2

I am a newbie in python programming for Debugging . I wrote a code for using the function FastLogHook() in immlib but i am not able to figure out the exact problem with my code as it is not working :(

Here is My code

#!/usr/bin/env python

import immlib
from immlib import FastLogHook

DESC = "FastLogHook Basic Demo"

def showresult(imm, a,addr):
if a[0]==addr:
    imm.Log("(0x%08x >> 0x%08x , 0x%08x)%(a[1][0], a[1][1], a[1][2]) ")
    return "done"

def main(args):
imm = immlib.Debugger()
Name = 'fasty'
fast = imm.getKnowledge( Name )

functionToHook = "msvcrt.strcpy"
functionAddress = imm.getAddress(functionToHook)
imm.log(str(functionAddress) + 'pf')
if fast:
    hook_list = fast.getAllLog()
    imm.log(str(hook_list))
    for a in hook_list:
        ret = showresult( imm, a, functionAddress )
    return"Logged: %d hook hits." % len(hook_list)
imm.pause()
fast = FastLogHook(imm)
fast.logFunction(functionAddress)
fast.logBaseDisplacement('ESP', 0x4)
fast.logBaseDisplacement('ESP', 0x8)
fast.logRegister("ESP")
fast.Hook()
imm.addKnowledge(Name, fast, force_add = 1)

return "Success!!"

I am running this code in Immunity Debugger but continuously getting error . I searched , googled but due to the limitation of documentation regarding this I am unable to correct it .

3

I also just started to learn more about this topic and managed to write down the following lines of code.

I guess all my comments in the code are good enough as answer. I dont know much more then that anyway.

  ' #!/usr/bin/env python

  import immlib
  import struct
  from immlib import STDCALLFastLogHook

  DESC="FastLoogHook"

  def main(args):

        """
                Will hook and run its own assembly code then return to the process
                Usage: First run the script to install hook, then run it again to get results ^^
        """

        imm = immlib.Debugger()
        Name = "hippie"


        # Get stored data on second script run
        fast = imm.getKnowledge(Name)

        if fast:

                # Get a list of all the things we saved
                hook_list = fast.getAllLog()

                # Log result
                imm.log(str(hook_list))

                # unpack list
                (func_addr, (esp1, esp2)) = hook_list[0]

                # Log argument
                imm.log(imm.readString(esp2))

                return "Parsing results done"

        # Find strcpy address   
        strcpy = imm.getAddress("msvcrt.strcpy")

        # Building the hook
        fast = immlib.FastLogHook(imm)

        # This function is required and returns 
        # the address of the original instruction
        fast.logFunction(strcpy)

        # Offset
        fast.logBaseDisplacement("ESP", 4)
        fast.logBaseDisplacement("ESP", 8)

        # Set hook
        fast.Hook()

        # Save data for later use
        imm.addKnowledge(Name, fast, force_add = 1)

        return "FastLogHook installed for strcpy"'
| improve this answer | |
  • Can u tell me what's wrong with my code ? – in3o Jul 20 '13 at 12:31
  • The line with imm.Log in showresult has typos in it. it should be imm.log("(0x%08x >> 0x%08x , 0x%08x)"%(a[1][0], a[1][1], a[1][2])) – user2464 Jul 20 '13 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.