WASM逆向辅助脚本

在wasm加载完成后再注入如下代码,便可在后面调试的时候使用以查看wasm申请的内存

wasm = i.instance.exports;
memories = [wasm.memory]
viewDWORD = (addr) =>{
    const arr = new Uint32Array(memories[0].buffer.slice(addr, addr + 16));
    return arr;
};
viewChar = (addr, size = 16) =>{
    const arr = new Uint8Array(memories[0].buffer.slice(addr, addr + size));
    return String.fromCharCode.apply(null, arr);
};
viewHEX = (addr, size = 16) =>{
    const arr = new Uint8Array(memories[0].buffer.slice(addr, addr + size));
    return (Array.from(arr, x =>x.toString(16).padStart(2, '0')).join(' '));
};
viewHexCode = (addr, size = 16) =>{
    const arr = new Uint8Array(memories[0].buffer.slice(addr, addr + size));
    return (Array.from(arr, x =>'0x' + x.toString(16).padStart(2, '0')).join(', '));
};
dumpMemory = (addr, size = 16) =>{
    const arr = new Uint8Array(memories[0].buffer.slice(addr, addr + size));
    return arr;
};
viewString = (addr, size = 16) =>{
    const arr = new Uint8Array(memories[0].buffer.slice(addr, addr + size));
    let max = size;
    for (let i = 0; i < size; i++) {
        if (arr[i] === 0) {
            max = i;
            break;
        }
    }
    return String.fromCharCode.apply(null, arr.slice(0, max));
};

search = function(stirng) {
    const m = new Uint8Array(memories[0].buffer);
    // vid=35402, 9AAizQZJ
    // vid=20268, a3fMpSkB
    const k = Array.from(stirng, x =>x.charCodeAt());
 
    const match = (j) =>{
        return k.every((b, i) =>m[i + j] === b);
    };
    const max = Math.min(10_000_000, m.byteLength || m.length);
    for (let i = 0; i < max; i++) {
        if (match(i)) {
            console.info(i);
        }
    }
    console.info('done');
}

评论

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注