5

How does fastloghook work in immunity debugger pycommand section? i cant figure it out. Everything i try does not work and i know this code is a mess. I seriously dont understand fastloghook which makes me crazy when bphook worked so nicely. I need an explanation :/

#!/usr/bin/env python

import immlib
import struct
from immlib import FastLogHook

def main(args):

"""
    Will hook and run its own assembly code then return control
"""

imm = immlib.Debugger()

# Set name
Name = "hippie"

fast = imm.getKnowledge(Name)

if fast:
    hook_list = fast.getAllLog()
    imm.log(str(hook_list))
        imm.log("%s" item[1[0]])

# Instantiate fastloghook
fast = immlib.FastLogHook(imm)

# Primary address to hook on to
fast.logFunction(imm.getAddress("msvcrt.strcpy"))

# Takes register and offset. dereference parameters from the stack
# or capture data at a known offset from a register
fast.logBaseDisplacement('ESP', 0x4)
fast.logBaseDisplacement('ESP', 0x8)

# Tracks the value of a specific register when the hook is hit
fast.logRegister("ESP")

# Logs known memory offset at hook time
# fast.logDirectMemory()

# Set the hook
fast.Hook()

# Save data so we can retrieve results later
imm.addKnowledge(Name, fast, force_add=1)

return "LogBPHook installed"`
6

FastLogHook is one of the 13 hook types that Immunity Debugger comes with. Essentially, the purpose of this type of hook is to use tiny assembly stub to transfer execution to a hook function in order to log particular registers and/or memory locations. FastLogHook is essentially an python object, which allows us to setup hard hook relatively easy.

The definition of setup is as following:

debugger  = immlib.Debugger()
fast_hook = immlib.FasLogHook(debugger)

fast_hook.logFunction(address, number_of_arguments)
fast_hook.logRegister(register)
fast_hook.logDirectMemory(address)
fast_hook.logBaseDisplacement( register, offset ) 

logFunction() returns us the address of the original instruction we need to overwrite with the jump to our hook function. It is absolutely required.

logRegister(), logDirectMemory(), and logBaseDisplacement() are methods to track specific values of particular register, memory location, or certain offset from the register respectively at hook time.

FastLogHook will not interrupt the execution and smoothly log the results to debugger object. BpHook on the other hand is totally different type of a hook. When BpHook is called, it will halt execution.

| improve this answer | |
  • oh now i feel really stupid, i thought that immunity debugger after first script run invoked the script by it self and logged the result to my log window. But i have to run the script again to get result back to me. – user2464 Jul 17 '13 at 12:35
  • Exactly. As far as your script goes. logFunction has the following prototype logFunction(address, number_of_arguments). If number_of_arguments is nothing, like you have, it will most likely try to hook the exit of the function. In order to hook the entry point you need to provide number of args as 2. Also, logDirectMemory(address) requires an address to log. Yours missing that part as well. – PSS Jul 17 '13 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.