Python HexDump.address方法代码示例

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def memory_search( pid, bytes ):

    # Instance a Process object.
    process = Process( pid )

    # Search for the string in the process memory.
    for address in process.search_bytes( bytes ):

        # Print the memory address where it was found.
        print HexDump.address( address )

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
    def handler(self, event):
        if (
            event.get_event_code() == win32.EXCEPTION_DEBUG_EVENT
            and event.get_exception_code() != win32.STATUS_BREAKPOINT
            and (event.is_last_chance() or event.get_exception_code() in self.alwaysCatchExceptions)
        ):
            crash = Crash(event)
            report = CrashReport()

            crash = Crash(event)
            (exploitable, type, info) = crash.isExploitable()
            try:
                report.code = event.get_thread().disassemble(crash.pc, 0x10)[0][2]
            except:
                report.code = "Could not disassemble"

            if crash.faultAddress is None or MemoryAddresses.align_address_to_page_start(crash.faultAddress) == 0:
                report.nearNull = True
            else:
                report.nearNull = False
            report.type = type

            lib = event.get_thread().get_process().get_module_at_address(crash.pc)
            if lib != None:
                report.location = lib.get_label_at_address(crash.pc)
            else:
                report.location = HexDump.address(crash.pc, event.get_thread().get_process().get_bits())[-4:]

            if crash.faultAddress == None:
                crash.faultAddress = 0
            report.faultAddr = HexDump.address(crash.faultAddress, event.get_thread().get_process().get_bits())

            report.stack = ""
            stList = self.getStackTraceRelList(event.get_thread())
            if len(stList) > 0:
                for ra in stList:
                    lib = event.get_thread().get_process().get_module_at_address(ra)
                    if lib != None:
                        report.stack += (
                            lib.get_label_at_address(ra)
                            + " "
                            + HexDump.address(ra, event.get_thread().get_process().get_bits())
                            + "\n"
                        )
                    else:
                        report.stack += HexDump.address(ra, event.get_thread().get_process().get_bits()) + "\n"
            if report.stack == "":
                report.stack = "NO_STACK"
            report.info = crash.fullReport()

            return report
        return None

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def do(self, arg):
    ".exchain - Show the SEH chain"
    thread = self.get_thread_from_prefix()
    print("Exception handlers for thread %d" % thread.get_tid())
    table = Table()
    table.addRow("Block", "Function")
    bits = thread.get_bits()
    for (seh, seh_func) in thread.get_seh_chain():
        if seh is not None:
            seh      = HexDump.address(seh, bits)
        if seh_func is not None:
            seh_func = HexDump.address(seh_func, bits)
        table.addRow(seh, seh_func)
    print(table.getOutput())

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def log_eip_callback(event):
    '''
    This will be called when our breakpoint is hit. It writes the current EIP.
    @param event: Event information, dough!
    '''        
    
    address = event.get_thread().get_pc()
    fd.write(HexDump.address(address) + '\n')

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
    def single_step( self, event ):

        # Show the user where we're running.
        thread = event.get_thread()
        pc     = thread.get_pc()
        code   = thread.disassemble( pc, 0x10 ) [0]
        bits   = event.get_process().get_bits()
        print "%s: %s" % ( HexDump.address(code[0], bits), code[2].lower() )

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
    def single_step(self, event):
        thread = event.get_thread()
        pc = thread.get_pc()
        code = thread.disassemble(pc, 0x10)[0]

        trace_file = open(os.path.join(TRACE_PATH, "%s.csv" % event.get_pid()), "a")
        trace_file.write("\"0x%s\",\"%s\"\n"
                         % (HexDump.address(code[0]), code[2]))
        trace_file.close()

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def my_event_handler( event ):

    # Get the event name.
    name = event.get_event_name()

    # Get the event code.
    code = event.get_event_code()

    # Get the process ID where the event occured.
    pid = event.get_pid()

    # Get the thread ID where the event occured.
    tid = event.get_tid()

    # Get the value of EIP at the thread.
    pc = event.get_thread().get_pc()

    # Show something to the user.
    bits = event.get_process().get_bits()
    format_string = "%s (%s) at address %s, process %d, thread %d"
    message = format_string % ( name,
                                HexDump.integer(code, bits),
                                HexDump.address(pc, bits),
                                pid,
                                tid )
    print message

    # If the event is a crash...
    if code == win32.EXCEPTION_DEBUG_EVENT and event.is_last_chance():
        print "Crash detected, storing crash dump in database..."

