uCTF Debugger Bookmarklet

bookmarklet.js

javascript:(function()%7B(function()%7Bdonemanual();$('%23hideheaders').click().hide();(function()%7Bvar%20helpDiv=$('%3Cdiv/%3E').css(%7B'width':'300px','height':'300px','background':'black','position':'fixed','top':'50%25','left':'50%25','margin-top':'-150px','margin-left':'-150px','zIndex':'1000000','opacity':'0.8','padding':'30px'%7D).appendTo('body').hide();$('%3Ch3/%3E').text('Global%20Hotkeys').appendTo(helpDiv);$('%3Cbr/%3E').appendTo(helpDiv);$('%3Cp/%3E').text('%5B%20-%3E%20step').appendTo(helpDiv);$('%3Cp/%3E').text('%5D%20-%3E%20finish').appendTo(helpDiv);$('%3Cp/%3E').text('%5C%5C%20-%3E%20continue').appendTo(helpDiv);$(document).bind('keydown',function(e)%7Bswitch(e.which)%7Bcase%20219:parse('s');break;case%20221:parse('f');break;case%20220:parse('c');break;case%20191:helpDiv.show();%7D%7D);$(document).bind('keyup',function(e)%7Bif(e.which==191)helpDiv.hide();%7D);%7D)();(function()%7Bcpu._readhex=function(e)%7Bif(!e%5B1%5D)return%20write(%22%20%20%20Please%20give%20an%20expression%20to%20read%20the%20memory%20at.%22),void%200;var%20t=cpu.to_addr(e%5B1%5D);cpu.get(%22/cpu/dbg/memory/%22+t+%22?len=%22+(parseInt(e%5B2%5D,16)+(15-parseInt(e%5B2%5D,16)&15)%7C%7C32),function(e)%7Bfor(var%20n=atob(e.raw),i=%22%22,o=%22%20%20%22,s=0;s%3Cn.length;s++)s%252===0&&(o+=%22%20%22),o+=pad(n.charCodeAt(s).toString(16),2),s%258==7&&(i+=%22%20%20%20%22+o+%22%5Cn%22,o=%22%20%20%22);write(i);%7D);%7D;cpu._rh=cpu._readhex;cpu._disassemble=function(e)%7Bif(!e%5B1%5D)return%20write(%22%20%20%20Please%20give%20an%20expression%20to%20read%20the%20memory%20at.%22),void%200;var%20t=cpu.to_addr(e%5B1%5D);cpu.get(%22/cpu/dbg/memory/%22+t+%22?len=%22+(parseInt(e%5B2%5D,16)+(15-parseInt(e%5B2%5D,16)&15)%7C%7C32),function(e)%7Bfor(var%20n=atob(e.raw),i=%22%22,o=%22%22,s=0;s%3Cn.length;s++)s%252===0&&(o+=%22%22),o+=pad(n.charCodeAt(s).toString(16),2),s%258==7&&(i+=o,o=%22%22);cpu.get(%22/cpu/dbg/disasm?obj=%22+i,function(e)%7Bwrite(e.error?%22ERROR:%20%22+e.error:e.data.insns.join(%22%5Cn%22));%7D,1);%7D);%7D;cpu._d=cpu._disassemble;%7D)();(function()%7B$('%3Cstyle%3E.changedregister%20%7B%20color:%20red;%20%7D%3C/style%3E').appendTo('body');cpu.$do_update=cpu.do_update;cpu.do_update=function(e)%7Bvar%20strpc=pad(e.regs%5B0%5D.toString(16),4);if(cpu.debugmode&&e.regs%5B0%5D%252==0&&(!$(%22%23insn%22+strpc).length%7C%7C$(%22%23insn%22+strpc+%22%20pre.removeme%22).length))%7Bvar%20code=%22%22;for(var%20i=e.regs%5B0%5D;i%3C0x10000;i+=2)%7Bif(cpu.memory%5Bi%5D==0&&cpu.memory%5Bi+1%5D==0)break;code+=pad(cpu.memory%5Bi%5D.toString(16),2)+pad(cpu.memory%5Bi+1%5D.toString(16),2);if(cpu.memory%5Bi%5D==0x30&&cpu.memory%5Bi+1%5D==0x41)break;%7Dcpu.get(%22/cpu/dbg/disasm?obj=%22+code,function(f)%7Bvar%20asmbox=$(%22%23asmbox%22);var%20i=0,pc,div_id;var%20prev_id=%22%22,tmp;for(k%20in%20cpu.div_insns)%7Bif(k%3Ee.regs%5B0%5D)break;prev_id=cpu.div_insns%5Bk%5D;%7Dfor(var%20ins%20in%20f.data.insns)%7Bpc=pad((e.regs%5B0%5D+i).toString(16),4);div_id=cpu.div_insns%5Be.regs%5B0%5D+i%5D;if(div_id)%7B$(%22%23%22+div_id+%22%20pre%22).text(pc+':%20%20'+f.data.insns%5Bins%5D).show();$(%22%23%22+div_id+%22%20pre.removeme%22).remove();%7Delse%7Bif(!prev_id.length)alert(%22???%22);$(%22%23%22+prev_id).after('%3Cdiv%20id=%22insn'+pc+'%22%20class=%22insn%22%20onclick=%22togglebreakpoint(this.id)%22%3E%3Cpre%3E'+pc+':%20%20'+f.data.insns%5Bins%5D+'%3C/pre%3E%3C/div%3E');cpu.div_insns%5Be.regs%5B0%5D+i%5D=cpu.div_insns%5Be.regs%5B0%5D+i+1%5D=%22insn%22+pc;prev_id=%22insn%22+pc;%7Dtmp=f.data.insns%5Bins%5D.match(/(?:%5B0-9a-f%5D%7B4%7D)+/);if(tmp&&tmp.length)%7Bi+=Math.round(tmp%5B0%5D.length/5)*2;%7Delse%7Bi+=2;%7D%7Dcpu.$do_update(e);%7D,1);%7Delse%7Bcpu.$do_update(e);%7D%7D;%7D)();%7D)();%7D)();

