PowerPC

PowerPC

MMUShell

Bases: MMUShell

Source code in mmushell/architectures/ppc.py

class MMUShell(MMUShellDefault):
    def __init__(self, completekey="tab", stdin=None, stdout=None, machine={}):
        super(MMUShell, self).__init__(completekey, stdin, stdout, machine)

        if not self.data:
            self.data = Data(
                is_mem_parsed=False,
                is_registers_found=False,
                opcodes={},
                regs_values={},
                htables={},
            )

    def do_parse_memory(self, args):
        """Parse memory to find opcode MMU related and hash tables"""
        if self.data.is_mem_parsed:
            logger.warning("Memory already parsed")
            return

        self.parse_memory()
        self.data.is_mem_parsed = True

    def parse_memory(self):
        # Collect opcodes and hash table of the minium size
        (
            fragments,
            self.data.opcodes,
        ) = self.machine.mmu.collect_htable_framents_opcodes()

        # Glue hash table
        htables = self.machine.mmu.glue_htable_fragments(fragments)

        # Filtering results
        self.data.htables = self.machine.mmu.filter_htables(htables)

    def do_show_hashtables(self, args):
        """Show hash tables found"""
        if not self.data.is_mem_parsed:
            logger.warning("Please, parse the memory first")
            return

        table = PrettyTable()
        table.field_names = ["Address", "Size"]

        for size in sorted(self.data.htables.keys()):
            for htable in self.data.htables[size]:
                table.add_row([hex(htable.address), hex(size)])

        print(table)

    def do_find_registers_values(self, arg):
        """Find and execute MMU related functions inside the memory dump in order to extract MMU registers values"""

        if not self.data.is_mem_parsed:
            logging.warning("First parse the dump!")
            return

        if self.data.is_registers_found:
            logging.warning("Registers already searched")
            return

        logging.info("This analysis could be extremely slow!")
        logging.info("Use heuristics to find function addresses...")
        self.machine.cpu.identify_functions_start(self.data.opcodes)

        logging.info("Identify register values using data flow analysis...")

        # We use data flow analysis and merge the results
        dataflow_values = self.machine.cpu.find_registers_values_dataflow(
            self.data.opcodes, zero_registers=["ZERO"]
        )

        filtered_values = defaultdict(set)
        for register, values in dataflow_values.items():
            for value in values:
                reg_obj = CPURegPPC.get_register_obj(register, value)
                if reg_obj.valid:
                    filtered_values[register].add(reg_obj)

        # Add default values
        for register, value in self.machine.cpu.registers_values.items():
            if (
                register
                not in self.machine.cpu.processor_features[
                    "opcode_to_mmu_regs"
                ].values()
            ):
                continue

            reg_obj = CPURegPPC.get_register_obj(register, value)
            if reg_obj.valid and all(
                [not reg_obj.is_mmu_equivalent_to(x) for x in filtered_values[register]]
            ):
                filtered_values[register].add(reg_obj)

        self.data.regs_values = filtered_values
        self.data.is_registers_found = True

    def do_show_registers(self, args):
        """Show registers values found"""
        if not self.data.is_registers_found:
            logging.info("Please, find them first!")
            return

        for registers in sorted(self.data.regs_values.keys()):
            for register in self.data.regs_values[registers]:
                print(register)

    def do_show_hashtable(self, arg):
        "Parse a Hash Table of a given size"
        "Usage: show_hashtable ADDRESS size"

        arg = arg.split()
        if len(arg) < 2:
            logging.error("Missing parameter")
            return

        try:
            address = self.parse_int(arg[0])
            size = self.parse_int(arg[1])
        except ValueError:
            logging.error("Invalid format")
            return

        if address is None:
            logging.error("Invalid address format")
            return

        if address not in self.machine.memory:
            logging.error("Address not in memory address space")
            return

        valid_sizes = [
            65536,
            131072,
            262144,
            524288,
            1048576,
            2097152,
            4194304,
            8388608,
            16777216,
            33554432,
        ]
        if size not in valid_sizes:
            logging.error(f"Invalid order table. Valid sizes are {valid_sizes}")
            return

        frame_buf = self.machine.memory.get_data(address, size)
        table = self.machine.mmu.parse_hash_table(frame_buf, size, address)
        if table is None:
            logging.warning("Table not present or malformed")
        else:
            print(table)

do_find_registers_values(arg)

Find and execute MMU related functions inside the memory dump in order to extract MMU registers values

Source code in mmushell/architectures/ppc.py

def do_find_registers_values(self, arg):
    """Find and execute MMU related functions inside the memory dump in order to extract MMU registers values"""

    if not self.data.is_mem_parsed:
        logging.warning("First parse the dump!")
        return

    if self.data.is_registers_found:
        logging.warning("Registers already searched")
        return

    logging.info("This analysis could be extremely slow!")
    logging.info("Use heuristics to find function addresses...")
    self.machine.cpu.identify_functions_start(self.data.opcodes)

    logging.info("Identify register values using data flow analysis...")