        # Generate a minimal crash dump.
        crash = Crash( event )

        # You can turn it into a full crash dump (recommended).
        # crash.fetch_extra_data( event, takeMemorySnapshot = 0 ) # no memory dump
        # crash.fetch_extra_data( event, takeMemorySnapshot = 1 ) # small memory dump
        crash.fetch_extra_data( event, takeMemorySnapshot = 2 ) # full memory dump

        # Connect to the database. You can use any URL supported by SQLAlchemy.
        # For more details see the reference documentation.
        dao = CrashDAO( "sqlite:///crashes.sqlite" )
        #dao = CrashDAO( "mysql+MySQLdb://root:[email protected]/crashes" )

        # Store the crash dump in the database.
        dao.add( crash )

        # If you do this instead, heuristics are used to detect duplicated
        # crashes so they aren't added to the database.
        # dao.add( crash, allow_duplicates = False )

        # You can also launch the interactive debugger from here. Try it! :)
        # event.debug.interactive()

        # Kill the process.
        event.get_process().kill()

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def my_event_handler( event ):

    # Get the process ID where the event occured.
    pid = event.get_pid()

    # Get the thread ID where the event occured.
    tid = event.get_tid()

    # Find out if it's a 32 or 64 bit process.
    bits = event.get_process().get_bits()

    # Get the value of EIP at the thread.
    address = event.get_thread().get_pc()

    # Get the event name.
    name = event.get_event_name()

    # Get the event code.
    code = event.get_event_code()

    # If the event is an exception...
    if code == win32.EXCEPTION_DEBUG_EVENT:

        # Get the exception user-friendly description.
        name = event.get_exception_description()

        # Get the exception code.
        code = event.get_exception_code()

        # Get the address where the exception occurred.
        try:
            address = event.get_fault_address()
        except NotImplementedError:
            address = event.get_exception_address()

    # If the event is a process creation or destruction,
    # or a DLL being loaded or unloaded...
    elif code in ( win32.CREATE_PROCESS_DEBUG_EVENT,
                   win32.EXIT_PROCESS_DEBUG_EVENT,
                   win32.LOAD_DLL_DEBUG_EVENT,
                   win32.UNLOAD_DLL_DEBUG_EVENT ):

        # Get the filename.
        filename = event.get_filename()
        if filename:
            name = "%s [%s]" % ( name, filename )

    # Show a descriptive message to the user.
    print "-" * 79
    format_string = "%s (0x%s) at address 0x%s, process %d, thread %d"
    message = format_string % ( name,
                                HexDump.integer(code, bits),
                                HexDump.address(address, bits),
                                pid,
                                tid )
    print message

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
    def accessed( self, event ):

        # Show the user where we're running.
        thread = event.get_thread()
        pc     = thread.get_pc()
        code   = thread.disassemble( pc, 0x10 ) [0]
        print "%s: %s" % (
            HexDump.address(code[0], thread.get_bits()),
            code[2].lower()
        )

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def strings( pid ):

    # Instance a Process object.
    process = Process( pid )

    # For each ASCII string found in the process memory...
    for address, size, data in process.strings():

        # Print the string and the memory address where it was found.
        print "%s: %s" % ( HexDump.address(address), data )

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def entering( event ):

