PavelBlinnikov

#!/usr/bin/env python3
"""Extract /usr/lib/vmware/vmkmod from an ESXi offline depot (.zip).

An offline bundle is a zip of VIB packages. Each VIB is an ar archive.
Bootbank payloads are gzip streams. Small driver VIBs gunzip to a VMware
visor tar (vmtar). The large esx-base tardisks (s, sb, vmx, vim) are
gzip around an xz stream, and that xz stream is the visor tar.

A visor header is a 512-byte ustar-style header with magic ``visor``.
Member bytes are not stored after each header. The uint32 at offset 0x1F0

PavelBlinnikov

import idautils
import ida_bytes
import ida_idaapi
import ida_segment
from keystone import *

ks = Ks(KS_ARCH_X86, KS_MODE_64)

def create_gs_segment():
    start = 0x41420000

PavelBlinnikov

def get_sysClasses():
    groups = ["UserLinux_SyscallTable", "Linux64_SyscallTable", "UWVMKPrivateSyscall_HandlerTable", "UW64VMKPrivateSyscall_HandlerTable", "UWVMKSyscall_HandlerTable", "UW64VMKSyscall_HandlerTable"]
    
    sysClasses = {0xffffffff: ["alwaysAllowSys", []]}
    sysClasses_addr = ida_name.get_name_ea(idaapi.BADADDR, "sysClassIdentifiers")
    
    i = 0
    while True:
        class_val = idc.get_strlit_contents(ida_bytes.get_qword(sysClasses_addr + i * 8))
        if class_val is None:

PavelBlinnikov

import idautils

def find():
    guid = b'\xb7\xbf\xcc\xf4\xe0\xf6\xfdG\x9d\xd4\x10\xa8\xf1P\xc1\x91'
    for i in range(ida_ida.inf_get_min_ea(), ida_ida.inf_get_max_ea(), 0x1000):
        data = ida_bytes.get_bytes(i, 0x1000)
        if guid in data:
            return i+data.index(guid)
    return False