forked from JonathanSalwan/Tigress_protection
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sample1-virt-dispatcher-binary.py
166 lines (162 loc) · 7.1 KB
/
sample1-virt-dispatcher-binary.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_264 = SymVar_0
ref_279 = ref_264 # MOV operation
ref_15541 = ref_279 # MOV operation
ref_16999 = ref_15541 # MOV operation
ref_17007 = ((ref_16999 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_17014 = ref_17007 # MOV operation
ref_22783 = ref_279 # MOV operation
ref_23917 = ref_22783 # MOV operation
ref_23925 = (ref_23917 >> (0x7 & 0x3F)) # SHR operation
ref_23932 = ref_23925 # MOV operation
ref_24549 = ref_23932 # MOV operation
ref_24561 = ref_17014 # MOV operation
ref_24563 = (ref_24561 | ref_24549) # OR operation
ref_25123 = ref_24563 # MOV operation
ref_35721 = ref_25123 # MOV operation
ref_37151 = ref_35721 # MOV operation
ref_37153 = ((ref_37151 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_37680 = ref_37153 # MOV operation
ref_37682 = (ref_37680 & 0x1D5ABF66) # AND operation
ref_43456 = ref_279 # MOV operation
ref_44914 = ref_43456 # MOV operation
ref_44922 = ((ref_44914 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_44929 = ref_44922 # MOV operation
ref_50698 = ref_279 # MOV operation
ref_51832 = ref_50698 # MOV operation
ref_51840 = (ref_51832 >> (0xB & 0x3F)) # SHR operation
ref_51847 = ref_51840 # MOV operation
ref_52464 = ref_51847 # MOV operation
ref_52476 = ref_44929 # MOV operation
ref_52478 = (ref_52476 | ref_52464) # OR operation
ref_53100 = ref_52478 # MOV operation
ref_53112 = ref_37682 # MOV operation
ref_53114 = ((ref_53100 - ref_53112) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_53122 = ref_53114 # MOV operation
ref_53677 = ref_53122 # MOV operation
ref_64774 = ref_279 # MOV operation
ref_65371 = ref_64774 # MOV operation
ref_65385 = ((ref_65371 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_65393 = ref_65385 # MOV operation
ref_65948 = ref_65393 # MOV operation
ref_76546 = ref_25123 # MOV operation
ref_77181 = ref_76546 # MOV operation
ref_77195 = ((0x20453EE3 + ref_77181) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_82970 = ref_279 # MOV operation
ref_83567 = ref_82970 # MOV operation
ref_83579 = ref_77195 # MOV operation
ref_83581 = ((ref_83567 - ref_83579) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_83589 = ref_83581 # MOV operation
ref_84144 = ref_83589 # MOV operation
ref_101105 = ref_25123 # MOV operation
ref_108492 = ref_65948 # MOV operation
ref_109089 = ref_108492 # MOV operation
ref_109101 = ref_101105 # MOV operation
ref_109103 = (ref_109101 | ref_109089) # OR operation
ref_110408 = ref_109103 # MOV operation
ref_110414 = (0x3F & ref_110408) # AND operation
ref_111897 = ref_110414 # MOV operation
ref_111905 = ((ref_111897 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_111912 = ref_111905 # MOV operation
ref_117861 = ref_25123 # MOV operation
ref_118458 = ref_117861 # MOV operation
ref_118470 = ref_111912 # MOV operation
ref_118472 = (ref_118470 | ref_118458) # OR operation
ref_119032 = ref_118472 # MOV operation
ref_130984 = ref_53677 # MOV operation
ref_137696 = ref_119032 # MOV operation
ref_138830 = ref_137696 # MOV operation
ref_138838 = (ref_138830 >> (0x1 & 0x3F)) # SHR operation
ref_138845 = ref_138838 # MOV operation
ref_140145 = ref_138845 # MOV operation
ref_140151 = (0xF & ref_140145) # AND operation
ref_140773 = ref_140151 # MOV operation
ref_140787 = (0x1 | ref_140773) # OR operation
ref_142204 = ref_140787 # MOV operation
ref_142206 = ((0x40 - ref_142204) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_142214 = ref_142206 # MOV operation
