diff --git a/tools/angr/plugins/hooks/libc.py b/tools/angr/plugins/hooks/libc.py index b30301da..9da2bd8f 100644 --- a/tools/angr/plugins/hooks/libc.py +++ b/tools/angr/plugins/hooks/libc.py @@ -334,7 +334,37 @@ def run(self, dst, src, num): max_len = src_len self.inline_call(strncpy, dst + dst_len, src, max_len + 1, src_len=src_len) return dst + +class libc_setlocale(angr.SimProcedure): + locale = None + def run (self, category, locale): + if self.locale is None: + self.locale = self.inline_call( + angr.SIM_PROCEDURES["libc"]["malloc"], 256 + ).ret_expr + self.state.memory.store(self.locale + 255, b"\x00") + return self.locale + +class libc_bindtextdomain(angr.SimProcedure): + domainname = None + def run (self, domainname, dirname): + if self.domainname is None: + self.domainname = self.inline_call( + angr.SIM_PROCEDURES["libc"]["malloc"], 256 + ).ret_expr + self.state.memory.store(self.domainname + 255, b"\x00") + return self.domainname + +class libc_textdomain(angr.SimProcedure): + domainname = None + def run (self, domainname): + if self.domainname is None: + self.domainname = self.inline_call( + angr.SIM_PROCEDURES["libc"]["malloc"], 256 + ).ret_expr + self.state.memory.store(self.domainname + 255, b"\x00") + return self.domainname libc_hooks = { # Additional functions that angr doesn't provide hooks for @@ -356,6 +386,9 @@ def run(self, dst, src, num): "__snprintf_chk": libc__snprintf_chk, "strncat": libc_strncat, "strrchr": libc_strrchr, + "setlocale":libc_setlocale, + "bindtextdomain": libc_bindtextdomain, + "textdomain": libc_textdomain, } hook_condition = ("libc\.so.*", libc_hooks)