diff --git a/sins/mutation.py b/sins/mutation.py index 625ec5b..74878e0 100644 --- a/sins/mutation.py +++ b/sins/mutation.py @@ -54,20 +54,14 @@ def generation(queue: Queue, shellcode: bytes): queue.put(result) -def growth(*, shellcode: bytes, length: int) -> bytes: - if length <= len(shellcode): - return bytes(shellcode) - - opcodes = disasm(shellcode) - +def growth(*, shellcode: bytes, objdump: str) -> bytes: max_op_len = 15 - if len(shellcode) > len(opcodes) * max_op_len: + if len(shellcode) > objdump.count('\n') * max_op_len: return bytes(shellcode) - for mnemonic, op_str in opcodes: - if mnemonic == 'nop': - return bytes(shellcode) + if objdump.count('nop'): + return bytes(shellcode) shellcode = bytearray(shellcode) shellcode += b'\x90' diff --git a/sins/run.py b/sins/run.py index 659fa19..c2955f4 100755 --- a/sins/run.py +++ b/sins/run.py @@ -10,6 +10,7 @@ import logging from .mutation import generation, mutate, seed_shell, growth from .orm import db_config, ScrapNode +from .disassemble import objdump def sins(): @@ -94,13 +95,17 @@ def sins(): lineage += 1 continue - if not result: + if result != len(scrap): lineage += 1 continue - scrap = growth(shellcode=scrap, length=result) + logger.debug(f'result: {result}, {len(scrap)}') + + opcodes = objdump(scrap) + scrap = growth(shellcode=scrap, objdump=opcodes) parent = ScrapNode(child=scrap, parent_id=parent.id) + parent.objdump = opcodes session.add(parent) session.commit()