Pin-VM解题工具

2021-09-01

Pin VM解题工具

寒假做了点VM相关的逆向题，了解到了一个工具——Pin

Pin是Intel出的一个插桩工具

安装

直接在官网下载压缩包

Linux / macOS:

1
2
3

$ tar zxf pin-3.2-81205-gcc-linux.tar.gz
$ cd pin-3.2-81205-gcc-linux
Use the macOS* kit names respectively.

Windows:

1	$ cd pin-3.2-81205-msvc-windows

使用

pintools本身提供了很多插件，做VM类的题目就需要我们自己依据模板编写pintool（其实就是填一下地址

插桩的地址是F7跟程序的控制流得来的

模板：

/*
 *source/tools/MyPinTool/MyPinTool.cpp
 */

#include <stdio.h>
#include "pin.H"

FILE * trace;

VOID printip(ADDRINT * ip,ADDRINT *rax,ADDRINT *rdx,ADDRINT *rcx,ADDRINT *rbx) { 
  //打印虚拟机log  
  if((long int)ip == 0x004015F1){ //mov
        if(rbx){
            fprintf(trace, "%p\tMOV (%p)[%p],input[%p]\n", ip, rdx, rcx, rax);
        }else{
            fprintf(trace, "%p\tMOV (%p)[%p],ECX(%p)\n", ip, rdx, rax, rcx);
        }
    }else if ((long int)ip == 0x401594){ //add
        if(rbx){
            fprintf(trace, "%p\tADD RDX,input[%p]+input[%p]\n", ip, rax, rcx);
        }else{
            fprintf(trace, "%p\tADD RDX,input[%p]+%p\n", ip, rax, rcx);
        }
    }else if ((long int)ip == 0x401477){ //xor
        if(rbx){
            fprintf(trace, "%p\tXOR (%p)[%p],input[%p]\n", ip, rdx, rax, rcx);
        }else{
            fprintf(trace, "%p\tXOR (%p)[%p],%p\n", ip, rdx, rax, rcx);
        }
    }else if ((long int)ip == 0x401408){ //cmp
        if(rbx){
            fprintf(trace, "%p\tCMP (%p)[%p],(%p)[%p]\n", ip, rdx, rax, rdx, rcx);
        }else{
            fprintf(trace, "%p\tCMP (%p)[%p],%p\n", ip, rdx, rax, rcx);
        }
    }else if ((long int)ip == 0x401464){ //jmp
        if(rdx){
            fprintf(trace, "%p\tJNZ (%p) no \n", ip, rax);
        }else{
            fprintf(trace, "%p\tJNZ (%p)\n", ip, rax);
        }
    }else if ((long int)ip == 0x401535){ //shr
        if(rbx){
            fprintf(trace, "%p\tSHL (%p)[%p],(%p)[%p]\n", ip, rdx, rax, rdx, rcx);
        }else{
             fprintf(trace, "%p\tSHL (%p)[%p],%p\n", ip, rdx, rax,rcx);
        }
    }else if ((long int)ip == 0x4014D6){ //shl
        if(rbx){
            fprintf(trace, "%p\tSHL (%p)[%p],(%p)[%p]\n", ip, rdx, rax, rdx, rcx);
        }else{
            fprintf(trace, "%p\tSHL (%p)[%p],%p\n", ip, rdx, rax,rcx);
        }
    }
}
VOID Instruction(INS ins, VOID *v){
    long int opList[] = {0x004015F1, 0x401594, 0x401477, 0x401408, 0x401464, 0x401535, 0x4014D6};//需要插桩的地址
    long int ip = INS_Address(ins);
    bool flag = false;
    for (size_t i = 0; i < 7; i++){
        if(ip == opList[i]){
            flag = true;
            break;
        }
    }//进行指令级别插桩
    if(flag){//IPOINT_BEFORE在指令执行前插桩
        INS_InsertCall(ins, IPOINT_BEFORE, (AFUNPTR)printip,
                   IARG_INST_PTR,
                   IARG_REG_VALUE,REG_EAX,
                   IARG_REG_VALUE,REG_EDX,
                   IARG_REG_VALUE,REG_ECX,
                   IARG_REG_VALUE,REG_EBX,
                   IARG_END);
    }
  //以IARG_REG_VALUE,REG_EAX的形式将执行这条指令前的寄存器值传入
}

VOID Fini(INT32 code, VOID *v)
{
    fprintf(trace, "#eof\n");
    fclose(trace);
}

/* ===================================================================== */
/* Print Help Message                                                    */
/* ===================================================================== */

INT32 Usage()
{
    PIN_ERROR("This Pintool log flow\n" 
              + KNOB_BASE::StringKnobSummary() + "\n");
    return -1;
}

/* ===================================================================== */
/* Main                                                                  */
/* ===================================================================== */

int main(int argc, char * argv[])
{
    trace = fopen("itrace.out", "w");

    // Initialize pin
    if (PIN_Init(argc, argv)) return Usage();

    // Register Instruction to be called to instrument instructions
    INS_AddInstrumentFunction(Instruction, 0);
    // Register Fini to be called when the application exits
    PIN_AddFiniFunction(Fini, 0);

    // Start the program, never returns
    PIN_StartProgram();

    return 0;
}
//这里的地址是程序中虚拟机的每个代码段的起始地址

写完pintool后

$ cd source/tools/MyPinTool
$ make all TARGET=ia32  //64位就是intel64
$ ../../../pin -t obj-intel64/MyPinTool.so -- ./[targetfile]
//最后一个参数是输入的参数，运行后会运行这个程序

然后生成的itrace.out就是受虚拟机所保护的控制流，可以直接阅读汇编猜测加密手段，也可以编译之后反编译成伪C阅读