search

seemoo-lab / frankenstein

Broadcom and Cypress firmware emulation for fuzzing and further full-stack debugging
Apache License 2.0
428 stars 65 forks source link

Frankenstein using an old InternalBlue Version? #7

Closed MrMatch246 closed 3 years ago

MrMatch246 commented 3 years ago

I tried using the internalBlueMod.py and got following error: Traceback (most recent call last): File "/home/user/frankenstein/internalBlueMod.py", line 1, in <module> import internalblue.cmds ModuleNotFoundError: No module named 'internalblue.cmds' I researched that error and found out that in a previous version of internalblue there was a file cmds.py and a class Cmd that was removed when converting form pwntool to cmd2 for cmd-handling (i guess). Is this easy to fix and if not which is the latest working commit?

Greetings.

jiska2342 commented 3 years ago

Oh, you're right, we switched to cmd2 recently. Should be easy to switch but didn't try it yet. @unixb0y added the ports to cmd2, so I guess this one here could be one of the latest working commits: https://github.com/seemoo-lab/internalblue/commit/68f4a7ef0a76c37c85062533c48be44071e77f7d

I'll do some Frankenstein-related stuff in probably 2-3 weeks and will see if I can fix the root cause :)

unixb0y commented 3 years ago

I'll try fixing the script later :)

Boogboy commented 3 years ago

Hi, is there a workaround available in the meantime while this is being fixed? Thanks for your work. :)

bolek42 commented 3 years ago

Hi, I'm half way through the fix. The interalblue API changed quite a bit so porting was not to straight forward. I gues a valid hotfix would be to use an old version of InternalBlue without cmd2. Sorry for the inconvenience, I'll try to push the fix this week.

bolek42 commented 3 years ago

I've pushed some changes that fix most of this issue. loadelf and xmitstate should work now again however, there is still a bug with mapmemory that I do not understand right now. I also stumbled across some other bugs, especially one in xmitstate. get_int and set_int from xmit_memory.patch caused an illegal instruction as they were not disabled using patch_return()

jiska2342 commented 3 years ago

Tested it on my machine and loadelf also works for me :)