服务端分析 • Use the VMware Workstation Pro REST API Service https://docs.vmware.com/en/VMware-Workstation- Pro/15.0/com.vmware.ws.using.doc/GUID-C3361DF5-A4C1-432E-850C- 8F60D83E5E2B.html • 前文分析与文档行为有出入 ➜ Library ./vmrest -h VMware Fusion REST API Copyright (C) 2015-2018 VMware Inc. All Rights Reserved vmrest 1.2.0 build-10952296 Usage of ./vmrest: -D, --Daemon Internal usage -c, --cert-path REST API Server certificate path
MAPPING = { 'g_log': 'r9', 'Debug': 'rdx', 'Warning': 'rdx', 'Log': 'rdx', } for name, reg in MAPPING.items(): for xref in XrefsTo(ida_name.get_name_ea(BADADDR, name), 0): if not xref.iscode: continue ea = xref.frm old_name = idc.get_func_name(ea) if old_name and not old_name.startswith('sub_'): continue start = idc.get_func_attr(ea, FUNCATTR_START) curr = ea while curr > start: # lea r9, [xxx] if idc.print_insn_mnem(curr) == 'lea' and ida_idp.get_reg_name(id c.get_operand_value(curr, 0), 8) == reg: p = idc.get_operand_value(curr, 1) if not p: break symbol = idc.get_strlit_contents(p) if symbol: ida_name.set_name(start, sanitize(symbol)) break curr = idc.prev_head(curr) 还原符号
非 Windows 客户机 • 非 Windows 客户机不支持 launchGuestApp • 已于 2008 年移除 Linux 客户机的 UNITY_RPC_SHELL_OPEN 等功能 https://github.com/vmware/open-vm- tools/commit/b0ef27f773c3af4b6b9c38600d9acbbc73ac6838 • 仍有部分功能被支持 • onSendKey: • sendCtrlAltDel: • 发送按键序列打开 terminal const keys = [ 0x15b, // WinKey 0x014, // T 0x012, // E 0x013, // R 0x032, // M // 0x017, // I // 0x031, // N // 0x01e, // A // 0x026, // L 0x01c, // Enter 0x017, // I 0x020, // D 0x01c, // Enter ]