Libs.debugtypes

1 #!/usr/bin/env python 2 3 """ 4 (c) Immunity, Inc. 2004-2007 5 6 7 U{Immunity Inc.<http://www.immunityinc.com>} 8 9 10 """ 11 12 __version__ = '1.0' 13 14 import debugger 15 import struct 16 17 ###ulong 18 # handle = handle 19 # handles[handle][0]=type 20 # handles[handle][1]=access 21 # handles[handle][2]=data1 22 # handles[handle][3]=data2 23 ### int 24 # handles[handle][4]=refcount 25 ###char 26 # handles[handle][5]=htype 27 # handles[handle][6]=username 28 # handles[handle][7]=nativename 29

30 -class Handle:

31 - def __init__(self, handle):

32 self.handle = handle 33 self.type = 0 34 self.access = 0 35 self.data1 = 0 36 self.data2 = 0 37 self.refcount = 0 38 self.htype = "" 39 self.username = "" 40 self.nativename = ""

41

42 - def _getfromtuple(self, mem):

43 self.type = mem[0] 44 self.access = mem[1] 45 self.data1 = mem[2] 46 self.data2 = mem[3] 47 self.refcount = mem[4] 48 self.htype = mem[5] 49 self.username = mem[6] 50 self.nativename = mem[7]

51

52 - def getHandle(self):

53 return self.handle

54

55 - def getType(self):

56 return self.type

57

58 - def getAccess(self):

59 return self.access

60

61 - def getData1(self):

62 return self.data1

63

64 - def getData2(self):

65 return self.data2

66

67 - def getRefCount(self):

68 return self.refcount

69

70 - def getHtype(self):

71 return self.htype

72

73 - def getUserName(self):

74 return self.username

75

76 - def getNativeName(self):

77 return self.nativename

78

79 -class Symbol:

80 - def __init__(self, addr):

81 self.address = addr 82 self.section = "" 83 self.type = "" 84 self.name = "" 85 self.comment = "" 86 self.module = ""

87

88 - def _getfromtuple(self, tup):

89 self.module = tup[0].strip() 90 self.module = self.module.lower() 91 92 self.section = tup[1] 93 self.type = tup[2] 94 self.name = tup[3] 95 self.comment = tup[4]

96

97 - def getAddress(self):

98 return self.address

99

100 - def getModule(self):

101 return self.module

102

103 - def getSection(self):

104 return self.section

105

106 - def getType(self):

107 return self.type

108

109 - def getName(self):

110 return self.name

111

112 - def getComment(self):

113 return self.comment

114 115 116 #Base address of module: base 117 #Size occupied by module: size 118 #service information, TY_xxx: type 119 #base address of module code block: codebase 120 #size of module code block: codesize 121 #Base address of resources: resbase 122 #Size of resources: ressize 123 #Address of <ModuleEntryPoint> or NULL: entry 124 #Base address of module data block: database 125 #Base address of import data table: idatatable 126 #Base address of import data block: idatabase 127 #Base address of export data table: edatatable 128 #Size of export data table: edatasize 129 #Base address of relocation table: reloctable 130 #Size of relocation table: relocsize 131 #Short name of the module: name 132 #Full name of the module: path 133 #Number of sections in the module: nsect 134 #Total size of headers in executable: headersize 135 #Base of image in executable file: fixupbase 136 #Decoded code features or NULL: codedec 137 #Code CRC for actual decoding: codecrc 138 #Hit tracing data or NULL: hittrace 139 #Decoded data features or NULL: datadec 140 #Global types from debug info: globaltypes 141 #Address of WinMain() etc. in dbg data: mainentry 142 #Entry of packed code or NULL: realsfxentry 143 #Original size of module code block: origcodesize 144 #Base of memory block with SFX: sfxbase 145 #Size of memory block with SFX: sfxsize 146 #Whether system DLL: issystemdll 147 #Version of executable file: version

148 -class Module:

149 - def __init__(self, name, baseaddress, size, entrypoint):

