JungHyun Kim

Update README.md

Showing 1 changed file with 8 additions and 11 deletions
...@@ -10,23 +10,20 @@ ...@@ -10,23 +10,20 @@
10 10
11 ## Usage 11 ## Usage
12 12
13 -1. Analyze the given firmware: 13 +1. Analyze the given firmware. It generates the followings:
14 -
15 - ```python3 m0-angr.py --type a --name firm.bin```
16 -
17 - It generates the followings:
18 + `api.txt`: It contains the list of restored APIs. 14 + `api.txt`: It contains the list of restored APIs.
19 + `cfg.txt`: It contains the restored Control-Flow Graph in the form of disassembly. 15 + `cfg.txt`: It contains the restored Control-Flow Graph in the form of disassembly.
20 + `vuln.txt`: It contains the list of found vulnerabilities. 16 + `vuln.txt`: It contains the list of found vulnerabilities.
21 - 17 +```
22 -2. Generate exploitable payloads: 18 +python3 m0-angr.py --type a --name firm.bin
23 - 19 +```
24 - ```python3 m0-angr.py --type g --name firm.bin --out payload.bin --code {{vuln_offset}} --dest {{dest_offset}} --ret {{ret_offset}} ``` 20 +2. Generate exploitable payloads.
25 -
26 + `{{vuln_offset}}`: The offset where vulnerable codes are located(listed in the generated `vuln.txt`). 21 + `{{vuln_offset}}`: The offset where vulnerable codes are located(listed in the generated `vuln.txt`).
27 + `{{dest_offset}}`: The offset to jump into. It must be of the prologue in a function. 22 + `{{dest_offset}}`: The offset to jump into. It must be of the prologue in a function.
28 + `{{ret_offset}}`: The offset to go back to after its first step of ROP ends. 23 + `{{ret_offset}}`: The offset to go back to after its first step of ROP ends.
29 - 24 +```
25 +python3 m0-angr.py --type g --name firm.bin --out payload.bin --code {{vuln_offset}} --dest {{dest_offset}} --ret {{ret_offset}}
26 +```
30 3. Enjoy~. 27 3. Enjoy~.
31 28
32 ## Requirements 29 ## Requirements
......