source.js

(function() {
    // Hide the manual, if it is visible
    donemanual();

    // Enable minimal mode and hide the button
    $('#hideheaders').click().hide();

    // Hotkeys
    (function() {
        var helpDiv = $('<div/>').css({
            'width': '300px',
            'height': '300px',
            'background': 'black',
            'position': 'fixed',
            'top': '50%',
            'left': '50%',
            'margin-top': '-150px',
            'margin-left': '-150px',
            'zIndex': '1000000',
            'opacity': '0.8',
            'padding': '30px'
        }).appendTo('body').hide();
        $('<h3/>').text('Global Hotkeys').appendTo(helpDiv);
        $('<br/>').appendTo(helpDiv);
        $('<p/>').text('[ -> step').appendTo(helpDiv);
        $('<p/>').text('] -> finish').appendTo(helpDiv);
        $('<p/>').text('\\ -> continue').appendTo(helpDiv);
        $(document).bind('keydown', function(e) {
            switch(e.which) {
                case 219: // [ -> s
                    parse('s');
                    break;
                case 221: // ] -> f
                    parse('f');
                    break;
                case 220: // \ -> c
                    parse('c');
                    break;
                case 191: // / shows help (can't be bothered dealing with shift)
                    helpDiv.show();
            }
        });
        $(document).bind('keyup', function(e) {
            if (e.which == 191)
                helpDiv.hide();
        });
    })();

