-
Notifications
You must be signed in to change notification settings - Fork 144
/
sample1-virt-dispatcher-direct.py
166 lines (162 loc) · 6.89 KB
/
sample1-virt-dispatcher-direct.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
#!/usr/bin/env python2
## -*- coding: utf-8 -*-
import sys
def sx(bits, value):
sign_bit = 1 << (bits - 1)
return (value & (sign_bit - 1)) - (value & sign_bit)
SymVar_0 = int(sys.argv[1])
ref_264 = SymVar_0
ref_279 = ref_264 # MOV operation
ref_12424 = ref_279 # MOV operation
ref_12560 = ref_12424 # MOV operation
ref_12568 = ((ref_12560 << (0x39 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_12575 = ref_12568 # MOV operation
ref_13152 = ref_279 # MOV operation
ref_13288 = ref_13152 # MOV operation
ref_13296 = (ref_13288 >> (0x7 & 0x3F)) # SHR operation
ref_13303 = ref_13296 # MOV operation
ref_13367 = ref_13303 # MOV operation
ref_13379 = ref_12575 # MOV operation
ref_13381 = (ref_13379 | ref_13367) # OR operation
ref_13458 = ref_13381 # MOV operation
ref_14802 = ref_13458 # MOV operation
ref_14942 = ref_14802 # MOV operation
ref_14944 = ((ref_14942 + 0x2D4AF89B) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_15026 = ref_14944 # MOV operation
ref_15028 = (ref_15026 & 0x1D5ABF66) # AND operation
ref_15610 = ref_279 # MOV operation
ref_15746 = ref_15610 # MOV operation
ref_15754 = ((ref_15746 << (0x35 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_15761 = ref_15754 # MOV operation
ref_16338 = ref_279 # MOV operation
ref_16474 = ref_16338 # MOV operation
ref_16482 = (ref_16474 >> (0xB & 0x3F)) # SHR operation
ref_16489 = ref_16482 # MOV operation
ref_16553 = ref_16489 # MOV operation
ref_16565 = ref_15761 # MOV operation
ref_16567 = (ref_16565 | ref_16553) # OR operation
ref_16636 = ref_16567 # MOV operation
ref_16648 = ref_15028 # MOV operation
ref_16650 = ((ref_16636 - ref_16648) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_16658 = ref_16650 # MOV operation
ref_16730 = ref_16658 # MOV operation
ref_17989 = ref_279 # MOV operation
ref_18033 = ref_17989 # MOV operation
ref_18047 = ((ref_18033 - 0xE8D4346) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_18055 = ref_18047 # MOV operation
ref_18127 = ref_18055 # MOV operation
ref_19471 = ref_13458 # MOV operation
ref_19515 = ref_19471 # MOV operation
ref_19529 = ((0x20453EE3 + ref_19515) & 0xFFFFFFFFFFFFFFFF) # ADD operation
ref_20112 = ref_279 # MOV operation
ref_20156 = ref_20112 # MOV operation
ref_20168 = ref_19529 # MOV operation
ref_20170 = ((ref_20156 - ref_20168) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_20178 = ref_20170 # MOV operation
ref_20250 = ref_20178 # MOV operation
ref_22333 = ref_13458 # MOV operation
ref_23199 = ref_18127 # MOV operation
ref_23243 = ref_23199 # MOV operation
ref_23255 = ref_22333 # MOV operation
ref_23257 = (ref_23255 | ref_23243) # OR operation
ref_23418 = ref_23257 # MOV operation
ref_23424 = (0x3F & ref_23418) # AND operation
ref_23585 = ref_23424 # MOV operation
ref_23593 = ((ref_23585 << (0x4 & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_23600 = ref_23593 # MOV operation
ref_24318 = ref_13458 # MOV operation
ref_24362 = ref_24318 # MOV operation
ref_24374 = ref_23600 # MOV operation
ref_24376 = (ref_24374 | ref_24362) # OR operation
ref_24453 = ref_24376 # MOV operation
ref_25937 = ref_16730 # MOV operation
ref_26719 = ref_24453 # MOV operation
ref_26855 = ref_26719 # MOV operation
ref_26863 = (ref_26855 >> (0x1 & 0x3F)) # SHR operation
ref_26870 = ref_26863 # MOV operation
ref_27026 = ref_26870 # MOV operation
ref_27032 = (0xF & ref_27026) # AND operation
ref_27101 = ref_27032 # MOV operation
ref_27115 = (0x1 | ref_27101) # OR operation
