a poc implementation arm64 tracer based on simulation

Related tags

Miscellaneous sim-trace
Overview

sim-trace

a poc implementation arm64 tracer based on simulation

Build Test

ndk-build NDK_DEBUG=1

Run Test

adb push test /data/local/tmp/test && adb shell chmod +x /data/local/tmp/test
adb shell /data/local/tmp/test

expected result:

#    x0: 0x0000000000000003
#    x1: 0x0000000000000005
#    x2: 0x0000007fe7960924
#    x3: 0x0000000000000040
#    x4: 0x0000007f8aebc100
#    x5: 0x0000000000000000
#    x6: 0x0000000000000003
#    x7: 0xffffffffffffffff
#    x8: 0x3d39d1cf02e47cf9
#    x9: 0x3d39d1cf02e47cf9
#   x10: 0x000000000000002f
#   x11: 0x0000000000000000
#   x12: 0x0000000000000010
#   x13: 0x0000000000000008
#   x14: 0xfffffffffffffffc
#   x15: 0x0000000000000001
#   x16: 0x0000007fe7960920
#   x17: 0x0000007f8a7fff00
#   x18: 0x00000000ffffffff
#   x19: 0x0000000000001000
#   x20: 0x0000007f8aebc000
#   x21: 0x0000007f8af86b30
#   x22: 0x0000007fe79609d8
#   x23: 0x0000000000000000
#   x24: 0x0000000000000000
#   x25: 0x0000000000000000
#   x26: 0x0000000000000000
#   x27: 0x0000000000000000
#   x28: 0x0000000000000000
#   x29: 0x0000007fe7960950
#    lr: 0x0000005587214af4
#    sp: 0x0000007fe7960920
#    v0: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v1: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v2: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v3: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v4: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v5: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v6: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v7: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v8: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#    v9: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v10: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v11: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v12: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v13: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v14: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v15: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v16: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v17: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v18: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v19: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v20: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v21: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v22: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v23: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v24: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v25: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v26: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v27: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v28: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v29: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v30: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
#   v31: 0x7ff0dead7f8beef17ff00cab7f8ba9e1
0x0000005587214a48  90000709            adrp x9, #+0xe0000 (addr 0x55872f4000)
#    x9: 0x00000055872f4000
0x0000005587214a4c  f9467929            ldr x9, [x9, #3312]
#    x9: 0x00000055872f5618 <- 0x00000055872f4cf0
0x0000005587214a50  0b000028            add w8, w1, w0
#    x8: 0x0000000000000008
0x0000005587214a54  b9000048            str w8, [x2]
#    w8:         0x00000008 -> 0x0000007fe7960924
0x0000005587214a58  b9000128            str w8, [x9]
#    w8:         0x00000008 -> 0x00000055872f5618
0x0000005587214a5c  b9400040            ldr w0, [x2]
#    x0: 0x0000000000000008 <- 0x0000007fe7960924
0x0000005587214a60  d65f03c0            ret
# Branch to 0x0000005587214af4.
stack result  = 8, register result = 8, global result = 8
You might also like...
VM devirtualization PoC based on AsmJit and llvm
VM devirtualization PoC based on AsmJit and llvm

vm_jit PoC vm devirtualization based on AsmJit. The binary was taken from YauzaCTF 2021 competition. You are welcome to try to solve it yourself, the

Pavel 58 Aug 8, 2022
Evasive shellcode loader for bypassing event-based injection detection (PoC)
Evasive shellcode loader for bypassing event-based injection detection (PoC)

DripLoader (PoC) Evasive shellcode loader for bypassing event-based injection detection, without necessarily suppressing event collection. The project

Filip Olszak 547 Dec 28, 2022
TiEtwAgent - PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
TiEtwAgent - PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

TiEtwAgent - ETW-based process injection detection This project was created to research, build and test different memory injection detection use cases

Filip Olszak 187 Dec 20, 2022
A ROS based Open Source Simulation Environment for Robotics Beginners
A ROS based Open Source Simulation Environment for Robotics Beginners

A ROS based Open Source Simulation Environment for Robotics Beginners

Sulegeyixiu 131 Jan 5, 2023
SFML-based flocking simulation program
SFML-based flocking simulation program

boids SFML-based flocking simulation program Requirements C++20 CMake 3.16 SFML 2.5 Building cmake -B build -DCMAKE_BUILD_TYPE=Release cmake --build b

