lief详细介绍
import lief
# ELF
binary = lief.parse("/usr/bin/ls")
print(binary)
# PE
binary = lief.parse("C:\\Windows\\explorer.exe")
print(binary)
# Mach-O
binary = lief.parse("/usr/bin/ls")
print(binary)
# OAT
binary = lief.parse("android.odex")
print(binary)
# DEX
dex = lief.DEX.parse("classes.dex")
print(dex)
# VDEX
vdex = lief.VDEX.parse("classes.vdex")
print(vdex)
# ART
art = lief.ART.parse("boot.art")
print(art)
可打印出文件各个区段，头，节区等信息
header = binary.header
图片.png
更改入口点和目标体系结构[
ARCH]
header.entrypoint = 0x123
header.machine_type = lief.ELF.ARCH.AARCH64
binary.write("ls.modified") //重建写入新文件
图片.png
图片.png
我们还可以迭代输出二进制[节区]
for section in binary.sections:
print(section.name) # section's name
print(section.size) # section's size
print(len(section.content)) # Should match the previous print
要修改该.text部分的内容
text = binary.get_section(".text")
text.content = bytes([0x33] * text.size)
图片.png
使用lief创建简单PE
创建文件完整脚本
#!/usr/bin/env python
# -*- coding: utf-8 -*-
# Description:
# Create a PE which pop a MessageBox
# with the message "Hello World"
from lief import PE
title = "LIEF is awesome\0"
message = "Hello World\0"
data = list(map(ord, title))
data += list(map(ord, message))
code = [
0x6a, 0x00, # push 0x00 uType
0x68, 0x00, 0x20, 0x40, 0x00, # push VA(title)
0x68, 0x10, 0x20, 0x40, 0x00, # push VA(message)
0x6a, 0x00, # push 0 hWnd
0xFF, 0x15, 0x54, 0x30, 0x40, 0x00, # call MessageBoxA
0x6A, 0x00, # push 0 uExitCode
0xFF, 0x15, 0x4C, 0x30, 0x40, 0x00 # call ExitProcess
]
binary32 = PE.Binary("pe_from_scratch", PE.PE_TYPE.PE32)
section_text = PE.Section(".text")
section_text.content = code
section_text.virtual_address = 0x1000
section_data = PE.Section(".data")
section_data.content = data
section_data.virtual_address = 0x2000
section_text = binary32.add_section(section_text, PE.SECTION_TYPES.TEXT)
section_data = binary32.add_section(section_data, PE.SECTION_TYPES.DATA)
print(section_text)
print(section_data)
binary32.optional_header.addressof_entrypoint = section_text.virtual_address
kernel32 = binary32.add_library("kernel32.dll")
kernel32.add_entry("ExitProcess")
user32 = binary32.add_library("user32.dll")
user32.add_entry("MessageBoxA")
ExitProcess_addr = binary32.predict_function_rva("kernel32.dll", "ExitProcess")
MessageBoxA_addr = binary32.predict_function_rva("user32.dll", "MessageBoxA")
print("Address of 'ExitProcess': 0x{:06x} ".format(ExitProcess_addr))
print("Address of 'MessageBoxA': 0x{:06x} ".format(MessageBoxA_addr))
builder = PE.Builder(binary32)
builder.build_imports(True)
builder.build()
builder.write("pe_from_scratch.exe")
step - 1
先创建一个对象
from lief import PE
binary32 = PE.Binary("pe_from_scratch", PE.PE_TYPE.PE32)
第一个参数是二进制文件的名字,第二个参数是PE文件的类型：PE32或是PE64(PE_TYPE)。Binary的构造器可以自动创建DosHeader，Header，OptionalHeader以及一个空的DataDirectory
step - 2
创建区段
section_text = PE.Section(".text")
section_text.content = code
section_text.virtual_address = 0x1000
section_data = PE.Section(".data")
section_data.content = data
section_data.virtual_address = 0x2000
step - 3
MessageBoxA由title和message组成。这两个字符串将存储在.data段中：
title = "LIEF is awesome\0"
message = "Hello World\0"
data = list(map(ord, title))
data += list(map(ord, message))
step - 4
创建text段asm代码
push 0x00 ; uType
push "LIEF is awesome" ; Title
push "Hello World" ; Message
push 0 ; hWnd
call MessageBoxA ;
push 0 ; uExitCode
call ExitProcess ;
