Package Libs :: Module debugtypes
[hide private]
[frames] | no frames]

Source Code for Module Libs.debugtypes

   1  #!/usr/bin/env python 
   2   
   3  """ 
   4  (c) Immunity, Inc. 2004-2007 
   5   
   6   
   7  U{Immunity Inc.<http://www.immunityinc.com>} 
   8   
   9   
  10  """ 
  11   
  12  __version__ = '1.0' 
  13   
  14  import debugger 
  15  import struct 
  16   
  17  ###ulong 
  18  #    handle = handle 
  19  #    handles[handle][0]=type 
  20  #    handles[handle][1]=access 
  21  #    handles[handle][2]=data1 
  22  #    handles[handle][3]=data2 
  23  ### int 
  24  #    handles[handle][4]=refcount 
  25  ###char 
  26  #    handles[handle][5]=htype 
  27  #    handles[handle][6]=username    
  28  #    handles[handle][7]=nativename 
  29   
30 -class Handle:
31 - def __init__(self, handle):
32 self.handle = handle 33 self.type = 0 34 self.access = 0 35 self.data1 = 0 36 self.data2 = 0 37 self.refcount = 0 38 self.htype = "" 39 self.username = "" 40 self.nativename = ""
41
42 - def _getfromtuple(self, mem):
43 self.type = mem[0] 44 self.access = mem[1] 45 self.data1 = mem[2] 46 self.data2 = mem[3] 47 self.refcount = mem[4] 48 self.htype = mem[5] 49 self.username = mem[6] 50 self.nativename = mem[7]
51
52 - def getHandle(self):
53 return self.handle
54
55 - def getType(self):
56 return self.type
57
58 - def getAccess(self):
59 return self.access
60
61 - def getData1(self):
62 return self.data1
63
64 - def getData2(self):
65 return self.data2
66
67 - def getRefCount(self):
68 return self.refcount
69
70 - def getHtype(self):
71 return self.htype
72
73 - def getUserName(self):
74 return self.username
75
76 - def getNativeName(self):
77 return self.nativename
78
79 -class Symbol:
80 - def __init__(self, addr):
81 self.address = addr 82 self.section = "" 83 self.type = "" 84 self.name = "" 85 self.comment = "" 86 self.module = ""
87
88 - def _getfromtuple(self, tup):
89 self.module = tup[0].strip() 90 self.module = self.module.lower() 91 92 self.section = tup[1] 93 self.type = tup[2] 94 self.name = tup[3] 95 self.comment = tup[4]
96
97 - def getAddress(self):
98 return self.address
99
100 - def getModule(self):
101 return self.module
102
103 - def getSection(self):
104 return self.section
105
106 - def getType(self):
107 return self.type
108
109 - def getName(self):
110 return self.name
111
112 - def getComment(self):
113 return self.comment
114 115 116 #Base address of module: base 117 #Size occupied by module: size 118 #service information, TY_xxx: type 119 #base address of module code block: codebase 120 #size of module code block: codesize 121 #Base address of resources: resbase 122 #Size of resources: ressize 123 #Address of <ModuleEntryPoint> or NULL: entry 124 #Base address of module data block: database 125 #Base address of import data table: idatatable 126 #Base address of import data block: idatabase 127 #Base address of export data table: edatatable 128 #Size of export data table: edatasize 129 #Base address of relocation table: reloctable 130 #Size of relocation table: relocsize 131 #Short name of the module: name 132 #Full name of the module: path 133 #Number of sections in the module: nsect 134 #Total size of headers in executable: headersize 135 #Base of image in executable file: fixupbase 136 #Decoded code features or NULL: codedec 137 #Code CRC for actual decoding: codecrc 138 #Hit tracing data or NULL: hittrace 139 #Decoded data features or NULL: datadec 140 #Global types from debug info: globaltypes 141 #Address of WinMain() etc. in dbg data: mainentry 142 #Entry of packed code or NULL: realsfxentry 143 #Original size of module code block: origcodesize 144 #Base of memory block with SFX: sfxbase 145 #Size of memory block with SFX: sfxsize 146 #Whether system DLL: issystemdll 147 #Version of executable file: version
148 -class Module:
149 - def __init__(self, name, baseaddress, size, entrypoint):
