Python Debug.execv方法代碼示例

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
def main( argv ):

    # Parse the command line arguments
    options = parse_cmdline(argv)

    # Create the event handler object
    eventHandler = Tracer()
    eventHandler.options = options

    # Create the debug object
    debug = Debug(eventHandler, bHostileCode = options.hostile)
    try:

        # Attach to the targets
        for pid in options.attach:
            debug.attach(pid)
        for argv in options.console:
            debug.execv(argv, bConsole = True,  bFollow = options.follow)
        for argv in options.windowed:
            debug.execv(argv, bConsole = False, bFollow = options.follow)

        # Make sure the debugees die if the debugger dies unexpectedly
        debug.system.set_kill_on_exit_mode(True)

        # Run the debug loop
        debug.loop()

    # Stop the debugger
    finally:
        if not options.autodetach:
            debug.kill_all(bIgnoreExceptions = True)
        debug.stop()

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
def analyze_crash(cmd):
    """
    This is called with the command line (including the filename)
    which caused the crash before.
    It is a late analysis routine which sorts the crashes.
    """

    global file_info
    global victim_filename
    global crash_filename

    # TODO: This may not always be the case
    victim_filename, crash_filename = cmd
    print "=== [*] Analyzing %s" % crash_filename
    file_binary = fileops.get_base64_contents(crash_filename)

    if file_binary:
        file_info = (crash_filename, file_binary)

    # Instance a Debug object, passing it the event handler callback.
    debug = Debug(crash_event_handler, bKillOnExit = True)
    try:

        # Start a new process for debugging.
        debug.execv(cmd)

        # Wait for the debugee to finish.
        debug.loop()

    # Stop the debugger.
    finally:
        debug.stop()

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
def simple_debugger( argv ):

    # Instance a Debug object, passing it the event handler callback.
    debug = Debug( my_event_handler, bKillOnExit = True )
    try:

        # Start a new process for debugging.
        debug.execv( argv )

        # Wait for the debugee to finish.
        debug.loop()

    # Stop the debugger.
    finally:
        debug.stop()

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
def simple_debugger( argv ):

    # Instance a Debug object.
    debug = Debug()
    try:

        # Start a new process for debugging.
        debug.execv( argv )

        # Launch the interactive debugger.
        debug.interactive()

    # Stop the debugger.
    finally:
        debug.stop()

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
class Process(object):
    def __init__(self, api_hooks=None):
        System.request_debug_privileges()
        self.api_hooks = api_hooks
        self.hooks = []
        self.debugger = None

    def _loop(self):
        try:
            self.debugger.loop()
        except KeyboardInterrupt:
            self.debugger.stop()

    def hook_function(self, address, pre_callback=None, post_callback=None, signature=None):
        if not pre_callback and not post_callback:
            return

        self.hooks.append((address, pre_callback, post_callback, signature))

    def start(self, path, kill_process_on_exit=True, anti_anti_debugger=False, blocking=True):
        def function():
            os.chdir(os.path.dirname(path))
            self.debugger = Debug(HookingEventHandler(self.hooks, self.api_hooks), bKillOnExit=kill_process_on_exit, bHostileCode=anti_anti_debugger)
            self.debugger.execv([path])
            self._loop()

        if blocking:
            function()
        start_new_thread(function)

    def attach(self, pid, kill_process_on_exit=False, anti_anti_debugger=False, blocking=True):
        def function():
            self.debugger = Debug(HookingEventHandler(self.hooks, self.api_hooks), bKillOnExit=kill_process_on_exit, bHostileCode=anti_anti_debugger)
            self.debugger.attach(pid)
            self._loop()

        if blocking:
            function()
        start_new_thread(function)

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.

# This line is needed in Python 2.5 to use the "with" statement.
from __future__ import with_statement

from winappdbg import Debug

import sys

# Instance a Debug object, set the kill on exit property to True.
debug = Debug( bKillOnExit = True )

# The user can stop debugging with Control-C.
try:
    print "Hit Control-C to stop debugging..."

    # Start a new process for debugging.
    debug.execv( sys.argv[ 1 : ] )

    # Wait for the debugee to finish.
    debug.loop()

# If the user presses Control-C...
except KeyboardInterrupt:
    print "Interrupted by user."

    # Stop debugging. This kills all debugged processes.
    debug.stop()

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
    debug = Debug( myevent )

    try:

        if options.pid:
            debug.attach(options.pid)
            print_threads_and_modules(options.pid, debug)
        elif options.program:
            procs = list_processes(options.program)

            if len(procs) == 0:
                print "[E] no matching process"
            elif len(procs) == 1:
                debug.attach(procs[0].get_pid())
                print_threads_and_modules(procs[0].get_pid(), debug)
            else:
                print "[E] ambigious"
        elif options.command:
            p = debug.execv( options.command, bFollow = True )

