Open ngo opened 5 years ago
Feel free to open a PR! This project isn’t really being maintained anymore.
Great, thanks for quick reply and merge.
No worries. Tell me if you’re interested in maintaining this project (for a time).
On Mon, 29 Jul 2019 at 13:32, ngo notifications@github.com wrote:
Great, thanks for quick reply and merge.
— You are receiving this because you commented.
Reply to this email directly, view it on GitHub https://github.com/x64dbg/x64dbgpylib/issues/12?email_source=notifications&email_token=AASYFGIZXFNVDNYZK2CO64TQB3IMPA5CNFSM4IHRIA22YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3ANQNA#issuecomment-515954740, or mute the thread https://github.com/notifications/unsubscribe-auth/AASYFGPAN7NOTOH5PLHIOPDQB3IMPANCNFSM4IHRIA2Q .
I'm not proficient enough in binary exploitation and RE to maintain a project like this, but I might be able to help with some python-related issues. Feel free to ping me if such issues arise.
When trying to use mona's find feature I get the following error:
mona.mona("find -s '\xff\xe4' -m binary.exe") =>
The exception happens because of an error on parsing the PEB in x64dbgpylib. In getDebuggedName, x64dbgpylib uses getPEBInfo().ProcessParameters from pykd, which returns an object of type
typePtr
(a pointer to a struct RTL_USER_PROCESS_PARAMETERS). It then needs to dereference the pointer and get theImagePathName
member. So the code uses the__add__
operation of typePtr, which resolves to__add__
of typeBase, which uses the address of the typePtr itsel, instead of using the address of the struct that it points to. So, python codeProcessParameters + offset
results inPEB->process_parameters + offset
, but we need*(PEB->process_parameters) + offset
.Demonstration (x32 app):
__add__
(as you can see this is peb + 0x48, which is not what we want)In order to have the correct pointer we have to cast ProcessParameters to int, because it will cause the
__int__
method of class typePrimitive to be used (which dereferences the pointer). Verification:So, the line
shold be changed as follows:
After this fix mona's find command starts to work for me.
https://github.com/x64dbg/x64dbgpylib/blob/d3b67021880f924860437098b05c3d879aae1a2f/x64dbgpylib.py#L900