uroboros-diversification/src/disasm/pic_process.py
def text_process_strip(f):
    """
    Find thunk PC invocations and substitute .got.plt offsets with _GLOBAL_OFFSET_TABLE_ symbol
    :param f: path to target executable
    """
    sec_symb = {'.got.plt': '$_GLOBAL_OFFSET_TABLE_'}
    pic_map = info_collect(f)
    with open(f + '.temp') as fd:
        ls = fd.readlines()
    pc_thunk_addr = thunk_identify(ls)

    for i in xrange(1,len(ls)):
        l = ls[i]
        if "call" in l and next((addr for addr in pc_thunk_addr if addr in l), None):
            t = ls[i+1]
            items = t.split('\t')
            addr_s = items[0].strip().rstrip(':')
            items = items[2].split()
            if len(items) != 2 or items[0] != "add": continue
            # typically, it should look like this
            # 804c466: add    $0x2b8e,%ebx
            off_s = items[-1].split(',')[0][1:]
            try: off = int(off_s, 16)
            except: continue
            addr = int(addr_s, 16)
            baddr = addr + off
            for key, value in pic_map.iteritems():
                if value[0] == baddr:
                    ls[i+1] = t.replace('$'+off_s, sec_symb[key])
                elif value[0] < baddr < value[0] + value[1]:
                    print "Unhandled PIC situation at 0x" + addr_s

    with open(f + '.temp', 'w') as fd:
        fd.writelines(ls)

    Find thunk PC invocations and substitute .got.plt offsets with _GLOBAL_OFFSET_TABLE_ symbol
    :param f: path to target executable
    
Find thunk PC invocations and substitute .got.plt offsets with _GLOBAL_OFFSET_TABLE_ symbol
Find thunk PC invocations and substitute . got . plt offsets with _GLOBAL_OFFSET_TABLE_ symbol
def text_process_strip(f):
    sec_symb = {'.got.plt': '$_GLOBAL_OFFSET_TABLE_'}
    pic_map = info_collect(f)
    with open(f + '.temp') as fd:
        ls = fd.readlines()
    pc_thunk_addr = thunk_identify(ls)
    for i in xrange(1,len(ls)):
        l = ls[i]
        if "call" in l and next((addr for addr in pc_thunk_addr if addr in l), None):
            t = ls[i+1]
            items = t.split('\t')
            addr_s = items[0].strip().rstrip(':')
            items = items[2].split()
            if len(items) != 2 or items[0] != "add": continue
            off_s = items[-1].split(',')[0][1:]
            try: off = int(off_s, 16)
            except: continue
            addr = int(addr_s, 16)
            baddr = addr + off
            for key, value in pic_map.iteritems():
                if value[0] == baddr:
                    ls[i+1] = t.replace('$'+off_s, sec_symb[key])
                elif value[0] < baddr < value[0] + value[1]:
                    print "Unhandled PIC situation at 0x" + addr_s
    with open(f + '.temp', 'w') as fd:
        fd.writelines(ls)
def text_process_strip ( f ) : sec_symb = { '.got.plt' : '$_GLOBAL_OFFSET_TABLE_' } pic_map = info_collect ( f ) with open ( f + '.temp' ) as fd : ls = fd . readlines ( ) pc_thunk_addr = thunk_identify ( ls ) for i in xrange ( 1 , len ( ls ) ) : l = ls [ i ] if "call" in l and next ( ( addr for addr in pc_thunk_addr if addr in l ) , None ) : t = ls [ i + 1 ] items = t . split ( '\t' ) addr_s = items [ 0 ] . strip ( ) . rstrip ( ':' ) items = items [ 2 ] . split ( ) if len ( items ) != 2 or items [ 0 ] != "add" : continue off_s = items [ - 1 ] . split ( ',' ) [ 0 ] [ 1 : ] try : off = int ( off_s , 16 ) except : continue addr = int ( addr_s , 16 ) baddr = addr + off for key , value in pic_map . iteritems ( ) : if value [ 0 ] == baddr : ls [ i + 1 ] = t . replace ( '$' + off_s , sec_symb [ key ] ) elif value [ 0 ] < baddr < value [ 0 ] + value [ 1 ] : print "Unhandled PIC situation at 0x" + addr_s with open ( f + '.temp' , 'w' ) as fd : fd . writelines ( ls )
Find thunk PC invocations and substitute .got.plt offsets with _GLOBAL_OFFSET_TABLE_ symbol
Find thunk PC invocations and substitute . got . plt offsets with _GLOBAL_OFFSET_TABLE_ symbol
"""
    Find thunk PC invocations and substitute .got.plt offsets with _GLOBAL_OFFSET_TABLE_ symbol
    :param f: path to target executable
    """ # typically, it should look like this # 804c466: add    $0x2b8e,%ebx
f
path to target executable
path to target executable