        # Wait for the debugee to finish
        debug.loop()

    # Stop the debugger
    finally:
        debug.stop()

    #report = open("%s/report.html" % dir, 'a')
    #if report:
    report.close()

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
 def createDebugger(self, command):
     debug = Debug(self.debuggerEventHandler, bKillOnExit=True)
     argv = command.split()
     debug.execv(argv)
     debug.loop()
     

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
def action_0( event ):
    global debug
    aThread = event.get_thread()
    aProcess = event.get_process()
    r_eax = aThread.get_register("Eax")
    r_ecx = aThread.get_register("Ecx")
    r_edx = aThread.get_register("Edx")
    debug.dont_break_at(aProcess.get_pid() , 0x0043F90F)


words = open('dic.txt', "r").readlines() #lengthall
print "[+] Words Loaded:",len(words)

try:
    debug = Debug()
    # Start a new process for debugging
    p = debug.execv( ['TrueCrypt.exe', '/v', 'test.tc', '/lx', '/p', "".ljust(WORD_SIZE) ,'/q', '/s'])

    debug.break_at(p.get_pid() , 0x0043F90F, action_0) #save state
    debug.break_at(p.get_pid() , 0x0043F929, action_1) #save buffer addres
    debug.break_at(p.get_pid() , 0x0043F93E, action_2) #check result, restore state, change eip

    # Wait for the debugee to finish
    t1 = time.clock() 
    debug.loop()

finally:
    debug.stop()

print 'Finished in ' + repr(time.clock() - t1) + ' seconds!'

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
class WinBasic:
    debugger = None
    mainProc = None
    alwaysCatchExceptions = [
        win32.STATUS_ACCESS_VIOLATION,
        win32.STATUS_ILLEGAL_INSTRUCTION,
        win32.STATUS_ARRAY_BOUNDS_EXCEEDED,
    ]

    def __init__(self, killOnExit=True):
        self.debugger = Debug(bKillOnExit=killOnExit)
        self.mainProcs = []

    def run(self, executable, children=True):
        tmp = self.debugger.execv(executable, bFollow=children)
        self.mainProcs.append(tmp)
        return tmp.get_pid()

    def attachPid(self, pid):
        self.mainProcs.append(self.debugger.attach(pid))

    def attachImg(self, img):
        self.debugger.system.scan_processes()
        for (process, name) in self.debugger.system.find_processes_by_filename(img):
            self.attachPid(process.get_pid())

    def close(self, kill=True, taskkill=True, forced=True):
        pids = self.debugger.get_debugee_pids()

        self.debugger.detach_from_all(True)
        for pid in pids:
            if kill:
                try:
                    proc = self.debugger.system.get_process(pid)
                    proc.kill()
                except:
                    pass

                    # Taskkill
            if taskkill and not forced:
                subprocess.call(["taskkill", "/pid", str(pid)], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
            if taskkill and forced:
                subprocess.call(["taskkill", "/f", "/pid", str(pid)], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

    def waitForCrash(self, waitTime=4, checkAlive=False):
        event = None
        endDebuging = False
        endTime = time() + waitTime

        while time() < endTime:
            if checkAlive:
                for proc in self.mainProcs:
                    if not proc.is_alive():
                        return None

            try:
                event = self.debugger.wait(1000)
            except WindowsError, e:
                if e.winerror in (win32.ERROR_SEM_TIMEOUT, win32.WAIT_TIMEOUT):
                    continue
                raise

            crash = self.handler(event)
            if crash != None:
                return crash
            else:
                try:
                    self.debugger.dispatch()
                except:
                    pass
                finally:
                    self.debugger.cont()
        return None

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
# Specify a dictionary here
words = open("dic.txt", "r").readlines()
print "[+] Words Loaded: ", len(words)

# Specify a key file
keyfile = "pwsafe.key"

try:
    debug = Debug()