    # We use data flow analysis and merge the results
    dataflow_values = self.machine.cpu.find_registers_values_dataflow(
        self.data.opcodes, zero_registers=["ZERO"]
    )

    filtered_values = defaultdict(set)
    for register, values in dataflow_values.items():
        for value in values:
            reg_obj = CPURegPPC.get_register_obj(register, value)
            if reg_obj.valid:
                filtered_values[register].add(reg_obj)

    # Add default values
    for register, value in self.machine.cpu.registers_values.items():
        if (
            register
            not in self.machine.cpu.processor_features[
                "opcode_to_mmu_regs"
            ].values()
        ):
            continue

        reg_obj = CPURegPPC.get_register_obj(register, value)
        if reg_obj.valid and all(
            [not reg_obj.is_mmu_equivalent_to(x) for x in filtered_values[register]]
        ):
            filtered_values[register].add(reg_obj)

    self.data.regs_values = filtered_values
    self.data.is_registers_found = True

do_parse_memory(args)

Parse memory to find opcode MMU related and hash tables

Source code in mmushell/architectures/ppc.py

def do_parse_memory(self, args):
    """Parse memory to find opcode MMU related and hash tables"""
    if self.data.is_mem_parsed:
        logger.warning("Memory already parsed")
        return

    self.parse_memory()
    self.data.is_mem_parsed = True

do_show_hashtable(arg)

Parse a Hash Table of a given size

Source code in mmushell/architectures/ppc.py

def do_show_hashtable(self, arg):
    "Parse a Hash Table of a given size"
    "Usage: show_hashtable ADDRESS size"

    arg = arg.split()
    if len(arg) < 2:
        logging.error("Missing parameter")
        return

    try:
        address = self.parse_int(arg[0])
        size = self.parse_int(arg[1])
    except ValueError:
        logging.error("Invalid format")
        return

    if address is None:
        logging.error("Invalid address format")
        return

    if address not in self.machine.memory:
        logging.error("Address not in memory address space")
        return

    valid_sizes = [
        65536,
        131072,
        262144,
        524288,
        1048576,
        2097152,
        4194304,
        8388608,
        16777216,
        33554432,
    ]
    if size not in valid_sizes:
        logging.error(f"Invalid order table. Valid sizes are {valid_sizes}")
        return

    frame_buf = self.machine.memory.get_data(address, size)
    table = self.machine.mmu.parse_hash_table(frame_buf, size, address)
    if table is None:
        logging.warning("Table not present or malformed")
    else:
        print(table)

do_show_hashtables(args)

Show hash tables found

Source code in mmushell/architectures/ppc.py

def do_show_hashtables(self, args):
    """Show hash tables found"""
    if not self.data.is_mem_parsed:
        logger.warning("Please, parse the memory first")
        return

    table = PrettyTable()
    table.field_names = ["Address", "Size"]

    for size in sorted(self.data.htables.keys()):
        for htable in self.data.htables[size]:
            table.add_row([hex(htable.address), hex(size)])

    print(table)

do_show_registers(args)

Show registers values found

Source code in mmushell/architectures/ppc.py

def do_show_registers(self, args):
    """Show registers values found"""
    if not self.data.is_registers_found:
        logging.info("Please, find them first!")
        return

    for registers in sorted(self.data.regs_values.keys()):
        for register in self.data.regs_values[registers]:
            print(register)

MMUShellGTruth

Bases: MMUShell

Source code in mmushell/architectures/ppc.py

class MMUShellGTruth(MMUShell):
    def do_show_hashtables_gtruth(self, args):
        """Show hash tables found and compare them with the ground truth"""
        if not self.data.is_mem_parsed:
            logger.warning("Please, parse the memory first")
            return

        table = PrettyTable()
        table.field_names = [
            "Address",
            "Size",
            "Found",
            "Correct size",
            "First seen",
            "Last seen",
        ]

        # Collect valid true table
        valids = {}
        for sdr1_value, sdr1_data in self.gtruth["SDR1"].items():
            sdr1_obj = SDR1(sdr1_value)
            if not sdr1_obj.valid:
                continue
            valids[sdr1_obj.address] = [
                sdr1_obj.size,
                sdr1_data["first_seen"],
                sdr1_data["last_seen"],
            ]

        # MMUShell found values
        found = {}
        for size in self.data.htables:
            for table_obj in self.data.htables[size]:
                found[table_obj.address] = [
                    table_obj.size,
                    "False positive",
                    "False positive",
                ]

        already_visited = set()
        for k, v in valids.items():
            table.add_row(
                [
                    hex(k),
                    hex(v[0]),
                    "X" if k in found else "",
                    "X"
                    if v[0]
                    == found.get(
                        k,
                        [
                            None,
                        ],
                    )[0]
                    else "",
                    v[1],
                    v[2],
                ]
            )
            already_visited.add((k, v[0]))

        fps = 0
        for k, v in found.items():
            if (k, v[0]) in already_visited:
                continue
            table.add_row([hex(k), hex(v[0]), "", "", v[1], v[2]])
            fps += 1

        print(table)
        print(f"FP: {fps}")

    def do_show_registers_gtruth(self, args):
        """Show registers value retrieved and compare with the ground truth"""
        if not self.data.is_registers_found:
            logging.info("Please, find them first!")
            return

