lief 1.0.0

Official Rust bindings for LIEF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

#![allow(warnings)]
mod utils;
use lief;
use lief::assembly::{Instruction, Instructions};
use lief::dwarf::types::{Base, ClassLike, DwarfType};
use lief::dwarf::{Parameter, Scope, Type};
use lief::generic::{Binary, Section};

use std::path::{Path, PathBuf};
use std::sync::Arc;
fn get_binary(name: &str) -> lief::Binary {
    let path = utils::get_sample(Path::new(name)).unwrap();
    let path_str = path.to_str().unwrap();

    let bin = lief::Binary::parse(path_str);
    bin.unwrap()
}

fn should_skip(inst: &lief::assembly::Instructions) -> bool {
    if let lief::assembly::Instructions::X86(x86) = inst {
        if let opcode = x86.opcode() {
            return opcode == lief::assembly::x86::Opcode::JCC_1
                || opcode == lief::assembly::x86::Opcode::JCC_2
                || opcode == lief::assembly::x86::Opcode::JCC_4
                || opcode == lief::assembly::x86::Opcode::JMP_1
                || opcode == lief::assembly::x86::Opcode::JMP_2
                || opcode == lief::assembly::x86::Opcode::JMP_4
                || opcode == lief::assembly::x86::Opcode::CALL64pcrel32
                || opcode == lief::assembly::x86::Opcode::CALLpcrel32;
        }
    }
    return false;
}

fn assemble_inst(
    name: &str,
    bin: &mut dyn lief::generic::Binary,
    inst: &lief::assembly::Instructions,
) {
    println!("{}: {:02X?}", inst.to_string(), inst.raw());
    if should_skip(inst) {
        return;
    }
    let raw = bin.assemble(inst.address(), &inst.to_string_no_address());
    let new_inst = bin
        .disassemble_slice(raw.as_slice(), inst.address())
        .next()
        .unwrap();
    assert_eq!(new_inst.to_string_no_address(), inst.to_string_no_address());
}

fn reassemble_from(name: &str, address: u64, count: usize) {
    let mut bin = get_binary(name);
    match bin {
        lief::Binary::ELF(mut elf) => {
            let insts = elf
                .disassemble_address(address)
                .take(count)
                .collect::<Vec<lief::assembly::Instructions>>();

            for inst in insts {
                assemble_inst(name, &mut elf, &inst);
            }
        }

        lief::Binary::PE(mut pe) => {
            let insts = pe
                .disassemble_address(address)
                .take(count)
                .collect::<Vec<lief::assembly::Instructions>>();

            for inst in insts {
                assemble_inst(name, &mut pe, &inst);
            }
        }

        lief::Binary::MachO(fat) => {
            for mut macho in fat.iter() {
                let insts = macho
                    .disassemble_address(address)
                    .take(count)
                    .collect::<Vec<lief::assembly::Instructions>>();

                for inst in insts {
                    assemble_inst(name, &mut macho, &inst);
                }
            }
        }
        lief::Binary::COFF(_) => {
            todo!();
        }
    }
}
#[test]
fn test_api() {
    if !lief::is_extended() {
        return;
    }

    reassemble_from("MachO/ios17/DebugHierarchyKit", 0x16650, 100); // ARM64E
    //reassemble_from("MachO/macho-issue-1110.bin", 0x00000b10, 10); // PPC
    reassemble_from("PE/ntoskrnl.exe", 0x140200000, 300);
    reassemble_from("ELF/ELF32_x86_library_libshellx.so", 0x000010c0, 300);
    //reassemble_from("ELF/libmonochrome-armv7.so", 0x0468b701, 300); // Thumb
    //reassemble_from("ELF/i872_risv.elf", 0x80000000, 300);

    if let lief::Binary::PE(mut pe) = get_binary("PE/ntoskrnl.exe") {
        let imagebase = pe.imagebase();

        let mut config = lief::assembly::AssemblerConfig::default();

        let entrypoint = pe.entrypoint();
        let resolver = Arc::new(move |symbol: &str| {
            if symbol == "entrypoint" {
                return Some(entrypoint);
            }
            None
        });

        config.symbol_resolver = Some(resolver);
        pe.assemble_with_config(
            pe.entrypoint() - imagebase,
            r#"
        call entrypoint
        "#,
            &config,
        );
    }
}