    # Start a new process for debugging
    # Allocate 20 bytes for the words

    if os.path.isfile(keyfile):
        print "[+] Keyfile Loaded: '" + keyfile + "'"
        aProcess = debug.execv(["KeePass.exe", "Database.kdb", "-keyfile:" + keyfile, "-pw:".ljust(WORD_SIZE + 4)])
    else:
        print "[+] Specified keyfile '" + keyfile + "' does not exist, ignoring argument"
        aProcess = debug.execv(["KeePass.exe", "Database.kdb", "-pw:".ljust(WORD_SIZE + 4)])

    # Set the breakpoints
    debug.break_at(aProcess.get_pid(), 0x004DC395, action_0)
    debug.break_at(aProcess.get_pid(), 0x004D77A0, action_1)
    debug.break_at(aProcess.get_pid(), 0x004D6684, action_2)
    debug.break_at(aProcess.get_pid(), 0x004DC39A, action_3)

    # Wait for the debugee to finish
    t1 = time.clock()
    debug.loop()

finally:

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
class Coverage:
	verbose = False
	bbFiles = {}
	bbFilesBreakpints = []
	bbFilesData = {}
	bbOriginalName = {}
	modules = []
	fileOutput = None
		
	#Construct
	def __init__(self):
		self.debugger = Debug( bKillOnExit = True )
		
	def setVerbose(self, val):
		self.verbose = val
		
	#cuts after .
	def cutDot(self, input):
		if (input.find(".") == -1):
			return input
		return input[0:input.find(".")]

	#load basic blocks
	def loadBB(self, baseBbDir):
		self.bbFiles = {}
		count = 0
		print "baseBbDir:"+baseBbDir
		for bbFile in os.listdir(baseBbDir):
			print "bbFile:" + bbFile
			f = open(baseBbDir + "/" + bbFile, "r")
			fname = f.readline().strip().lower()
			#fname = f.readline().strip()
			fnameOrig = fname
			if ".dll" not in fname and ".exe" not in fname:  #Stupid hack to avoid problems in loading libs with other extensions then .dll
				fname = self.cutDot(fname) + ".dll"
			self.bbOriginalName[fname] = fnameOrig
			self.bbFiles[fname] = count
			self.bbFilesBreakpints.append({})
			rvaHighest = 0
			for line in f:
				try:
					rva = int(line[0:8], 16)
					val = int(line[18:20], 16)
					self.bbFilesBreakpints[count][rva] = val
					if rva > rvaHighest:
						rvaHighest = rva
				except Exception:
					continue
			self.bbFilesData[fname] = [rvaHighest + 10, count]
			if self.verbose:
				print "Loaded breakpoints for %s with index %02X" % (fname, count)
			count += 1
			f.close()
	
	#Register module (original exe image or dll)
	def registerModule(self, filename, baseaddr):
		filename = filename.lower()
		if ".dll" not in filename and ".exe" not in filename:  #Stupid hack to avoid problems in loading libs with other extensions then .dll
			filename = self.cutDot(filename) + ".dll"
		if filename not in self.bbFiles:
			return
		if self.verbose:
			print "  Image %s has breakpoints defined" % filename
		self.modules.append([baseaddr,baseaddr+self.bbFilesData[filename][0], self.bbFilesData[filename][1]])
		if self.verbose:
			print "  Image has breakpoints from %08X to %08X with index %02X" % (baseaddr,baseaddr+self.bbFilesData[filename][0],self.bbFilesData[filename][1])
		
	#Handle a breakpoint
	def breakpoint(self, location):
		index = None
		for i in xrange(len(self.modules)):
			if location>=self.modules[i][0] and location<=self.modules[i][1]:
				index = i
				break
		if index == None:
			return None	
		rva = location - self.modules[index][0]
		index = self.modules[index][2]
		if rva not in self.bbFilesBreakpints[index]:
			return None
		self.fileOutput.write("%02X|%08X\n" % (index, rva))
		return self.bbFilesBreakpints[index][rva]
		
	def startFileRec(self, filename):
		self.modules = []
		self.fileOutput = open(filename, "w")
		for image in self.bbFiles:
			self.fileOutput.write("%s|%02X\n" % (self.bbOriginalName[image], self.bbFiles[image]))
		
	def endFileRec(self):
		self.fileOutput.close()		
	
	#Start program
	def start(self, execFile, waitTime = 6, recFilename = "output.txt", kill = True):	
		self.startFileRec(recFilename)
		mainProc = self.debugger.execv( execFile, bFollow = True )
		event = None
		endTime = time() + waitTime
		while time() < endTime:
			if not mainProc.is_alive():
#.........這裏部分代碼省略.........