        # Check if the last value of SDR1 was found
        last_sdr1 = SDR1(
            sorted(
                self.gtruth["SDR1"].keys(),
                key=lambda x: self.gtruth["SDR1"][x]["last_seen"],
                reverse=True,
            )[0]
        )
        print(f"Correct SDR1 value: {last_sdr1}")
        print(
            "SDR1 correct value... {}FOUND".format(
                "" if last_sdr1 in self.data.regs_values["SDR1"] else "NOT "
            )
        )

        # Found last BAT registers used by the system
        bats_found = {}
        for t in ["I", "D"]:
            for i in range(4):
                reg_name = t + "BAT" + str(i)
                batu_v, batl_v = sorted(
                    self.gtruth[reg_name].keys(),
                    key=lambda x: self.gtruth[reg_name][x][1],
                    reverse=True,
                )[0]
                bats_found[reg_name + "U"] = BATU(batu_v, reg_name + "U")
                bats_found[reg_name + "L"] = BATL(batl_v, reg_name + "L")

        # Check if values are found
        for reg_name in bats_found:
            print(
                "{} correct value... {}FOUND\t\t{}".format(
                    reg_name,
                    ""
                    if bats_found[reg_name] in self.data.regs_values[reg_name]
                    else "NOT ",
                    bats_found[reg_name],
                )
            )

do_show_hashtables_gtruth(args)

Show hash tables found and compare them with the ground truth

Source code in mmushell/architectures/ppc.py

def do_show_hashtables_gtruth(self, args):
    """Show hash tables found and compare them with the ground truth"""
    if not self.data.is_mem_parsed:
        logger.warning("Please, parse the memory first")
        return

    table = PrettyTable()
    table.field_names = [
        "Address",
        "Size",
        "Found",
        "Correct size",
        "First seen",
        "Last seen",
    ]

    # Collect valid true table
    valids = {}
    for sdr1_value, sdr1_data in self.gtruth["SDR1"].items():
        sdr1_obj = SDR1(sdr1_value)
        if not sdr1_obj.valid:
            continue
        valids[sdr1_obj.address] = [
            sdr1_obj.size,
            sdr1_data["first_seen"],
            sdr1_data["last_seen"],
        ]

    # MMUShell found values
    found = {}
    for size in self.data.htables:
        for table_obj in self.data.htables[size]:
            found[table_obj.address] = [
                table_obj.size,
                "False positive",
                "False positive",
            ]

    already_visited = set()
    for k, v in valids.items():
        table.add_row(
            [
                hex(k),
                hex(v[0]),
                "X" if k in found else "",
                "X"
                if v[0]
                == found.get(
                    k,
                    [
                        None,
                    ],
                )[0]
                else "",
                v[1],
                v[2],
            ]
        )
        already_visited.add((k, v[0]))

    fps = 0
    for k, v in found.items():
        if (k, v[0]) in already_visited:
            continue
        table.add_row([hex(k), hex(v[0]), "", "", v[1], v[2]])
        fps += 1

    print(table)
    print(f"FP: {fps}")

do_show_registers_gtruth(args)

Show registers value retrieved and compare with the ground truth

Source code in mmushell/architectures/ppc.py

def do_show_registers_gtruth(self, args):
    """Show registers value retrieved and compare with the ground truth"""
    if not self.data.is_registers_found:
        logging.info("Please, find them first!")
        return

    # Check if the last value of SDR1 was found
    last_sdr1 = SDR1(
        sorted(
            self.gtruth["SDR1"].keys(),
            key=lambda x: self.gtruth["SDR1"][x]["last_seen"],
            reverse=True,
        )[0]
    )
    print(f"Correct SDR1 value: {last_sdr1}")
    print(
        "SDR1 correct value... {}FOUND".format(
            "" if last_sdr1 in self.data.regs_values["SDR1"] else "NOT "
        )
    )

    # Found last BAT registers used by the system
    bats_found = {}
    for t in ["I", "D"]:
        for i in range(4):
            reg_name = t + "BAT" + str(i)
            batu_v, batl_v = sorted(
                self.gtruth[reg_name].keys(),
                key=lambda x: self.gtruth[reg_name][x][1],
                reverse=True,
            )[0]
            bats_found[reg_name + "U"] = BATU(batu_v, reg_name + "U")
            bats_found[reg_name + "L"] = BATL(batl_v, reg_name + "L")

    # Check if values are found
    for reg_name in bats_found:
        print(
            "{} correct value... {}FOUND\t\t{}".format(
                reg_name,
                ""
                if bats_found[reg_name] in self.data.regs_values[reg_name]
                else "NOT ",
                bats_found[reg_name],
            )
        )