239 lines
8.4 KiB
Python
Executable File
239 lines
8.4 KiB
Python
Executable File
#!/usr/bin/env python
|
|
|
|
"""
|
|
(c) Immunity, Inc. 2004-2007
|
|
|
|
|
|
U{Immunity Inc.<http://www.immunityinc.com>}
|
|
|
|
|
|
|
|
"""
|
|
|
|
__VERSION__ = '1.0'
|
|
import debugger
|
|
|
|
class Event:
|
|
def __init__( self, event ):
|
|
self.dwDebugEventCode = event[0][0]
|
|
self.dwProcessId = event[0][1]
|
|
self.dwThreadId = event[0][2]
|
|
self._GetValues(event)
|
|
|
|
def isCreateProcess(self):
|
|
return self.dwDebugEventCode == debugger.CREATE_PROCESS_DEBUG_EVENT
|
|
|
|
def isCreateThread(self):
|
|
return self.dwDebugEventCode == debugger.CREATE_THREAD_DEBUG_EVENT
|
|
|
|
def isException(self):
|
|
return self.dwDebugEventCode == debugger.EXCEPTION_DEBUG_EVENT
|
|
|
|
def isExitProcess(self):
|
|
return self.dwDebugEventCode == debugger.EXIT_PROCESS_DEBUG_EVENT
|
|
|
|
def isExitThread(self):
|
|
return self.dwDebugEventCode == debugger.EXIT_THREAD_DEBUG_EVENT
|
|
|
|
def isLoadDll(self):
|
|
return self.dwDebugEventCode == debugger.LOAD_DLL_DEBUG_EVENT
|
|
|
|
def isOutputDebugString(self):
|
|
return self.dwDebugEventCode == debugger.OUTPUT_DEBUG_STRING_EVENT
|
|
|
|
def isUnloadDll(self):
|
|
return self.dwDebugEventCode == debugger.UNLOAD_DLL_DEBUG_EVENT
|
|
|
|
def isRipEvent(self):
|
|
return self.dwDebugEventCode == debugger.RIP_EVENT
|
|
|
|
def _GetValues(self, event):
|
|
return
|
|
|
|
class CreateProcessEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.hFile = event[1][0]
|
|
self.hProcess = event[1][1]
|
|
self.hThread = event[1][2]
|
|
self.lpBaseOfImage = event[1][3]
|
|
self.dwDebugInfoFileOffset = event[1][4]
|
|
self.nDebugInfoSize = event[1][5]
|
|
self.lpThreadLocalBase = event[1][6]
|
|
self.lpStartAddress = event[1][7]
|
|
self.lpImageName = event[1][8]
|
|
self.fUnicode = event[1][9]
|
|
|
|
class CreateThreadEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.hThread = [1][0]
|
|
self.lpStartAddress = event[1][1]
|
|
self.lpThreadLocalBase = event[1][2]
|
|
|
|
EXCEPTION_CODE = {debugger.EXCEPTION_BREAKPOINT: "Breakpoint",
|
|
debugger.EXCEPTION_SINGLE_STEP:"SingleStep",
|
|
debugger.EXCEPTION_ACCESS_VIOLATION:"AccessViolation",
|
|
debugger.EXCEPTION_GUARD_PAGE: "GuardPage",
|
|
debugger.EXCEPTION_ARRAY_BOUNDS_EXCEEDED: "ArrayBoundsExceeded",
|
|
debugger.EXCEPTION_FLT_DENORMAL_OPERAND: "FltDenormalOperand",
|
|
debugger.EXCEPTION_FLT_DIVIDE_BY_ZERO: "FltDivideByZero",
|
|
debugger.EXCEPTION_FLT_INEXACT_RESULT: "FltInexactResult",
|
|
debugger.EXCEPTION_FLT_INVALID_OPERATION: "FltInvalidOperation",
|
|
debugger.EXCEPTION_FLT_OVERFLOW: "FltOverflow",
|
|
debugger.EXCEPTION_FLT_STACK_CHECK: "FltStackCheck",
|
|
debugger.EXCEPTION_FLT_UNDERFLOW: "FltUnderflow",
|
|
debugger.EXCEPTION_INT_DIVIDE_BY_ZERO: "IntDivideByZero",
|
|
debugger.EXCEPTION_INT_OVERFLOW: "IntOverflow",
|
|
debugger.EXCEPTION_PRIV_INSTRUCTION: "PrivInstruction",
|
|
debugger.EXCEPTION_ILLEGAL_INSTRUCTION: "IllegalInstruction",
|
|
debugger.EXCEPTION_NONCONTINUABLE_EXCEPTION: "NonContinuableException",
|
|
debugger.EXCEPTION_STACK_OVERFLOW: "StackOverflow"
|
|
}
|
|
|
|
class ExceptionRecord:
|
|
def __init__(self, er):
|
|
self.ExceptionCode = er [0]
|
|
self.ExceptionFlags = er [1]
|
|
self.ExceptionAddress = er [2]
|
|
self.NumberParameters = er [3]
|
|
self.ExceptionInformation = er [4]
|
|
self.ExceptionRecord = er [5]
|
|
|
|
def isAccessViolationOnExecute(self):
|
|
return self.isAccessViolation() and self.ExceptionInformation[0] != 1 and self.ExceptionInformation[0] == self.ExceptionAddress
