afc635f6d1
* removal of `omo` command * use of `oml`, `oml.` and `oml=` to list maps instead of `om` * removal of RIZIN output from `oml` * removal of `omn.` and just assume `omn` uses core->offset
155 lines
3.3 KiB
Text
155 lines
3.3 KiB
Text
NAME=PE: corkami cm01.exe - open
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=q!
|
|
EXPECT=<<EOF
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - sections
|
|
FILE=bins/pe/cm01.exe
|
|
ARGS=-n
|
|
CMDS=!rz-bin -S bins/pe/cm01.exe
|
|
EXPECT=<<EOF
|
|
[Sections]
|
|
paddr size vaddr vsize align perm name type flags
|
|
--------------------------------------------------------------------------------
|
|
0x00000600 0x600 0x00401000 0x1000 0x0 -r-x CODE CNT_CODE
|
|
0x00000c00 0x200 0x00402000 0x1000 0x0 -rw- DATA CNT_INITIALIZED_DATA
|
|
0x00000e00 0x800 0x00403000 0x1000 0x0 -rw- .idata CNT_INITIALIZED_DATA
|
|
0x00001600 0x200 0x00404000 0x1000 0x0 -r-- .edata CNT_INITIALIZED_DATA
|
|
0x00001800 0x200 0x00405000 0x1000 0x0 sr-- .reloc CNT_INITIALIZED_DATA
|
|
0x00001a00 0x1400 0x00406000 0x2000 0x0 sr-- .rsrc CNT_INITIALIZED_DATA
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - sections json
|
|
FILE=bins/pe/cm01.exe
|
|
ARGS=-n
|
|
CMDS=!rz-bin -jS bins/pe/cm01.exe
|
|
EXPECT=<<EOF
|
|
{"sections":[{"name":"CODE","size":1536,"vsize":4096,"perm":"-r-x","flags":["CNT_CODE"],"paddr":1536,"vaddr":4198400},{"name":"DATA","size":512,"vsize":4096,"perm":"-rw-","flags":["CNT_INITIALIZED_DATA"],"paddr":3072,"vaddr":4202496},{"name":".idata","size":2048,"vsize":4096,"perm":"-rw-","flags":["CNT_INITIALIZED_DATA"],"paddr":3584,"vaddr":4206592},{"name":".edata","size":512,"vsize":4096,"perm":"-r--","flags":["CNT_INITIALIZED_DATA"],"paddr":5632,"vaddr":4210688},{"name":".reloc","size":512,"vsize":4096,"perm":"sr--","flags":["CNT_INITIALIZED_DATA"],"paddr":6144,"vaddr":4214784},{"name":".rsrc","size":5120,"vsize":8192,"perm":"sr--","flags":["CNT_INITIALIZED_DATA"],"paddr":6656,"vaddr":4218880}]}
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section seek 1
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
s 0x00401000
|
|
oml.~[8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fmap.CODE
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section seek 2
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
s 0x00402000
|
|
oml.~[8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fmap.DATA
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section seek 3
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
s 0x00403000
|
|
oml.~[8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fmap..idata
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section seek 4
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
s 0x00404000
|
|
oml.~[8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fmap..edata
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section seek 5
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
s 0x00405000
|
|
oml.~[8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fmap..reloc
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section seek 6
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
s 0x00406000
|
|
oml.~[8]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fmap..rsrc
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section refs 1
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
e analysis.jmp.cref=true
|
|
e analysis.strings=true
|
|
aaa
|
|
pi 2 @ 0x004010b7
|
|
EOF
|
|
EXPECT=<<EOF
|
|
push str.CrackMe_v1.0
|
|
push str.No_need_to_disasm_the_code
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section refs 2
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
e analysis.jmp.cref=true
|
|
e analysis.strings=true
|
|
aaa
|
|
pi 2 @ 0x0040136b
|
|
EOF
|
|
EXPECT=<<EOF
|
|
push str.No_luck
|
|
push str.No_luck_there__mate
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section refs 3
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
e analysis.jmp.cref=true
|
|
e analysis.strings=true
|
|
aaa
|
|
pi 2 @ 0x004013af
|
|
EOF
|
|
EXPECT=<<EOF
|
|
push str.No_luck
|
|
push str.No_luck_there__mate
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE: corkami cm01.exe - section refs 4
|
|
FILE=bins/pe/cm01.exe
|
|
CMDS=<<EOF
|
|
e analysis.jmp.cref=true
|
|
e analysis.strings=true
|
|
aaa
|
|
pi 2 @ 0x0040134f
|
|
EOF
|
|
EXPECT=<<EOF
|
|
push str.Good_work
|
|
push str.Great_work__mate__Now_try_the_next_CrackMe
|
|
EOF
|
|
RUN
|