cli

#!/usr/bin/env python
# Copyright 2013 anthony cantor
# This file is part of sefi.
# 
# sefi is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#  
# sefi is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#  
# You should have received a copy of the GNU General Public License
# along with sefi.  If not, see <http://www.gnu.org/licenses/>.

import argparse
import sys
import os.path
import logging

import sefi
import sefi.log
import sefi.matcher
import sefi.disassembler
import sefi.container
import sefi.elf

def opt_parser():

	parser = argparse.ArgumentParser(description='search binary data for sequences of instructions')

	parser.add_argument(
		'file', 
		nargs='?', 
		type=argparse.FileType('r'),
		help='file to search. if no file is given, stdin will be used',
		default=False
	)

	parser.add_argument(
		'-v', 
		'--verbose', 
		action='count', 
		help='print debug output. repeat to increase verbosity.',
		default=0
	)

	parser.add_argument(
		'-n',
		'--n',
		metavar='N',
		type=int,
		help='search backwards from gadget terminator for N bytes. default: 20',
		default=20
	)

	parser.add_argument(
		'-g',
		'--gadget',
		metavar='REGEXP',
		action='append',
		help='search for gadgets ending in an instruction that matches REGEXP. ' + \
				'note: REGEXP will have to match the specific output style of ' + \
				'whichever disassembler backend is being used (though the match ' + \
				'is not case sensitive)',
		default=[]
	)

	parser.add_argument(
		'--ret',
		action='store_true',
		help='search for gadgets ending with a RET instruction.'
	)

	parser.add_argument(
		'--jmp-reg',
		action='store_true',
		help='search for gadgets ending with a "JMP %%reg" instruction.'
	)

	parser.add_argument(
		'--call-reg',
		action='store_true',
		help='search for gadgets ending with a "CALL %%reg" instruction.'
	)

	parser.add_argument(
		'--all',
		action='store_true',
		help='equivalent to passing --ret, --jmp-reg, and --call-reg.'
	)

	parser.add_argument(
		'--d-backend',
		metavar='NAME',
		help='use NAME as the disassembler backend. note: the backend ' + \
				'may or may not support the architecture of the input file. ' + \
				'valid backends: %s' % (
					", ".join(sefi.disassembler.backend_names())
				)
	)

	parser.add_argument(
		'-d',
		'--disassemble',
		nargs='?',
		action='append',
		metavar='SYMBOL',
		help='disassemble SYMBOL. pass -d more than once ' + \
				'with different symbols to disassemble more than one ' + \
				'symbol. if no symbols are provided, all executable ' + \
				'segments will be disassembled.'
	)

	parser.add_argument(
		'--uncond-flow',
		action='store_true',
		help='allow unconditional control flow in gadgets. default: False.',
		default=False
	)

	parser.add_argument(
		'--cond-flow',
		action='store_true',
		help='allow conditional control flow in gadgets. default: False.',
		default=False
	)

	""" 
	TODO: parser.add_argument(
		'--raw',
		action='store_true', 
		help='treat the input as raw executable bytes (by default the input is parsed as an elf executable).'
	)
	"""
	
	return parser

class SefiCliErr(Exception):
	pass

class MissingOption(SefiCliErr):
	pass

class NotImplemented(SefiCliErr):
	pass

def validate_options(options):
	if len(options.gadget) < 1 and \
			not options.ret and \
			not options.jmp_reg and \
			not options.call_reg and \
			not options.all and \
			not options.disassemble:
		raise MissingOption("you must specify at least one gadget " + \
							"specification: -g, --ret, --jmp-reg, " + \
							"--call-reg, --all or -d")

def run(options):
	validate_options(options)
	
	lgr = logging.getLogger("sefi")
	if options.verbose >= 2:
		lgr.setLevel(logging.DEBUG)
	elif options.verbose == 1:
		lgr.setLevel(logging.INFO)
	else:
		lgr.setLevel(logging.ERROR)

	ch = logging.StreamHandler()
	ch.setLevel(lgr.level)
	lgr.addHandler(ch)
	sefi.log.set_logger(lgr)