    /* https://gist.github.com/staticshock/8511868 */
    (function() {
        // Add a 'readhex' command that works just like 'read' but dumps nothing but the hex
        cpu._readhex = function(e) {
            if (!e[1])
                return write("   Please give an expression to read the memory at."), void 0;
            var t = cpu.to_addr(e[1]);
            cpu.get("/cpu/dbg/memory/" + t + "?len=" + (parseInt(e[2], 16) + (15 - parseInt(e[2], 16) & 15) || 32), function(e) {
                for (var n = atob(e.raw), i = "", o = "  ", s = 0; s < n.length; s++) s % 2 === 0 && (o += " "), o += pad(n.charCodeAt(s).toString(16), 2), s % 8 == 7 && (i += "   " + o + "\n", o = "  ");
                write(i);
            });
        };
        cpu._rh = cpu._readhex;

        // Add a 'disassemble' command that takes the same arguments as read/readhex
        // and disassembles the instructions starting at that address
        cpu._disassemble = function(e) {
            if (!e[1]) return write("   Please give an expression to read the memory at."), void 0;
            var t = cpu.to_addr(e[1]);
            cpu.get("/cpu/dbg/memory/" + t + "?len=" + (parseInt(e[2], 16) + (15 - parseInt(e[2], 16) & 15) || 32), function(e) {
                for (var n = atob(e.raw), i = "", o = "", s = 0; s < n.length; s++) s % 2 === 0 && (o += ""), o += pad(n.charCodeAt(s).toString(16), 2), s % 8 == 7 && (i += o, o = "");
                cpu.get("/cpu/dbg/disasm?obj=" + i, function(e) {
                    write(e.error ? "ERROR: " + e.error : e.data.insns.join("\n"));
                }, 1);
            });
        };
        cpu._d = cpu._disassemble;
    })();

    /* http://pastebin.com/xWN21n3A */
    (function() {
        $('<style>.changedregister { color: red; }</style>').appendTo('body');
        cpu.$do_update = cpu.do_update;
        cpu.do_update = function(e) {
            var strpc = pad(e.regs[0].toString(16), 4);
            if (cpu.debugmode && e.regs[0] % 2 === 0 && (!$("#insn"+strpc).length || $("#insn" + strpc + " pre.removeme").length)) {
                var code = "";
                for (var i = e.regs[0]; i < 0x10000; i+=2) {
                    if (cpu.memory[i] === 0 && cpu.memory[i+1] === 0)
                        break;
                    code += pad(cpu.memory[i].toString(16),2)+pad(cpu.memory[i+1].toString(16),2);
                    if (cpu.memory[i] == 0x30 && cpu.memory[i+1] == 0x41)
                        break;
                }
                cpu.get("/cpu/dbg/disasm?obj=" + code, function (f) {
                    var asmbox = $("#asmbox");
                    var i = 0, pc, div_id;
                    var prev_id = "", tmp;

                    for (var k in cpu.div_insns) {
                        if (k > e.regs[0]) break;
                        prev_id = cpu.div_insns[k];
                    }

                    for (var ins in f.data.insns) {
                        pc = pad((e.regs[0]+i).toString(16), 4);
                        div_id = cpu.div_insns[e.regs[0]+i];
                        if (div_id) {
                            $("#" + div_id + " pre").text(pc+':  '+f.data.insns[ins]).show();
                            $("#" + div_id + " pre.removeme").remove();
                        } else {
                            if (!prev_id.length)
                                alert("???");
                            $("#"+prev_id).after('<div id="insn' + pc + '" class="insn" onclick="togglebreakpoint(this.id)"><pre>' + pc + ':  ' + f.data.insns[ins] + '</pre></div>');
                            cpu.div_insns[e.regs[0] + i] = cpu.div_insns[e.regs[0] + i + 1] = "insn" + pc;
                            prev_id = "insn" + pc;
                        }

                        tmp = f.data.insns[ins].match(/(?:[0-9a-f]{4} )+/);
                        if (tmp && tmp.length) {
                            i += Math.round(tmp[0].length / 5) * 2;
                        } else {
                            i += 2;
                        }
                    }
                    cpu.$do_update(e);
                }, 1);
            } else {
                cpu.$do_update(e);
            }
        };
    })();
})();