Skip to content

Commit

Permalink
update docs
Browse files Browse the repository at this point in the history
  • Loading branch information
DennyDai committed Mar 28, 2024
1 parent caca6bb commit abfe59b
Show file tree
Hide file tree
Showing 13 changed files with 112 additions and 99 deletions.
25 changes: 25 additions & 0 deletions docs/advanced_usage.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# Advanced Usage

## Reuse Unreachable Code Locations
Patcherex2 can be used to reuse unreachable code locations in the binary.
Add the following code anywhere before `apply_patches` to reuse unreachable code.

```python
for func in p.binary_analyzer.get_unused_funcs():
p.allocation_manager.add_free_space(func["addr"], func["size"], "RX")
```

## Pre- and Post- Function Hooks
Patcherex2 allows you to add pre- and post- function hooks to the function call when using `InsertFunctionPatch` and first argument is a address.

```python
InsertFunctionPatch(0xdeadbeef, "int foo(int a) { return bar(); }", prefunc="mov rdi, 0x10", postfunc="mov rdi, rax")
```
At the address `0xdeadbeef`, pre-function hook `mov rdi, 0x10` will be executed before the function `foo` is called and post-function hook `mov rdi, rax` will be executed after the function `foo` is called. This is useful when you want to pass arguments to the function or get the return value from the function.

## Save Context and Restore Context when using `Insert*Patch`
When using `InsertInstructionPatch` or `InsertFunctionPatch`, it is possible to save the context before the inserted content and restore the context after the inserted content. This is useful when the inserted content modifies the context.

```python
InsertInstructionPatch(0xdeadbeef, "push rbp", save_context=True)
```
5 changes: 0 additions & 5 deletions docs/api_reference.md

This file was deleted.

1 change: 1 addition & 0 deletions docs/api_reference/patcherex.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
:::patcherex2.patcherex
1 change: 1 addition & 0 deletions docs/api_reference/patches.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
:::patcherex2.patches
29 changes: 2 additions & 27 deletions docs/patch_types.md → docs/core_ideas.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@

## Patch Types

The core of Patcherex2 consists of 9 different types of patches, which are used to manipulate the binary in different ways.

| | Data | Instruction | Function |
Expand Down Expand Up @@ -66,6 +66,7 @@ Each tier features three patch types:

### Referencing previously inserted content.
Examples:

- This will load effective address of the data `my_data` into the `rsi` register.
```python
InsertDataPatch("my_data", b"Hello, World!")
Expand All @@ -76,29 +77,3 @@ Examples:
InsertFunctionPatch("bar", "int bar() { return 42; }")
ModifyFunctionPatch("foo", "int bar(void); int foo() { return bar(); }")
```


## Patcherex2 Advanced Usage
### Reuse Unreachable Code Locations
Patcherex2 can be used to reuse unreachable code locations in the binary.
Add the following code anywhere before `apply_patches` to reuse unreachable code.

```python
for func in p.binary_analyzer.get_unused_funcs():
p.allocation_manager.add_free_space(func["addr"], func["size"], "RX")
```

## Pre- and Post- Function Hooks
Patcherex2 allows you to add pre- and post- function hooks to the function call when using `InsertFunctionPatch` and first argument is a address.

```python
InsertFunctionPatch(0xdeadbeef, "int foo(int a) { return bar(); }", prefunc="mov rdi, 0x10", postfunc="mov rdi, rax")
```
At the address `0xdeadbeef`, pre-function hook `mov rdi, 0x10` will be executed before the function `foo` is called and post-function hook `mov rdi, rax` will be executed after the function `foo` is called. This is useful when you want to pass arguments to the function or get the return value from the function.

## Save Context and Restore Context when using `Insert*Patch`
When using `InsertInstructionPatch` or `InsertFunctionPatch`, it is possible to save the context before the inserted content and restore the context after the inserted content. This is useful when the inserted content modifies the context.

```python
InsertInstructionPatch(0xdeadbeef, "push rbp", save_context=True)
```
4 changes: 4 additions & 0 deletions docs/css/extra.css
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[data-md-color-scheme="pursec"] {
--md-primary-fg-color: #4f6da9;
--md-accent-fg-color: #bd9020;
}
54 changes: 0 additions & 54 deletions docs/examples.md

This file was deleted.

29 changes: 29 additions & 0 deletions docs/examples/modify_function_patch.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# ModifyFunctionPatch

Consider a simple C program:

```c title="examples/modify_function_patch/add.c"
--8<-- "examples/modify_function_patch/add.c"
```

After compiling and executing this program, the output is:

```bash
$ gcc -o add add.c && ./add
2 + 3 = 5
```

Now, we can use Patcherex2 to modify the `add` function to multiply the two arguments instead of adding them.

```python title="examples/modify_function_patch/patch.py"
--8<-- "examples/modify_function_patch/patch.py"
```

Executing the patched program yields a different result:

```bash
$ ./add_patched
2 + 3 = 6
```

💥 We've successfully modified the binary with Patcherex2!
12 changes: 4 additions & 8 deletions docs/index.md
Original file line number Diff line number Diff line change
@@ -1,9 +1,5 @@
This site contains the documentation for the Patcherex2 project, a tool for patching binaries.
---
title: "Home"
---

Patcherex2 is a rewritten adaptation of the original Patcherex project, aimed at building upon its core ideas and extending its capabilities. It attempts to be a comprehensive and reliable replacement for other patching tools, allowing for patching at the byte, data, instruction, and function level, as well as allowing others to easily implement additional architectures.

## Table Of Contents

1. [Examples](examples.md)
2. [Patch Types](patch_types.md)
3. [API Reference](api_reference.md)
---8<--- 'README.md'
10 changes: 10 additions & 0 deletions examples/modify_function_patch/add.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
#include <stdio.h>

int add(int a, int b) {
return a + b;
}

int main() {
printf("2 + 3 = %d\n", add(2, 3));
return 0;
}
14 changes: 14 additions & 0 deletions examples/modify_function_patch/patch.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
from patcherex2 import *

p = Patcherex("add")

new_add_func = """
int add(int a, int b) {
return a * b;
}
"""

p.patches.append(ModifyFunctionPatch("add", new_add_func))

p.apply_patches()
p.binfmt_tool.save_binary("add_patched")
24 changes: 19 additions & 5 deletions mkdocs.yml
Original file line number Diff line number Diff line change
@@ -1,20 +1,34 @@
site_name: Patcherex2 Docs
site_name: Patcherex2 Documentation
repo_url: https://github.com/purseclab/patcherex2
repo_name: purseclab/patcherex2
edit_uri: edit/main/docs/

theme:
name: "material"
features:
- search.suggest
- content.code.copy
- toc.follow
- toc.integrate
- content.action.edit
palette:
- scheme: pursec

plugins:
- mkdocstrings:
handlers:
python:
options:
docstring_style: sphinx
show_symbol_type_heading: true
show_symbol_type_toc: true
- search

extra_css:
- css/extra.css

nav:
- index.md
- Examples: examples.md
- Reference: reference.md
markdown_extensions:
- pymdownx.highlight
- pymdownx.inlinehilite
- pymdownx.snippets
- pymdownx.superfences
3 changes: 3 additions & 0 deletions pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -26,5 +26,8 @@ dependencies = [
[tool.setuptools.packages.find]
where = ["src"]

[tool.ruff]
exclude = ["examples"]

[tool.ruff.lint]
extend-select = ["I", "N", "UP", "B"]

0 comments on commit abfe59b

Please sign in to comment.