MonoTouch 二三事（三）mono mkbundle 打包程序的解包支持

int main (int argc, char* argv[])
{
    char **newargs;
    int i, k = 0;

    newargs = (char **) malloc (sizeof (char *) * (argc + 2 + count_mono_options_args ()));

    newargs [k++] = argv [0];

    if (mono_options != NULL) {
        i = 0;
        while (mono_options[i] != NULL)
            newargs[k++] = mono_options[i++];
    }

    newargs [k++] = image_name;

    for (i = 1; i < argc; i++) {
        newargs [k++] = argv [i];
    }
    newargs [k] = NULL;
    
    if (config_dir != NULL && getenv ("MONO_CFG_DIR") == NULL)
        mono_set_dirs (getenv ("MONO_PATH"), config_dir);
    
    mono_mkbundle_init();

    return mono_main (k, newargs);
}

void mono_mkbundle_init ()
{
    CompressedAssembly **ptr;
    MonoBundledAssembly **bundled_ptr;
    Bytef *buffer;
    int nbundles;

    install_dll_config_files ();

    ptr = (CompressedAssembly **) compressed;
    nbundles = 0;
    while (*ptr++ != NULL)
        nbundles++;

    bundled = (MonoBundledAssembly **) malloc (sizeof (MonoBundledAssembly *) * (nbundles + 1));
    bundled_ptr = bundled;
    ptr = (CompressedAssembly **) compressed;
    while (*ptr != NULL) {
        uLong real_size;
        uLongf zsize;
        int result;
        MonoBundledAssembly *current;

        real_size = (*ptr)->assembly.size;
        zsize = (*ptr)->compressed_size;
        buffer = (Bytef *) malloc (real_size);
        result = my_inflate ((*ptr)->assembly.data, zsize, buffer, real_size);
        if (result != 0) {
            fprintf (stderr, "mkbundle: Error %d decompressing data for %s\n", result, (*ptr)->assembly.name);
            exit (1);
        }
        (*ptr)->assembly.data = buffer;
        current = (MonoBundledAssembly *) malloc (sizeof (MonoBundledAssembly));
        memcpy (current, *ptr, sizeof (MonoBundledAssembly));
        current->name = (*ptr)->assembly.name;
        *bundled_ptr = current;
        bundled_ptr++;
        ptr++;
    }
    *bundled_ptr = NULL;
    mono_register_bundled_assemblies((const MonoBundledAssembly **) bundled);
}

typedef struct {
    const char *name;
    const unsigned char *data;
    const unsigned int size;
} MonoBundledAssembly;


typedef struct _compressed_data {
    MonoBundledAssembly assembly;
    int compressed_size;
} CompressedAssembly;

#!/usr/bin/env python
# coding=gbk


# 支持 mtouch mtouch-64 mtouch.exe mandroid.exe 解包
# 用IDA打开待分析文件，等待分析完毕，运行此脚本，将会在待分析文件同目录下生成临时文件夹并解压文件
# by BinSys 


import urllib2, httplib
import zlib
import StringIO, gzip
import struct
import io
import sys

import idaapi
import idc
import idautils
from struct import *

import time
import datetime
from datetime import datetime, date, time



InputFileType_EXE = 11
InputFileType_MachO = 25
InputFileType = -1


Is64Bit = False



string_type_map = {
    0 : "ASCSTR_C",       #              C-string, zero terminated
    1 : "ASCSTR_PASCAL",  #              Pascal-style ASCII string (length byte)
    2 : "ASCSTR_LEN2",    #              Pascal-style, length is 2 bytes
    3 : "ASCSTR_UNICODE", #              Unicode string
    4 : "ASCSTR_LEN4",    #              Delphi string, length is 4 bytes
    5 : "ASCSTR_ULEN2",   #              Pascal-style Unicode, length is 2 bytes
    6 : "ASCSTR_ULEN4",   #              Pascal-style Unicode, length is 4 bytes
}