Chris Thrasher 7 Oct 8, 2022
A simulation for QKM HL6-0900 6DOF robot based on gazebo
A simulation for QKM HL6-0900 6DOF robot based on gazebo

HLRobot_gazebo A simulation for QKM HL6-0900 6DOF robot based on gazebo Demo Demo Link Install sudo apt-get install ros-melodic-ros-control ros-melodi

Liu,Xiao 12 Jul 21, 2022
PoC capable of detecting manual syscalls from usermode.

syscall-detect PoC capable of detecting manual syscalls from usermode. More information available at: https://winternl.com/detecting-manual-syscalls-f

null 125 Dec 26, 2022
PoC MSVC COFF Object file loader/injector.

COFFInjector A Proof of Concept code - loading and injecting MSVC object file. Blog post with explanation: https://0xpat.github.io/Malware_development

null 132 Dec 28, 2022
POC Hooking PG3D v16.6.1

PG3D-Hook POC Hooking PG3D v16.6.1 Info This code was written by me for PG3D v16.6.1 back in 2019. My main code is in jbro.cpp You can compare the off

Jonah 19 Oct 18, 2022
Owner
null
GitHub
A PIC/FLIP fluid simulation based on the methods found in Robert Bridson's "Fluid Simulation for Computer Graphics"

GridFluidSim3d This program is an implementation of a PIC/FLIP liquid fluid simulation written in C++11 based on methods described in Robert Bridson's

Ryan Guy 727 Dec 8, 2022
Physically-based GPU and CPU ray-tracer emerging on a surface

etx-tracer Physically-based GPU and CPU ray-tracer emerging on a surface. Features Vertex Connection and Merging algorithm (CPU and GPU); Full-spectra

Serhii Rieznik 233 Dec 14, 2022
A cheap，simple，Ongeki controller Use Keyboard Simulation and Mouse Simulation to controller the ongeki game. Using Pro-micro control.

N.A.G.E.K.I. A cheap，simple，Ongeki controller Use Keyboard Simulation and Mouse Simulation to controller the ongeki game. Using Pro-micro control. 中文版

NanaNana 39 Dec 8, 2022
A cheap，simple，Ongeki controller Use Keyboard Simulation and Mouse Simulation to controller the ongeki game. Using Pro-micro control.

N.A.G.E.K.I. PLEASE CHECK Main Project A cheap，simple，Ongeki controller Use Keyboard Simulation and Mouse Simulation to controller the ongeki game. Us

NanaNana 11 Dec 30, 2021
A simple Linux kernel module that kills ptrace tracer and its tracees

dont_trace dont_trace is a simple Linux kernel module that kills ptrace tracer and its tracees. This kernel module relies upon the Linux kernel task_s

null 5 Mar 31, 2022
Grafana/Prometheus exporter for EPEVER/EPSOLAR Tracer solar charge controllers

epever_exporter epever_exporter is a standalone program written in C that can query Epever/Epsolar Tracer solar charge controllers and output metrics

Cédric Félizard 1 Nov 23, 2021
Emergency alert and tracer for realtime high-performance computing app (work in progress, currently supported env is only Linux x86-64).

HPC Emerg Emergency alert and tracer for realtime high-performance computing app (work in progress, currently supported env is only Linux x86-64). Exa

Ammar Faizi 7 Jan 19, 2022
A CUDA-accelerated cloth simulation engine based on Extended Position Based Dynamics (XPBD).

Velvet Velvet is a CUDA-accelerated cloth simulation engine based on Extended Position Based Dynamics (XPBD). Why another cloth simulator? There are a

Vital Chen 39 Dec 21, 2022
BOF implementation of the research by @jonasLyk and the drafted PoC from @LloydLabs

Self_Deletion_BOF BOF implementation of the research by @jonasLyk and the drafted PoC from @LloydLabs Why? I didn't see that it currently existed (via

null 130 Nov 13, 2022
Evasive shellcode loader for bypassing event-based injection detection (PoC)

(cleaned up version here: https://github.com/xinbailu/DripLoader-Ops) DripLoader (PoC) Evasive shellcode loader for bypassing event-based injection de

Filip Olszak 547 Dec 28, 2022