Showing
1 changed file
with
8 additions
and
11 deletions
... | @@ -10,23 +10,20 @@ | ... | @@ -10,23 +10,20 @@ |
10 | 10 | ||
11 | ## Usage | 11 | ## Usage |
12 | 12 | ||
13 | -1. Analyze the given firmware: | 13 | +1. Analyze the given firmware. It generates the followings: |
14 | - | ||
15 | - ```python3 m0-angr.py --type a --name firm.bin``` | ||
16 | - | ||
17 | - It generates the followings: | ||
18 | + `api.txt`: It contains the list of restored APIs. | 14 | + `api.txt`: It contains the list of restored APIs. |
19 | + `cfg.txt`: It contains the restored Control-Flow Graph in the form of disassembly. | 15 | + `cfg.txt`: It contains the restored Control-Flow Graph in the form of disassembly. |
20 | + `vuln.txt`: It contains the list of found vulnerabilities. | 16 | + `vuln.txt`: It contains the list of found vulnerabilities. |
21 | - | 17 | +``` |
22 | -2. Generate exploitable payloads: | 18 | +python3 m0-angr.py --type a --name firm.bin |
23 | - | 19 | +``` |
24 | - ```python3 m0-angr.py --type g --name firm.bin --out payload.bin --code {{vuln_offset}} --dest {{dest_offset}} --ret {{ret_offset}} ``` | 20 | +2. Generate exploitable payloads. |
25 | - | ||
26 | + `{{vuln_offset}}`: The offset where vulnerable codes are located(listed in the generated `vuln.txt`). | 21 | + `{{vuln_offset}}`: The offset where vulnerable codes are located(listed in the generated `vuln.txt`). |
27 | + `{{dest_offset}}`: The offset to jump into. It must be of the prologue in a function. | 22 | + `{{dest_offset}}`: The offset to jump into. It must be of the prologue in a function. |
28 | + `{{ret_offset}}`: The offset to go back to after its first step of ROP ends. | 23 | + `{{ret_offset}}`: The offset to go back to after its first step of ROP ends. |
29 | - | 24 | +``` |
25 | +python3 m0-angr.py --type g --name firm.bin --out payload.bin --code {{vuln_offset}} --dest {{dest_offset}} --ret {{ret_offset}} | ||
26 | +``` | ||
30 | 3. Enjoy~. | 27 | 3. Enjoy~. |
31 | 28 | ||
32 | ## Requirements | 29 | ## Requirements | ... | ... |
-
Please register or login to post a comment