(ql: Qiling)
| 28 | |
| 29 | |
| 30 | def get_password(ql: Qiling): |
| 31 | # we land on a memcmp call, where the real password is being compared to |
| 32 | # the one provided by the user. we can follow the arguments to read the |
| 33 | # real password |
| 34 | |
| 35 | params = ql.os.resolve_fcall_params({ |
| 36 | 'ptr1': POINTER, # points to real password |
| 37 | 'ptr2': POINTER, # points to user provided password |
| 38 | 'size': SIZE_T # comparison length |
| 39 | }) |
| 40 | |
| 41 | ptr1 = params['ptr1'] |
| 42 | size = params['size'] |
| 43 | |
| 44 | password_raw = ql.mem.read(ptr1, size) |
| 45 | |
| 46 | def __hex_digit(ch: int) -> str: |
| 47 | off = ord('0') if ch in range(10) else ord('a') - 10 |
| 48 | |
| 49 | return chr(ch + off) |
| 50 | |
| 51 | # should be: "013f1f" |
| 52 | password = "".join(__hex_digit(ch) for ch in password_raw) |
| 53 | |
| 54 | print(f'The password is: {password}') |
| 55 | |
| 56 | |
| 57 | def partial_run_init(ql: Qiling): |
nothing calls this directly
no test coverage detected