150 """ 151 Module Information 152 153 @type name: STRING 154 @param name: Name of the module 155 156 @type baseaddress: DWORD 157 @param baseaddress: Base Address of the Module 158 159 @type size: DWORD 160 @param size: Size of the Module 161 162 @type entrypoint: DWORD 163 @param entrypoint: Entry Point 164 """ 165 # for modulos in mods.keys(): 166 # name : modulos 167 # base addy: mods[modulos][0] 168 # size : mods[modulos][1] 169 # entry : mods[modulos][2] 170 # full path: mods[modulos][3] 171 172 self.name = name.lower() 173 self.baseaddress = baseaddress 174 self.size = size 175 self.entrypoint = entrypoint 176 self.modDict = None 177 self.symbols = [] 178 self.XREFto = {} 179 self.XREFfrom = {}

180

181 - def getFunctions(self):

182 """ 183 Get the all the functions from Module 184 185 @rtype: LIST of DWORD 186 @return: A List of the address of all function 187 """ 188 return debugger.Getallfunctions(self.baseaddress)

189

190 - def _xrefs(self, address, XREF, debugger_callback):

191 code = self.getCodebase() 192 codesize = self.getCodesize() 193 194 # We first check check if address is inside this module code 195 if address >= code and address <= (code+codesize): 196 return [] 197 198 # If we didn't get the whole xref list from debugger, we get it 199 if not XREF: 200 XREF = debugger_callback(address) 201 202 # returning the xrefs as a list of (addy, type) 203 try: 204 return XREF[address] 205 except KeyError: 206 return []

207

208 - def getXrefTo(self, address):

209 """ 210 Get the Xreference to the given address 211 212 @type address: DWORD 213 @param address: Address in the Module to get Xref to 214 215 @rtype: LIST of DWORD 216 @return: List of Address 217 """ 218 return self._xrefs(address, self.XREFto, debugger.Getxref_to)

219

220 - def getXrefFrom(self, address):

221 """ 222 Get the Xreference from the given address 223 224 @type address: DWORD 225 @param address: Address in the Module to get Xref from 226 227 @rtype: LIST of DWORD 228 @return: List of Address 229 """ 230 return self._xrefs(address, self.XREFfrom, debugger.Getxref_from)

231

232 - def getBaseAddress(self):

233 """ 234 Get the Base Address 235 236 @rtype: DWORD 237 @return: Base Address 238 """ 239 return self.baseaddress

240

241 - def getReferencedStrings(self):

242 return debugger.Getreferencedstrings(self.entrypoint)

243

244 - def setModuleExtension(self, mod_dict):

245 self.modDict = mod_dict

246

247 - def setSymbols(self, symbol):

248 self.symbols = symbol

249

250 - def Analyse(self):

251 """ 252 Analize the Current Module 253 """ 254 return debugger.Analysecode(self.baseaddress)

255

256 - def get(self, name):

257 name = name.lower() 258 if not self.modDict.has_key(name): 259 return None 260 return self.modDict[name][0]

261

262 - def getSymbols(self):

263 return self.symbols

264

265 - def getBase(self):

266 """ 267 Get Base from module 268 269 @rtype: DWORD 270 @return: Base from the module 271 """ 272 try: 273 return self.modDict['base'][0] 274 except KeyError: 275 return None

276

277 - def getSize(self):

278 """ 279 Get Size from module 280 """ 281 try: 282 return self.modDict['size'][0] 283 except KeyError: 284 return None

285

286 - def getType(self):

287 """ 288 Get Type from module 289 """ 290 try: 291 return self.modDict['type'][0] 292 except KeyError: 293 return None

294

295 - def getCodebase(self):

296 """ 297 Get Codebase from module 298 """ 299 try: 300 return self.modDict['codebase'][0] 301 except KeyError: 302 return None

303

304 - def getCodesize(self):

305 """ 306 Get Codesize from module 307 308 @rtype: DWORD 309 @return: Code Size 310 """ 311 try: 312 return self.modDict['codesize'][0] 313 except KeyError: 314 return None

315

316 - def getResbase(self):

317 """ 318 Get Resbase from module 319 320 @rtype: DWORD 321 @return: Res Base 322 323 """ 324 try: 325 return self.modDict['resbase'][0] 326 except KeyError: 327 return None

328

329 - def getRessize(self):

330 """ 331 Get Ressize from module 332 333 @rtype: DWORD 334 @return: Res Size 335 """ 336 try: 337 return self.modDict['ressize'][0] 338 except KeyError: 339 return None

340

341 - def getEntry(self):

342 """ 343 Get Entry from module 344 345 @rtype: DWORD 346 @return: Entry 347 """ 348 try: 349 return self.modDict['entry'][0] 350 except KeyError: 351 return None