	if not options.file:
		sys.stderr.write("using stdin as input file\n")
		#elftools needs to be able to seek
		#so we need to make stdin a normal file
		with open("/tmp/sefi-stdin", "w") as f:
			f.write(sys.stdin.read())
	
		options.file = open("/tmp/sefi-stdin", "r")
	
	if options.d_backend is None:
		pass
	elif options.d_backend not in sefi.disassembler.backends:
		print("invalid backend %r" % options.d_backend)
		exit(1)
	else:
		#set rank of lib to arbitrary high number
		sefi.disassembler.backend_set_rank(options.d_backend, 9999)
		
	run_elf(options)

def run_elf(options):
	run_search_elf(options)

	run_dasm_elf(options)

def run_search_elf(options):
	if not (options.ret or \
			options.jmp_reg or \
			options.call_reg or \
			options.all or \
			len(options.gadget) > 0):
		return
	
	result = set([])

	def set_matcher_flow(m):
		m.uncond_flow = options.uncond_flow
		m.cond_flow = options.cond_flow
		return m

	if options.ret or options.all:
		m = set_matcher_flow(sefi.matcher.Rets())
		for gadget in sefi.search_elf_for_gadgets(options.file, options.n, m):
			result.add(gadget)
	
	if options.jmp_reg or options.all:
		m = set_matcher_flow(sefi.matcher.JmpRegUncond())
		for gadget in sefi.search_elf_for_gadgets(options.file, options.n, m):
			result.add(gadget)

	if options.call_reg or options.all:
		m = set_matcher_flow(sefi.matcher.CallReg())
		for gadget in sefi.search_elf_for_gadgets(options.file, options.n, m):
			result.add(gadget)

	if len(options.gadget) > 0:
		for reg in options.gadget:
			sefi.log.info("search for gadgets matching %r" % reg)
			m = set_matcher_flow(sefi.matcher.REMatcher(reg))
			for gadget in sefi.search_elf_for_gadgets(options.file, options.n, m):
				result.add(gadget)

	if len(result) < 1:
		sys.stderr.write("no gadgets found\n")
		return

	cond_flow = []
	uncond_flow = []
	normal = []
	
	for g in result:
		#unconditional is the strongest condition
		if g.has_uncond_ctrl_flow():
			uncond_flow.append(g)
		elif g.has_cond_ctrl_flow():
			cond_flow.append(g)
		else:
			normal.append(g)

	print("gadgets with unconditional control flow:")
	display_gadgets(uncond_flow)
	print("\n")
	print("gadgets with conditional control flow:")
	display_gadgets(cond_flow)
	print("\n")
	print("gadgets with no control flow:")
	display_gadgets(normal)
	print("\n")

def run_dasm_elf(options):
	if not options.disassemble:
		return

	syms = set([])
	syms_found = set([])
	for sym in options.disassemble:
		if isinstance(sym, str):
			syms.add(sym)

	elf_o, arch = sefi.elf.open(options.file)
	dasm = sefi.disassembler.find(arch)

	i = 0
	for (name, addr, data) in sefi.elf.executable_data_by_symbol(elf_o):
		if len(syms) < 1 or name in syms:
			if i > 0:
				print("")
			disassemble_symbol(elf_o, name, addr, data, dasm)
			i += 1
			if name in syms:
				syms_found.add(name)
	
	not_found = syms - syms_found
	if len(not_found) > 0:
		for name in not_found:
			print("failed to find symbol %r" % name)

def disassemble_symbol(elf_o, name, addr, data, dasm):
	if not name:
		sec = sefi.elf.section_at_addr(elf_o, addr)
		if sec:
			name = sec.name

	name_str = ("<%s>" % name) if name else "(NO NAME)"

	print '%s:' % name_str
	print sefi.container.InstSeq(addr, data, dasm).display()

def display_gadgets(gadgets):
	width = 60

	for g in sorted(gadgets, lambda x,y: cmp(x.addr(), y.addr())):
		print("-"*width)
		print(g.display())
			

		
if __name__ == "__main__":
	opt_p = opt_parser()
	options = opt_p.parse_args()

	try:
		run(options)
	except SefiCliErr as e:
		print(e)
		print("")
		opt_p.print_help()
		exit(1)
	except IOError as e:
		if e.args[0] != 32: #broken pipe
			raise e