{"action":"created","issue":{"url":"https://api.github.com/repos/cea-sec/miasm/issues/183","labels_url":"https://api.github.com/repos/cea-sec/miasm/issues/183/labels{/name}","comments_url":"https://api.github.com/repos/cea-sec/miasm/issues/183/comments","events_url":"https://api.github.com/repos/cea-sec/miasm/issues/183/events","html_url":"https://github.com/cea-sec/miasm/issues/183","id":90383505,"number":183,"title":"Analysis of linux shellcode","user":{"login":"rlesteve","id":11787785,"avatar_url":"https://avatars.githubusercontent.com/u/11787785?v=3","gravatar_id":"","url":"https://api.github.com/users/rlesteve","html_url":"https://github.com/rlesteve","followers_url":"https://api.github.com/users/rlesteve/followers","following_url":"https://api.github.com/users/rlesteve/following{/other_user}","gists_url":"https://api.github.com/users/rlesteve/gists{/gist_id}","starred_url":"https://api.github.com/users/rlesteve/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rlesteve/subscriptions","organizations_url":"https://api.github.com/users/rlesteve/orgs","repos_url":"https://api.github.com/users/rlesteve/repos","events_url":"https://api.github.com/users/rlesteve/events{/privacy}","received_events_url":"https://api.github.com/users/rlesteve/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-06-23T13:02:55Z","updated_at":"2015-06-27T18:15:54Z","closed_at":null,"body":"Hi,\r\n\r\nI'm trying to use Miasm2 to analyse Linux shellcodes and saw your conference on Sstic 2014 but i'm missing something !\r\nWhen the shellcode is executed in Miasm, int 0x80 are not computed : no errors, no modifications on registers. So i tried to use Linux libs like you used Windows dlls on your example, using functions in *_elf.py instead of ones in *_pe.py.\r\nI tried to add stdlib.h with absolute path and i had an \"KeyError\" :\r\n\r\nTraceback (most recent call last):\r\nFile \"process.py\", line 91, in \r\ne_lib = vm_load_elf(myjit.vm, lib_name)\r\nFile \"/usr/local/lib/python2.7/dist-packages/miasm2/jitter/loader/elf.py\", line 56, in vm_load_elf\r\ne = elf_init.ELF(fdata, *kargs)\r\nFile \"/usr/local/lib/python2.7/dist-packages/elfesteem/elf_init.py\", line 658, in init\r\nself.parse_content()\r\nFile \"/usr/local/lib/python2.7/dist-packages/elfesteem/elf_init.py\", line 671, in parse_content\r\nself.Ehdr = WEhdr(self, self.sex, self.size, self.content)\r\nFile \"/usr/local/lib/python2.7/dist-packages/elfesteem/elf_init.py\", line 32, in init\r\nself.cstr = self.wrapped(sex, size, *args, *kargs)\r\nFile \"/usr/local/lib/python2.7/dist-packages/elfesteem/cstruct.py\", line 56, in init\r\npstr = fix_size(self._fields, wsize)\r\nFile \"/usr/local/lib/python2.7/dist-packages/elfesteem/cstruct.py\", line 23, in fix_size\r\nv = size2type[wsize]\r\nKeyError: 1504\r\n\r\nThat is the code i used to add libs :\r\n\r\n    libs = libimp()\r\n    all_imp_lib = [\"stdlib.h\"]\r\n    all_e = []\r\n\r\n    for lib in all_imp_lib:\r\n        lib_name = os.path.join('/usr/include/', lib)\r\n        e_lib = vm_load_elf(myjit.vm, lib_name)\r\n        libs.add_export_lib(e_lib, lib)\r\n        all_e.append(e_lib)\r\n\r\n    for ee in all_e:\r\n        preload_elf(myjit.vm, ee, libs)\r\n\r\n    e = mv_load_elf(myjit.vm, \"shellcode.bin\")\r\n    preload_elf(myjit.vm, e, libs)\r\n\r\nIf you could help me understanding how to correctly use Miasm :)\r\n\r\n\r\nP.S. : In the way this is not possible, how can i execute a given system call in Miasm VM ?"},"comment":{"url":"https://api.github.com/repos/cea-sec/miasm/issues/comments/116113278","html_url":"https://github.com/cea-sec/miasm/issues/183#issuecomment-116113278","issue_url":"https://api.github.com/repos/cea-sec/miasm/issues/183","id":116113278,"user":{"login":"serpilliere","id":9433661,"avatar_url":"https://avatars.githubusercontent.com/u/9433661?v=3","gravatar_id":"","url":"https://api.github.com/users/serpilliere","html_url":"https://github.com/serpilliere","followers_url":"https://api.github.com/users/serpilliere/followers","following_url":"https://api.github.com/users/serpilliere/following{/other_user}","gists_url":"https://api.github.com/users/serpilliere/gists{/gist_id}","starred_url":"https://api.github.com/users/serpilliere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/serpilliere/subscriptions","organizations_url":"https://api.github.com/users/serpilliere/orgs","repos_url":"https://api.github.com/users/serpilliere/repos","events_url":"https://api.github.com/users/serpilliere/events{/privacy}","received_events_url":"https://api.github.com/users/serpilliere/received_events","type":"User","site_admin":false},"created_at":"2015-06-27T18:15:54Z","updated_at":"2015-06-27T18:15:54Z","body":"Have you got a \"good\" example or the original shell code? (if you can share it with us)"}}