5

I'd like to write something using Python C-Types that hooks API calls and can be leveraged for unpacking executables. Currently my (Python with C-Types) code launches an executable in a suspended state then performs DLL injection using the createremotethread API. The DLL is loaded and the code is successfully executed.

I'd like the injected code to patch the executable so that it hooks certain API calls. Eventually I'd like to find code caves but I'm currently just allocating virtual memory (virtualalloc). I'd like to do this using just Python. Is this possible?

I imagine since it can be done in C it can be accomplished using Python's C-Types. In my research I've seen people use DiStorm for certain parts of this, but again I'd like to use Python. I understand that this has been done before but I'd like to code something up as a learning exercise. Looking for some direction and any guidance is welcomed.

Improve this question
2
  • Have a look at my answer here: reverseengineering.stackexchange.com/a/1981/245 ... if you want to patch the executable, personally I'd do that through an injected DLL. But it's a matter of taste. I.e. the injected DLL would do all the patching up, but be careful to avoid complications with the loader lock (i.e. don't use LoadLibrary and friends within DllMain).
    – 0xC0000022L ♦
    Sep 1, 2013 at 13:58
  • I plan to put the code to patch it in the DLLMain of the DLL that I'm injecting. Thanks for the link!
    – user2743
    Sep 1, 2013 at 23:03

1 Answer 1

Reset to default
4

please look at the following:

  • PyDBG - it's a python wrapper around Win Debug API and much more. The framework enables one to literally inspect every aspect of the running process by registering event handlers for BPs, memory executions/reads/writes, stack inspection, etc.. You can change whatever you want in the process you are debugging.
  • WinAppDbg - python module allows developers to quickly code instrumentation scripts in Python under a Windows environment.

By using the above tools you can write a general unpacker and if you find something more serious, there is no other way , other than do it manually and incorporate the knowledge into scripts. I've experience with the above tools for solving just the same problem you are trying to solve, and I can tell that those frameworks do a good job.

For a start you can BP all memory allocation, protections changing and freeing APIs and inspect those buffers - (VirtualAlloc(Ex), VirtualFree, VirtualProtect). In addition, add WriteProcessMemory and inspect buffer that just to be written to other processes (in case of malware). For more advanced packers you can also inspect *UnmapViewOfSection APIs too.

Improve this answer
3
  • 1
    Also give github.com/Fitblip/vdb-fork a look instead of PyDBG.
    – Stolas
    Sep 2, 2013 at 7:08
  • PyDBG is good but somehow outdated, vdb is kind of the bleeding edge but has a steep learning curve. In between you will find WinAppDbg (link already mentioned above). It is very good and the documentation and examples on the site will allow you to start writing your own scripts very quickly.
    – Carlos Garcia
    Sep 3, 2013 at 8:04
  • Here's an updated link for vdb
    – viv
    Sep 3, 2013 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.