pydbg：在 $exentry 处反汇编和 $exentry 的相对偏移量

逆向工程 视窗 调试器 Python
2021-06-14 17:30:34

我试图反汇编我用 masm 编写的测试二进制文件。以下是以下字节：

    Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file X:\test.exe

File Type: EXECUTABLE IMAGE

00401000: EB FE              jmp         00401000
00401002: 33 C0              xor         eax,eax
00401004: 33 DB              xor         ebx,ebx
00401006: 33 C9              xor         ecx,ecx
00401008: 33 D2              xor         edx,edx
0040100A: B8 02 00 00 00     mov         eax,2
0040100F: BB 01 00 00 00     mov         ebx,1
00401014: 3B C3              cmp         eax,ebx
00401016: 7F 06              jg          0040101E
00401018: 2B C3              sub         eax,ebx
0040101A: 3B C3              cmp         eax,ebx
0040101C: 7F 22              jg          00401040
0040101E: B8 05 00 00 00     mov         eax,5
00401023: BB 0A 00 00 00     mov         ebx,0Ah
00401028: 3B C3              cmp         eax,ebx
0040102A: 7F 06              jg          00401032
0040102C: 2B D8              sub         ebx,eax
0040102E: 3B D8              cmp         ebx,eax
00401030: 7F 07              jg          00401039
00401032: B8 0D 00 00 00     mov         eax,0Dh
00401037: EB 0E              jmp         00401047
00401039: BB 09 00 00 00     mov         ebx,9
0040103E: EB 07              jmp         00401047
00401040: B9 17 00 00 00     mov         ecx,17h
00401045: EB 00              jmp         00401047
00401047: 6A 00              push        0
00401049: E8 00 00 00 00     call        0040104E
0040104E: FF 25 00 20 40 00  jmp         dword ptr ds:[00402000h]

以下是我的python脚本：

import os, sys
from pydbg import *
from pydbg.defines import *

pid = int(sys.argv[1])

def handler_breakpoint(pydbg):
    if pydbg.first_breakpoint:
        return DBG_CONTINUE
    for thread_id in dbg.enumerate_threads():
        context = dbg.get_thread_context(None, h_thread)
    print("Eip = %08x" % context.Eip)
    dbg.disasm(context.Eip)
    return DBG_CONTINUE

dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.attach(pid)
for thread_id in dbg.enumerate_threads():
        context = dbg.get_thread_context(None, h_thread)
dbg.bp_set(context.Eip)
dbg.resume_all_threads()
pydbg.debug_event_loop(dbg)

我只想进入第一条 (jmp-0x2) 指令。

我检查了 pydbg API pydbg API和使用 pydbg 的各种项目，但对如何执行此操作一无所知。

2个回答

如果您附加到任何正在运行的进程，入口点处的断点将不会被击中

打破Address of EntryPoint你应该加载二进制文件并在第一个系统期间设置断点（pydbg.firstbreakpoint）

要动态检索 AddressofEntryPoint，您必须读取进程内存并解密 pe 标头->入口点地址

下面显示的是一个示例脚本，它在 calc.exe 入口点中断并转储上下文 

:\>cat entrypoint.py
import struct
from pydbg import *
from pydbg.defines import *
def handler_breakpoint (pydbg):
  if pydbg.first_breakpoint:
    for module in dbg.iterate_modules():
      base_address = module.modBaseAddr
      dos_header   = dbg.read_process_memory(base_address, 0x40)
      if len(dos_header) != 0x40 or dos_header[:2] != "MZ":
        continue
      e_lfanew   = struct.unpack("<I", dos_header[0x3c:0x40])[0]
      pe_headers = dbg.read_process_memory(base_address + e_lfanew, 0xF8)
      if len(pe_headers) != 0xF8 or pe_headers[:2] != "PE":
        continue
      entrypoint = (struct.unpack("<I", pe_headers[0x28:0x2c])[0]) + base_addres
s
      print "0x%08x" % entrypoint
      dbg.bp_set(entrypoint)
      return DBG_CONTINUE
  print dbg.dump_context(dbg.context)
  return DBG_CONTINUE
dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.load("c:\windows\system32\calc.exe")
pydbg.debug_event_loop(dbg)

结果 

:\>python entrypoint.py
0x01012475
CONTEXT DUMP
  EIP: 01012475 push byte 0x70
  EAX: 00000000 (         0) -> N/A
  EBX: 7ffd7000 (2147315712) -> N/A
  ECX: 0007ffb0 (    524208) ->
  EDX: 7c90e514 (2089870612) -> N/A
  EDI: 00250000 (   2424832) -> N/A
  ESI: 7c9115f9 (2089883129) -> N/A
  EBP: 0007fff0 (    524272) -> 
  ESP: 0007ffc4 (    524228) -> wp (stack)
  +00: 7c817077 (2088857719) -> N/A
  +04: 00250000 (   2424832) -> N/A
  +08: 7c9115f9 (2089883129) -> N/A
  +0c: 7ffd7000 (2147315712) -> N/A
  +10: 80544c7d (2153008253) -> N/A
  +14: 0007ffc8 (    524232) ->

看起来您想要缩进dbg.bp_set(context.Eip)（以便它是for-loop的一部分）并替换dbg.resume_all_threads()为dbg.run().

其它你可能感兴趣的问题
上一篇是否可以使用 IDA Pro 在运行期间或运行之外向函数提供数据？ 下一篇在 IDA Pro for MIPS 中重命名子程序