filetype_t_map = {
     0 : "f_EXE_old",            # MS DOS EXE File
     1 : "f_COM_old",            # MS DOS COM File
     2 : "f_BIN",                # Binary File
     3 : "f_DRV",                # MS DOS Driver
     4 : "f_WIN",                # New Executable (NE)
     5 : "f_HEX",                # Intel Hex Object File
     6 : "f_MEX",                # MOS Technology Hex Object File
     7 : "f_LX",                 # Linear Executable (LX)
     8 : "f_LE",                 # Linear Executable (LE)
     9 : "f_NLM",                # Netware Loadable Module (NLM)
    10 : "f_COFF",               # Common Object File Format (COFF)
    11 : "f_PE",                 # Portable Executable (PE)
    12 : "f_OMF",                # Object Module Format
    13 : "f_SREC",               # R-records
    14 : "f_ZIP",                # ZIP file (this file is never loaded to IDA database)
    15 : "f_OMFLIB",             # Library of OMF Modules
    16 : "f_AR",                 # ar library
    17 : "f_LOADER",             # file is loaded using LOADER DLL
    18 : "f_ELF",                # Executable and Linkable Format (ELF)
    19 : "f_W32RUN",             # Watcom DOS32 Extender (W32RUN)
    20 : "f_AOUT",               # Linux a.out (AOUT)
    21 : "f_PRC",                # PalmPilot program file
    22 : "f_EXE",                # MS DOS EXE File
    23 : "f_COM",                # MS DOS COM File
    24 : "f_AIXAR",              # AIX ar library
    25 : "f_MACHO",              # Max OS X
}

def FindStringEA():
    searchstr = str("mkbundle: Error %d decompressing data for %s\n")
    searchstr2 = str("Error %d decompresing data for %s\n")
    
    #Do not use default set up, we‘ll call setup().
    s = idautils.Strings(default_setup = False)
    # we want C & Unicode strings, and *only* existing strings.
    s.setup(strtypes=Strings.STR_C | Strings.STR_UNICODE, ignore_instructions = True, display_only_existing_strings = True)

    #loop through strings
    for i, v in enumerate(s):                
        if not v:
            #print("Failed to retrieve string at index {}".format(i))
            return -1
        else:
            #print("[{}] ea: {:#x} ; length: {}; type: {}; ‘{}‘".format(i, v.ea, v.length, string_type_map.get(v.type, None), str(v)))
            if str(v) == searchstr or str(v) == searchstr2:
                return v.ea
                
    return -1


def FindUnFunction(StringEA):
    for ref in DataRefsTo(StringEA):
        f = idaapi.get_func(ref)

        if f:
            return f
    return None
    
def FindDataOffset(FuncEA):
    for funcitem in FuncItems(FuncEA):
        #print hex(funcitem)
        for dataref in DataRefsFrom(funcitem):
            return dataref
            #print "    " + hex(dataref)
    return None
    
def GetStructOffsetList(DataOffset):

    global Is64Bit


    if Is64Bit == True:
        addv = 8
        mf=MakeQword
        vf=Qword
    else:
        mf=MakeDword
        addv = 4
        vf=Dword
    
    AsmListStructListOffset = DataOffset
    
    currentoffset = AsmListStructListOffset



    mf(currentoffset)
    currentvalue = vf(currentoffset)
    currentoffset+=addv


    AsmListStructListOffsetList = []
    AsmListStructListOffsetList.append(currentvalue)
    
    while currentvalue!= 0:


        mf(currentoffset)
        currentvalue = vf(currentoffset)
        
        if currentvalue!=0:
            AsmListStructListOffsetList.append(currentvalue)
        currentoffset+=addv
        
    return AsmListStructListOffsetList
        
    #print len(AsmListStructListOffsetList)
    
    #for vv in AsmListStructListOffsetList:
        #print hex(vv)
        
def MakeFileItemStruct(FileItemStructOffset):

    global Is64Bit


    if Is64Bit == True:
        addv = 8
        mf=MakeQword
        vf=Qword
    else:
        mf=MakeDword
        addv = 4
        vf=Dword
    
    offset = FileItemStructOffset


    
    mf(offset)
    FileNameOffset = vf(offset)
    FileName = idc.GetString(FileNameOffset)
    offset+=addv
    
    mf(offset)
    FileDataOffset = vf(offset)
    offset+=addv
    
    mf(offset)
    FileSize = vf(offset)
    FileSizeOffset = offset
    offset+=addv
    
    
    
    mf(offset)
    FileCompressedSize = vf(offset)
    FileCompressedSizeOffset = offset
    offset+=addv
    
    IsGZip = 0
    
    FileDataCompressed = idc.GetManyBytes(FileDataOffset,FileCompressedSize)
    
    b1,b2,b3 = struct.unpack(‘ccc‘, FileDataCompressed[0:3])
    if b1 == ‘\x1f‘ and b2 == ‘\x8b‘ and b3 == ‘\x08‘:
        IsGZip = 1
    else:
        IsGZip = 0
    

    
    return {        "FileItemStructOffset":FileItemStructOffset,         "FileNameOffset":FileNameOffset,        "FileName":FileName,        "FileDataOffset":FileDataOffset,        "FileSize":FileSize,        "FileSizeOffset":FileSizeOffset,        "FileCompressedSizeOffset":FileCompressedSizeOffset,        "FileCompressedSize":FileCompressedSize,        "IsGZip":IsGZip,        "FileDataCompressed":FileDataCompressed         }