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
class WinAppDbgController(BaseController):
    '''
    WinAppDbgController controls a server process
    by starting it on setup making sure it stays up.
    It uses winappdbg to attach to the target processes.
    '''

    def __init__(self, name, process_path, process_args=[], sql_crash_db='sqlite:///crashes.sqlite', logger=None):
        '''
        :param name: name of the object
        :param process_path: path to the target executable
        :param process_args: arguments to pass to the process
        :param attach: try to attach if process path
        :param sql_crash_db: sql alchemy connection string to crash db (default:sqlite:///crashes.sqlite)
        :param logger: logger for this object (default: None)
        '''
        super(WinAppDbgController, self).__init__(name, logger)
        assert(process_path)
        assert(os.path.exists(process_path))
        self._process_path = process_path
        self._process_name = os.path.basename(process_path)
        self._process_args = process_args
        self._process = None
        self._sql_crash_db = sql_crash_db
        self._crash_event_complete = threading.Event()
        self._server_is_up = threading.Event()
        self._crash_event_complete.set()
        self._debug = Debug(lambda x: _my_event_handler(self, x), bKillOnExit=True)

    def _debug_server(self):
        '''
        debugger thread
        '''
        try:
            self._process = None
            # Start a new process for debugging.
            argv = [self._process_path] + self._process_args
            self.logger.debug('debugger starting server: %s' % argv)
            try:
                self._process = self._debug.execv(argv, bFollow=True)
            except WindowsError:
                self.logger.error('debug_server received exception', traceback.fmt_exc())
            self._pid = self._process.get_pid()
            self.logger.info('process started. pid=%d' % self._pid)

            # Wait for the debugee to finish.
            self._server_is_up.set()
            self._debug.loop()
        except:
            self.logger.error('Got an exception in _debug_server')
            self.logger.error(traceback.format_exc())
        # Stop the debugger.
        finally:
            self._debug.stop()
            self._process = None
            self._pid = -1
            self._crash_event_complete.set()

    def _start_server_thread(self):
        '''
        start the server thread
        '''
        self._server_is_up.clear()
        self.server_thread = FuncThread(self._debug_server)
        self.server_thread.start()
        self.logger.info('waiting for server to be up')
        self._server_is_up.wait()
        self.logger.info('server should be up')

    def _kill_all_processes(self):
        '''
        kill all processes with the same name
        :return: True if all matching processes were killed properly, False otherwise
        '''
        res = True
        # Lookup the currently running processes.
        self._debug.system.scan_processes()
        # For all processes that match the requested filename...
        for (process, name) in self._debug.system.find_processes_by_filename(self._process_name):
            process_pid = process.get_pid()
            self.logger.info('found process %s (%d) - trying to kill it' % (name, process_pid))
            try:
                process.kill()
                self.logger.info('successfully killed %s (%d)' % (name, process_pid))
            except:
                self.logger.error('failed to kill %s (%d) [%s]' % (name, process_pid, traceback.format_exc()))
                res = False
        return res

    def setup(self):
        '''
        Called at the beginning of a fuzzing session.
        Will start the server up.
        '''
        self._stop_process()
        self._start_server_thread()

    def teardown(self):
        self._stop_process()
        self._process = None
#.........這裏部分代碼省略.........

# 需要導入模塊: from winappdbg import Debug [as 別名]
# 或者: from winappdbg.Debug import execv [as 別名]
        print "CreateFileW: %s" % (fname)
   
    # The post_ functions are called upon exiting the API
    
    def post_CreateFileW(self, event, retval):
        if retval:
            print 'Suceeded (handle value: %x)' % (retval)
        else:
            print 'Failed!'

if __name__ == "__main__":

    if len(sys.argv) < 2 or not os.path.isfile(sys.argv[1]):
        print "\nUsage: %s <File to monitor> [arg1, arg2, ...]\n" % sys.argv[0]
        sys.exit()

    # Instance a Debug object, passing it the MyEventHandler instance
    debug = Debug( MyEventHandler() )

    try:
        # Start a new process for debugging
        p = debug.execv(sys.argv[1:], bFollow=True)

        # Wait for the debugged process to finish
        debug.loop()

    # Stop the debugger
    finally:
        debug.stop()