IOT二进制漏洞挖掘小工具

import argparse
import r2pipe
import subprocess
import json

def get_dynamic_libraries(r2, file_system_path):
    libraries = []
    libs = r2.cmdj('ilj')
    for lib in libs:
        library = get_path_by_filename(lib, file_system_path)
        libraries.append(library)

    return libraries

def get_path_by_filename(filename, file_system_path):
    output = subprocess.check_output(['find', file_system_path, '-name', filename]).decode('utf-8')
    for line in output.split('\n'):
        if line:
            return line

def get_referencing_functions(r2, filename, target_symbols):
    referencing_functions = []

    r2.cmd('aaa')  # 执行初始分析
    functions = r2.cmdj('aflj')

    for function in functions:
        function_name = function['name']
        if any(symbol in function_name for symbol in target_symbols):
            refs = r2.cmdj(f"axtj {function_name}")
            for ref in refs:
                ref_address = ref['from']
                ref_functions = r2.cmdj(f"afij {ref_address}")
                if ref_functions:
                    ref_function = ref_functions[0]
                    ref_function_name = ref_function['name']
                    ref_function_disassembly = r2.cmd(f"pdf @ {ref_function_name}")
                    referencing_functions.append((ref_function_name, ref_function_disassembly, function_name, filename))

    return referencing_functions

def find_referencing_functions_in_libraries(main_program, libraries, target_symbols):
    referencing_functions = []

    print("Load Program")
    print(f"Program Name: {main_program}")
    r2_main = r2pipe.open(main_program)

    # 获取程序的架构和端序
    program_architecture = get_architecture(r2_main)
    program_endian = get_endian(r2_main)

    print(f"Program Architecture: {program_architecture}")
    print(f"Program Endian: {program_endian}")
    print("------------------------------------------------------------")

    main_program_referencing_functions = get_referencing_functions(r2_main, main_program, target_symbols)
    referencing_functions.extend(main_program_referencing_functions)
    r2_main.quit()
    print("Load Libraries")

    for library in libraries:
        print(f"Library Name: {library}")

        r2_lib = r2pipe.open(library)

        # 获取库的架构和端序
        libc_architecture = get_architecture(r2_lib)
        libc_endian = get_endian(r2_lib)

        print(f"Library Architecture: {libc_architecture}")
        print(f"Library Endian: {libc_endian}")
        print("------------------------------------------------------------")

        library_referencing_functions = get_referencing_functions(r2_lib, library, target_symbols)
        referencing_functions.extend(library_referencing_functions)

        r2_lib.quit()

    return referencing_functions

def get_architecture(r2fd):
    info = json.loads(r2fd.cmd('iIj'))
    return info["arch"]

def get_endian(r2fd):
    info = json.loads(r2fd.cmd('iIj'))
    return info["endian"]

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Find referencing functions in a program and libraries.')
    parser.add_argument('-p', '--program', type=str, help='Path to the main program')
    parser.add_argument('-f', '--filesystem', type=str, help='Path to the file system')
    parser.add_argument('-s', '--symbols', type=str, help='Target symbols (comma-separated)', default='system,execve,popen')
    parser.add_argument('-d', '--disassembly', type=int, help='Print disassembly information (0 or 1)', default=0)

    args = parser.parse_args()

    if not args.program or not args.filesystem:
        parser.print_help()
        exit()

    main_program = args.program
    file_system_path = args.filesystem
    target_symbols = args.symbols.split(',')
    print_disassembly = bool(args.disassembly)

    r2 = r2pipe.open(main_program)
    libraries = get_dynamic_libraries(r2, file_system_path)
    r2.quit()

    referencing_functions = find_referencing_functions_in_libraries(main_program, libraries, target_symbols)

    unique_functions = set((function_name, symbol, filename) for function_name, _, symbol, filename in referencing_functions)

    print("Referencing Functions in Main Program:")

    for function_name, symbol, filename in unique_functions:
        if filename == main_program:
            print(f"File: {filename}")
            print(f"Symbol: {symbol}")
            print(f"Function: {function_name}")
            print("------------------------------------------------------------")
    print("Referencing Functions in Libraries:")
    for function_name, symbol, filename in unique_functions:
        if filename != main_program:
            print(f"File: {filename}")
            print(f"Symbol: {symbol}")
            print(f"Function: {function_name}")
            print("------------------------------------------------------------")
if print_disassembly:
    for ref_function_name, ref_function_disassembly, _, _ in referencing_functions:
        print(f"Referenced by: {ref_function_name}")
        print(f"Disassembly:\n{ref_function_disassembly}")
        print("------------------------------------------------------------")