352

353 - def getDatabase(self):

354 """ 355 Get Database from module 356 357 @rtype: DWORD 358 @return: Database 359 """ 360 try: 361 return self.modDict['database'][0] 362 except KeyError: 363 return None

364

365 - def getIdatatable(self):

366 """ 367 Get Idatatable from module 368 """ 369 try: 370 return self.modDict['idatatable'][0] 371 except KeyError: 372 return None

373

374 - def getIdatabase(self):

375 """Get Idatabase from module""" 376 try: 377 return self.modDict['idatabase'][0] 378 except KeyError: 379 return None

380

381 - def getEdatatable(self):

382 """ 383 Get Edatatable from module 384 """ 385 try: 386 return self.modDict['edatatable'][0] 387 except KeyError: 388 return None

389

390 - def getEdatasize(self):

391 """ 392 Get Edatasize from module 393 """ 394 try: 395 return self.modDict['edatasize'][0] 396 except KeyError: 397 return None

398

399 - def getReloctable(self):

400 """ 401 Get Reloctable from module 402 """ 403 try: 404 return self.modDict['reloctable'][0] 405 except KeyError: 406 return None

407

408 - def getRelocsize(self):

409 """ 410 Get Relocsize from module 411 """ 412 try: 413 return self.modDict['relocsize'][0] 414 except KeyError: 415 return None

416

417 - def getName(self):

418 """ 419 Get Name from module 420 """ 421 try: 422 return self.name 423 except KeyError: 424 return None

425

426 - def getPath(self):

427 """ 428 Get Path from module 429 """ 430 try: 431 return self.modDict['path'][0] 432 except KeyError: 433 return None

434

435 - def getNsect(self):

436 """ 437 Get Nsect from module 438 """ 439 try: 440 return self.modDict['nsect'][0] 441 except KeyError: 442 return None

443

444 - def getHeadersize(self):

445 """ 446 Get Headersize from module 447 """ 448 try: 449 return self.modDict['headersize'][0] 450 except KeyError: 451 return None

452

453 - def getFixupbase(self):

454 """ 455 Get Fixupbase from module 456 """ 457 try: 458 return self.modDict['fixupbase'][0] 459 except KeyError: 460 return None

461

462 - def getCodedec(self):

463 """ 464 Get Codedec from module 465 """ 466 try: 467 return self.modDict['codedec'][0] 468 except KeyError: 469 return None

470

471 - def getCodecrc(self):

472 """ 473 Get Codecrc from module 474 """ 475 try: 476 return self.modDict['codecrc'][0] 477 except KeyError: 478 return None

479

480 - def getHittrace(self):

481 """ 482 Get Hittrace from module 483 """ 484 try: 485 return self.modDict['hittrace'][0] 486 except KeyError: 487 return None

488

489 - def getDatadec(self):

490 """ 491 Get Datadec from module 492 """ 493 try: 494 return self.modDict['datadec'][0] 495 except KeyError: 496 return None

497

498 - def getGlobaltypes(self):

499 """ 500 Get Globaltypes from module 501 """ 502 try: 503 return self.modDict['globaltypes'][0] 504 except KeyError: 505 return None

506

507 - def getMainentry(self):

508 """ 509 Get Mainentry from module 510 """ 511 try: 512 return self.modDict['mainentry'][0] 513 except KeyError: 514 return None

515

516 - def getRealsfxentry(self):

517 """ 518 Get Realsfxentry from module 519 """ 520 try: 521 return self.modDict['realsfxentry'][0] 522 except KeyError: 523 return None

524

525 - def getOrigcodesize(self):

526 """ 527 Get Origcodesize from module 528 """ 529 try: 530 return self.modDict['origcodesize'][0] 531 except KeyError: 532 return None

533

534 - def getSfxbase(self):

535 """ 536 Get Sfxbase from module 537 """ 538 try: 539 return self.modDict['sfxbase'][0] 540 except KeyError: 541 return None

542

543 - def getSfxsize(self):

544 """ 545 Get Sfxsize from module 546 """ 547 try: 548 return self.modDict['sfxsize'][0] 549 except KeyError: 550 return None

551

552 - def getIssystemdll(self):

553 """ 554 Get Issystemdll from module 555 """ 556 try: 557 return self.modDict['issystemdll'][0] 558 except KeyError: 559 return None

