0

Is there any quick/ faster way to find , any address resides in which loaded module.

For example from stack if I have ret address of any api. I want to check from which module actually that function was get called ??

1 Answer 1

4
from pydbg import *
from pydbg.defines import *

def handler_breakpoint (pydbg):   
   if pydbg.first_breakpoint:
    dbg.bp_set(dbg.func_resolve("user32","SendMessageW"))
    return DBG_CONTINUE
   retaddr = dbg.get_arg(0,dbg.context)
   modname = dbg.addr_to_module(retaddr).szModule   
   print "Calling Module and Return Address %25s\t%08x" % (modname,retaddr)
   return DBG_CONTINUE

dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.load("c:\windows\system32\calc.exe")
pydbg.debug_event_loop(dbg)

result

Calling Module and Return Address              comctl32.dll     773f2883
Calling Module and Return Address              comctl32.dll     773f2883
Calling Module and Return Address                USER32.dll     7e4269ed
Calling Module and Return Address                USER32.dll     7e4269fa

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.