a0rtega / metame Goto Github PK

Running under VM Linux Kali updated:
Radare2 - installed.
r2pipe - installed.
keystone-engine - installed.

When I try to run it i have this:

Traceback (most recent call last): File "/usr/local/bin/metame", line 5, in <module> metame.main() File "/usr/local/lib/python3.5/dist-packages/metame/__init__.py", line 5, in main import metame.r2parser as r2parser File "/usr/local/lib/python3.5/dist-packages/metame/r2parser.py", line 2, in <module> import metame.x86handler as x86handler File "/usr/local/lib/python3.5/dist-packages/metame/x86handler.py", line 6, in <module> from keystone import * File "/usr/local/lib/python3.5/dist-packages/keystone/__init__.py", line 4, in <module> from .keystone import Ks, ks_version, ks_arch_supported, version_bind, debug, KsError, __version__ File "/usr/local/lib/python3.5/dist-packages/keystone/keystone.py", line 75, in <module> raise ImportError("ERROR: fail to load the dynamic library.") ImportError: ERROR: fail to load the dynamic library.

I tried with python2.7 and python3.5.

I updated radare to the last version and metame now crash

metame -i ea1da9a6fb202a0e1d9e2c27b1c806b2 -o caca.exe
[INFO] Opening file with r2
Metadata Signature: 0x96e8 0x10001424a5342 12
.NET Version: v2.0.50727
Number of Metadata Streams: 5
DirectoryAddress: 6c Size: 29e0
Stream name: MZ 4
DirectoryAddress: 2a4c Size: 1638
Stream name: MZ 4
DirectoryAddress: 73676e69 Size: 0
Stream name: MZ 4
DirectoryAddress: 10a8 Size: 535523
Stream name: MZ 4
DirectoryAddress: 10 Size: 49554723
Stream name: MZ 4
Traceback (most recent call last):
  File "/usr/local/bin/metame", line 5, in <module>
    metame.main()
  File "/usr/local/lib/python2.7/dist-packages/metame/__init__.py", line 19, in main
    r = r2parser.R2Parser(args.input, True, debug=args.debug, force_replace=args.force)
  File "/usr/local/lib/python2.7/dist-packages/metame/r2parser.py", line 20, in __init__
    info = json.loads(self.r2.cmd("ij").replace("\\", "\\\\"))
  File "/usr/local/lib/python2.7/dist-packages/r2pipe/open_base.py", line 204, in cmd
    res = self._cmd(cmd, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/r2pipe/open_sync.py", line 102, in _cmd_process
    self.process.stdin.write((cmd + '\n').encode('utf8'))
IOError: [Errno 32] Broken pipe

Crash with any sample

root@XS4325421825:/var/uuu# metame -i ups.exe -o s.exe
[INFO] Opening file with r2
[INFO] Analyzing functions with r2
Traceback (most recent call last):
File "/usr/local/bin/metame", line 5, in
metame.main()
File "/usr/local/lib/python2.7/dist-packages/metame/init.py", line 20, in main
patches = r.iterate_fcn()
File "/usr/local/lib/python2.7/dist-packages/metame/r2parser.py", line 34, in iterate_fcn
arch = x86handler.X86Handler(self.bits, self.debug, self.force)
File "/usr/local/lib/python2.7/dist-packages/metame/x86handler.py", line 73, in init
ks_mode = KS_MODE_32 if self.bits == 32 else KS_MODE_64
NameError: global name 'KS_MODE_32' is not defined
root@XS4325421825:/var/uuu# metame --help

THE File is winx86

looks like an exciting project! linked to your tool from our website now: http://www.keystone-engine.org/showcase/

keep it up, cheers!

Can you add ARM and AARCH64 support please?

Prologue: Installed metame using pip install metame as recommended, ran metame and got the error.