我们push的不是ascii，而是字符串所在的虚拟地址。在PE格式中，虚拟地址表示的是相对虚拟地址(如果ASLR不开启的话，是相对于Optional.imagebase)。Binary构造器会默认把imagebase设为0x400000
字符串的虚拟地址计算如下的如下：
title:imagebase+virtual_address+0=0x402000
message:imagebase+virtual_address+len(title)=0x402010
step - 5
载入dll文件
MessageBoxA，我们需要将user32.dll放进Imports表中，并将MessageBoxA放进ImportEntry中；
使用add_library()和add_entry()来实现
user32 = binary32.add_library("user32.dll")
user32.add_entry("MessageBoxA")
ExitProcess(kernel32.dll)的导入也是：
kernel32 = binary32.add_library("kernel32.dll")
kernel32.add_entry("ExitProcess")
step - 6
确定导入库的地址
使用predict_funciton_rva()方法，它会返回由Builder设置的IAT地址：
ExitProcess_addr = binary32.predict_function_rva("kernel32.dll", "ExitProcess")
MessageBoxA_addr = binary32.predict_function_rva("user32.dll",
"MessageBoxA")
print("Address of 'ExitProcess': 0x{:06x} ".format(ExitProcess_addr))
print("Address of 'MessageBoxA': 0x{:06x} ".format(MessageBoxA_addr))
Address of 'ExitProcess': 0x00304c
Address of 'MessageBoxA': 0x003054
MessageBoxA和ExitProcess的绝对虚拟地址是：
MessageBoxA: imagebase + 0x306a = 0x40306a
ExitProcess: imagebase + 0x305c = 0x40305c
汇编代码
push 0x00 ; uType
push 0x402000 ; Title
push 0x402010 ; Message
push 0 ; hWnd
call 0x40306a ;
push 0 ; uExitCode
call 0x40305c ;
step - 7
将Binary对象转化为可执行文件的操作是由Builder类来实现的；导入表不会被重建，所以我们需要手动配置
builder = lief.PE.Builder(binary32)
builder.build_imports(True)
builder.build()
builder.write("pe_from_scratch.exe")
修改ELF符号
使用exported_functions和imported_functions对funtion进行枚举
import lief
binary = lief.parse("/usr/bin/ls")
library = lief.parse("/usr/lib/libc.so.6")
print(binary.imported_functions)
print(library.exported_functions)
使用lief将下面函数名进行更换
gcc jing.c -lm
#include
#include
#include
double hashme(double input) {
return pow(input, 4) + log(input + 3);
}
int main(int argc, char** argv) {
if (argc != 2) {
printf("Usage: %s N\n", argv[0]);
return EXIT_FAILURE;
}
double N = (double)atoi(argv[1]);
double hash = hashme(N);
printf("%f\n", hash);
return EXIT_SUCCESS;
}
图片.png
将pow和log函数用LIEF把当前的函数名和另一个函数名进行互换
first - 导入文件和库
import lief
hasme = lief.parse("a.out")
libm = lief.parse("/libm.so.6")
second - 改变binary中两个导入函数的函数名：
hashme_pow_sym = next(filter(lambda e : e.name == "pow", my_binary.imported_symbols))
hashme_log_sym = next(filter(lambda e : e.name == "log", my_binary.imported_symbols))
hashme_pow_sym.name = "cos"
hashme_log_sym.name = "sin"
in the end
把log替换为sin，把pow替换为cos，并重建这两个对象
!/usr/bin/env python3
import lief
hasme = lief.parse("hasme")
libm = lief.parse("/usr/lib/libm.so.6")
def swap(obj, a, b):
symbol_a = next(filter(lambda e : e.name == a, obj.dynamic_symbols))
symbol_b = next(filter(lambda e : e.name == b, obj.dynamic_symbols))
b_name = symbol_b.name
symbol_b.name = symbol_a.name
symbol_a.name = b_name
hashme_pow_sym = next(filter(lambda e : e.name == "pow", my_binary.imported_symbols))
hashme_log_sym = next(filter(lambda e : e.name == "log", my_binary.imported_symbols))
hashme_pow_sym.name = "cos"
hashme_log_sym.name = "sin"
swap(libm, "log", "sin")
swap(libm, "pow", "cos")
hashme.write("hashme.obf")
libm.write("libm.so.6")
我们在当前目录下构建了一个修改过后的libm，接下来需要在执行binary.obf的时候强制让Linux加载器加载我们修改过后的这个库。要实现这个功能，我们需要把LD_LIBRARY_PATH导出到当前目录：
$ LD_LIBRARY_PATH=. hashme.obf 123
228886645.836282
修改过后的动态库中cos对应的地址是pow函数的地址,sin的对应地址是log函数的地址，而修改后的binary中调用的分别是cos和sin函数。调用的是cos函数，而实际执行的是pow函数的功能，这就会对分析人员造成困扰