150 """ 151 Module Information 152 153 @type name: STRING 154 @param name: Name of the module 155 156 @type baseaddress: DWORD 157 @param baseaddress: Base Address of the Module 158 159 @type size: DWORD 160 @param size: Size of the Module 161 162 @type entrypoint: DWORD 163 @param entrypoint: Entry Point 164 """ 165 # for modulos in mods.keys(): 166 # name : modulos 167 # base addy: mods[modulos][0] 168 # size : mods[modulos][1] 169 # entry : mods[modulos][2] 170 # full path: mods[modulos][3] 171 172 self.name = name.lower() 173 self.baseaddress = baseaddress 174 self.size = size 175 self.entrypoint = entrypoint 176 self.modDict = None 177 self.symbols = [] 178 self.XREFto = {} 179 self.XREFfrom = {}
180
181 - def getFunctions(self):
182 """ 183 Get the all the functions from Module 184 185 @rtype: LIST of DWORD 186 @return: A List of the address of all function 187 """ 188 return debugger.Getallfunctions(self.baseaddress)
189
190 - def _xrefs(self, address, XREF, debugger_callback):
191 code = self.getCodebase() 192 codesize = self.getCodesize() 193 194 # We first check check if address is inside this module code 195 if address >= code and address <= (code+codesize): 196 return [] 197 198 # If we didn't get the whole xref list from debugger, we get it 199 if not XREF: 200 XREF = debugger_callback(address) 201 202 # returning the xrefs as a list of (addy, type) 203 try: 204 return XREF[address] 205 except KeyError: 206 return []
207
208 - def getXrefTo(self, address):
209 """ 210 Get the Xreference to the given address 211 212 @type address: DWORD 213 @param address: Address in the Module to get Xref to 214 215 @rtype: LIST of DWORD 216 @return: List of Address 217 """ 218 return self._xrefs(address, self.XREFto, debugger.Getxref_to)
219
220 - def getXrefFrom(self, address):
221 """ 222 Get the Xreference from the given address 223 224 @type address: DWORD 225 @param address: Address in the Module to get Xref from 226 227 @rtype: LIST of DWORD 228 @return: List of Address 229 """ 230 return self._xrefs(address, self.XREFfrom, debugger.Getxref_from)
231
232 - def getBaseAddress(self):
233 """ 234 Get the Base Address 235 236 @rtype: DWORD 237 @return: Base Address 238 """ 239 return self.baseaddress
240
241 - def getReferencedStrings(self):
242 return debugger.Getreferencedstrings(self.entrypoint)
243
244 - def setModuleExtension(self, mod_dict):
245 self.modDict = mod_dict
246
247 - def setSymbols(self, symbol):
248 self.symbols = symbol
249
250 - def Analyse(self):
251 """ 252 Analize the Current Module 253 """ 254 return debugger.Analysecode(self.baseaddress)
255
256 - def get(self, name):
257 name = name.lower() 258 if not self.modDict.has_key(name): 259 return None 260 return self.modDict[name][0]
261
262 - def getSymbols(self):
263 return self.symbols
264
265 - def getBase(self):
266 """ 267 Get Base from module 268 269 @rtype: DWORD 270 @return: Base from the module 271 """ 272 try: 273 return self.modDict['base'][0] 274 except KeyError: 275 return None
276
277 - def getSize(self):
278 """ 279 Get Size from module 280 """ 281 try: 282 return self.modDict['size'][0] 283 except KeyError: 284 return None
285
286 - def getType(self):
287 """ 288 Get Type from module 289 """ 290 try: 291 return self.modDict['type'][0] 292 except KeyError: 293 return None
294
295 - def getCodebase(self):
296 """ 297 Get Codebase from module 298 """ 299 try: 300 return self.modDict['codebase'][0] 301 except KeyError: 302 return None
303
304 - def getCodesize(self):
305 """ 306 Get Codesize from module 307 308 @rtype: DWORD 309 @return: Code Size 310 """ 311 try: 312 return self.modDict['codesize'][0] 313 except KeyError: 314 return None
315
316 - def getResbase(self):
317 """ 318 Get Resbase from module 319 320 @rtype: DWORD 321 @return: Res Base 322 323 """ 324 try: 325 return self.modDict['resbase'][0] 326 except KeyError: 327 return None
328
329 - def getRessize(self):
330 """ 331 Get Ressize from module 332 333 @rtype: DWORD 334 @return: Res Size 335 """ 336 try: 337 return self.modDict['ressize'][0] 338 except KeyError: 339 return None
340
341 - def getEntry(self):
342 """ 343 Get Entry from module 344 345 @rtype: DWORD 346 @return: Entry 347 """ 348 try: 349 return self.modDict['entry'][0] 350 except KeyError: 351 return None
352
353 - def getDatabase(self):
