Python pydbg函数代码示例

def main():
	global all_func
	global most_used_funcs
	most_used_funcs = []
	all_func = parseidalog('ida-export.txt')
	dbg = pydbg()
	exe_file = sys.argv[1]
	pe = pefile.PE(exe_file)
	dbg = pydbg()
	dbg.load(exe_file)
	entry = pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.AddressOfEntryPoint
	dbg.bp_set(entry,handler=setallbp)
	dbg.run()

    def start_debugger(self):

        self.dbg = pydbg()
        pid = self.dbg.load(self.exe_path)
        self.pid = self.dbg.pid

        self.dbg.run()

def do_pydbg_dance (proggie, the_file):
    dbg = pydbg()
    dbg.load(proggie, the_file, show_window=False)
    dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, av_handler)
    dbg.set_callback(EXCEPTION_BREAKPOINT,       bp_handler)

    dbg.run()

	def __init__ (self, process_monitor, proc_name, ignore_pid=None):
		'''
		Instantiate a new PyDbg instance and register user and access violation callbacks.
		'''

		threading.Thread.__init__(self)
		#self.daemon = True

		self.process_monitor  = process_monitor
		self.proc_name		= proc_name
		self.ignore_pid	   = ignore_pid

		self.access_violation = False
		#self.active		   = True
		self.dbg			  = pydbg()
		self.pid			  = None
		#Process instance
		self.inst			= None
		#ASSUMPTION: only the first request is the one to be fuzzed, everything else is just related content,
		#after first req, flag is set to true and proxy will not fuzz (or post_send).
		#we could fuzz also related content, todo: modify handling of thread queue, test case saving 
		#(we now use test_number = thread number)
		self.FuzzReqSent = False

		# give this thread a unique name.
		self.setName("%d" % time.time())

		#self.process_monitor.log("debugger thread initialized with UID: %s" % self.getName(), 5)
		self.process_monitor.log("debugger thread initialized with UID: %s" % self.getName())

		# set the user callback which is response for checking if this thread has been killed.
		self.dbg.set_callback(USER_CALLBACK_DEBUG_EVENT,  self.dbg_callback_user)
		self.dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, self.dbg_callback_access_violation)

def startfuzzer():
	printBanner()
	raw_input('[+] Press Enter to Continue...')
	c = 1
	if len(basefilelist) == 0:
		print '[+] No base files @ ',basefile_dir
		exit()
	print basefilelist
	print '[+] Starting Fuzzing..'
	while 1:
		global basefilename,ext,fuzzfilename
		basefilename = random.choice(basefilelist)
		ext = basefilename.split('.',1)[1]
		fuzzfilename = 'fuzz_' +  basefilename.split('\\',basefilename.count('\\'))[-1:][0]
		fi = open(basefilename,'rb')
		file_data = fi.read()
		fi.close()
		if c%100 == 0:
			collected = gc.collect()
			print '[+] '+str(c)+'th Testcase'
			print "[+] Garbage collector triggered: collected %d objects." % (collected)
		mutated = mutate(file_data)
		try:
			fo = open(temp_dir + fuzzfilename,'wb')
			fo.write(mutated)
			fo.close()
		except Exception, e:
			print '[+] Unable to write new file skipping..'
		dbg = pydbg()
		dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, AccessViolationHandler)
		thread.start_new_thread(StillRunning, (dbg, ))
		args = command_line_arg + " " + temp_dir + fuzzfilename
		dbg.load(programname,args , show_window=True)
		dbg.run()
		c = c + 1

 def hookIE(self, dbg):
     loadpid = dbg.pid
     dbg.detach()
     dbg = pydbg()
     dbg.cf = self.cf
     print "IE first process PID = %d" % loadpid
     pattern = r"iexplore.exe\s*([0-9]*)\s*Console"
     count = 0
     while count <= 1:
         p = os.popen('tasklist|find "iexplore"')
         pids = re.findall(pattern, p.read())
         count = len(pids)
     print "find IE pids:" + str(pids)
     for pid in pids:
         if loadpid == int(pid):
             continue
         try:
             dbg.attach(int(pid))
             dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, deal_accessv)
             dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, deal_accessv)
             dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, deal_accessv)
             print "hook IE(pid=%s) success!" % (pid)
             return dbg
         except Exception, e:
             print "hook IE(pid=%s) failed!" % (pid)
             print e
             return None

    def __init__ (self, process_monitor, proc_name, ignore_pid=None):
        '''
        Instantiate a new PyDbg instance and register user and access violation callbacks.
        '''

        threading.Thread.__init__(self)

        self.process_monitor  = process_monitor
        self.proc_name        = proc_name
        self.ignore_pid       = ignore_pid

        self.access_violation = False
        self.unscheduled_exit = False
        self.active           = True
        self.dbg              = pydbg()
        self.pid              = None
        self.stopping_process = False

