Python winappdbg.Debug類代碼示例

def intercept_wsmprovhost(pid,eventHandler):
    debug = Debug(eventHandler,bKillOnExit=True)
    try:
        debug.attach(int(pid))
        debug.loop()
    except Exception,e:
        print "Error: ",str(e)

def simple_debugger(address_file, program_file, arg_check):
    
    process = None
    debug = Debug(HitTracerEventHandler(address_file, program_file, arg_check))
    
    
    try:
        # Lookup currently running processes
        debug.system.scan_processes()
        
        for (process, name) in debug.system.find_processes_by_filename(program_file):
            print "[*] Found %d: %s" % (process.get_pid(), name)
            
            # Attach to it
            debug.attach(process.get_pid())
            
        if process == None:
            print "[*] Fatal. Process not found. Is it running?"
            sys.exit(1)
            
        # Wait for all debugees to finish
        debug.loop()
        
    # Cleanup actions
    finally:
        debug.stop()

def analyze_crash(cmd):
    """
    This is called with the command line (including the filename)
    which caused the crash before.
    It is a late analysis routine which sorts the crashes.
    """

    global file_info
    global victim_filename
    global crash_filename

    # TODO: This may not always be the case
    victim_filename, crash_filename = cmd
    print "=== [*] Analyzing %s" % crash_filename
    file_binary = fileops.get_base64_contents(crash_filename)

    if file_binary:
        file_info = (crash_filename, file_binary)

    # Instance a Debug object, passing it the event handler callback.
    debug = Debug(crash_event_handler, bKillOnExit = True)
    try:

        # Start a new process for debugging.
        debug.execv(cmd)

        # Wait for the debugee to finish.
        debug.loop()

    # Stop the debugger.
    finally:
        debug.stop()

class Process(object):
    def __init__(self, api_hooks=None):
        System.request_debug_privileges()
        self.api_hooks = api_hooks
        self.hooks = []
        self.debugger = None

    def _loop(self):
        try:
            self.debugger.loop()
        except KeyboardInterrupt:
            self.debugger.stop()

    def hook_function(self, address, pre_callback=None, post_callback=None, signature=None):
        if not pre_callback and not post_callback:
            return

        self.hooks.append((address, pre_callback, post_callback, signature))

    def start(self, path, kill_process_on_exit=True, anti_anti_debugger=False, blocking=True):
        def function():
            os.chdir(os.path.dirname(path))
            self.debugger = Debug(HookingEventHandler(self.hooks, self.api_hooks), bKillOnExit=kill_process_on_exit, bHostileCode=anti_anti_debugger)
            self.debugger.execv([path])
            self._loop()

        if blocking:
            function()
        start_new_thread(function)

    def attach(self, pid, kill_process_on_exit=False, anti_anti_debugger=False, blocking=True):
        def function():
            self.debugger = Debug(HookingEventHandler(self.hooks, self.api_hooks), bKillOnExit=kill_process_on_exit, bHostileCode=anti_anti_debugger)
            self.debugger.attach(pid)
            self._loop()

        if blocking:
            function()
        start_new_thread(function)

def simple_debugger( argv ):

    # Instance a Debug object, passing it the event handler callback.
    debug = Debug( my_event_handler, bKillOnExit = True )
    try:

        # Start a new process for debugging.
        debug.execv( argv )

        # Wait for the debugee to finish.
        debug.loop()

    # Stop the debugger.
    finally:
        debug.stop()

def simple_debugger( argv ):

    # Instance a Debug object.
    debug = Debug()
    try:

        # Start a new process for debugging.
        debug.execv( argv )

        # Launch the interactive debugger.
        debug.interactive()

    # Stop the debugger.
    finally:
        debug.stop()

 def __init__(self, name, process_path, process_args=[], sql_crash_db='sqlite:///crashes.sqlite', logger=None):
     '''
     :param name: name of the object
     :param process_path: path to the target executable
     :param process_args: arguments to pass to the process
     :param attach: try to attach if process path
     :param sql_crash_db: sql alchemy connection string to crash db (default:sqlite:///crashes.sqlite)
     :param logger: logger for this object (default: None)
     '''
     super(WinAppDbgController, self).__init__(name, logger)
     assert(process_path)
     assert(os.path.exists(process_path))
     self._process_path = process_path
     self._process_name = os.path.basename(process_path)
     self._process_args = process_args
     self._process = None
     self._sql_crash_db = sql_crash_db
     self._crash_event_complete = threading.Event()
     self._server_is_up = threading.Event()
     self._crash_event_complete.set()
     self._debug = Debug(lambda x: _my_event_handler(self, x), bKillOnExit=True)

def main( ):
	
	set_logger()

	args = parse_args()	
	pid = get_pid(args)

	logging.debug( "about to connect to pid %(pid)s" % locals() )

	dbg = None
	try:

		dbg = Debug( event_handler.RPCEventHandler(), bKillOnExit = False)
		dbg.attach(pid)
		dbg.loop()

	finally:
		if dbg != None:
			logging.debug ("About to detach from pid %(pid)s" % locals() )
			dbg.detach(pid)
		
		logging.info("Finished")

# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.

from winappdbg import Debug

import sys

# Get the process filename from the command line.
filename = sys.argv[1]

# Instance a Debug object.
debug = Debug()
try:

    # Lookup the currently running processes.
    debug.system.scan_processes()

    # For all processes that match the requested filename...
    for ( process, name ) in debug.system.find_processes_by_filename( filename ):
        print process.get_pid(), name

        # Attach to the process.
        debug.attach( process.get_pid() )

    # Wait for all the debugees to finish.
    debug.loop()

        else:
            event.debug.pmf.append("Path","contains", value, "EXCLUDE")
    elif subsystem == 3:
        #Registry
        if semantics[semantic] == 'REG_ALLOW_READONLY':
            event.debug.pmf.append("Path","contains", value, "EXCLUDE")
        elif  semantics[semantic] == 'REG_ALLOW_ANY':
            event.debug.pmf.append("Path","contains", value, "INCLUDE")
    else:
        pass


if __name__ == '__main__':
    print "Wellcome. Using Winappdbg version", version
    #Instantiate the debugger
    debug = Debug(bKillOnExit=True, bHostileCode=True)
    #Build the basic set of filter rules
    pmf = PMF('policy.pmf')
    pmf.clear()
    pmf.append('Process Name','is', 'Procmon.exe', 'EXCLUDE')
    pmf.append('Process Name','is', 'System', 'EXCLUDE')
    pmf.append('Operation','begins with', 'IRP_MJ_', 'EXCLUDE')
    pmf.append('Operation','begins with', 'FASTIO_', 'EXCLUDE')
    pmf.append('Result','begins with', 'FAST IO', 'EXCLUDE')
    pmf.append('Path','ends with', 'pagefile.sys', 'EXCLUDE')
    pmf.append('Path','ends with', '$Mft', 'EXCLUDE')
    pmf.append('Path','ends with', '$MftMirr', 'EXCLUDE')
    pmf.append('Path','ends with', '$LogFile', 'EXCLUDE')
    pmf.append('Path','ends with', '$Volume', 'EXCLUDE')
    pmf.append('Path','ends with', '$AttrDef', 'EXCLUDE')
    pmf.append('Path','ends with', '$Root', 'EXCLUDE')

class Coverage:
	verbose = False
	bbFiles = {}
	bbFilesBreakpints = []
	bbFilesData = {}
	bbOriginalName = {}
	modules = []
	fileOutput = None
		
	#Construct
	def __init__(self):
		self.debugger = Debug( bKillOnExit = True )
		
	def setVerbose(self, val):
		self.verbose = val
		
	#cuts after .
	def cutDot(self, input):
		if (input.find(".") == -1):
			return input
		return input[0:input.find(".")]

	#load basic blocks
	def loadBB(self, baseBbDir):
		self.bbFiles = {}
		count = 0
		print "baseBbDir:"+baseBbDir
		for bbFile in os.listdir(baseBbDir):
			print "bbFile:" + bbFile
			f = open(baseBbDir + "/" + bbFile, "r")
			fname = f.readline().strip().lower()
			#fname = f.readline().strip()
			fnameOrig = fname
			if ".dll" not in fname and ".exe" not in fname:  #Stupid hack to avoid problems in loading libs with other extensions then .dll
				fname = self.cutDot(fname) + ".dll"
			self.bbOriginalName[fname] = fnameOrig
			self.bbFiles[fname] = count
			self.bbFilesBreakpints.append({})
			rvaHighest = 0
			for line in f:
				try:
					rva = int(line[0:8], 16)
					val = int(line[18:20], 16)
					self.bbFilesBreakpints[count][rva] = val
					if rva > rvaHighest:
						rvaHighest = rva
				except Exception:
					continue
			self.bbFilesData[fname] = [rvaHighest + 10, count]
			if self.verbose:
				print "Loaded breakpoints for %s with index %02X" % (fname, count)
			count += 1
			f.close()
	
