dbwodlf3

하잉. 하잉 음.

dbwodlf3

#https://github.com/lifting-bits/mcsema/blob/940ccd5357c5a6758203b70e5332b69d662412ff/tools/mcsema_disass/ida7/get_cfg.py#L1507

if __name__ == "__main__":

  parser = argparse.ArgumentParser()

  parser.add_argument(
      "--log_file",
      type=argparse.FileType('w'),
      default=sys.stderr,

dbwodlf3

#include <stdio.h>
#include <sys/mman.h>
#include <unistd.h>
#include <stdint.h>
#include <string.h>

int getMemoryPermission(void*);
void smcInit(void*);

int main(){

dbwodlf3

section .text
global _start
_start:
	mov ah, 0xb8
	mov [_modified], ah
	mov ah, 0x01
	mov [_modified+1], ah
	mov ah, 0x00
	mov [_modified+2], ah
	mov ah, 0x00

dbwodlf3

anvill-decompile-json-9.0 --spec big_mul.json --ir_out big_mul.ll

target datalayout = "e-m:e-p:32:32-f64:32:64-f80:32-n8:16:32-S128"
target triple = "i386-pc-linux-gnu-elf"

%struct.Memory = type opaque
%struct.State = type { %struct.ArchState, [32 x %union.VectorReg], %struct.ArithFlags, %union.anon, %struct.Segments, %struct.AddressSpace, %struct.GPR, %struct.X87Stack, %struct.MMX, %struct.FPUStatusFlags, %union.anon, %union.FPU, %struct.SegmentCaches }

dbwodlf3

section .data
hello_string db "Hello World!", 0x0d, 0x0a
hello_string_len equ $ - hello_string

section .text
global _start

_start:
	mov eax, 4 ; eax <- 4, syscall number (print) But, never execute.

dbwodlf3

specification

• arch
• os
• functions
  • name
  • address
  • parameters
  • return_address
• return_values

dbwodlf3

#step 1, c source file

//helloWorld.c
#include<stdio.h>

int main(){
	printf("Hello World!\n");
	return 0;
}

dbwodlf3

Todo

LLVM

• LLVM IR 문법 정리 보고서 작성하기
• LLVM Tutorial 저장소의 Example 채우기
  • 이 예제 만들기
• Windows 환경에서 수행

Lifting

dbwodlf3

/* https://leahayes.wordpress.com/2011/08/28/documenting-javascript-with-jsdoc3/

Namespaces can still be documented when a more abstract mechanism is used. @lends allows members to be added to an existing namespace:
*/
/**
 * Root namespace
 * @namespace root
 */
$namespace('root', /** @lends root **/ {
   /**