Quantcast
Channel: Python extension for WinDbg
Viewing all articles
Browse latest Browse all 1625

New Post: Allocating and Writing Memory

$
0
0
1) Pykd is not supported "nativly" writting into memory/regsity. Maybe, it will be implemented within 0.3.x version

2) For modifying traget memory you can use this approach:

import sys
import pykd
from ctypes import *

PAGE_READWRITE = 0x04
PROCESS_ALL_ACCESS = ( 0x000F0000 | 0x00100000 | 0xFFF )
VIRTUAL_MEM = ( 0x1000 | 0x2000 )

kernel32 = windll.kernel32
pid = pykd.getCurrentProcessId()

hprocess = kernel32.OpenProcess( PROCESS_ALL_ACCESS, False, pid )

print hprocess

vaddr = kernel32.VirtualAllocEx(hprocess, 0, 0x1000, VIRTUAL_MEM, PAGE_READWRITE)

print hex(vaddr)

written = c_int(0)
buffer = "a"*100

kernel32.WriteProcessMemory(hprocess, vaddr, buffer, len(buffer), byref(written))

readChars = pykd.loadChars( vaddr, len(buffer) ) #check memory is filled as expected

print readChars

3) and you can use all windbg command through dbgCommand routine:
dbgCommand( "r rip=%x" % 0xdeadcode ) # set register value
dbgCommend( "ed %x 0xFFFF0000" % addr ) # place 0xFFFF0000 by address

Viewing all articles
Browse latest Browse all 1625

Trending Articles