OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Monday, August 17 2009 12:12.15 CDT

Modified: Monday, August 17 2009 12:15.08 CDT

Direct Link, View / Make / Edit Comments

Stalking modules

Author: mwollenweber

# Views: 3778

I hate when I'm debugging a DLL, but it's not loaded until it's needed. This creates the problem that (to my knowledge) you can't set a breakpoint at addresses that aren't loaded into memory. To get around this problem I created the following script for Immunity Debugger:

<code>
#!/usr/bin/env python
'''
Matthew Wollenweber
August 6 2009
[email protected]

I want to debug modules that are dynamically loaded at runtime and then unloaded. It's a pain to set and
reset breakpoints. This script watches for the module to be loaded. When the module is loaded breakpoints are set.

-r implies the use of a relative base for the target module
'''
DESC = "Set breakpoints when a specific library is loaded"
USAGE = "!stalkmod <-r> modname <breakpoint 0> ... <breakpoint n>"

import immlib
from immlib import LogBpHook
#import time
import struct
import unicodedata
import getopt

def main(args):
    imm = immlib.Debugger()
    imm.Log("starting modstalker")
    breakpoints = []
    module_name = ""


    try:
        opts, extra = getopt.getopt(args, "r")

        for flag, val in opts:
            if flag == "-r":
                imm.addKnowledge("getbase", 1)

        module_name = extra[0]
        for x in range(1, len(extra)):
            breakpoints.append(long(extra[x], 16))
    except:
        usage()
        imm.Log("ERROR in modstalker")
        return "ERROR. Exiting module"

    allmodules=imm.getAllModules()
    for x in allmodules:
        if x.getName().find(module_name) >= 0:
            for b in breakpoints:
                imm.setBreakpoint(b)
            imm.Log("Module Already loaded. Breakpoints set")
            return "Module already loaded. Breakpoints set"

    imm.addKnowledge("breakpoints", breakpoints)
    imm.addKnowledge("modname", module_name)

    load_hook = MyLoadHook()

    load_addr = imm.getAddress("kernel32.LoadLibraryW")
    load_hook.add("bp on loadlibraryW", load_addr, 0, 0, 0)
    load_addr = imm.getAddress("kernel32.LoadLibraryA")
    load_hook.add("bp on loadlibraryW", load_addr, 0, 0, 0)
    imm.Log("Placed hook on loadlibraryA and LoadLibraryW")

    return "Hooks loaded"


class MyLoadHook(LogBpHook):
    def __init__(self):
        LogBpHook.__init__(self)
        self.imm = immlib.Debugger()
        self.found = 0

    def run(self,regs):
        imm = self.imm
        ucode = 0
        getbase = 0
        baseoffset = long(0)

        modname = imm.getKnowledge("modname")
        getbase = imm.getKnowledge("getbase")

        regs = imm.getRegs()
        ptr = imm.readMemory(regs['ESP']+0x4, 0x4)
        ptr = int(struct.unpack("L", ptr)[0])
        filename = imm.readString(ptr)


        #fuck unicode
        if len(filename) < 3:
            ucode = 1
            tmp = imm.readWString(ptr)
            filename = ""
            x = 0
            while x <  len(tmp):
                filename += str(tmp[x])
                x+=2

        filename = filename.lower()

        #imm.Log("I'm in: " + filename)
        #imm.Log("I'm stalking: " + modname)

        if filename.find(modname) >= 0:
            imm.Log("MATCHED. Setting breakpoints")
            if ucode == 0:
                imm.setBreakpoint(0x7c801DAB) #End of LoadLibraryA
            else:
                imm.setBreakpoint(0x7c80AEEB) #End of LoadLibraryW

            imm.Run() #let it run until the end of loadlibrary so that our memory is mapped
            #time.sleep(2)
            if getbase == 1:
                allmodules=imm.getAllModules()
                for x in allmodules:
                    if x.getName().find(modname) >= 0:
                        baseoffset = x.getBase()
                        break

            bps = imm.getKnowledge("breakpoints")
            for x in bps:
                x = x + baseoffset
                imm.Log("set BP: %08x" % (x))
                imm.setBreakpoint(x)

            imm.Log("breakpoints set")
            self.found = 1
            self.UnHook()

        return


def usage():
    print USAGE

if __name__=="__main__":
    print "This module is for use within Immunity Debugger only"

</code>

This module stalks LoadLibraryA and LoadLibraryW. When your target module is loaded it sets breakpoints at the given addresses. Optionally you can set no breakpoints and it will pause on your module. You can also specify the '-r' flag to set the breakpoints relative to the base address of the module.

Archived Entries for mwollenweber

Subject	# Views	Created On
No archived blog entries found.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit