Skip to content

Commit

Permalink
Merge pull request #14 from aktsk/v0.2.3
Browse files Browse the repository at this point in the history 
v0.2.3
  • Loading branch information
@tkmru
tkmru authored Jun 5, 2020
2 parents e86a28c + 8da159a commit ca5bf04
Show file tree
Hide file tree
Showing 4 changed files with 67 additions and 30 deletions.
39 changes: 31 additions & 8 deletions cmd/cmd.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"log"
"os"
"os/exec"
"path/filepath"
"regexp"
"strconv"
"strings"
Expand Down Expand Up @@ -38,22 +39,27 @@ func Plist() (string, error) {

re := regexp.MustCompile(`\s+`)
line, err := out.ReadString('\n')
pids := []string{}
pids := make(map[string]string)
for err == nil && len(line) != 0 {
s := strings.Split(re.ReplaceAllString(string(line), " "), " ")
pid := s[1]
cmd := s[8]
if pid != "PID" && cmd != "" && cmd != "ps" && cmd != "sh" && cmd != "medit" {
fmt.Printf("Package: %s, PID: %s\n", cmd, pid)
pids = append(pids, pid)
pids[cmd] = pid
}
line, err = out.ReadString('\n')
}

if len(pids) == 1 {
fmt.Printf("Target PID has been set to %s.\n", pids[0])
return pids[0], nil
current_path, _ := os.Getwd()
_, package_name := filepath.Split(current_path)
for cmd, pid := range pids {
if cmd == package_name {
fmt.Printf("Target PID has been set to %s.\n", pid)
return pid, nil
}
}

return "", nil
}

Expand Down Expand Up @@ -98,10 +104,11 @@ func Attach(pid string) error {

func Find(pid string, targetVal string, dataType string) ([]Found, error) {
founds := []Found{}
// search value in /proc/<pid>/mem
// parse /proc/<pid>/map, and get writable area
mapsPath := fmt.Sprintf("/proc/%s/maps", pid)
memPath := fmt.Sprintf("/proc/%s/mem", pid)
addrRanges, err := memory.GetWritableAddrRanges(mapsPath)
// search value in /proc/<pid>/mem
memPath := fmt.Sprintf("/proc/%s/mem", pid)
if err != nil {
return nil, err
}
Expand All @@ -115,6 +122,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
converter: converter.StringToBytes,
dataType: "UTF-8 string",
})
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}
fmt.Println("------------------------")

Expand All @@ -129,6 +138,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
})
}
return founds, nil
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}
fmt.Println("------------------------")
foundAddrs, err = memory.FindDword(memPath, targetVal, addrRanges)
Expand All @@ -141,6 +152,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
})
}
return founds, nil
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}
fmt.Println("------------------------")
foundAddrs, err = memory.FindQword(memPath, targetVal, addrRanges)
Expand All @@ -153,6 +166,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
})
}
return founds, nil
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}

} else if dataType == "string" {
Expand All @@ -166,6 +181,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
})
}
return founds, nil
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}

} else if dataType == "word" {
Expand All @@ -179,6 +196,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
})
}
return founds, nil
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}

} else if dataType == "dword" {
Expand All @@ -192,6 +211,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
})
}
return founds, nil
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}

} else if dataType == "qword" {
Expand All @@ -205,6 +226,8 @@ func Find(pid string, targetVal string, dataType string) ([]Found, error) {
})
}
return founds, nil
} else if _, ok := err.(memory.TooManyErr); ok {
return founds, err
}
}

Expand Down Expand Up @@ -235,7 +258,7 @@ func Filter(pid string, targetVal string, prevFounds []Found) ([]Found, error) {
}
}
foundAddrs, _ := memory.FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!!!\n", len(foundAddrs))
fmt.Printf("Found: %d!!\n", len(foundAddrs))
if len(foundAddrs) < 10 {
for _, v := range foundAddrs {
fmt.Printf("Address: 0x%x\n", v)
Expand Down
5 changes: 1 addition & 4 deletions main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,7 @@ func executor(in string) {
targetVal = inputSlice[2]
dataType = inputSlice[1]
}
foundAddr, err := cmd.Find(appPID, targetVal, dataType)
if err != nil {
fmt.Println(err)
}
foundAddr, _ := cmd.Find(appPID, targetVal, dataType)
addrCache = foundAddr

