74 lines
2.2 KiB
Python
74 lines
2.2 KiB
Python
#!/usr/bin/env python3
|
|
import subprocess, os, glob, sys, time, struct
|
|
|
|
RPP = sys.argv[1] if len(sys.argv) > 1 else "/home/m/soothe-bt/render_long.rpp"
|
|
|
|
VCAND = list(range(0x1824abb60, 0x1824abc20, 8)) # wide vtable range
|
|
CTOR = 0x180529610
|
|
|
|
proc = subprocess.Popen(
|
|
['reaper', '-nosplash', '-renderproject', RPP],
|
|
stdout=open('/tmp/rtov.log', 'w'), stderr=subprocess.STDOUT)
|
|
print('reaper', proc.pid, flush=True)
|
|
|
|
|
|
def find_hosts():
|
|
out = []
|
|
for p in glob.glob('/proc/[0-9]*'):
|
|
try:
|
|
pid = int(os.path.basename(p))
|
|
maps = open(f'/proc/{pid}/maps').read()
|
|
if 'soothe2' in maps and 'yabridge-host' in open(f'/proc/{pid}/cmdline','rb').read().decode('utf8','replace'):
|
|
out.append(pid)
|
|
except Exception:
|
|
pass
|
|
return out
|
|
|
|
|
|
def scan(pid):
|
|
mem = os.open(f'/proc/{pid}/mem', os.O_RDONLY)
|
|
found = []
|
|
pats = {v: struct.pack('<Q', v) for v in VCAND}
|
|
ctor = struct.pack('<Q', CTOR)
|
|
maps = open(f'/proc/{pid}/maps').read()
|
|
for line in maps.splitlines():
|
|
parts = line.split()
|
|
lo, hi = (int(x, 16) for x in parts[0].split('-'))
|
|
if 'r' not in parts[1]:
|
|
continue
|
|
try:
|
|
d = os.pread(mem, hi - lo, lo)
|
|
except Exception:
|
|
continue
|
|
for v, p in pats.items():
|
|
i = 0
|
|
while True:
|
|
i = d.find(p, i)
|
|
if i < 0:
|
|
break
|
|
found.append((v, lo + i))
|
|
i += 1
|
|
os.close(mem)
|
|
return found
|
|
|
|
hosts = None
|
|
found = []
|
|
t0 = time.time()
|
|
while time.time() - t0 < 60:
|
|
hosts = find_hosts()
|
|
if hosts:
|
|
for h in hosts:
|
|
f = scan(h)
|
|
if f:
|
|
found += [(h, a, b) for a, b in f]
|
|
if len(found) > 0:
|
|
print('HITS', host if 'host' in dir() else h, len(found), flush=True)
|
|
with open('/tmp/inst2.txt', 'w') as fo:
|
|
for hh, va, a in found:
|
|
fo.write(f'{hh} {va:#x} {a:#x}\n')
|
|
if not hosts:
|
|
proc.kill()
|
|
sys.exit(0)
|
|
time.sleep(0.3)
|
|
print('none', flush=True)
|
|
proc.kill() |