Box: Linux kali 4.6.0-kali1-amd64 #1 SMP Debian 4.6.4-1kali1 (2016-07-21) x86_64 GNU/Linux (straight from Kali Linux VMWare Image Nightly Build)

Error Log:

root@kali:~# metame -i /root/Desktop/untitled.exe -o untitled_metamorphic.exe
[INFO] Opening file with r2
[INFO] Analyzing functions with r2
Function too big at 0x7c073377
Traceback (most recent call last):
  File "/usr/local/bin/metame", line 5, in <module>
    metame.main()
  File "/usr/local/lib/python2.7/dist-packages/metame/__init__.py", line 20, in main
    patches = r.iterate_fcn()
  File "/usr/local/lib/python2.7/dist-packages/metame/r2parser.py", line 32, in iterate_fcn
    arch = x86handler.X86Handler(self.bits, self.debug, self.force)
  File "/usr/local/lib/python2.7/dist-packages/metame/x86handler.py", line 73, in __init__
    ks_mode = KS_MODE_32 if self.bits == 32 else KS_MODE_64
NameError: global name 'KS_MODE_32' is not defined

System: Debian 7.11 wheezy
Python Version: 2.7.3

NameError: global name 'KS_MODE_32' is not defined
joey@local_joey:~/radare2# metame -i /home/joey/testing/test.exe -o /home/joey/testing/mutation.exe -d
[INFO] Opening file with r2
Warning: read (tls_callback)
[INFO] Analyzing functions with r2
Traceback (most recent call last):
File "/usr/local/bin/metame", line 5, in
metame.main()
File "/usr/local/lib/python2.7/dist-packages/metame/init.py", line 20, in main
patches = r.iterate_fcn()
File "/usr/local/lib/python2.7/dist-packages/metame/r2parser.py", line 32, in iterate_fcn
arch = x86handler.X86Handler(self.bits, self.debug, self.force)
File "/usr/local/lib/python2.7/dist-packages/metame/x86handler.py", line 73, in init
ks_mode = KS_MODE_32 if self.bits == 32 else KS_MODE_64
NameError: global name 'KS_MODE_32' is not defined

Hi, I'm trying to understand the substitutions but I don't understand whats the meaning in assembly of "jmp 3" (get_nops, size=3, bits=32)? or why it's considered a nop. Also, why you pop from the stack? Wouldn't it destroy the stack? (for example, if the executable tries to access some already pop'd variable)

return "jmp %s; pop %s" % (3 + prev_ins_size, random.choice(regs))

Thanks in advance.

Stop using r2.cmd when using Json command ! Use r2.cmdj

Does having too big a binary cause problems?

C:\Users\faker\AppData\Local\Programs\Python\Python38\Scripts>python metame -i Coinbase.exe -o Wallet.exe -d
[INFO] Opening file with r2
Traceback (most recent call last):
File "C:\Users\faker\AppData\Local\Programs\Python\Python38\lib\site-packages\r2pipe\open_sync.py", line 64, in init
self.process = Popen(
File "C:\Users\faker\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 854, in init
self._execute_child(args, executable, preexec_fn, close_fds,
File "C:\Users\faker\AppData\Local\Programs\Python\Python38\lib\subprocess.py", line 1307, in _execute_child
hp, ht, pid, tid = _winapi.CreateProcess(executable, args,
FileNotFoundError: [WinError 2] The system cannot find the file specified

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "metame", line 5, in
metame.main()
File "C:\Users\faker\AppData\Local\Programs\Python\Python38\lib\site-packages\metame_init_.py", line 19, in main
r = r2parser.R2Parser(args.input, True, debug=args.debug, force_replace=args.force)
File "C:\Users\faker\AppData\Local\Programs\Python\Python38\lib\site-packages\metame\r2parser.py", line 19, in init
self.r2 = r2pipe.open(filename, flags)
File "C:\Users\faker\AppData\Local\Programs\Python\Python38\lib\site-packages\r2pipe\open_sync.py", line 68, in init
raise Exception("ERROR: Cannot find radare2 in PATH")
Exception: ERROR: Cannot find radare2 in PATH

i was stuck at this for hours

[INFO] Opening file with r2

how can i fix it?

