uroboros-diversification/src/disasm/pic_process.py
def thunk_identify(ls):
    """
    Find x86 32bit thunk routines retriving program counter
    :param ls: assembler lines
    :return: list of virtual addresses
    """
    res = set()
    thunkre = re.compile('\(\%esp\)\,\%e(ax|bx|cx|bp|si|di)', re.I)

    for i in xrange(len(ls)):
        l = ls[i]
        if thunkre.search(l) and "mov" in l:
            t = ls[i+1]
            if "ret" in t.split()[-1]:
                res.add(l.split(":")[0].strip())
    if len(res) == 0: print "PIC position location can not be found!!"
    with open('pic_thunk.info', 'w') as f:
        for e in res: f.write(e + '\n')
    return tuple(res)

    Find x86 32bit thunk routines retriving program counter
    :param ls: assembler lines
    :return: list of virtual addresses
    
Find x86 32bit thunk routines retriving program counter
Find x86 32bit thunk routines retriving program counter
def thunk_identify(ls):
    res = set()
    thunkre = re.compile('\(\%esp\)\,\%e(ax|bx|cx|bp|si|di)', re.I)
    for i in xrange(len(ls)):
        l = ls[i]
        if thunkre.search(l) and "mov" in l:
            t = ls[i+1]
            if "ret" in t.split()[-1]:
                res.add(l.split(":")[0].strip())
    if len(res) == 0: print "PIC position location can not be found!!"
    with open('pic_thunk.info', 'w') as f:
        for e in res: f.write(e + '\n')
    return tuple(res)
def thunk_identify ( ls ) : res = set ( ) thunkre = re . compile ( '\(\%esp\)\,\%e(ax|bx|cx|bp|si|di)' , re . I ) for i in xrange ( len ( ls ) ) : l = ls [ i ] if thunkre . search ( l ) and "mov" in l : t = ls [ i + 1 ] if "ret" in t . split ( ) [ - 1 ] : res . add ( l . split ( ":" ) [ 0 ] . strip ( ) ) if len ( res ) == 0 : print "PIC position location can not be found!!" with open ( 'pic_thunk.info' , 'w' ) as f : for e in res : f . write ( e + '\n' ) return tuple ( res )
Find x86 32bit thunk routines retriving program counter
Find x86 32bit thunk routines retriving program counter
"""
    Find x86 32bit thunk routines retriving program counter
    :param ls: assembler lines
    :return: list of virtual addresses
    """
list of virtual addresses
list of virtual addresses
ls
None