Skip to content

Instantly share code, notes, and snippets.

@mgeeky
Created March 22, 2016 18:05
Show Gist options
  • Save mgeeky/6284555fac3f8a02b985 to your computer and use it in GitHub Desktop.
Save mgeeky/6284555fac3f8a02b985 to your computer and use it in GitHub Desktop.
My old patch of Immunity Debugger's shellcodediff.py script that added support for external binary shellcode files.
#!/usr/bin/env python
"""
(c) Immunity, Inc. 2004-2008
U{Immunity Inc.<http://www.immunityinc.com>}
Shellcode diff
- Corrected by <MGeeky> to support BINARY
external shellcode files
"""
DESC="""Check for badchars"""
from immlib import *
from os.path import dirname
import sys
NAME = "shellcodediff"
USAGE = "address [-b] [shellcode] // -b stands for binary mode"
def main(args):
imm = Debugger()
if len(args) < 1:
imm.log("Usage: !" + NAME + " " + USAGE)
return "See log window for usage info"
address = 0
length = 0
bad_byte_offset = 0
mangled = False
address = int(args[0],16)
shellcode = "shellcode.txt"
bin = 0
if len(args) > 1:
if len(args) == 2:
if args[1] != '-b':
shellcode = args[1]
else:
bin = 1
elif len(args) == 3:
if args[1] == '-b':
shellcode = args[2]
bin = 1
elif args[2] == '-b':
shellcode = args[1]
bin = 1
else:
return "See log window for usage info"
else: return "See log window for usage info"
m = "TEXT"
if bin == 1: m = "BIN"
curdir = dirname(imm.getModule(imm.getDebuggedName()).getPath())
try:
fd = open(shellcode,"r"+'b'*bin)
except:
fd = open(curdir+'\\'+shellcode, "r"+'b'*bin)
shellcode = curdir+'\\'+shellcode
imm.log("[+] Reading '%s' in %s mode shellcode." % (shellcode,m))
if not fd:
imm.log("[!] INVALID SHELLCODE file path!")
return "ERROR"
canvas_shellcode = ""
# Just pretty this up
if bin == 0:
canvas_byte_list = fd.readlines()
for i in canvas_byte_list:
canvas_shellcode += i.rstrip("\x0a")
else:
data = fd.read()
for a in data:
canvas_shellcode += "%02x" % ord(a)
fd.close()
length = len(canvas_shellcode) / 2
id_shellcode = imm.readMemory( address, length )
id_shellcode = id_shellcode.encode("HEX")
imm.log("Address: 0x%08x" % address)
imm.log("SC Len : %d" % length)
imm.log("CANVAS Shellcode: %s..." % canvas_shellcode[:128])
imm.log("ID Shellcode: %s..." % id_shellcode[:128])
count = 0
# We use the CANVAS shellcode length here again cause
# presumably its not mangled
while count < (length*2):
if id_shellcode[count] != canvas_shellcode[count]:
imm.log("Missed at byte: %d" % (count/2))
bad_byte_offset = count
mangled = True
break
count += 1
if mangled:
imm.log(" ")
imm.log("Bad byte is centered in output with three leading and three trailing bytes.")
imm.log(" ")
imm.log("Bad byte at offset: %d" % (bad_byte_offset/2))
imm.log("Bad byte at address:%08X" % (address + bad_byte_offset/2))
imm.log("Bad byte value from attacker: %s" % canvas_shellcode[bad_byte_offset:bad_byte_offset+2])
imm.log("====================")
imm.log("CANVAS: %s %s %s" % (canvas_shellcode[bad_byte_offset-6:bad_byte_offset],canvas_shellcode[bad_byte_offset:bad_byte_offset+2],canvas_shellcode[bad_byte_offset+2:bad_byte_offset+6]))
imm.log("ID : %s %s %s" % (id_shellcode[bad_byte_offset-6:bad_byte_offset], id_shellcode[bad_byte_offset:bad_byte_offset+2],id_shellcode[bad_byte_offset+2:bad_byte_offset+6]))
imm.log("====================")
else:
imm.log("Both shellcodes seems to be same.")
return "SAME"
return "Shellcode diff output to log window."
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment