3

I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter.

Do I have actually to scan all the code, looking for the call that is calling that function or is there a more elegant way?

Update:

The function is not exported or imported.

Update 2:

For example ImmDbg how can it find all the references and show them?

6
  • 1
    im not sure pydbg has any static analysis built into it and so i don't think it could do much more than what Igor suggested
    – 0xea
    Commented Jun 3, 2013 at 17:33
  • For update 2: it does that using static analysis. Roughly the same as IDA. Disassemble the entire binary and note every immediate destination.
    – NirIzr
    Commented Jun 3, 2013 at 19:30
  • presumably I still do not know about radare capabilities, is there some "cheep" static disassembler library that can be connected to PyDbg and produce some sort of "ImmDbg" result?
    – PhoeniX
    Commented Jun 3, 2013 at 19:34
  • @ph0sec: you shouldn't amend your question with things that broaden instead of narrow down the scope of it.
    – 0xC0000022L
    Commented Jun 3, 2013 at 20:32
  • @0xC0000022L: So, how do you suggest to ask this question? In my opinion, this will help to understand the matter and resolve the problem I have.
    – PhoeniX
    Commented Jun 3, 2013 at 20:52

2 Answers 2

5

Since you want all the call instructions (and possibly fake calls using push and jmp and similar using opaque predicates) you won't get around static analysis () of the binary. And if the binary is in any way packed or encrypted that means you need to get through that layer first.

Igor's solution will be your best bet short of loading the file into a good disassembler and finding all the cross-references to the function you are interested in. But it has the limitation that Igor already pointed out.

Static analysis has to deal with a lot of ambiguities and issues when distinguishing data and code. But good disassemblers are fairly good at making the right guess and will offer to interactively mark items one way or the other in case of doubt.

Conclusion

What this means is that PyDbg is probably not the right tool for the problem at hand unless you manage to coerce it into making use of a proper full-fledged disassembler to get all cross-references. But the better choice is probably something like radare2 and then, if you are more familiar with PyDbg, applying the gained knowledge to the debugged target in PyDbg.

2
  • Ok thanks, I understand your point and I'll take a look @ radare. I'd like to understand another thing - in the main question
    – PhoeniX
    Commented Jun 3, 2013 at 19:23
  • @ph0sec: if it's closely related, edit your question, otherwise better ask a new question :) ... it's better than changing the scope of an existing question after people answered.
    – 0xC0000022L
    Commented Jun 3, 2013 at 19:25
2
  1. Put a breakpoint on the function address.
  2. When hit, get the dword at ESP - that would be the return address.

This, obviously, will catch only the actual calls, not all potential ones.

1
  • Thanks, this is indeed the obvious one. But I need all of them :).
    – PhoeniX
    Commented Jun 3, 2013 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.