|
|
|
|
def isAccessViolationOnWrite(self):
|
|
return self.isAccessViolation() and self.ExceptionInformation[0] == 1
|
|
|
|
def isAccessViolationOnRead(self):
|
|
return self.isAccessViolation() and self.ExceptionInformation[0] != 1 and self.ExceptionInformation[0] != self.ExceptionAddress
|
|
|
|
def isBreakpoint(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_BREAKPOINT
|
|
|
|
def isSingleStep(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_SINGLE_STEP
|
|
|
|
def isAccessViolation(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_ACCESS_VIOLATION
|
|
|
|
def isGuardPage(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_GUARD_PAGE
|
|
|
|
def isArrayBoundsExceeded(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_ARRAY_BOUNDS_EXCEEDED
|
|
|
|
def isFltDenormalOperand(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_FLT_DENORMAL_OPERAND
|
|
|
|
def isFltDivideByZero(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_FLT_DIVIDE_BY_ZERO
|
|
|
|
def isFltInexactResult(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_FLT_INEXACT_RESULT
|
|
|
|
def isFltInvalidOperation(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_FLT_INVALID_OPERATION
|
|
|
|
def isFltOverflow(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_FLT_OVERFLOW
|
|
|
|
def isFltStackCheck(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_FLT_STACK_CHECK
|
|
|
|
def isFltUnderflow(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_FLT_UNDERFLOW
|
|
|
|
def isIntDivideByZero(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_INT_DIVIDE_BY_ZERO
|
|
|
|
def isIntOverflow(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_INT_OVERFLOW
|
|
|
|
def isPrivInstruction(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_PRIV_INSTRUCTION
|
|
|
|
def isIllegalInstruction(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_ILLEGAL_INSTRUCTION
|
|
|
|
def isNonContinuableException(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_NONCONTINUABLE_EXCEPTION
|
|
|
|
def isExceptionStackOverflow(self):
|
|
return self.ExceptionCode == debugger.EXCEPTION_STACK_OVERFLOW
|
|
|
|
def getType(self):
|
|
try:
|
|
return EXCEPTION_CODE[self.ExceptionCode]
|
|
except KeyError:
|
|
return "UknownException"
|
|
|
|
def __str__(self):
|
|
return self.getType()
|
|
|
|
|
|
class ExceptionEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.dwFirstChance = event[1][0]
|
|
self.Exception = []
|
|
for er in range(1, len(event[1])):
|
|
self.Exception.append( ExceptionRecord(event[1][er]) )
|
|
|
|
class ExitProcessEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.dwExitCode = event[1][0]
|
|
|
|
class ExitThreadEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.dwExitCode = event[1][0]
|
|
|
|
class LoadDLLEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.hFile = event[1][0]
|
|
self.lpBaseOfDll = event[1][1]
|
|
self.dwDebugInfoFileOffset = event[1][2]
|
|
self.nDebugInfoSize = event[1][3]
|
|
self.lpImageName = event[1][4]
|
|
self.fUnicode = event[1][5]
|
|
|
|
class OutputDebugEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.lpDebugStringData = event[1][0]
|
|
self.fUnicode = event[1][1]
|
|
self.nDebugStringLength = event[1][2]
|
|
|
|
class RIPEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(self, event)
|
|
|
|
def _GetValues(self, event):
|
|
self.dwError = event[1][0]
|
|
self.dwType = event[1][1]
|
|
|
|
class UnloadDLLEvent(Event):
|
|
def __init__(self, event):
|
|
Event.__init__(event)
|
|
|
|
def _GetValues(self, event):
|
|
self.lpBaseOfDll = event[1][0]
|