Libs.immlib

152 - def __init__(self):

153 """ Initialize the Immunity Debugger API""" 154 self.threadid = 0 155 os = self.getOsInformation() 156 self.ossystem = os[ 0 ].lower() 157 self.osversion = os[ 1 ].lower() 158 self.osrelease = os[ 2 ].lower() 159 160 # we want to distinguish Vista over other Windows. 161 self.isVista = self.getOsRelease()[0] == '6' 162 163 self.Eventndx = { debugger.CREATE_PROCESS_DEBUG_EVENT : CreateProcessEvent, 164 debugger.CREATE_THREAD_DEBUG_EVENT : CreateThreadEvent, 165 debugger.EXCEPTION_DEBUG_EVENT : ExceptionEvent, 166 debugger.EXIT_PROCESS_DEBUG_EVENT : ExitProcessEvent, 167 debugger.EXIT_THREAD_DEBUG_EVENT : ExitThreadEvent, 168 debugger.LOAD_DLL_DEBUG_EVENT : LoadDLLEvent, 169 debugger.OUTPUT_DEBUG_STRING_EVENT : OutputDebugEvent, 170 debugger.UNLOAD_DLL_DEBUG_EVENT : UnloadDLLEvent, 171 debugger.RIP_EVENT : RIPEvent } 172 173 self.clearState()

174

175 - def clearState(self):

176 self.Symbols = DictTypes() 177 self.Handles = DictTypes() 178 self.Threads = DictTypes() 179 self.MemoryPages = DictTypes() 180 self.Modules = DictTypes() 181 self.BackTrace = [] 182 self.HeapsAddr = [] 183 self.Heaps = {}

184 185 186 ### Get the ultimate solution ###

187 - def getShellcodeExecutionNoMatterWhat(self):

188 return self.Error("%d" % (0x15 * 2))

189 190 191 ### Immunity Debugger Knowledge ### 192 # Sharing information between scripts 193

194 - def addKnowledge(self, id, object, force_add = 0x0):

195 """ 196 This function add a python object to the knowledge database. 197 198 @type id: STRING 199 @param id: unique name tag of the object 200 201 @type object: Python object 202 @param object: Object to be saved in the knowledge database 203 """ 204 205 pickled_object=pickle.dumps(object) 206 return debugger.AddKnowledge(pickled_object,id, force_add)

207

208 - def getKnowledge(self,id):

209 """ 210 Gets python object from the knowledge database. 211 212 @type id: STRING 213 @param id: unique name tag of the object 214 215 @rtype: PYTHON OBJECT 216 @return: Object retrieved from the knowledge database 217 """ 218 pickled_object=debugger.GetKnowledge(id) 219 #try: 220 if not pickled_object: 221 return None 222 return pickle.loads(pickled_object)

223

224 - def listKnowledge(self):

225 """ 226 Gets the list of saved objects in the knowledge database. 227 228 @rtype: TUPLE 229 @return: List of String ids currently saved 230 """ 231 return debugger.ListKnowledge()

232

233 - def findPacker(self, name, OnMemory = True):

234 """ 235 Find possible Packer/Cryptors/etc on a Module 236 237 @type name: STRING 238 @param name: Module name 239 240 @type OnMemory: (Optional, Def: True) BOOLEAN 241 @param OnMemory: Whether to look in memory or on a file. 242 243 @rtype: LIST of TUPLES in the form of (DWORD, LIST OF STRING) 244 @return: A list of the Packer founded (Offset, List of Packer found in that address) 245 """ 246 if OnMemory: 247 mem = self.getMemoryPagebyOwner(name) 248 if not mem: 249 raise Exception, "Coudln't find a Memory Page belonging to %s" % name 250 data = "" 251 for a in mem: 252 data+= a.getMemory() 253 else: 254 mod = self.getModule( name ) 255 if not mod: 256 raise Exception, "Coudln't find the correct Module belonging to %s" % name 257 data = mod.getPath() 258 259 import pefile 260 import peutils 261 if OnMemory: 262 pe = pefile.PE( data = data ) 263 else: 264 pe = pefile.PE( name = data ) 265 266 sig_db = peutils.SignatureDatabase('Data/UserDB.TXT') 267 return sig_db.match( pe )

