| 9 | |
| 10 | |
| 11 | def parse_asm_text_file(injectable: Injectable, asm_text: str, settings: Settings) -> List[str]: |
| 12 | lines_out = [] |
| 13 | lines = asm_text.split("\n") |
| 14 | |
| 15 | current_segment = None |
| 16 | current_datareuse_entry= None |
| 17 | line_idx = -1 |
| 18 | for line in lines: |
| 19 | line = line.rstrip() |
| 20 | line_idx += 1 |
| 21 | tokens = line.split() |
| 22 | |
| 23 | # skip irrelevant |
| 24 | #if not tokens: |
| 25 | # lines_out.append(line) |
| 26 | # continue |
| 27 | if len(tokens) <= 1: |
| 28 | lines_out.append(line) |
| 29 | continue |
| 30 | |
| 31 | # TRACK in which segment we currently are |
| 32 | if tokens[1] == "SEGMENT": |
| 33 | current_segment = tokens[0] |
| 34 | lines_out.append(line) |
| 35 | continue |
| 36 | |
| 37 | if tokens[0] == "COMM": |
| 38 | # HACK atm. Will be handled by masm_shc |
| 39 | # gives false positives for supermega_payload |
| 40 | continue |
| 41 | |
| 42 | # PATCH SHORT |
| 43 | if "jmp\tSHORT" in line: |
| 44 | updated_line = line.replace("SHORT", "") |
| 45 | lines_out.append(updated_line) |
| 46 | continue |
| 47 | |
| 48 | # REMOVE EXTRN, we dont need it |
| 49 | ## EXTRN __imp_GetEnvironmentVariableW:PROC |
| 50 | ## to |
| 51 | ## ; EXTRN __imp_GetEnvironmentVariableW:PROC |
| 52 | if tokens[0] == "EXTRN": |
| 53 | updated_line = "; " + line + "; Removed" |
| 54 | lines_out.append(updated_line) |
| 55 | continue |
| 56 | |
| 57 | # PATCH external shellcode reference |
| 58 | ## mov rdi, QWORD PTR supermega_payload |
| 59 | ## to |
| 60 | ## lea rdi, XXX |
| 61 | if "supermega_payload" in line: |
| 62 | string_ref = "supermega_payload" |
| 63 | |
| 64 | # should already exist (added before) |
| 65 | datareuse_fixup = injectable.get_reusedata_fixup(string_ref) |
| 66 | if datareuse_fixup == None: |
| 67 | raise Exception("Data reuse entry not found: {}".format(string_ref)) |
| 68 | |