} else if strings.HasPrefix(in, "filter") {
Expand Down
53 changes: 35 additions & 18 deletions pkg/memory/search.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import (
"github.com/aktsk/apk-medit/pkg/converter"
)

var splitSize = 0x50000000
var splitSize = 0x5000000
var bufferPool = sync.Pool{
New: func() interface{} {
return make([]byte, splitSize)
Expand Down Expand Up @@ -57,6 +57,22 @@ func GetWritableAddrRanges(mapsPath string) ([][2]int, error) {
return addrRanges, nil
}

type Err struct {
err error
}

func (e *Err) Error() string {
return fmt.Sprint(e.err)
}

type ParseErr struct {
*Err
}

type TooManyErr struct {
*Err
}

func FindDataInAddrRanges(memPath string, targetBytes []byte, addrRanges [][2]int) ([]int, error) {
foundAddrs := []int{}
f, err := os.OpenFile(memPath, os.O_RDONLY, 0600)
Expand All @@ -71,6 +87,7 @@ func FindDataInAddrRanges(memPath string, targetBytes []byte, addrRanges [][2]in
fmt.Println(err)
}
for i := 0; i < (memSize/splitSize)+1; i++ {
// target memory is too big to read all of it, so split it and then search in memory
splitIndex := (i + 1) * splitSize
splittedBeginAddr := beginAddr + i*splitSize
splittedEndAddr := endAddr
Expand All @@ -81,9 +98,9 @@ func FindDataInAddrRanges(memPath string, targetBytes []byte, addrRanges [][2]in
ReadMemory(f, b, splittedBeginAddr, splittedEndAddr)
findDataInSplittedMemory(&b, targetBytes, searchLength, splittedBeginAddr, 0, &foundAddrs)
bufferPool.Put(b)
if len(foundAddrs) > 60000 {
if len(foundAddrs) > 500000 {
fmt.Println("Too many addresses with target data found...")
return foundAddrs, errors.New("Error: Too many addresses")
return foundAddrs, TooManyErr{&Err{errors.New("Error: Too many addresses")}}
}
}
}
Expand All @@ -107,66 +124,66 @@ func FindString(memPath string, targetVal string, addrRanges [][2]int) ([]int, e
fmt.Println("Search UTF-8 String...")
targetBytes, _ := converter.StringToBytes(targetVal)
fmt.Printf("Target Value: %s(%v)\n", targetVal, targetBytes)
foundAddrs, _ := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!\n", len(foundAddrs))
foundAddrs, err := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!!\n", len(foundAddrs))
if len(foundAddrs) < 10 {
for _, v := range foundAddrs {
fmt.Printf("Address: 0x%x\n", v)
}
}
return foundAddrs, nil
return foundAddrs, err
}

func FindWord(memPath string, targetVal string, addrRanges [][2]int) ([]int, error) {
fmt.Println("Search Word...")
targetBytes, err := converter.WordToBytes(targetVal)
if err != nil {
fmt.Printf("parsing %s: value out of range\n", targetVal)
return nil, err
return nil, ParseErr{&Err{errors.New("Error: value out of range")}}
}
fmt.Printf("Target Value: %s(%v)\n", targetVal, targetBytes)
foundAddrs, _ := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!\n", len(foundAddrs))
foundAddrs, err := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!!\n", len(foundAddrs))
if len(foundAddrs) < 10 {
for _, v := range foundAddrs {
fmt.Printf("Address: 0x%x\n", v)
}
}
return foundAddrs, nil
return foundAddrs, err
}

func FindDword(memPath string, targetVal string, addrRanges [][2]int) ([]int, error) {
fmt.Println("Search Double Word...")
targetBytes, err := converter.DwordToBytes(targetVal)
if err != nil {
fmt.Printf("parsing %s: value out of range\n", targetVal)
return nil, err
return nil, ParseErr{&Err{errors.New("Error: value out of range")}}
}
fmt.Printf("Target Value: %s(%v)\n", targetVal, targetBytes)
foundAddrs, _ := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!\n", len(foundAddrs))
foundAddrs, err := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!!\n", len(foundAddrs))
if len(foundAddrs) < 10 {
for _, v := range foundAddrs {
fmt.Printf("Address: 0x%x\n", v)
}
}
return foundAddrs, nil
return foundAddrs, err
}

func FindQword(memPath string, targetVal string, addrRanges [][2]int) ([]int, error) {
fmt.Println("Search Quad Word...")
targetBytes, err := converter.QwordToBytes(targetVal)
if err != nil {
fmt.Printf("parsing %s: value out of range\n", targetVal)
return nil, err
return nil, ParseErr{&Err{errors.New("Error: value out of range")}}
}
fmt.Printf("Target Value: %s(%v)\n", targetVal, targetBytes)
foundAddrs, _ := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!\n", len(foundAddrs))
foundAddrs, err := FindDataInAddrRanges(memPath, targetBytes, addrRanges)
fmt.Printf("Found: %d!!\n", len(foundAddrs))
if len(foundAddrs) < 10 {
for _, v := range foundAddrs {
fmt.Printf("Address: 0x%x\n", v)
}
}
return foundAddrs, nil
return foundAddrs, err
}
Binary file modified screenshots/terminal.gif
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit ca5bf04

Please sign in to comment.