560

561 - def getVersion(self):

562 """ 563 Get Version from module 564 """ 565 try: 566 return self.modDict['version'][0] 567 except KeyError: 568 return None

569

570 - def isAnalysed(self):

571 """ 572 Check if module was analysed 573 """ 574 # we should check every time, cause the module might be analysed. Since modules are cached sometimes 575 return debugger.IsAnalysed(self.baseaddress)

576

577 - def getJumpList(self):

578 """ 579 get jump list from analysed module 580 """ 581 #jumplist[0] = from 582 #jumplist[1] = to 583 #jumplist[2] = type 584 #type is one of 585 #define JT_JUMP 0 // Unconditional jump 586 #define JT_COND 1 // Conditional jump 587 #define qJT_SWITCH 2 // Jump via switch table 588 #define JT_CALL 3 // Local (intramodular) call 589 #define CALL_INTER 4 // intermodular call 590 #jmpTypeFlags = {"JUMP":0,\ 591 #"JUMP_COND":1,\ 592 #"JUMP_SWITCH":2,\ 593 #"CALL":3,\ 594 #"CALL_INTER":4} 595 try: 596 return self.modDict['jumplist'][0] 597 except KeyError: 598 return None

599 600

601 -class Stack:

602 - def __init__(self):

603 self.address = 0 # stack pointer 604 self.stack = 0 605 self.procedure = "" 606 self.calledfrom = 0 607 self.frame = 0 # frame pointer 608 # args 609 self.stackdump1 = 0 610 self.stackdump2 = 0 611 self.stackdump3 = 0

612

613 - def _setfromtuple(self, s):

614 self.address = s[0] # stack pointer 615 self.stack = s[1] 616 self.procedure = str(s[2]) 617 self.calledfrom = s[3] 618 self.frame = s[4] # frame pointer 619 self.stackdump1 = s[5] 620 self.stackdump2 = s[6] 621 self.stackdump3 = s[7]

622 623

624 - def getStackDump(self):

625 return (self.stackdump1,self.stackdump2,self.stackdump3)

626

627 - def getAddress(self):

628 return self.address

629

630 - def getStack(self):

631 return self.stack

632

633 - def getProcedure(self):

634 return self.procedure

635

636 - def getFrame(self):

637 return self.frame

638

639 - def getCalledFrom(self):

640 return self.calledfrom

641 642

643 -class Table:

644 - def __init__(self,imm,title,col_titles):

645 """ 646 Create a GUI Window Table 647 648 @type imm: Debugger Object 649 @param imm: Debugger 650 651 @type title: STRING 652 @param title: Title for the Window 653 654 @type col_titles: LIST of STRINGs 655 @param col_titles: List of the Column's Name 656 """ 657 self.imm = imm 658 self.instance=self.createTable(title,col_titles)

659

660 - def createTable(self,title,col_titles):

661 title1="" 662 title2="" 663 title3="" 664 title4="" 665 title5="" 666 if len(col_titles) > 5: 667 maxcol=5 668 else: 669 maxcol=len(col_titles) 670 try: 671 title1=col_titles[0] 672 except: 673 pass 674 try: 675 title2=col_titles[1] 676 except: 677 pass 678 try: 679 title3=col_titles[2] 680 except: 681 pass 682 try: 683 title4=col_titles[3] 684 except: 685 pass 686 try: 687 title5=col_titles[4] 688 except: 689 pass 690 return debugger.Createtable(title,maxcol,title1,title2,title3,title4,title5)

691 692 # Focus not implemented yet

693 - def Log(self, data, address=0, focus = False):

694 """ 695 Add a message into a column 696 697 @type data: STRING 698 @param data: Message for the column 699 700 @type address: DWORD 701 @param address: (Optional, Default: 0) Address related to the message 702 703 @type focus: BOOLEAN 704 @param focus: (Optional, Default: False) Whether or not give focus to the window 705 """ 706 return debugger.Addtotable(self.instance,address,"0x%08x" % address, data,"","","")

707 708

709 - def isValidHandle(self):

710 return debugger.IsValidHandle(self.instance)

711 712

713 - def add(self,address,data):