354 """ 355 Get Database from module 356 357 @rtype: DWORD 358 @return: Database 359 """ 360 try: 361 return self.modDict['database'][0] 362 except KeyError: 363 return None
364
365 - def getIdatatable(self):
366 """ 367 Get Idatatable from module 368 """ 369 try: 370 return self.modDict['idatatable'][0] 371 except KeyError: 372 return None
373
374 - def getIdatabase(self):
375 """Get Idatabase from module""" 376 try: 377 return self.modDict['idatabase'][0] 378 except KeyError: 379 return None
380
381 - def getEdatatable(self):
382 """ 383 Get Edatatable from module 384 """ 385 try: 386 return self.modDict['edatatable'][0] 387 except KeyError: 388 return None
389
390 - def getEdatasize(self):
391 """ 392 Get Edatasize from module 393 """ 394 try: 395 return self.modDict['edatasize'][0] 396 except KeyError: 397 return None
398
399 - def getReloctable(self):
400 """ 401 Get Reloctable from module 402 """ 403 try: 404 return self.modDict['reloctable'][0] 405 except KeyError: 406 return None
407
408 - def getRelocsize(self):
409 """ 410 Get Relocsize from module 411 """ 412 try: 413 return self.modDict['relocsize'][0] 414 except KeyError: 415 return None
416
417 - def getName(self):
418 """ 419 Get Name from module 420 """ 421 try: 422 return self.name 423 except KeyError: 424 return None
425
426 - def getPath(self):
427 """ 428 Get Path from module 429 """ 430 try: 431 return self.modDict['path'][0] 432 except KeyError: 433 return None
434
435 - def getNsect(self):
436 """ 437 Get Nsect from module 438 """ 439 try: 440 return self.modDict['nsect'][0] 441 except KeyError: 442 return None
443
444 - def getHeadersize(self):
445 """ 446 Get Headersize from module 447 """ 448 try: 449 return self.modDict['headersize'][0] 450 except KeyError: 451 return None
452
453 - def getFixupbase(self):
454 """ 455 Get Fixupbase from module 456 """ 457 try: 458 return self.modDict['fixupbase'][0] 459 except KeyError: 460 return None
461
462 - def getCodedec(self):
463 """ 464 Get Codedec from module 465 """ 466 try: 467 return self.modDict['codedec'][0] 468 except KeyError: 469 return None
470
471 - def getCodecrc(self):
472 """ 473 Get Codecrc from module 474 """ 475 try: 476 return self.modDict['codecrc'][0] 477 except KeyError: 478 return None
479
480 - def getHittrace(self):
481 """ 482 Get Hittrace from module 483 """ 484 try: 485 return self.modDict['hittrace'][0] 486 except KeyError: 487 return None
488
489 - def getDatadec(self):
490 """ 491 Get Datadec from module 492 """ 493 try: 494 return self.modDict['datadec'][0] 495 except KeyError: 496 return None
497
498 - def getGlobaltypes(self):
499 """ 500 Get Globaltypes from module 501 """ 502 try: 503 return self.modDict['globaltypes'][0] 504 except KeyError: 505 return None
506
507 - def getMainentry(self):
508 """ 509 Get Mainentry from module 510 """ 511 try: 512 return self.modDict['mainentry'][0] 513 except KeyError: 514 return None
515
516 - def getRealsfxentry(self):
517 """ 518 Get Realsfxentry from module 519 """ 520 try: 521 return self.modDict['realsfxentry'][0] 522 except KeyError: 523 return None
524
525 - def getOrigcodesize(self):
526 """ 527 Get Origcodesize from module 528 """ 529 try: 530 return self.modDict['origcodesize'][0] 531 except KeyError: 532 return None
533
534 - def getSfxbase(self):
535 """ 536 Get Sfxbase from module 537 """ 538 try: 539 return self.modDict['sfxbase'][0] 540 except KeyError: 541 return None
542
543 - def getSfxsize(self):
544 """ 545 Get Sfxsize from module 546 """ 547 try: 548 return self.modDict['sfxsize'][0] 549 except KeyError: 550 return None
551
552 - def getIssystemdll(self):
553 """ 554 Get Issystemdll from module 555 """ 556 try: 557 return self.modDict['issystemdll'][0] 558 except KeyError: 559 return None
560
561 - def getVersion(self):
562 """ 563 Get Version from module 564 """ 565 try: 566 return self.modDict['version'][0] 567 except KeyError: 568 return None
569
570 - def isAnalysed(self):
571 """ 572 Check if module was analysed 573 """ 574 # we should check every time, cause the module might be analysed. Since modules are cached sometimes 575 return debugger.IsAnalysed(self.baseaddress)
576