defcheck_system(bv,symbol="system"): addr = get_function_addr(bv,symbol) if addr == None: return [] refs = bv.get_code_refs(addr) ret = [] for ref in refs: func = ref.function cmd = func.get_parameter_at(ref.address,None,0) if is_constant(cmd): continue ret.append((symbol,func.name,ref.address,Error.COMMANDINJECT)) return ret
defget_function_addr(bv,symbol): syms = [] if symbol in bv.symbols: syms = bv.symbols[symbol] if"_%s"%symbol in bv.symbols: syms = bv.symbols["_%s"%symbol] for i in syms: if"mips32" == bv.arch.name or"mipsel32" == bv.arch.name: if i.type == SymbolType.ImportAddressSymbol: return i.address else: if i.type == SymbolType.ImportedFunctionSymbol: return i.address returnNone
defis_constant(a): return a.type == RegisterValueType.ConstantPointerValue or a.type == RegisterValueType.ConstantValue
if __name__ == "__main__": input_file = sys.argv[1] if os.path.exists(input_file + ".bndb"): bv = open_view(input_file + ".bndb") else: bv = open_view(input_file) settings = SaveSettings() bv.create_database(input_file + ".bndb", None, settings) ret = check_system(bv) for i in ret: print("%-15s function: %-20s addr: 0x%x %s"%(i[0],i[1],i[2],i[3]))