#Python语言: Python Cookbook: 比系统自带的更加友好的makedir函数
#from: http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/82465
def _mkdir(newdir):
    """works the way a good mkdir should :)
        - already exists, silently complete
        - regular file in the way, raise an exception
        - parent directory(ies) does not exist, make them as well
    """
    if os.path.isdir(newdir):
        pass
    elif os.path.isfile(newdir):
        raise OSError("a file with the same name as the desired "                       "dir, ‘%s‘, already exists." % newdir)
    else:
        head, tail = os.path.split(newdir)
        if head and not os.path.isdir(head):
            _mkdir(head)
        #print "_mkdir %s" % repr(newdir)
        if tail:
            os.mkdir(newdir)
def DecompressZLib(Data,Path):

    #compressedstream = StringIO.StringIO(Data) 
    data2 = zlib.decompress(Data)
    f = open(Path, ‘wb‘)
    f.write(data2)
    f.close()
    pass

def DecompressGzipTo(Data,Path):

    compressedstream = StringIO.StringIO(Data)  
    gziper = gzip.GzipFile(fileobj=compressedstream)    
    data2 = gziper.read()   # 读取解压缩后数据

    f = open(Path, ‘wb‘)
    f.write(data2)
    f.close()
    pass

def DecompressFileTo(FileItem,OutputDir):
    newpath = ‘{}\\{}‘.format(OutputDir, FileItem["FileName"])
    #print newpath


    if FileItem["IsGZip"] == 1:
        DecompressGzipTo(FileItem["FileDataCompressed"],newpath)
        pass
    else:
        DecompressZLib(FileItem["FileDataCompressed"],newpath)
        pass

    pass


def main():
    global Is64Bit
    global InputFileType
    print("Input File:{}".format(GetInputFile()))
    print("Input File Path:{}".format(GetInputFilePath()))
    print("Idb File Path:{}".format(GetIdbPath()))
    print("cpu_name:{}".format(idc.GetShortPrm(idc.INF_PROCNAME).lower()))
    
    InputFileType = idc.GetShortPrm(idc.INF_FILETYPE)
    #ida.hpp filetype_t f_PE=11 f_MACHO=25
    
    print("InputFileType:{}".format(filetype_t_map.get(InputFileType, None)))
    
    
    if InputFileType != InputFileType_EXE and InputFileType != InputFileType_MachO:
        print "Error,Input file type must is PE or MachO!"
        return
        
    
    
    
    if (idc.GetShortPrm(idc.INF_LFLAGS) & idc.LFLG_64BIT) == idc.LFLG_64BIT:
        Is64Bit = True
    else:
        Is64Bit = False
        
    print("Is64Bit:{}".format(Is64Bit))
    
    
    OutputDir = ‘{}_{:%Y%m%d%H%M%S%f}‘.format(GetInputFilePath(), datetime.now())
    _mkdir(OutputDir)
    print("OutputDir:{}".format(OutputDir))
    
    

    
    StringEA = FindStringEA()
    if StringEA == -1:
        print "Can‘t find StringEA!"
        return
    
    Func = FindUnFunction(StringEA)
    
    if not Func:
        print "Can‘t find Func!"
        return
        
        
    FuncName = idc.GetFunctionName(Func.startEA)
    
    print "Found Data Function:" + FuncName
        
    DataOffset = FindDataOffset(Func.startEA)
    if not DataOffset:
        print "Can‘t find DataOffset!"
        return
    
    print("DataOffset:0x{:016X}".format(DataOffset));
    
    
    
    StructOffsetList = GetStructOffsetList(DataOffset)
    
    if len(StructOffsetList) == 0:
        print "Can‘t find StructOffsetList!"
        return
    
    
    
    FileItems = []
    
    for StructOffsetItem in StructOffsetList:
        FileItemStruct = MakeFileItemStruct(StructOffsetItem)
        FileItems.append(FileItemStruct)
    
    for FileItem in FileItems:
        
        print("FileItemStructOffset:{:016X} FileNameOffset:{:016X} FileDataOffset:{:016X} FileSize:{:016X} FileCompressedSize:{:016X} IsGZip:{} FileName:{}"            .format(             FileItem["FileItemStructOffset"] ,             FileItem["FileNameOffset"],            FileItem["FileDataOffset"],            FileItem["FileSize"],            FileItem["FileCompressedSize"],            FileItem["IsGZip"],            FileItem["FileName"]))

        DecompressFileTo(FileItem,OutputDir)
        
if __name__ == "__main__":
    main()