Why i don't have in python script folder, metame script?
Have all requirement installed. Still can't understand how to start dat script.

this happens in any executable that i try

[INFO] Opening file with r2
Traceback (most recent call last):
File "C:\Users\noobz\Downloads\metame-master\metame-master\build\scripts-3.10\metame", line 5, in
metame.main()
File "C:\Program Files\Python310\lib\site-packages\metame_init_.py", line 19, in main
r = r2parser.R2Parser(args.input, True, debug=args.debug, force_replace=args.force)
File "C:\Program Files\Python310\lib\site-packages\metame\r2parser.py", line 20, in init
info = json.loads(self.r2.cmd("ij").replace("\", "\\"))
File "C:\Users\noobz\AppData\Roaming\Python\Python310\site-packages\simplejson_init_.py", line 525, in loads
return _default_decoder.decode(s)
File "C:\Users\noobz\AppData\Roaming\Python\Python310\site-packages\simplejson\decoder.py", line 370, in decode
obj, end = self.raw_decode(s)
File "C:\Users\noobz\AppData\Roaming\Python\Python310\site-packages\simplejson\decoder.py", line 400, in raw_decode
return self.scan_once(s, idx=_w(s, idx).end())
simplejson.errors.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

I installed everything 2 times and it still gives me this error:

ubuntu@ip-172-31-9-203:~/metame$ metame -i test.exe -o penmut.exe
[INFO] Opening file with r2
Traceback (most recent call last):
File "/usr/local/bin/metame", line 5, in
metame.main()
File "/usr/local/lib/python3.5/dist-packages/metame/init.py", line 19, in main
r = r2parser.R2Parser(args.input, True, debug=args.debug, force_replace=args.force)
File "/usr/local/lib/python3.5/dist-packages/metame/r2parser.py", line 21, in init
if not info["bin"]["bits"] in constants.supported_bits or \

I've run into an error using metame. It appears that fcn_ctx is missing the key 'type'.

I'm using python 3.5.

$ metame -i file.exe -o foo.exe
[INFO] Opening file with r2
[INFO] Analyzing functions with r2
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x0040485b
[anal.jmptbl] Missing cjmp bb in predecessor at 0x004049f7
[INFO] Loading functions information
[INFO] Replacing instructions
Traceback (most recent call last):
  File "venv/bin/metame", line 5, in <module>
    metame.main()
  File "venv/lib/python3.5/site-packages/metame/__init__.py", line 20, in main
    patches = r.iterate_fcn()
  File "venv/lib/python3.5/site-packages/metame/r2parser.py", line 43, in iterate_fcn
    replacements += arch.replace_fcn_opcodes(fcn_ctx)
  File "venv/lib/python3.5/site-packages/metame/x86handler.py", line 174, in replace_fcn_opcodes
    if fcn_ctx["ops"][count]["type"] not in self.mutables:
KeyError: 'type'

It seems that this could be easy enough to fix -- use the dict.get method & provide a sensible default.

After the latest radare update I'm getting:

[INFO] Opening file with r2
Traceback (most recent call last):
  File "/usr/local/bin/metame", line 5, in <module>
    metame.main()
  File "/usr/local/lib/python2.7/dist-packages/metame/__init__.py", line 19, in main
    r = r2parser.R2Parser(args.input, True, debug=args.debug, force_replace=args.force)
  File "/usr/local/lib/python2.7/dist-packages/metame/r2parser.py", line 21, in __init__
    if not info["bin"]["bits"] in constants.supported_bits or \
KeyError: 'bin'
[INFO] Opening file with r2
[INFO] Analyzing functions with r2
[INFO] Loading functions information
Traceback (most recent call last):
  File "/usr/local/bin/metame", line 5, in <module>
    metame.main()
  File "/usr/local/lib/python2.7/dist-packages/metame/__init__.py", line 20, in main
    patches = r.iterate_fcn()
  File "/usr/local/lib/python2.7/dist-packages/metame/r2parser.py", line 35, in iterate_fcn
    fcns = json.loads(self.r2.cmd("aflj"))
  File "/usr/local/lib/python2.7/dist-packages/simplejson/__init__.py", line 518, in loads
    return _default_decoder.decode(s)
  File "/usr/local/lib/python2.7/dist-packages/simplejson/decoder.py", line 370, in decode
    obj, end = self.raw_decode(s)
  File "/usr/local/lib/python2.7/dist-packages/simplejson/decoder.py", line 400, in raw_decode
    return self.scan_once(s, idx=_w(s, idx).end())
simplejson.errors.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

This happens with any binary used