    # Get the thread object.
    thread = event.get_thread()

    # Get the thread ID.
    tid = thread.get_tid()

    # Get the return address location (the top of the stack).
    stack_top = thread.get_sp()

    # Get the return address and the parameters from the stack.
    bits = event.get_process().get_bits()
    if bits == 32:
        return_address, hModule, lpProcName = thread.read_stack_dwords( 3 )
    else:
        return_address = thread.read_stack_qwords( 1 )
        registers  = thread.get_context()
        hModule    = registers['Rcx']
        lpProcName = registers['Rdx']

    # Get the string from the process memory.
    procedure_name = event.get_process().peek_string( lpProcName )

    # Show a message to the user.
    message = "%s: GetProcAddress(%s, %r);"
    print message % (
        HexDump.address(return_address, bits),
        HexDump.address(hModule, bits),
        procedure_name
    )

    # Watch the DWORD at the top of the stack.
    try:
        event.debug.stalk_variable( tid, stack_top, 4, returning )
        #event.debug.watch_variable( tid, stack_top, 4, returning )

    # If no more slots are available, set a code breakpoint at the return address.
    except RuntimeError:
        event.debug.stalk_at( event.get_pid(), return_address, returning_2 )

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def print_threads_and_modules( pid ):
    # Instance a Process object.
  process = Process( pid )
  print "Process %d" % process.get_pid()
    # Now we can enumerate the threads in the process...
  print "Threads:"
  for thread in process.iter_threads():
    print "\t%d" % thread.get_tid()
    # ...and the modules in the process.
  print "Modules:"
  bits = process.get_bits()
  for module in process.iter_modules():
    print "\t%s\t%s" % (
       HexDump.address( module.get_base(), bits ), module.get_filename()
    )

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def action_callback( event ):
    process = event.get_process()
    thread  = event.get_thread()

    # Get the address of the top of the stack.
    stack   = thread.get_sp()

    # Get the return address of the call.
    address = process.read_pointer( stack )

    # Get the process and thread IDs.
    pid     = event.get_pid()
    tid     = event.get_tid()

    # Show a message to the user.
    message = "kernel32!CreateFileW called from %s by thread %d at process %d"
    print message % ( HexDump.address(address, process.get_bits()), tid, pid )

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def print_alnum_jump_addresses(pid):

    # Request debug privileges so we can inspect the memory of services too.
    System.request_debug_privileges()

    # Suspend the process so there are no malloc's and free's while iterating.
    process = Process(pid)
    process.suspend()
    try:

        # For each executable alphanumeric address...
        for address, packed, module in iterate_alnum_jump_addresses(process):

            # Format the address for printing.
            numeric = HexDump.address(address, process.get_bits())
            ascii   = repr(packed)

            # Format the module name for printing.
            if module:
                modname = module.get_name()
            else:
                modname = ""

            # Try to disassemble the code at this location.
            try:
                code = process.disassemble(address, 16)[0][2]
            except NotImplementedError:
                code = ""

            # Print it.
            print numeric, ascii, modname, code

    # Resume the process when we're done.
    # This is inside a "finally" block, so if the program is interrupted
    # for any reason we don't leave the process suspended.
    finally:
        process.resume()

# 需要导入模块: from winappdbg import HexDump [as 别名]
# 或者: from winappdbg.HexDump import address [as 别名]
def print_threads_and_modules( pid, debug ):

    # Instance a Process object.
    process = Process( pid )
    print "Process %d" % process.get_pid()

    # Now we can enumerate the threads in the process...
    print "Threads:"
    for thread in process.iter_threads():
        print "\t%d" % thread.get_tid()

    # ...and the modules in the process.
    print "Modules:"
    bits = process.get_bits()
    for module in process.iter_modules():
        print "\thas module: %s\t%s" % (
            HexDump.address( module.get_base(), bits ),
            module.get_filename()
        )

    print "Breakpoints:"
    for i in debug.get_all_breakpoints():
        bp = i[2]
        print "breakpoint: %s %x" % (bp.get_state_name(), bp.get_address())