# coding=utf-8
import logging
import ctypes
from unicorn.arm_const import UC_ARM_REG_R0,UC_ARM_REG_R1,UC_ARM_REG_R2,UC_ARM_REG_R3,UC_ARM_REG_PC,UC_ARM_REG_R6,UC_ARM_REG_SP
from unicorn import Uc,UC_ARCH_ARM,UC_MODE_THUMB,UC_PROT_ALL,UC_HOOK_CODE,UcError

UC_MEM_ALIGN = 0x1000

# 分页函数
def align(addr, size, growl):
    to = ctypes.c_uint64(UC_MEM_ALIGN).value
    mask = ctypes.c_uint64(0xFFFFFFFFFFFFFFFF).value ^ ctypes.c_uint64(to - 1).value
    right = addr + size
    right = (right + to - 1) & mask
    addr &= mask
    size = right - addr
    if growl:
        size = (size + to - 1) & mask
    return addr, size

def hook_code(uc, address, size, user_data):
    if address>0x102ce22:
        print(">>> Tracing instruction at 0x%x, instruction size = 0x%x" %(address, size))
    # print("r3 0x%x"%(uc.reg_read(UC_ARM_REG_R3)))
    if address == 0x102cd32:
        uc.mem_write(address,b'\x00\xbf')
        uc.reg_write(UC_ARM_REG_R1,0xfac13)
    if address == 0x102cd2a:
        uc.mem_write(address,b'\x00\xbf')
        uc.reg_write(UC_ARM_REG_R3,0xfac13)
    if address == 0x102cd5e:
        uc.reg_write(UC_ARM_REG_R3,0x3000000)
    if address == 0x102ce26:
        uc.reg_write(UC_ARM_REG_R3,0xfac13)

if __name__ == "__main__":
    module_base = 0x1000000
    data_base = 0x2000000
    key_base = 0x3000000

    # 字符串数组
    key = b'\x66\x97\x6C\xE8\x6D\x46\x38\xB0\x09\x5A\xA5\xD7\x0F\xCB\x9A\xA0'
    simulator = Uc(UC_ARCH_ARM, UC_MODE_THUMB)
    with open('libSecShell.so','rb') as fstream:
        lib_bytes = fstream.read()
        filesize = len(lib_bytes)
        (address,size) = align(module_base,filesize,True);
        simulator.mem_map(address,size,UC_PROT_ALL)
        simulator.mem_write(address,lib_bytes)

        simulator.mem_map(0x800000, 0x1000, UC_PROT_ALL)
        simulator.reg_write(UC_ARM_REG_SP,0x801000)

        # 映入加密数据
        encode_file = open('SecShell0.jar','rb')
        encode_bytes = encode_file.read()

        (encode_address,encode_size) = align(data_base,len(encode_bytes),True)

        simulator.mem_map(encode_address,encode_size,UC_PROT_ALL)
        simulator.mem_write(encode_address,encode_bytes)        

        simulator.reg_write(UC_ARM_REG_R0,0)
        simulator.reg_write(UC_ARM_REG_R1,encode_address)
        simulator.reg_write(UC_ARM_REG_R2,len(encode_bytes))

        simulator.mem_map(key_base,0x1000,UC_PROT_ALL)
        simulator.mem_write(key_base,key)

        start_address = module_base+0x2cd24+1
        end_address = start_address+0x10e-1

        print('end_address:0x%x'%end_address)
        simulator.hook_add(UC_HOOK_CODE, hook_code, start_address, end_address)

        # 填充NOP过滤掉栈校验和全局变量的赋值
        simulator.mem_write(0x102cd2a,b'\x00\xbf')
        simulator.mem_write(0x102cd32,b'\x00\xbf')
        simulator.mem_write(0x102cd5e,b'\x00\xbf')
        simulator.mem_write(0x102ce26,b'\x00\xbf')

        simulator.emu_start(start_address,end_address)

        decode_size = len(encode_bytes);
        print('Decoded File Size:%d'%decode_size)
        ret = simulator.mem_read(data_base,len(encode_bytes))

        输出解密文件
        dump_file = open('dump.zip','wb');
        dump_file.write(ret)
        dump_file.flush()
        dump_file.close()
        # print(ret)