1

I am currently writing a small utility leveraging pydbg. One of the features I am trying to implement is as follows:

For each DLL imported, I want to list the api functions that the module exports and loaded at run-time. As an example if a debuggee imports ws2_32.dll I would like to walk the list of the API's that ws2_32.dll exports.

I know how to do this using PEfile when the executable is not running, by walking the import table. I am trying to do something similar when the executable is running as process. I know that you can use the enumerate_modules method from pydbg but that only returns the modules and base address. Is it possible to do what I am asking?

Thanks in advance,

Ryan

1
  • Ok so I think I have this partially figured out. Looks like I need to load the PEB_LDR_DATA structure and iterate (maybe) over the _LDR_DATA_ENTRY.
    – Ryan S
    Commented Sep 29, 2017 at 16:53

1 Answer 1

1

I figured out how to do this and hopefully this will help someone else. In retro spect the answer was in the original question. It just didn't click at the time of posting. This was implemented using pydbg and pefile. This was a good little exercise that forced me to get real familiar with the PE file format.

# Get module PE header base and size
for mods in dbg.iterate_modules():
    if mod.lower() == str(mods.szModule.lower()):
        print('Mod: {0} Base: {1}'.format(mods.szModule,
                                          hex(mods.modBaseAddr)))
        addr = mods.modBaseAddr
        size = mods.modBaseSize
        break

# Read PE header in memory
pe = pefile.PE(data=dbg.read_process_memory(addr, size))
pe.parse_data_directories(directories=[
                pefile.DIRECTORY_ENTRY[u'IMAGE_DIRECTORY_ENTRY_IMPORT'],
                ])

# Traverse IAT
for entry in pe.DIRECTORY_ENTRY_IMPORT:
    print(entry.dll)
    print('#'*20)
    for imp in entry.imports:
       print('Address:{0}    API:{1}'.format(hex(imp.address), imp.name))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.