268

269 - def forgetKnowledge(self,id):

270 """ 271 Remove python object from knowledge database. 272 273 @type id: STRING 274 @param id: unique name tag of the object 275 """ 276 return debugger.ForgetKnowledge(id)

277

278 - def cleanKnowledge(self):

279 """ Clean ID memory from known objects 280 """ 281 for ke in self.listKnowledge(): 282 self.forgetKnowledge(ke)

283 284

285 - def addGenHook(self,object):

286 """ 287 Add a hook to Immunity Debugger 288 """ 289 290 import pickle 291 try: 292 rtype=object.type 293 except: 294 rtype=0 295 try: 296 label=object.label 297 except: 298 label="No Label specified for this hook" 299 pickled_object=pickle.dumps(object) 300 debugger.Addhook(pickled_object,label,rtype)

301 302

303 - def cleanHooks(self):

304 """ 305 Clean ID memory from hook objects 306 """ 307 for hk in self.listHooks(): 308 debugger.Removehook(hk)

309 310 311

312 - def cleanUP(self):

313 """ 314 Clean ID memory for every kind of object saved in it 315 """ 316 self.cleanHooks() 317 self.cleanKnowledge()

318 319

320 - def getPEBaddress(self):

321 """ 322 Gets PEB. 323 @rtype: DWORD 324 @return: PEB address 325 """ 326 return debugger.GetPEB()

327 328 329 330 ### Disassembling / Analyzing Functions / etc ### 331

332 - def analyseCode(self,address):

333 """ 334 Analyse module's code 335 336 @type Address: DWORD 337 @param Address: Address from module to be analysed 338 """ 339 debugger.Analysecode(address)

340

341 - def isAnalysed(self,address):

342 """ 343 Check if module is already analysed 344 345 @type Address: DWORD 346 @param Address: Address from module 347 348 @rtype: DWORD 349 @return: 1 if module already analysed 350 """ 351 ret = debugger.IsAnalysed(address) 352 353 if ret == -1: 354 return 0 355 else: 356 return ret

357

358 - def setVariable(self,address,string):

359 """ 360 Set Variable name to specified address. 361 362 @type Address: DWORD 363 @param Address: Address from assembly line 364 365 @type String: STRING 366 @param String: Variable name to be set 367 368 """ 369 return debugger.SetVariable(address,string)

370

371 - def getVariable(self,address):

372 """ 373 Get Variable name from specified address 374 375 @type Address: DWORD 376 @param Address: Address from assembly line 377 378 @rtype: STRING 379 @return: Variable name for given address. 380 381 """ 382 return debugger.GetVariable(address)

383 384 385 # Disasm tooks 0.00008130 usec/pass

386 - def Disasm(self, address, mode = DISASM_ALL):

387 """ 388 Disasm address 389 390 @type Address: DWORD 391 @param Address: Address to disasm 392 393 @type Mode: (Optional, Def: DISASM_ALL) 394 @param Mode: Disasm mode 395 396 @rtype: opCode Object (Check libanalyze.py) 397 @return: Disassmbled Opcode 398 """ 399 400 op= opCode( self, address ) 401 op._getfromtuple( debugger.Disasm( address, mode) ) 402 return op

403 404 # Disasm tooks 0.00008130 usec/pass 405

406 - def disasm(self, address, mode = DISASM_ALL):

407 return self.Disasm(address, mode)

408 409 410 # DisasmSize 0.00007515 usec/pass

411 - def disasmSizeOnly(self, address):

412 """ 413 Determine command size only 414 415 @type Address: DWORD 416 @param Address: Address to disasm 417 418 @rtype: opCode Object (Check libanalyze.py) 419 @return: Disassmbled Opcode 420 """

Source Code for Module Libs.immlib