<filename>exploits/smartmeter.py<gh_stars>0
from idaapi import *
from idc import *
from idautils import *
import re, string
import struct


tbegin = SegStart(0x412310)
tend = SegEnd(tbegin)
addr = tbegin



i = 0
while addr < tend:
    #print(GetMnem(addr))
    #print(DecodeInstruction(addr).size)
    isz = DecodeInstruction(addr).size
    addr += isz 

    if GetMnem(addr) == "push" and \
        GetMnem(addr+1) == "lea" and \
        GetMnem(addr+8) == "push" and \
        GetMnem(addr+9) == "lea" and \
        GetMnem(addr+16) == "xchg" and \
        GetMnem(addr+21) == "retn":
            print("GOTCHA!")
            #print(hex(addr) + " - " + hex(addr+21))            
            jmp = LocByName(GetOpnd(addr+9, 1)) - (addr+5)
            print(hex(jmp))
            patch_many_bytes(addr, "\xe9" + struct.pack("<I", jmp) + 17 * "\x90")
            
#    i += 1
#    if i == 12:
#        break
<filename>exploits/smartmeter.py<gh_stars>0
from idaapi import *
from idc import *
from idautils import *
import re, string
import struct


tbegin = SegStart(0x412310)
tend = SegEnd(tbegin)
addr = tbegin



i = 0
while addr < tend:
    #print(GetMnem(addr))
    #print(DecodeInstruction(addr).size)
    isz = DecodeInstruction(addr).size
    addr += isz 

    if GetMnem(addr) == "push" and \
        GetMnem(addr+1) == "lea" and \
        GetMnem(addr+8) == "push" and \
        GetMnem(addr+9) == "lea" and \
        GetMnem(addr+16) == "xchg" and \
        GetMnem(addr+21) == "retn":
            print("GOTCHA!")
            #print(hex(addr) + " - " + hex(addr+21))            
            jmp = LocByName(GetOpnd(addr+9, 1)) - (addr+5)
            print(hex(jmp))
            patch_many_bytes(addr, "\xe9" + struct.pack("<I", jmp) + 17 * "\x90")
            
#    i += 1
#    if i == 12:
#        break
#print(GetMnem(addr)) #print(DecodeInstruction(addr).size) #print(hex(addr) + " - " + hex(addr+21)) #    i += 1 #    if i == 12: #        break