Miasm 是一个免费开源的（GPLv2）逆向工程框架。 Miasm 旨在分析/修改/生成二进制程序。以下是 一个非详尽的功能列表：
访问官方 博客 获取更多示例和演示。
导入 Miasm x86 架构：```pycon
from miasm.arch.x86.arch import mn_x86 from miasm.core.locationdb import LocationDB
获取位置数据库：```pycon
>>> loc_db = LocationDB()
组装一行：```pycon
l = mn_x86.fromstring('XOR ECX, ECX', loc_db, 32) print(l) XOR ECX, ECX mn_x86.asm(l) ['1\xc9', '3\xc9', 'g1\xc9', 'g3\xc9']
修改一个操作数：```pycon
>>> l.args[0] = mn_x86.regs.EAX
>>> print(l)
XOR EAX, ECX
>>> a = mn_x86.asm(l)
>>> print(a)
['1\xc8', '3\xc1', 'g1\xc8', 'g3\xc1']
对结果进行反汇编：```pycon
print(mn_x86.dis(a[0], 32)) XOR EAX, ECX
使用 `Machine` 抽象：```pycon
>>> from miasm.analysis.machine import Machine
>>> mn = Machine('x86_32').mn
>>> print(mn.dis('\x33\x30', 32))
XOR ESI, DWORD PTR [EAX]
对于 MIPS：```pycon
mn = Machine('mips32b').mn print(mn.dis(b'\x97\xa3\x00 ', "b")) LHU V1, 0x20(SP)
中间表示
---------------------------
创建一条指令：```pycon
>>> machine = Machine('arml')
>>> instr = machine.mn.dis('\x00 \x88\xe0', 'l')
>>> print(instr)
ADD R2, R8, R0
创建一个中间表示对象：```pycon
lifter = machine.lifter_model_call(loc_db)
创建一个空的ircfg:```pycon
>>> ircfg = lifter.new_ircfg()
添加指令到池中：```pycon
lifter.add_instr_to_ircfg(instr, ircfg)
打印当前池：```pycon
>>> for lbl, irblock in ircfg.blocks.items():
... print(irblock)
loc_0:
R2 = R8 + R0
IRDst = loc_4
处理 IR，例如通过获取副作用：```pycon
for lbl, irblock in ircfg.blocks.items(): ... for assignblk in irblock: ... rw = assignblk.get_rw() ... for dst, reads in rw.items(): ... print('read: ', [str(x) for x in reads]) ... print('written:', dst) ... print() ... read: ['R8', 'R0'] written: R2
read: [] written: IRDst
更多关于Miasm IR的信息见[对应的Jupyter Notebook](https://github.com/cea-sec/miasm/blob/master/doc/expression/expression.ipynb)。
模拟
---------
给出一个shellcode：```pycon
00000000 8d4904 lea ecx, [ecx+0x4]
00000003 8d5b01 lea ebx, [ebx+0x1]
00000006 80f901 cmp cl, 0x1
00000009 7405 jz 0x10
0000000b 8d5bff lea ebx, [ebx-1]
0000000e eb03 jmp 0x13
00000010 8d5b01 lea ebx, [ebx+0x1]
00000013 89d8 mov eax, ebx
00000015 c3 ret
>>> s = b'\x8dI\x04\x8d[\x01\x80\xf9\x01t\x05\x8d[\xff\xeb\x03\x8d[\x01\x89\xd8\xc3'
使用 Container 抽象来导入 shellcode：```pycon
from miasm.analysis.binary import Container c = Container.from_string(s, loc_db) c <miasm.analysis.binary.ContainerUnknown object at 0x7f34cefe6090>
将位于地址 `0` 处的 shellcode 进行反汇编：```pycon
>>> from miasm.analysis.machine import Machine
>>> machine = Machine('x86_32')
>>> mdis = machine.dis_engine(c.bin_stream, loc_db=loc_db)
>>> asmcfg = mdis.dis_multiblock(0)
>>> for block in asmcfg.blocks:
... print(block)
...
