2

I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter.

Do I have actually to scan all the code, looking for the call that is calling that function or is there a more elegant way?

Update:

The function is not exported or imported.

Update 2:

For example ImmDbg how can it find all the references and show them?

  • 1
    im not sure pydbg has any static analysis built into it and so i don't think it could do much more than what Igor suggested – 0xea Jun 3 '13 at 17:33
  • For update 2: it does that using static analysis. Roughly the same as IDA. Disassemble the entire binary and note every immediate destination. – NirIzr Jun 3 '13 at 19:30
  • presumably I still do not know about radare capabilities, is there some "cheep" static disassembler library that can be connected to PyDbg and produce some sort of "ImmDbg" result? – PhoeniX Jun 3 '13 at 19:34
  • @ph0sec: you shouldn't amend your question with things that broaden instead of narrow down the scope of it. – 0xC0000022L Jun 3 '13 at 20:32
  • @0xC0000022L: So, how do you suggest to ask this question? In my opinion, this will help to understand the matter and resolve the problem I have. – PhoeniX Jun 3 '13 at 20:52
5

Since you want all the call instructions (and possibly fake calls using push and jmp and similar using opaque predicates) you won't get around static analysis () of the binary. And if the binary is in any way packed or encrypted that means you need to get through that layer first.

Igor's solution will be your best bet short of loading the file into a good disassembler and finding all the cross-references to the function you are interested in. But it has the limitation that Igor already pointed out.

Static analysis has to deal with a lot of ambiguities and issues when distinguishing data and code. But good disassemblers are fairly good at making the right guess and will offer to interactively mark items one way or the other in case of doubt.

Conclusion

What this means is that PyDbg is probably not the right tool for the problem at hand unless you manage to coerce it into making use of a proper full-fledged disassembler to get all cross-references. But the better choice is probably something like radare2 and then, if you are more familiar with PyDbg, applying the gained knowledge to the debugged target in PyDbg.

  • Ok thanks, I understand your point and I'll take a look @ radare. I'd like to understand another thing - in the main question – PhoeniX Jun 3 '13 at 19:23
  • @ph0sec: if it's closely related, edit your question, otherwise better ask a new question :) ... it's better than changing the scope of an existing question after people answered. – 0xC0000022L Jun 3 '13 at 19:25
2
  1. Put a breakpoint on the function address.
  2. When hit, get the dword at ESP - that would be the return address.

This, obviously, will catch only the actual calls, not all potential ones.

  • Thanks, this is indeed the obvious one. But I need all of them :). – PhoeniX Jun 3 '13 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.