, archtype=QL_ARCH.ARM, ostype=QL_OS.LINUX, verbose=QL_VERBOSE.DEFAULT)


if __name__ == "__main__":
    unittest.main()