ref_27280 = ref_27115 # MOV operation
ref_27282 = ((0x40 - ref_27280) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_27290 = ref_27282 # MOV operation
ref_27362 = ref_25937 # MOV operation
ref_27366 = ref_27290 # MOV operation
ref_27368 = (ref_27366 & 0xFFFFFFFF) # MOV operation
ref_27370 = ((ref_27362 << ((ref_27368 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_27377 = ref_27370 # MOV operation
ref_28039 = ref_16730 # MOV operation
ref_28821 = ref_24453 # MOV operation
ref_28957 = ref_28821 # MOV operation
ref_28965 = (ref_28957 >> (0x1 & 0x3F)) # SHR operation
ref_28972 = ref_28965 # MOV operation
ref_29128 = ref_28972 # MOV operation
ref_29134 = (0xF & ref_29128) # AND operation
ref_29203 = ref_29134 # MOV operation
ref_29217 = (0x1 | ref_29203) # OR operation
ref_29294 = ref_28039 # MOV operation
ref_29298 = ref_29217 # MOV operation
ref_29300 = (ref_29298 & 0xFFFFFFFF) # MOV operation
ref_29302 = (ref_29294 >> ((ref_29300 & 0xFF) & 0x3F)) # SHR operation
ref_29309 = ref_29302 # MOV operation
ref_29373 = ref_29309 # MOV operation
ref_29385 = ref_27377 # MOV operation
ref_29387 = (ref_29385 | ref_29373) # OR operation
ref_29464 = ref_29387 # MOV operation
ref_30724 = ref_20250 # MOV operation
ref_31590 = ref_29464 # MOV operation
ref_31634 = ref_31590 # MOV operation
ref_31646 = ref_30724 # MOV operation
ref_31648 = ((ref_31634 - ref_31646) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_31656 = ref_31648 # MOV operation
ref_31728 = ref_31656 # MOV operation
ref_33951 = ref_24453 # MOV operation
ref_34677 = ref_16730 # MOV operation
ref_34813 = ref_34677 # MOV operation
ref_34819 = (0xF & ref_34813) # AND operation
ref_34888 = ref_34819 # MOV operation
ref_34902 = (0x1 | ref_34888) # OR operation
ref_35067 = ref_34902 # MOV operation
ref_35069 = ((0x40 - ref_35067) & 0xFFFFFFFFFFFFFFFF) # SUB operation
ref_35077 = ref_35069 # MOV operation
ref_35149 = ref_33951 # MOV operation
ref_35153 = ref_35077 # MOV operation
ref_35155 = (ref_35153 & 0xFFFFFFFF) # MOV operation
ref_35157 = ((ref_35149 << ((ref_35155 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_35164 = ref_35157 # MOV operation
ref_35826 = ref_24453 # MOV operation
ref_36552 = ref_16730 # MOV operation
ref_36688 = ref_36552 # MOV operation
ref_36694 = (0xF & ref_36688) # AND operation
ref_36763 = ref_36694 # MOV operation
ref_36777 = (0x1 | ref_36763) # OR operation
ref_36854 = ref_35826 # MOV operation
ref_36858 = ref_36777 # MOV operation
ref_36860 = (ref_36858 & 0xFFFFFFFF) # MOV operation
ref_36862 = (ref_36854 >> ((ref_36860 & 0xFF) & 0x3F)) # SHR operation
ref_36869 = ref_36862 # MOV operation
ref_36933 = ref_36869 # MOV operation
ref_36945 = ref_35164 # MOV operation
ref_36947 = (ref_36945 | ref_36933) # OR operation
ref_37698 = ref_20250 # MOV operation
ref_38340 = ref_31728 # MOV operation
ref_38384 = ref_38340 # MOV operation
ref_38396 = ref_37698 # MOV operation
ref_38398 = (ref_38396 | ref_38384) # OR operation
ref_38559 = ref_38398 # MOV operation
ref_38567 = (ref_38559 >> (0x1 & 0x3F)) # SHR operation
ref_38574 = ref_38567 # MOV operation
ref_38730 = ref_38574 # MOV operation
ref_38736 = (0x7 & ref_38730) # AND operation
ref_38805 = ref_38736 # MOV operation
ref_38819 = (0x1 | ref_38805) # OR operation
ref_38896 = ref_36947 # MOV operation
ref_38900 = ref_38819 # MOV operation
ref_38902 = (ref_38900 & 0xFFFFFFFF) # MOV operation
ref_38904 = ((ref_38896 << ((ref_38902 & 0xFF) & 0x3F)) & 0xFFFFFFFFFFFFFFFF) # SHL operation
ref_38911 = ref_38904 # MOV operation
ref_38983 = ref_38911 # MOV operation
ref_39137 = ref_38983 # MOV operation
ref_39139 = ref_39137 # MOV operation
print ref_39139 & 0xffffffffffffffff