714 """ 715 Add Data to the Window 716 717 @type address: DWORD 718 @param address: Address related to the Data 719 720 @type data: LIST OF STRING 721 @param data: Data to add on the different columns 722 """ 723 col1="" 724 col2="" 725 col3="" 726 col4="" 727 col5="" 728 if not address: 729 address=0x0 730 try: 731 col1=data[0] 732 except: 733 pass 734 try: 735 col2=data[1] 736 except: 737 pass 738 try: 739 col3=data[2] 740 except: 741 pass 742 try: 743 col4=data[3] 744 except: 745 pass 746 try: 747 col5=data[4] 748 except: 749 pass 750 return debugger.Addtotable(self.instance,address,col1,col2,col3,col4,col5)

751 752 753 MemoryProtection = { 0x10 : "PAGE_EXECUTE", 0x20 : "PAGE_EXECUTE_READ", 0x40: "PAGE_EXECUTE_READWRITE",\ 754 0x80 : "PAGE_EXECUTE_WRITECOPY", 0x01: "PAGE_NOACCESS", 0x02: "PAGE_READONLY",\ 755 0x04 : "PAGE_READWRITE", 0x08: "PAGE_WRITECOPY" } 756

757 -class MemoryPage:

758 - def __init__(self, baseaddress, imm):

759 """ 760 Memory Page Information 761 762 @type baseaddress: DWORD 763 @param baseaddress: Base Address of the Memory Page 764 765 @type imm: Debugger OBJECT 766 @param imm: Debugger 767 """ 768 self.baseaddress = baseaddress 769 self.imm = imm 770 self.size = 0 771 self.type = 0 772 self.owner = 0 773 self.initaccess = 0 774 self.access = 0 775 self.threadid = 0 776 self.section = "" 777 self.mem = ""

778

779 - def _getfromtuple(self, mem):

780 requery = debugger.VmQuery(self.baseaddress) 781 self.size = mem[0] 782 self.type = mem[1] 783 self.owner = mem[2] 784 self.initaccess = requery[4] 785 self.access = requery[3] 786 self.threadid = mem[5] 787 self.section = mem[6]

788

789 - def getBaseAddress(self):

790 return self.baseaddress

791

792 - def getSize(self):

793 return self.size

794

795 - def getType(self):

796 """ 797 Get Type of Memory Page 798 799 @rtype: DWORD 800 @return: Type of Page 801 """ 802 return self.type

803

804 - def getOwner(self):

805 """ 806 Get the Owner of the Memory Page 807 808 @rtype: STRING 809 @return: Owner of the Page 810 """ 811 # use to use getModulebyAddress 812 mod = self.imm.findModule(self.owner) 813 if not mod: 814 return "0x%08x" % self.owner 815 else: 816 return mod[0]

817

818 - def _getflags(self, page):

819 try: 820 return PageFlags[page] 821 except KeyError: 822 return " "

823

824 - def getInitAccess(self,human=0):

825 """ 826 Get the Intial Access Flag of the Memory Page 827 828 @type human: Human Readable String Flag 829 @param human: Boolean 830 831 @rtype: DWORD 832 @return: Initial Access Flag 833 834 835 """ 836 if human == 0: 837 return self.initaccess 838 else: 839 return MemoryProtection[self.initaccess & 0xFF]

840

841 - def getAccess(self,human=0):

842 """ 843 Get the Access Flag of the Memory Page 844 845 @type human: Human Readable String Flag 846 @param human: Boolean 847 848 @rtype: DWORD 849 @return: Access Flag 850 """ 851 if human == 0: 852 return self.access 853 else: 854 return MemoryProtection[self.access & 0xFF]

855 856 857

858 - def getThreadID(self):

859 """ 860 Get the ID of the Thread 861 862 @rtype: DWORD 863 @return: Thread ID 864 """ 865 return self.threadid

866

867 - def getMemory(self):

868 """ 869 Get the Memory of the Page 870 871 @rtype: BUFFER 872 @return: Page Memory 873 """ 874 if not self.mem: 875 self.mem = self.imm.readMemory(self.baseaddress, self.size) 876 return self.mem

877

878 - def getBaseAddress(self):

879 """ 880 Get the Base Address of the Memory Page 881 882 @rtype: DWORD 883 @return: Base Address 884 """ 885 return self.baseaddress

886

887 - def getSection(self):

888 """ 889 Get the Section from the Memory Page 890 891 @rtype: STRING 892 @return: Section 893 """ 894 return self.section

