Script help

[BedolagaEvgen]

Hello! I need to implement a memory search from a script similar to this: , the result of which is this:

I found several functions that should help me with this:

• DbgMemMap;
• FindMem or Find.

Using:

import x64dbgpy.pluginsdk._scriptapi.pattern as Pattern
import x64dbgpy.pluginsdk.x64dbg as X64
"""===================================================================="""
X64.GuiLogClear ()
"""===================================================================="""
mm = X64.MEMMAP ()
temp = X64.DbgMemMap (mm)
print (temp)
print (mm.count)
"""===================================================================="""
start = int ("03A10000", 16)
print (start)
print (hex (start))
res = Pattern.FindMem (start, 5, "GET /")
print (hex (res))
res = Pattern.Find ("GET /", 5)
print (res)

I get the following:

Question:

1. How should I use FindMem or Find to get the result?
2. How to go from MEMMAP to each MEMPAGE and get its start address and size block?

Or should my problem be solved in another way?

[BedolagaEvgen]

I understood the first part of the question: Pattern.FindMem (start, SizeMemPage, "47 45 54 20 2F") The second part of the question remains open.

[mrexodia]

You can use a loop, something like (pseudocode):

while True:
    found = Pattern.FindMem(start, SizeMemPage, "47 45 ...")
    if found == 0:
        break
    print(found)
    start = found + 1

[BedolagaEvgen]

This is a no brainer. Thus, I can’t go through the entire MEMMAP, but only one MEMPAGE - the start address and size I must enter manually. I need to search for a string in ALL MEMORY.

[mrexodia]

You can use DbgCmdExecDirect("findmemall ...") (see https://help.x64dbg.com/en/latest/commands/searching/findallmem.html). Then you can use DbgEval and the reference expression functions: https://help.x64dbg.com/en/latest/introduction/Expression-functions.html#references. If I have some time I will see if it's possible to update the python bindings, but you should be able to do this yourself.

[mrexodia]

For more information about how to implement these kind of features yourself, check the following commits. It's very easy to add new methods/properties/etc to this API, but I'm not using x64dbgpy myself so I don't know what is needed.

• https://github.com/x64dbg/x64dbgpy/commit/48f50365722283fa9d7bcb32896696519152e72e
• https://github.com/x64dbg/x64dbgpy/commit/73fe5c110a07fdb10eb26a270f336cd20400788a

Usage:

import scriptapi
print(help(scriptapi))

If you don't understand something, check scriptapi.cpp and feel free to open pull requests if you have improvements!

[BedolagaEvgen]

You do not want to hear my question, unfortunately.

According to your texts:

You can use DbgCmdExecDirect ("findmemall ...")

Using this is not possible:

• I have no way to get the result of the called command, but only the fact of its execution; moreover, this is just a check for the presence of the desired string;
• repeated call of findmemall burden the debugger very much, and each call takes longer.

I tried:

DisableLog
var AddrStop
mov AddrStop, 0x6D7853E4

start:
findallmem (0x10000, "47 45 54 20 2F")
cmp $ result, 0
jne positiv_result
esto
esto
esto
esto
esto
esto
esto
esto
esto
esto
cmp EIP, AddrStop
je negativ_result
jmp start

positiv_result:
msg "data found"
Enablelog
ret

negativ_result:
msg "not found data"
Enablelog
ret

and at the end of the night, using findallmem took 20 seconds

Then you can use DbgEval and the reference expression functions:

If I had to search only in the code section, I would not have a question.

 I wanted too much from PythonScript. I am sure that in the ScriptDLL I will not have a similar question. Thank you for your time.

[mrexodia]

I am quite baffled. First you act very rude. Then I give you two full solutions to your problem and you don’t even bother reading.

The expression ref.addr(0) will give the first result of findmemall, ref.addr(1) the second. Just read the fucking manual.

Additionally I implemented everything in python and you just fully ignore this. I read the topic on exelab and I thought I might have jumped to the conclusion to quickly that you are a rude cunt who doesn’t take time to read an answer or figure out something, but I see I shouldn’t have bothered giving free support and just leave the question closed.

[BedolagaEvgen]

Dear, if your parents mocked you, this is not a reason to insult me.

• You suggested ways to bypass unrealized functionality (due to your reluctance or features of Python), which, even if it works, will do it badly.
• Regarding the "Expression Functions - References" I understood you, but, I repeat, the repeated call to "findmemall" is incorrect.
• It was not only I who came to the conclusion about the unrealization, but also a significant number of advanced programmers. Good luck!

[mrexodia]

So Ctrl+B in the memory map doesn’t work? This is using findmemall.

In the last day (eg after you collectively agreed the features don’t exist) I implemented everything in python. Did you try this?

Just read the comments again, your answer is already here, in two different working approaches. I tested it myself.

On Wed, 4 Sep 2019 at 10:46, BedolagaEvgen notifications@github.com wrote:

Dear, if your parents mocked you, this is not a reason to insult me.

• You suggested ways to bypass unrealized functionality (due to your reluctance or features of Python), which, even if it works, will do it badly.
• Regarding the "Expression Functions - References" I understood you, but, I repeat, the repeated call to "findmemall" is incorrect.
• It was not only I who came to the conclusion about the unrealization, but also a significant number of advanced programmers. Good luck!

— You are receiving this because you modified the open/close state.

Reply to this email directly, view it on GitHub https://github.com/x64dbg/x64dbgpy/issues/38?email_source=notifications&email_token=AASYFGKV637XDBGYPUSOX33QH5YWPA5CNFSM4IPIK2J2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD522ZBQ#issuecomment-527805574, or mute the thread https://github.com/notifications/unsubscribe-auth/AASYFGMWIY4556MF4VH4MR3QH5YWPANCNFSM4IPIK2JQ .

[BedolagaEvgen]

Closed

[Ahmadmansoor]

Did you check AdvancedScript plugin, it will solve ur problems. :)

[BedolagaEvgen]

@Ahmadmansoor Faced with the need to expand the functionality of the usual (built-in) scripting engine, I considered your product as an option. Writing ScriptDLL solves my problem completely. Thank you for reminding yourself! ;)

[BedolagaEvgen]

Thanks for fixing pluginsdk. Hopefully no one else will be fooled.