Python winappdbg.System类代码示例

def print_api_address( pid, modName, procName ):

    # Request debug privileges.
    System.request_debug_privileges()

    # Instance a Process object.
    process = Process( pid )

    # Lookup it's modules.
    process.scan_modules()

    # Get the module.
    module = process.get_module_by_name( modName )
    if not module:
        print "Module not found: %s" % modName
        return

    # Resolve the requested API function address.
    address = module.resolve( procName )

    # Print the address.
    if address:
        print "%s!%s == 0x%.08x" % ( modName, procName, address )
    else:
        print "Could not resolve %s in module %s" % (procName, modName)

def copypasta(action, params, wait_state, doing_verb, done_verb):
    'common code in a lot of methods here :)'
    try:
        target = params[0]

        # Do the requested action.
        status = System.get_service(target)
        try:
            name = System.get_service_display_name(target)
        except WindowsError:
            name = target
        print "%s service \"%s\"..." % (doing_verb, name)
        action(*params)

        # Wait for it to finish.
        timeout = 20
        status = System.get_service(target)
        while status.CurrentState == wait_state:
            timeout -= 1
            if timeout <= 0:
                print "Error: timed out."
                return
            time.sleep(0.5)
            status = System.get_service(target)

        # Done.
        print "Service %s successfully." % done_verb

    # On error show a message and quit.
    except WindowsError, e:
        print str(e)
        return

def print_thread_disassembly( tid ):

    # Request debug privileges.
    System.request_debug_privileges()

    # Instance a Thread object.
    thread = Thread( tid )

    # Suspend the thread execution.
    thread.suspend()

    # Get the thread's currently running code.
    try:
        eip  = thread.get_pc()
        code = thread.disassemble_around( eip )

        # You can also do this:
        # code = thread.disassemble_around_pc()

        # Or even this:
        # process = thread.get_process()
        # code    = process.disassemble_around( eip )

    # Resume the thread execution.
    finally:
        thread.resume()

    # Display the disassembled code.
    print
    print CrashDump.dump_code( code, eip ),

def getPidsByImg(img):
	result = []
	system = System()
	system.scan_processes()
	for ( process, name ) in system.find_processes_by_filename( img ):
		result.append(process.get_pid())
	return result

def print_state( process_name ):

    # Request debug privileges.
    System.request_debug_privileges()

    # Find the first process that matches the requested name.
    system = System()
    process, filename = system.find_processes_by_filename( process_name )[ 0 ]

    # Suspend the process execution.
    process.suspend()
    try:

        # For each thread in the process...
        for thread in process.iter_threads():

            # Get the thread state.
            tid     = thread.get_tid()
            eip     = thread.get_pc()
            code    = thread.disassemble_around( eip )
            context = thread.get_context()

            # Display the thread state.
            print
            print "-" * 79
            print "Thread: %s" % HexDump.integer( tid )
            print
            print CrashDump.dump_registers( context )
            print CrashDump.dump_code( code, eip ),
            print "-" * 79

    # Resume the process execution.
    finally:
        process.resume()

class TSMonitorHandler:
    def __init__(self):
        self._system = System()
        self._system.request_debug_privileges()
        self._process = {}
        for process in self._system:
            self._process[process.get_pid()] = process

    def ping(self):
        print "function ping called."
        return 0

    def refresh(self):
        print "function refresh called."
        self.__init__()
        return 0

    def process(self, id):

        p = self._process[id]

        process = tsm.Process()
        process.id = id
        if id == 0:
            process.name = "System Idle Process"
        elif id == 4:
            process.name = "System"
        else:
            process.name = os.path.basename(p.get_filename())

        p.scan_threads()

        tids = p.get_thread_ids()
        #tids.sort()
        process.num_threads = len(tids)
        
        process.thread = []
        for tid in tids:
            # Suspend the thread executior
            try:
                th = p.get_thread(tid)
                th.suspend()
                stack_limit, stack_base = th.get_stack_range()
                thread = tsm.Thread()
                thread.id = tid
                thread.stack_size = stack_base - stack_limit
                process.thread.append(thread)

            except WindowsError:
                thread = tsm.Thread()
                thread.id = tid
                thread.stack_size = -1
                process.thread.append(thread)

            # Resume the thread execution
            finally:
                th.resume()

        return process

def wait_for_service( service, wait_state, timeout = 20 ):
    descriptor = System.get_service( service )
    while descriptor.CurrentState == wait_state:
        timeout -= 1
        if timeout <= 0:
            raise RuntimeException( "Error: timed out." )
        sleep( 0.5 )
        descriptor = System.get_service( service )

def main():

    # Create a system snaphot.
    system = System()

    # Get the Desktop window.
    root = system.get_desktop_window()

    # Now show the window tree.
    show_window_tree(root)

    def create_debugger(self):