895

896 - def search(self, buf):

897 """ 898 Search string in this memory page. 899 900 @param buf: Buffer to search for 901 @return: A list of address where the string was found on this memory page 902 """ 903 904 self.getMemory() 905 if not self.mem: 906 return [] 907 ndx = 0 908 find = [] 909 buf_size = len(buf) 910 while 1: 911 f = self.mem[ndx:].find( buf ) 912 if f == -1 : break 913 find.append( ndx + f + self.baseaddress ) 914 ndx += f + buf_size 915 return find

916 917 918 919 #PEB class (taken for bas's PDB)

920 -class PEB:

921 - def __init__(self, imm):

922 """ 923 Process Environment Block 924 925 @type imm: Debugger OBJECT 926 @param imm: Debugger 927 """ 928 # PEB struct is 488 bytes (win2k) located at 0x7ffdf000 929 # can also use NTQueryProcessInformation to locate PEB base 930 self.base = imm.getPEBaddress() 931 932 try: 933 self.PEB = imm.readMemory(self.base, 488) 934 except: 935 error = "can't read PEB struct" 936 raise Exception, error 937 938 """ 939 0:000> !kdex2x86.strct PEB 940 Loaded kdex2x86 extension DLL 941 struct _PEB (sizeof=488) 942 +000 byte InheritedAddressSpace 943 +001 byte ReadImageFileExecOptions 944 +002 byte BeingDebugged 945 +003 byte SpareBool 946 +004 void *Mutant 947 +008 void *ImageBaseAddress 948 +00c struct _PEB_LDR_DATA *Ldr 949 +010 struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters 950 +014 void *SubSystemData 951 +018 void *ProcessHeap 952 +01c void *FastPebLock 953 +020 void *FastPebLockRoutine 954 +024 void *FastPebUnlockRoutine 955 +028 uint32 EnvironmentUpdateCount 956 +02c void *KernelCallbackTable 957 +030 uint32 SystemReserved[2] 958 +038 struct _PEB_FREE_BLOCK *FreeList 959 +03c uint32 TlsExpansionCounter 960 +040 void *TlsBitmap 961 +044 uint32 TlsBitmapBits[2] 962 +04c void *ReadOnlySharedMemoryBase 963 +050 void *ReadOnlySharedMemoryHeap 964 +054 void **ReadOnlyStaticServerData 965 +058 void *AnsiCodePageData 966 +05c void *OemCodePageData 967 +060 void *UnicodeCaseTableData 968 +064 uint32 NumberOfProcessors 969 +068 uint32 NtGlobalFlag 970 +070 union _LARGE_INTEGER CriticalSectionTimeout 971 +070 uint32 LowPart 972 +074 int32 HighPart 973 +070 struct __unnamed3 u 974 +070 uint32 LowPart 975 +074 int32 HighPart 976 +070 int64 QuadPart 977 +078 uint32 HeapSegmentReserve 978 +07c uint32 HeapSegmentCommit 979 +080 uint32 HeapDeCommitTotalFreeThreshold 980 +084 uint32 HeapDeCommitFreeBlockThreshold 981 +088 uint32 NumberOfHeaps 982 +08c uint32 MaximumNumberOfHeaps 983 +090 void **ProcessHeaps 984 +094 void *GdiSharedHandleTable 985 +098 void *ProcessStarterHelper 986 +09c uint32 GdiDCAttributeList 987 +0a0 void *LoaderLock 988 +0a4 uint32 OSMajorVersion 989 +0a8 uint32 OSMinorVersion 990 +0ac uint16 OSBuildNumber 991 +0ae uint16 OSCSDVersion 992 +0b0 uint32 OSPlatformId 993 +0b4 uint32 ImageSubsystem 994 +0b8 uint32 ImageSubsystemMajorVersion 995 +0bc uint32 ImageSubsystemMinorVersion 996 +0c0 uint32 ImageProcessAffinityMask 997 +0c4 uint32 GdiHandleBuffer[34] 998 +14c function *PostProcessInitRoutine 999 +150 void *TlsExpansionBitmap 1000 +154 uint32 TlsExpansionBitmapBits[32] 1001 +1d4 uint32 SessionId 1002 +1d8 void *AppCompatInfo 1003 +1dc struct _UNICODE_STRING CSDVersion 1004 +1dc uint16 Length 1005 +1de uint16 MaximumLength 1006 +1e0 uint16 *Buffer 1007 """ 1008 # init PEB struct 1009 index = 0x000 1010 self.InheritedAddressSpace = struct.unpack("B",self.PEB[index])[0] 1011 index = 0x001 1012 self.ReadImageFileExecOptions = struct.unpack("B",self.PEB[index])[0] 1013 index = 0x002 1014 self.BeingDebugged = struct.unpack("B",self.PEB[index])[0] 1015 index = 0x003 1016 self.SpareBool = struct.unpack("B",self.PEB[index])[0] 1017 index = 0x004 1018 self.Mutant = struct.unpack("<L",self.PEB[index:index+4])[0] 1019 index = 0x008 1020 self.ImageBaseAddress = struct.unpack("<L",self.PEB[index:index+4])[0] 1021 index = 0x00c 1022 self.Ldr = struct.unpack("<L",self.PEB[index:index+4])[0] 1023 index = 0x010 1024 self.ProcessParameters = struct.unpack("<L",self.PEB[index:index+4])[0] 1025 index = 0x014 1026 self.SubSystemData = struct.unpack("<L",self.PEB[index:index+4])[0] 1027 index = 0x018 1028 self.ProcessHeap = struct.unpack("<L",self.PEB[index:index+4])[0] 1029 index = 0x01c 1030 self.FastPebLock = struct.unpack("<L",self.PEB[index:index+4])[0] 1031 index = 0x020 1032 self.FastPebLockRoutine = struct.unpack("<L",self.PEB[index:index+4])[0] 1033 index = 0x024 1034 self.FastPebUnlockRoutine = struct.unpack("<L",self.PEB[index:index+4])[0] 1035 index = 0x028 1036 self.EnviromentUpdateCount = struct.unpack("<L",self.PEB[index:index+4])[0] 1037 index = 0x02c 1038 self.KernelCallbackTable = struct.unpack("<L",self.PEB[index:index+4])[0] 1039 index = 0x030 1040 self.SystemReserved = [] 1041 for i in range(0,2): 1042 self.SystemReserved.append(struct.unpack("<L",self.PEB[index:index+4])[0]) 1043 index += 4 1044 index = 0x038 1045 self.FreeList = struct.unpack("<L",self.PEB[index:index+4])[0] 1046 index = 0x03c 1047 self.TlsExpansionCounter = struct.unpack("<L",self.PEB[index:index+4])[0] 1048 index = 0x040 1049 self.TlsBitmap = struct.unpack("<L",self.PEB[index:index+4])[0] 1050 index = 0x044 1051 self.TlsBitmapBits = [] 1052 for i in range(0,2): 1053 self.TlsBitmapBits.append(struct.unpack("<L",self.PEB[index:index+4])[0]) 1054 index += 4 1055 index = 0x04c 1056 self.ReadOnlySharedMemoryBase = struct.unpack("<L",self.PEB[index:index+4])[0] 1057 index = 0x050 1058 self.ReadOnlySharedMemoryheap = struct.unpack("<L",self.PEB[index:index+4])[0] 1059 index = 0x054 1060 self.ReadOnlyStaticServerData = struct.unpack("<L",self.PEB[index:index+4])[0] 1061 index = 0x058 1062 self.AnsiCodePageData = struct.unpack("<L",self.PEB[index:index+4])[0] 1063 index = 0x05c 1064 self.OemCodePageData = struct.unpack("<L",self.PEB[index:index+4])[0] 1065 index = 0x060 1066 self.UnicodeCaseTableData = struct.unpack("<L",self.PEB[index:index+4])[0] 1067 index = 0x064 1068 self.NumberOfProcessors = struct.unpack("<L",self.PEB[index:index+4])[0] 1069 index = 0x068 1070 self.NtGlobalFlag = struct.unpack("<L",self.PEB[index:index+4])[0] 1071 1072 # ??? WHAT HAPPENS TO THE 4 bytes here ? 