	#Register module (original exe image or dll)
	def registerModule(self, filename, baseaddr):
		filename = filename.lower()
		if ".dll" not in filename and ".exe" not in filename:  #Stupid hack to avoid problems in loading libs with other extensions then .dll
			filename = self.cutDot(filename) + ".dll"
		if filename not in self.bbFiles:
			return
		if self.verbose:
			print "  Image %s has breakpoints defined" % filename
		self.modules.append([baseaddr,baseaddr+self.bbFilesData[filename][0], self.bbFilesData[filename][1]])
		if self.verbose:
			print "  Image has breakpoints from %08X to %08X with index %02X" % (baseaddr,baseaddr+self.bbFilesData[filename][0],self.bbFilesData[filename][1])
		
	#Handle a breakpoint
	def breakpoint(self, location):
		index = None
		for i in xrange(len(self.modules)):
			if location>=self.modules[i][0] and location<=self.modules[i][1]:
				index = i
				break
		if index == None:
			return None	
		rva = location - self.modules[index][0]
		index = self.modules[index][2]
		if rva not in self.bbFilesBreakpints[index]:
			return None
		self.fileOutput.write("%02X|%08X\n" % (index, rva))
		return self.bbFilesBreakpints[index][rva]
		
	def startFileRec(self, filename):
		self.modules = []
		self.fileOutput = open(filename, "w")
		for image in self.bbFiles:
			self.fileOutput.write("%s|%02X\n" % (self.bbOriginalName[image], self.bbFiles[image]))
		
	def endFileRec(self):
		self.fileOutput.close()		
	
	#Start program
	def start(self, execFile, waitTime = 6, recFilename = "output.txt", kill = True):	
		self.startFileRec(recFilename)
		mainProc = self.debugger.execv( execFile, bFollow = True )
		event = None
		endTime = time() + waitTime
		while time() < endTime:
			if not mainProc.is_alive():
#.........這裏部分代碼省略.........

           print i.replace('\x00','')
        
        found = []
        # Looking for Password:
        pass_pattern = '([0-9]\x00){4}\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x07\x00\x00'
        for address in process.search_regexp( pass_pattern ):
                 found += [process.read(address[0]-3,16)]
        if found:
            print '\nPassword:'
        if len(found) > 1:
            s = list(set([x for x in found if found.count(x) > 1]))
            for i in s:
               pwd = re.findall('[0-9]{4}',i.replace('\x00',''))[0]
            print pwd
        else:
            print re.findall('[0-9]{4}',found[0].replace('\x00',''))[0]
        
        return found

debug = Debug()
try:
        # Lookup the currently running processes.
        debug.system.scan_processes()
        # For all processes that match the requested filename...
        for ( process, name ) in debug.system.find_processes_by_filename( filename ):
                pid = process.get_pid()

        memory_search(pid)
           
finally:
        debug.stop()

# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.

# This line is needed in Python 2.5 to use the "with" statement.
from __future__ import with_statement

from winappdbg import Debug

import sys

# Instance a Debug object, set the kill on exit property to True.
debug = Debug( bKillOnExit = True )

# The user can stop debugging with Control-C.
try:
    print "Hit Control-C to stop debugging..."

    # Start a new process for debugging.
    debug.execv( sys.argv[ 1 : ] )

    # Wait for the debugee to finish.
    debug.loop()

# If the user presses Control-C...
except KeyboardInterrupt:
    print "Interrupted by user."

    myevent = MyEventHandler()
    myevent.dir = dir
    myevent.report = report
    myevent.myself = os.path.basename(sys.argv[1])

    if options.functions:
        hooks = parse_hook_spec(options.functions)
        if len(hooks) == 0:
            sys.exit()
        else:
            myevent.set_hooks(hooks)


    # Instance a Debug object, passing it the MyEventHandler instance
    debug = Debug( myevent )

    try:

        if options.pid:
            debug.attach(options.pid)
            print_threads_and_modules(options.pid, debug)
        elif options.program:
            procs = list_processes(options.program)

            if len(procs) == 0:
                print "[E] no matching process"
            elif len(procs) == 1:
                debug.attach(procs[0].get_pid())
                print_threads_and_modules(procs[0].get_pid(), debug)
            else:

 def createDebugger(self, command):
     debug = Debug(self.debuggerEventHandler, bKillOnExit=True)
     argv = command.split()
     debug.execv(argv)
     debug.loop()