        # Instance a debugger
        debug = Debug(self, bHostileCode = self.options.hostile)

        # Make sure the remote symbol store is set
        System.fix_symbol_store_path(remote = True, force = False)

        # Populate the snapshot of processes
        debug.system.scan()

        # Use this debugger
        self.start_using_debugger(debug)

def main():
    print "Process string extractor"
    print "by Mario Vilas (mvilas at gmail.com)"
    print

    if len(sys.argv) != 2:
        script = os.path.basename(sys.argv[0])
        print "  %s <pid>" % script
        print "  %s <process.exe>" % script
        return

    System.request_debug_privileges()

    try:
        pid = HexInput.integer(sys.argv[1])
    except Exception, e:
        s = System()
        s.scan_processes()
        pl = s.find_processes_by_filename(sys.argv[1])
        if not pl:
            print "Process not found: %s" % sys.argv[1]
            return
        if len(pl) > 1:
            print "Multiple processes found for %s" % sys.argv[1]
            for p, n in pl:
                print "\t%s: %s" % (p.get_pid(), n)
            return
        pid = pl[0][0].get_pid()
        s.clear()
        del s

def get_explorer_pid():
    # Request debug privileges.
    System.request_debug_privileges()

    # Scan for running processes.
    system = System()
    try:
        system.scan_processes()
        #system.scan_process_filenames()
    except WindowsError:
        system.scan_processes_fast()

    # For each running process...
    for process in system.iter_processes():
        try:

            pid = process.get_pid()

            if pid in (0, 4, 8):
                continue

            if dev:
                print "* Process:", process.get_filename(), "Pid:", pid, "Time:", process.get_running_time()
            if process.get_filename() == "explorer.exe":
                if process.get_running_time() < 300000:
                    return pid

        # Skip processes we don't have permission to access.
        except WindowsError, e:
            if e.winerror == ERROR_ACCESS_DENIED:
                continue
            raise

def main(argv):

    # Print the banner.
    print "SelectMyParent: Start a program with a selected parent process"
    print "by Mario Vilas (mvilas at gmail.com)"
    print "based on a Didier Stevens tool (https://DidierStevens.com)"
    print

    # Check the command line arguments.
    if len(argv) < 3:
        script = os.path.basename(argv[0])
        print "  %s <pid> <process.exe> [arguments]" % script
        return

    # Request debug privileges.
    system = System()
    system.request_debug_privileges()

    # Parse the parent process argument.
    try:
        dwParentProcessId = HexInput.integer(argv[1])
    except ValueError:
        dwParentProcessId = None
    if dwParentProcessId is not None:
        dwMyProcessId = win32.GetProcessId( win32.GetCurrentProcess() )
        if dwParentProcessId != dwMyProcessId:
            system.scan_processes_fast()
            if not system.has_process(dwParentProcessId):
                print "Can't find process ID %d" % dwParentProcessId
                return
    else:
        system.scan_processes()
        process_list = system.find_processes_by_filename(argv[1])
        if not process_list:
            print "Can't find process %r" % argv[1]
            return
        if len(process_list) > 1:
            print "Too many processes found:"
            for process, name in process_list:
                print "\t%d:\t%s" % (process.get_pid(), name)
            return
        dwParentProcessId = process_list[0][0].get_pid()

    # Parse the target process argument.
    filename = argv[2]
    if not os.path.exists(filename):
        try:
            filename = win32.SearchPath(None, filename, '.exe')[0]
        except WindowsError, e:
            print "Error searching for %s: %s" % (filename, str(e))
            return
        argv = list(argv)
        argv[2] = filename

def print_label_address( pid, label ):

    # Request debug privileges.
    System.request_debug_privileges()

    # Instance a Process object.
    process = Process( pid )

    # Lookup it's modules.
    process.scan_modules()

    # Resolve the requested label address.
    address = process.resolve_label( label )

    # Print the address.
    print "%s == 0x%.08x" % ( label, address )

def list_processes(match_name=""):
    print "[+] processes:"
    s = System()

    l = []

    if len(match_name) > 0:
        l1 = []
        for p in s.find_processes_by_filename(match_name):
            l.append(p[0])
    else:
        l = s

    for p in l:
        print "%5d\t%s" % (p.get_pid(), p.get_filename())

    return l

def test_windbg_version():
    from winappdbg import System, win32

    dbghelp = System.load_dbghelp()
    pathname = win32.GetModuleFileNameEx(-1, dbghelp._handle)
    sysroot = os.getenv("SystemRoot")
    system = os.path.join(sysroot, "System32")
    syswow = os.path.join(sysroot, "SysWoW64")
    if pathname.lower().startswith(system.lower()) or pathname.lower().startswith(syswow.lower()):
        raise RuntimeError("WinDbg not found")