ref_142909 = ref_130984 # MOV operation
ref_142913 = ref_142214 # MOV operation
ref_142915 = (ref_142913 & 0xFFFFFFFF) # MOV operation
ref_142917 = ((ref_142909 << ((ref_142915 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_142924 = ref_142917 # MOV operation
ref_148194 = ref_53677 # MOV operation
ref_154906 = ref_119032 # MOV operation
ref_156040 = ref_154906 # MOV operation
ref_156048 = (ref_156040 >> (0x1 & 0x3F)) # SHR operation
ref_156055 = ref_156048 # MOV operation
ref_157355 = ref_156055 # MOV operation
ref_157361 = (0xF & ref_157355) # AND operation
ref_157983 = ref_157361 # MOV operation
ref_157997 = (0x1 | ref_157983) # OR operation
ref_158373 = ref_148194 # MOV operation
ref_158377 = ref_157997 # MOV operation
ref_158379 = (ref_158377 & 0xFFFFFFFF) # MOV operation
ref_158381 = (ref_158373 >> ((ref_158379 & 0xFF) & 0x3F)) # SHR operation
ref_158388 = ref_158381 # MOV operation
ref_159005 = ref_158388 # MOV operation
ref_159017 = ref_142924 # MOV operation
ref_159019 = (ref_159017 | ref_159005) # OR operation
ref_159579 = ref_159019 # MOV operation
ref_169394 = ref_84144 # MOV operation
ref_176781 = ref_159579 # MOV operation
ref_177378 = ref_176781 # MOV operation
ref_177390 = ref_169394 # MOV operation
ref_177392 = ((ref_177378 - ref_177390) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_177400 = ref_177392 # MOV operation
ref_177955 = ref_177400 # MOV operation
ref_196682 = ref_119032 # MOV operation
ref_202715 = ref_53677 # MOV operation
ref_203995 = ref_202715 # MOV operation
ref_204001 = (0xF & ref_203995) # AND operation
ref_204623 = ref_204001 # MOV operation
ref_204637 = (0x1 | ref_204623) # OR operation
ref_206054 = ref_204637 # MOV operation
ref_206056 = ((0x40 - ref_206054) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_206064 = ref_206056 # MOV operation
ref_206759 = ref_196682 # MOV operation
ref_206763 = ref_206064 # MOV operation
ref_206765 = (ref_206763 & 0xFFFFFFFF) # MOV operation
ref_206767 = ((ref_206759 << ((ref_206765 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_206774 = ref_206767 # MOV operation
ref_212044 = ref_119032 # MOV operation
ref_218077 = ref_53677 # MOV operation
ref_219357 = ref_218077 # MOV operation
ref_219363 = (0xF & ref_219357) # AND operation
ref_219985 = ref_219363 # MOV operation
ref_219999 = (0x1 | ref_219985) # OR operation
ref_220375 = ref_212044 # MOV operation
ref_220379 = ref_219999 # MOV operation
ref_220381 = (ref_220379 & 0xFFFFFFFF) # MOV operation
ref_220383 = (ref_220375 >> ((ref_220381 & 0xFF) & 0x3F)) # SHR operation
ref_220390 = ref_220383 # MOV operation
ref_221007 = ref_220390 # MOV operation
ref_221019 = ref_206774 # MOV operation
ref_221021 = (ref_221019 | ref_221007) # OR operation
ref_227079 = ref_84144 # MOV operation
ref_232329 = ref_177955 # MOV operation
ref_232926 = ref_232329 # MOV operation
ref_232938 = ref_227079 # MOV operation
ref_232940 = (ref_232938 | ref_232926) # OR operation
ref_234099 = ref_232940 # MOV operation
ref_234107 = (ref_234099 >> (0x1 & 0x3F)) # SHR operation
ref_234114 = ref_234107 # MOV operation
ref_235414 = ref_234114 # MOV operation
ref_235420 = (0x7 & ref_235414) # AND operation
ref_236042 = ref_235420 # MOV operation
ref_236056 = (0x1 | ref_236042) # OR operation
ref_236756 = ref_221021 # MOV operation
ref_236760 = ref_236056 # MOV operation
ref_236762 = (ref_236760 & 0xFFFFFFFF) # MOV operation
ref_236764 = ((ref_236756 << ((ref_236762 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_236771 = ref_236764 # MOV operation
ref_237326 = ref_236771 # MOV operation
ref_238325 = ref_237326 # MOV operation
ref_238327 = ref_238325 # MOV operation
print ref_238327 & 0xffffffffffffffff