cea-sec/miasm

from __future__ import print_function
import logging
from miasm.analysis.sandbox import Sandbox_Win_x86_32
from miasm.core.locationdb import LocationDB
from miasm.jitter.csts import PAGE_WRITE, PAGE_READ, EXCEPT_BREAKPOINT_MEMORY


parser = Sandbox_Win_x86_32.parser(description="Displays accesses to a specified memory space")
parser.add_argument("filename", help="PE Filename")
parser.add_argument("memory_address",
                    help="Starting address of the memory space")
parser.add_argument("size",
                    help="Size of the address space")
parser.add_argument("--access",
                    help="Access type",
                    choices=["r", "w", "rw"],
                    default="rw")
options = parser.parse_args()

# Create sandbox
loc_db = LocationDB()
sb = Sandbox_Win_x86_32(loc_db, options.filename, options, globals())

# Add a memory breakpoint
address = int(options.memory_address, 0)
size = int(options.size, 0)
access_type = 0
if 'r' in options.access:
    access_type |= PAGE_WRITE
if 'w' in options.access:
    access_type |= PAGE_READ
sb.jitter.vm.add_memory_breakpoint(address, size, access_type)
# And add a custom handler for memory breakpoints
def memory_breakpoint_handler(jitter):
    memory_read = jitter.vm.get_memory_read()
    if len(memory_read) > 0:
        print("Read at instruction 0x%x:" % jitter.pc)
        for start_address, end_address in memory_read:
            print("- from 0x%x to 0x%x" % (start_address, end_address))

    memory_write = jitter.vm.get_memory_write()
    if len(memory_write) > 0:
        print("Write at instruction 0x%x:" % jitter.pc)
        for start_address, end_address in memory_write:
            print("- from 0x%x to 0x%x" % (start_address, end_address))

    # Cleanup
    jitter.vm.set_exception(jitter.vm.get_exception() ^ EXCEPT_BREAKPOINT_MEMORY)
    jitter.vm.reset_memory_access()

    # Stop the jitter
    return False
sb.jitter.add_exception_handler(EXCEPT_BREAKPOINT_MEMORY, memory_breakpoint_handler)

# Run
sb.run()