bf.py

from keystone import * import struct import sys

arch = KS_ARCH_X86 mode = KS_MODE_64 ks = Ks(arch, mode)

memory_top = 0x900000 memory_size = 100000 entry_point = 0x500078

def asm(code): c, _ = ks.asm(code) return ''.join([chr(x) for x in c])

def p8(x): return struct.pack("<B", x)

def p16(x): return struct.pack("<H", x)

def p32(x): return struct.pack("<L", x)

def p64(x): return struct.pack("<Q", x)

def gen_header(code): elfh = '' elfh += '\x7fELF' # magic elfh += p8(2) # Class: 2 is 64bit elfh += p8(1) # Endinan: little endian elfh += p8(1) # ELF Version: EV Current elfh += p8(0) # EI_OSABI: It is often set to 0 regardless of the target platform.(Wikipedia) elfh += p8(0) # ABI version: (not used) elfh += p8(0) * 7 # Padding: currently unused elfh += p16(2) # e_type: 2 is exectable file elfh += p16(0x3e) # e_machine: 0x3e is x86-64 elfh += p32(1) # e_version: original version(maybe whatever) elfh += p64(entry_point) # e_entry: entry point elfh += p64(0x40) # e_phoff: program header table offset -> 64bit is 0x40 elfh += p64(0) # e_shoff: section header table offset -> notable elfh += p32(0) # e_flags: maybe whatever elfh += p16(0x40) # e_ehsize: ELF Header Size elfh += p16(0x38) # e_phentsize elfh += p16(1) # e_phnum: the number of program header entries elfh += p16(0) # e_shentsize: no section headers elfh += p16(0) # e_shnum: no section headers elfh += p16(0) # e_shstrndx: no section headers

# Program Header
prmh = ''
prmh += p32(1) # p_type: type of segment
prmh += p32(5) # p_flags: memory segment permission. 0b101 -> Exec + Read
prmh += p64(0x40 + 0x38) # p_offset: offset of the segment
prmh += p64(entry_point) # p_vaddr: virtual address to be mapped in memory
prmh += p64(entry_point) # p_paddr: physical address to be mapped in memory (maybe not used in my machine)
prmh += p64(len(code)) # p_filesz: file size of this segment
prmh += p64(len(code)) # p_memsz: file size of this segment
prmh += p64(0x1000) # p_align: alignment

return elfh + prmh

def inc_ptr(): code = asm('inc rbx') return code

def dec_ptr(): code = asm('dec rbx') return code

def inc_val(): code = asm('mov al, [rbx]') code += asm('inc al') code += asm('mov [rbx], al') return code

def dec_val(): code = asm('mov al, [rbx]') code += asm('dec al') code += asm('mov [rbx], al') return code

def put_char(): code = asm('mov rax, 1') code += asm('mov rdi, 1') code += asm('mov rsi, rbx') code += asm('mov rdx, 1') code += asm('syscall') return code

def get_char(): code = asm('mov rax, 0') code += asm('mov rdi, 0') code += asm('mov rsi, rbx') code += asm('mov rdx, 1') code += asm('syscall') return code

def push_fun(addr): code = asm('mov al, [rbx]') code += asm('cmp al, 0') code += asm('je %d' % addr) return code

def pop_fun(addr): code = asm('mov al, [rbx]') code += asm('cmp al, 0') code += asm('jne %d' % (addr - len(code))) return code

def epilogue(): code = '' code += asm('mov rax, 60') code += asm('mov rdi, 0') code += asm('syscall') return code

def prologue(): code = ''

# create the area of 'memory'
code += asm('mov rax, 9') # mmap
code += asm('mov rdi, %d' % memory_top)
code += asm('mov rsi, %d' % memory_size) # size
code += asm('mov rdx, 7')
code += asm('mov r10, 34')
code += asm('mov r8, 0xffffffffff')
code += asm('mov r9, 0')
code += asm('syscall')

# use rbx as current memory addr
code += asm('mov rbx, %d' % memory_top)

return code

class InvalidSyntax(Exception): pass

def inner(base, root=False): code = ''

while True:
    c = sys.stdin.read(1)
    if not c:
        break

    if c == '>':
        code += inc_ptr()
    elif c == '<':
        code += dec_ptr()
    elif c == '+':
        code += inc_val()
    elif c == '-':
        code += dec_val()
    elif c == '.':
        code += put_char()
    elif c == ',':
        code += get_char()
    elif c == '[':
        code += inner(base + len(code))
    elif c == ']':
        if len(code) > 129:
            tmp = push_fun(130)
        else:
            tmp = push_fun(129)
        code += pop_fun(-len(code))
        return push_fun(len(code)) + code
if root:
    return code

raise InvalidSyntax

def main(): base = entry_point

code = prologue()
code += inner(base + len(code), root=True)
code += epilogue()

h = gen_header(code)
artifact = h + code
return artifact

open('bf', 'w').write(main())