        # give this thread a unique name.
        self.setName("%d" % time.time())

        self.process_monitor.log("debugger thread initialized with UID: %s" % self.getName(), 5)

        # set the user callback which is response for checking if this thread has been killed.
        self.dbg.set_callback(USER_CALLBACK_DEBUG_EVENT,  self.dbg_callback_user)
        self.dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, self.dbg_callback_access_violation)
        self.dbg.set_callback(EXIT_PROCESS_DEBUG_EVENT, self.dbg_callback_unscheduled_exit)

 def start_debugger(self):
     print "[*] Starting debugger for iteration: %d" % self.iteration
     self.running = True
     self.dbg = pydbg()
     self.dbg.set_callback(EXCEPTION_ACCESS_VIOLATION,self.check_accessv)
     pid = self.dbg.load(self.exe_path,"test.%s" % self.ext)
     self.pid = self.dbg.pid
     self.dbg.run()         

def pydbg_bphandle(): 
    dbg = pydbg()
    pid = raw_input("Enter the printf_loop.py PID: ")
    dbg.attach(int(pid))
    printf_address = dbg.func_resolve("msvcrt", "printf")
    # Set the breakpoint with the printf_randomizer function defined as a callback
    dbg.bp_set(printf_address, description="printf_address", handler=printf_randomizer)
    dbg.run()

def start_safari():
    debug = pydbg()
    m_conmsg("Starting Safari",0)
    safari_process = subprocess.Popen(['/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment', ''], env=dict(os.environ, DYLD_INSERT_LIBRARIES="/usr/lib/libgmalloc.dylib"), stdin=subprocess.PIPE, stdout=subprocess.PIPE)
    debug.attach(safari_process.pid)
    print "DONE"
    time.sleep(0.6)
    m_ascript('tell application "Safari" to close every window') 
    m_ascript('tell application "Safari" to open location "about:blank"') 

 def __init__(self):
     self.pids = []
     self.dbg = pydbg()
     self.isAccessv = False
     self.isVul = False
     self.isMon = False
     self.isInAv = False
     self.timeout = 1
     self.nullPtrThr = -1
     self.avBlackList = [r"cmp byte \[0x70\],0x0 from"]

def main():

    target = sys.argv[1]
    dbg = pydbg()
    dbg.load(target, " ".join(sys.argv[2:]))

    pe = pefile.PE(target)
    entrypoint = pe.OPTIONAL_HEADER.ImageBase + pe.OPTIONAL_HEADER.AddressOfEntryPoint
    dbg.bp_set(entrypoint,handler=hook_install)
    dbg.run()

 def pydbg_set_locale (self, host, port):
     if host not in ("localhost", "127.0.0.1") and type(port) is int:
         try:
             self.parent.pydbg = pydbg_client(host, port)
             self.parent.status_bar.SetStatusText("Successfully connected to PyDbg server on %s:%d" % (host, port))
             self.parent.status_bar.SetStatusText("PyDbg: %s" % host, 3)
         except:
             self.parent.status_bar.SetStatusText("Failed connecting to PyDbg server on %s:%d" % (host, port))
     else:
         self.parent.pydbg = pydbg()

 def debug_process(self):
     
     self.running = True
     self.dbg = pydbg()
     # Install our custom handler
     self.dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, self.accessv_handler)
     self.dbg.load(self.modulePath, self.mutated_file)
     
     self.pid = self.dbg.pid
     self.dbg.run()

    def start_debugger(self):

        self.running = True
        self.dbg = pydbg()

        self.dbg.set_callback(EXCEPTION_ACCESS_VIOLATION,self.check_accessv)
        pid = self.dbg.load(self.exe_path, self.tmp_file)

        self.pid = self.dbg.pid
        self.dbg.run()