52 lines
1.9 KiB
Python
52 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Identify position-independent code techniques in a shellcode blob.
|
|
|
|
Scans for GetPC stubs, PEB access (x86/x64), API-hash loops, and stack-string construction, and
|
|
infers architecture from the PEB-access form. Reads bytes statically; executes nothing.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
TECHNIQUES = {
|
|
"getpc_call_pop": [b"\xe8\x00\x00\x00\x00"], # call $+5
|
|
"getpc_fnstenv": [b"\xd9\xee\xd9\x74\x24\xf4"], # fldz; fnstenv [esp-0xc]
|
|
"peb_access_x86": [b"\x64\xa1\x30\x00\x00\x00", b"\x64\x8b\x0d\x30", b"\x64\x8b\x15\x30"],
|
|
"peb_access_x64": [b"\x65\x48\x8b", b"\x65\x4c\x8b"], # gs:[..]
|
|
"api_hash_ror13": [b"\xac", b"\xc1\xcf\x0d", b"\xc1\xca\x0d"], # lodsb; ror reg,13
|
|
"stack_strings": [b"\xc6\x44\x24", b"\xc7\x44\x24"], # mov byte/dword [esp+x], imm
|
|
}
|
|
|
|
|
|
def analyze(path: str) -> dict:
|
|
data = Path(path).read_bytes()
|
|
found = {name: True for name, sigs in TECHNIQUES.items()
|
|
if any(s in data for s in sigs)}
|
|
arch = ("x64" if "peb_access_x64" in found
|
|
else "x86" if "peb_access_x86" in found else "unknown")
|
|
return {
|
|
"size": len(data),
|
|
"techniques": sorted(found.keys()),
|
|
"inferred_arch": arch,
|
|
"uses_peb_walk": "peb_access_x86" in found or "peb_access_x64" in found,
|
|
"uses_api_hashing": "api_hash_ror13" in found,
|
|
"is_position_independent": bool(found),
|
|
}
|
|
|
|
|
|
def main(argv: list[str] | None = None) -> int:
|
|
parser = argparse.ArgumentParser(description="Analyze position-independent code")
|
|
sub = parser.add_subparsers(dest="cmd", required=True)
|
|
p = sub.add_parser("analyze")
|
|
p.add_argument("file")
|
|
args = parser.parse_args(argv)
|
|
print(json.dumps(analyze(args.file), indent=2))
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|