1073 1074 index = 0x070 1075 self.CriticalSectionTimeout_LowPart = struct.unpack("<L",self.PEB[index:index+4])[0] 1076 index = 0x074 1077 self.CriticalSectionTimeout_HighPart = struct.unpack("<L",self.PEB[index:index+4])[0] 1078 index = 0x078 1079 self.HeapSegmentReserve = struct.unpack("<L",self.PEB[index:index+4])[0] 1080 index = 0x07c 1081 self.HeapSegmentCommit = struct.unpack("<L",self.PEB[index:index+4])[0] 1082 index = 0x080 1083 self.HeapDeCommitTotalFreeThreshold = struct.unpack("<L",self.PEB[index:index+4])[0] 1084 index = 0x084 1085 self.HeapDeCommitFreeBlockThreshold = struct.unpack("<L",self.PEB[index:index+4])[0] 1086 index = 0x088 1087 self.NumberOfHeaps = struct.unpack("<L",self.PEB[index:index+4])[0] 1088 index = 0x08c 1089 self.MaximumNumberOfHeaps = struct.unpack("<L",self.PEB[index:index+4])[0] 1090 index = 0x090 1091 self.ProcessHeaps = struct.unpack("<L",self.PEB[index:index+4])[0] 1092 index = 0x094 1093 self.GdiSharedHandleTable = struct.unpack("<L",self.PEB[index:index+4])[0] 1094 index = 0x098 1095 self.ProcessStarterHelper = struct.unpack("<L",self.PEB[index:index+4])[0] 1096 index = 0x09c 1097 self.GdiDCAttributeList = struct.unpack("<L",self.PEB[index:index+4])[0] 1098 index = 0x0a0 1099 self.LoaderLock = struct.unpack("<L",self.PEB[index:index+4])[0] 1100 index = 0x0a4 1101 self.OSMajorVersion = struct.unpack("<L",self.PEB[index:index+4])[0] 1102 index = 0x0a8 1103 self.OSMinorVersion = struct.unpack("<L",self.PEB[index:index+4])[0] 1104 index = 0x0ac 1105 self.OSBuildNumber = struct.unpack("<H",self.PEB[index:index+2])[0] 1106 index = 0x0ae 1107 self.OSCSDVersion = struct.unpack("<H",self.PEB[index:index+2])[0] 1108 index = 0x0b0 1109 self.OSPlatformId = struct.unpack("<L",self.PEB[index:index+4])[0] 1110 index = 0x0b4 1111 self.ImageSubsystem = struct.unpack("<L",self.PEB[index:index+4])[0] 1112 index = 0x0b8 1113 self.ImageSubsystemMajorVersion = struct.unpack("<L",self.PEB[index:index+4])[0] 1114 index = 0x0bc 1115 self.ImageSubsystemMinorVersion = struct.unpack("<L",self.PEB[index:index+4])[0] 1116 index = 0x0c0 1117 self.ImageProcessAffinityMask = struct.unpack("<L",self.PEB[index:index+4])[0] 1118 index = 0x0c4 1119 # uint32 GdiHandleBuffer[34] 1120 self.GdiHandleBuffer = [] 1121 for i in range(0,34): 1122 self.GdiHandleBuffer.append(struct.unpack("<L",self.PEB[index:index+4])[0]) 1123 index += 4 1124 index = 0x14c 1125 self.PostProcessInitRoutine = struct.unpack("<L",self.PEB[index:index+4])[0] 1126 index = 0x150 1127 self.TlsExpansionBitmap = struct.unpack("<L",self.PEB[index:index+4])[0] 1128 index = 0x154 1129 # uint32 TlsExpansionBitmapBits[32] 1130 self.TlsExpansionBitmapBits = [] 1131 for i in range(0,32): 1132 self.TlsExpansionBitmapBits.append(struct.unpack("<L",self.PEB[index:index+4])[0]) 1133 index += 4 1134 index = 0x1d4 1135 self.SessionId = struct.unpack("<L",self.PEB[index:index+4])[0] 1136 index = 0x1d8 1137 self.AppCompatInfo = struct.unpack("<L",self.PEB[index:index+4])[0] 1138 index = 0x1dc 1139 # struct _UNICODE_STRING CSDVersion 1140 self.CSDVersion_Length = struct.unpack("<H",self.PEB[index:index+2])[0] 1141 index += 2 1142 self.CSDVersion_MaximumLength = struct.unpack("<H",self.PEB[index:index+2])[0] 1143 index += 2 1144 self.CSDVersion_Buffer = struct.unpack("<H",self.PEB[index:index+2])[0] 1145 index += 2

1146

Source Code for Module Libs.debugtypes