loc_0
LEA ECX, DWORD PTR [ECX + 0x4]
LEA EBX, DWORD PTR [EBX + 0x1]
CMP CL, 0x1
JZ loc_10
-> c_next:loc_b c_to:loc_10
loc_10
LEA EBX, DWORD PTR [EBX + 0x1]
-> c_next:loc_13
loc_b
LEA EBX, DWORD PTR [EBX + 0xFFFFFFFF]
JMP loc_13
-> c_to:loc_13
loc_13
MOV EAX, EBX
RET
使用栈初始化 JIT 引擎：```pycon
jitter = machine.jitter(loc_db, jit_type='python') jitter.init_stack()
将shellcode添加到一个任意内存位置：```pycon
>>> run_addr = 0x40000000
>>> from miasm.jitter.csts import PAGE_READ, PAGE_WRITE
>>> jitter.vm.add_memory_page(run_addr, PAGE_READ | PAGE_WRITE, s)
创建一个哨兵来捕获shellcode的返回：```Python def code_sentinelle(jitter): jitter.running = False jitter.pc = 0 return True
jitter.add_breakpoint(0x1337beef, code_sentinelle) jitter.push_uint32_t(0x1337beef)
活动日志：```pycon
>>> jitter.set_trace_log()
在任意地址运行：```pycon
jitter.init_run(run_addr) jitter.continue_run() RAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000000 RDX 0000000000000000 RSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000 zf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000 RIP 0000000040000000 40000000 LEA ECX, DWORD PTR [ECX+0x4] RAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000004 RDX 0000000000000000 RSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000 zf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000 .... 4000000e JMP loc_0000000040000013:0x40000013 RAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000004 RDX 0000000000000000 RSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000 zf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000 RIP 0000000040000013 40000013 MOV EAX, EBX RAX 0000000000000000 RBX 0000000000000000 RCX 0000000000000004 RDX 0000000000000000 RSI 0000000000000000 RDI 0000000000000000 RSP 000000000123FFF8 RBP 0000000000000000 zf 0000000000000000 nf 0000000000000000 of 0000000000000000 cf 0000000000000000 RIP 0000000040000013 40000015 RET
与 jitter 交互：```pycon
>>> jitter.vm
ad 1230000 size 10000 RW_ hpad 0x2854b40
ad 40000000 size 16 RW_ hpad 0x25e0ed0
>>> hex(jitter.cpu.EAX)
'0x0L'
>>> jitter.cpu.ESI = 12
初始化IR池：```pycon
lifter = machine.lifter_model_call(loc_db) ircfg = lifter.new_ircfg_from_asmcfg(asmcfg)
使用默认符号值初始化引擎：```pycon
>>> from miasm.ir.symbexec import SymbolicExecutionEngine
>>> sb = SymbolicExecutionEngine(lifter)
启动执行：```pycon
symbolic_pc = sb.run_at(ircfg, 0) print(symbolic_pc) ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)
同上，带有步骤日志（仅显示更改）：```pycon
>>> sb = SymbolicExecutionEngine(lifter, machine.mn.regs.regs_init)
>>> symbolic_pc = sb.run_at(ircfg, 0, step=True)
Instr LEA ECX, DWORD PTR [ECX + 0x4]
Assignblk:
ECX = ECX + 0x4
________________________________________________________________________________
ECX = ECX + 0x4
________________________________________________________________________________
Instr LEA EBX, DWORD PTR [EBX + 0x1]
Assignblk:
EBX = EBX + 0x1
________________________________________________________________________________
EBX = EBX + 0x1
ECX = ECX + 0x4
________________________________________________________________________________
Instr CMP CL, 0x1
Assignblk:
zf = (ECX[0:8] + -0x1)?(0x0,0x1)
nf = (ECX[0:8] + -0x1)[7:8]
pf = parity((ECX[0:8] + -0x1) & 0xFF)
of = ((ECX[0:8] ^ (ECX[0:8] + -0x1)) & (ECX[0:8] ^ 0x1))[7:8]
cf = (((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1)) ^ ((ECX[0:8] ^ (ECX[0:8] + -0x1)) & (ECX[0:8] ^ 0x1)))[7:8]
af = ((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1))[4:5]
________________________________________________________________________________
af = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5]
pf = parity((ECX + 0x4)[0:8] + 0xFF)
zf = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1)
ECX = ECX + 0x4
of = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1))[7:8]
nf = ((ECX + 0x4)[0:8] + 0xFF)[7:8]
cf = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8]
EBX = EBX + 0x1
________________________________________________________________________________
Instr JZ loc_key_1
Assignblk:
IRDst = zf?(loc_key_1,loc_key_2)
EIP = zf?(loc_key_1,loc_key_2)
________________________________________________________________________________
af = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5]
EIP = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)
pf = parity((ECX + 0x4)[0:8] + 0xFF)
IRDst = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10)
zf = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1)
ECX = ECX + 0x4
of = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1))[7:8]
nf = ((ECX + 0x4)[0:8] + 0xFF)[7:8]
cf = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8]
EBX = EBX + 0x1
________________________________________________________________________________
>>>
使用具体的ECX重试执行。在此，符号/具体执行到达shellcode的末尾：```pycon
from miasm.expression.expression import ExprInt sb.symbols[machine.mn.regs.ECX] = ExprInt(-3, 32) symbolic_pc = sb.run_at(ircfg, 0, step=True) Instr LEA ECX, DWORD PTR [ECX + 0x4] Assignblk: ECX = ECX + 0x4
af = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5] EIP = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10) pf = parity((ECX + 0x4)[0:8] + 0xFF) IRDst = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10) zf = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1) ECX = 0x1 of = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1))[7:8] nf = ((ECX + 0x4)[0:8] + 0xFF)[7:8] cf = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8] EBX = EBX + 0x1
Instr LEA EBX, DWORD PTR [EBX + 0x1] Assignblk: EBX = EBX + 0x1
af = (((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[4:5] EIP = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10) pf = parity((ECX + 0x4)[0:8] + 0xFF) IRDst = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10) zf = ((ECX + 0x4)[0:8] + 0xFF)?(0x0,0x1) ECX = 0x1 of = ((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1))[7:8] nf = ((ECX + 0x4)[0:8] + 0xFF)[7:8] cf = (((((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8]) & ((ECX + 0x4)[0:8] ^ 0x1)) ^ ((ECX + 0x4)[0:8] + 0xFF) ^ (ECX + 0x4)[0:8] ^ 0x1)[7:8] EBX = EBX + 0x2
Instr CMP CL, 0x1 Assignblk: zf = (ECX[0:8] + -0x1)?(0x0,0x1) nf = (ECX[0:8] + -0x1)[7:8] pf = parity((ECX[0:8] + -0x1) & 0xFF) of = ((ECX[0:8] ^ (ECX[0:8] + -0x1)) & (ECX[0:8] ^ 0x1))[7:8] cf = (((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1)) ^ ((ECX[0:8] ^ (ECX[0:8] + -0x1)) & (ECX[0:8] ^ 0x1)))[7:8] af = ((ECX[0:8] ^ 0x1) ^ (ECX[0:8] + -0x1))[4:5]
af = 0x0 EIP = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10) pf = 0x1 IRDst = ((ECX + 0x4)[0:8] + 0xFF)?(0xB,0x10) zf = 0x1 ECX = 0x1 of = 0x0 nf = 0x0 cf = 0x0 EBX = EBX + 0x2
Instr JZ loc_key_1 Assignblk: IRDst = zf?(loc_key_1,loc_key_2) EIP = zf?(loc_key_1,loc_key_2)
af = 0x0 EIP = 0x10 pf = 0x1 IRDst = 0x10 zf = 0x1 ECX = 0x1 of = 0x0 nf = 0x0 cf = 0x0 EBX = EBX + 0x2
Instr LEA EBX, DWORD PTR [EBX + 0x1] Assignblk: EBX = EBX + 0x1
af = 0x0 EIP = 0x10 pf = 0x1 IRDst = 0x10 zf = 0x1 ECX = 0x1 of = 0x0 nf = 0x0 cf = 0x0 EBX = EBX + 0x3
Instr LEA EBX, DWORD PTR [EBX + 0x1] Assignblk: IRDst = loc_key_3
af = 0x0 EIP = 0x10 pf = 0x1 IRDst = 0x13 zf = 0x1 ECX = 0x1 of = 0x0 nf = 0x0 cf = 0x0 EBX = EBX + 0x3
