How to use fastloghook in immunity debugger

Question

How does fastloghook work in immunity debugger pycommand section? i cant figure it out. Everything i try does not work and i know this code is a mess. I seriously dont understand fastloghook which makes me crazy when bphook worked so nicely. I need an explanation :/

#!/usr/bin/env python

import immlib
import struct
from immlib import FastLogHook

def main(args):

"""
    Will hook and run its own assembly code then return control
"""

imm = immlib.Debugger()

# Set name
Name = "hippie"

fast = imm.getKnowledge(Name)

if fast:
    hook_list = fast.getAllLog()
    imm.log(str(hook_list))
        imm.log("%s" item[1[0]])

# Instantiate fastloghook
fast = immlib.FastLogHook(imm)

# Primary address to hook on to
fast.logFunction(imm.getAddress("msvcrt.strcpy"))

# Takes register and offset. dereference parameters from the stack
# or capture data at a known offset from a register
fast.logBaseDisplacement('ESP', 0x4)
fast.logBaseDisplacement('ESP', 0x8)

# Tracks the value of a specific register when the hook is hit
fast.logRegister("ESP")

# Logs known memory offset at hook time
# fast.logDirectMemory()

# Set the hook
fast.Hook()

# Save data so we can retrieve results later
imm.addKnowledge(Name, fast, force_add=1)

return "LogBPHook installed"`

Answer 1

FastLogHook is one of the 13 hook types that Immunity Debugger comes with. Essentially, the purpose of this type of hook is to use tiny assembly stub to transfer execution to a hook function in order to log particular registers and/or memory locations. FastLogHook is essentially an python object, which allows us to setup hard hook relatively easy.

The definition of setup is as following:

debugger  = immlib.Debugger()
fast_hook = immlib.FasLogHook(debugger)

fast_hook.logFunction(address, number_of_arguments)
fast_hook.logRegister(register)
fast_hook.logDirectMemory(address)
fast_hook.logBaseDisplacement( register, offset ) 

logFunction() returns us the address of the original instruction we need to overwrite with the jump to our hook function. It is absolutely required.

logRegister(), logDirectMemory(), and logBaseDisplacement() are methods to track specific values of particular register, memory location, or certain offset from the register respectively at hook time.

FastLogHook will not interrupt the execution and smoothly log the results to debugger object. BpHook on the other hand is totally different type of a hook. When BpHook is called, it will halt execution.