Instr MOV EAX, EBX Assignblk: EAX = EBX
af = 0x0 EIP = 0x10 pf = 0x1 IRDst = 0x13 zf = 0x1 ECX = 0x1 of = 0x0 nf = 0x0 cf = 0x0 EBX = EBX + 0x3 EAX = EBX + 0x3
Instr RET Assignblk: IRDst = @32[ESP[0:32]] ESP = {ESP[0:32] + 0x4 0 32} EIP = @32[ESP[0:32]]
af = 0x0 EIP = @32[ESP] pf = 0x1 IRDst = @32[ESP] zf = 0x1 ECX = 0x1 of = 0x0 nf = 0x0 cf = 0x0 EBX = EBX + 0x3 ESP = ESP + 0x4 EAX = EBX + 0x3
工作原理
=================
Miasm 嵌入了自己的反汇编器、中间语言和指令语义。它使用 Python 编写。
为了模拟代码，它使用 LLVM、GCC、Clang 或 Python 对中间表示进行 JIT 编译。它可以模拟 shellcode 以及二进制文件的全部或部分。可以执行 Python 回调来与执行过程交互，例如模拟库函数的效果。
文档
=============
一些文档资源可在 [doc](https://github.com/cea-sec/miasm/blob/HEAD/doc) 文件夹中找到。
自动生成的文档：
* [Doxygen](http://miasm.re/miasm_doxygen)
* [pdoc](http://miasm.re/miasm_pdoc)
获取 Miasm
===============
* 克隆仓库：[GitHub 上的 Miasm](https://github.com/cea-sec/miasm/)
* 从 [Docker Hub](https://registry.hub.docker.com/u/miasm/) 获取 Docker 镜像
软件要求
---------------------
Miasm 使用：
* python-pyparsing
* python-dev
* 可选的 python-pycparser（版本 >= 2.17）
要启用代码 JIT，必须安装以下模块之一：
* GCC
* Clang
* LLVM with Numba llvmlite，见下文
'可选' Miasm 还可以使用：
* Z3，[定理证明器](https://github.com/Z3Prover/z3)
配置
-------------
要使用 jitter，建议使用 GCC 或 LLVM
* GCC（任意版本）
* Clang（任意版本）
* LLVM
* Debian (testing/unstable): 未测试
* Debian stable/Ubuntu/Kali 等：`pip install llvmlite` 或从 [llvmlite](https://github.com/numba/llvmlite) 安装
* Windows: 未测试
* 构建并安装 Miasm：```pycon
$ cd miasm_directory
$ python setup.py build
$ sudo python setup.py install
如果在编译某个抖动模块时出现问题，Miasm 将跳过该错误并禁用相应模块（请参见编译 输出）。
大多数 Miasm 的 IDA 插件使用 Miasm 功能的一个子集。 让它们工作的快速方法是添加：
pyparsing.py 到 C:\...\IDA\python\ 或 pip install pyparsingmiasm/miasm 目录到 C:\...\IDA\python\除与 JITter 相关的功能外，所有功能都将可用。如需更完整的安装，请参考以上段落。
Miasm 附带一组回归测试。要运行所有测试：```pycon cd miasm_directory/test
python test_all.py
python -m unittest test_all.py # sequential, requires 'unittest' python -m pytest test_all.py # sequential, requires 'pytest' python -m pytest -n auto test_all.py # parallel, requires 'pytest' and 'pytest-xdist'
一些选项可以指定：
* 单线程：`-m`
* 代码覆盖插桩：`-c`
* 仅快速测试：`-t long`（排除长时间测试）
它们已经使用 Miasm
======================
工具
-----
* [Sibyl](https://github.com/cea-sec/Sibyl)：函数推断工具
* [R2M2](https://github.com/guedou/r2m2)：将 miasm 用作 radare2 插件
* [CGrex](https://github.com/mechaphish/cgrex)：面向 CGC 二进制文件的目标修补器
* [ethRE](https://github.com/jbcayrou/ethRE)：以太坊 EVM 逆向工具（配合相应的 Miasm2 架构）
博客文章 / 论文 / 会议
---------------------------------
* [去混淆：恢复被 OLLVM 保护的程序](http://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html)
* [用符号执行驯服受 Nanomite 保护的 MIPS 二进制文件：没有这样的 Crackme](https://doar-e.github.io/blog/2014/10/11/taiming-a-wild-nanomite-protected-mips-binary-with-symbolic-execution-no-such-crackme/)
* [使用 Miasm 快速生成 DGA](https://www.lexsi.com/securityhub/generation-rapide-de-dga-avec-miasm/)：DGA 快速计算（法文文章）
* [启用客户端抗崩溃能力以克服多样化和信息隐藏](https://www.internetsociety.org/sites/default/files/blogs-media/enabling-client-side-crash-resistance-overcome-diversification-information-hiding.pdf)：检测无定向调用的潜在参数
* [Miasm：逆向工程框架](https://www.sstic.org/2012/presentation/miasm_framework_de_reverse_engineering/)（法文）
* [Miasm 教程](https://www.sstic.org/2014/presentation/Tutorial_miasm/)（法文视频）
* [依赖图：小拇指风格](https://www.sstic.org/2016/presentation/graphes_de_dpendances__petit_poucet_style/)：DepGraph（法文）
书籍
-----
* [实用逆向工程：X86、X64、Arm、Windows 内核、逆向工具及混淆](http://eu.wiley.com/WileyCDA/WileyTitle/productCd-1118787315,subjectCd-CSJ0.html)：Miasm 入门（第 5 章“混淆”）
* [BlackHat Python - 附录](https://github.com/oreilly-japan/black-hat-python-jp-support/tree/master/appendix-A)：日本安全书籍的示例