Ejemplo n.º 1
0
    def test_vdb_stalker(self):
        plat = self.trace.getMeta('Platform')
        symname = breakpoints.get(plat)
        entry = self.trace.parseExpression(symname)
        v_stalker.addStalkerEntry(self.trace, entry)

        self.runUntilExit()
        self.assertTrue(v_stalker.getStalkerHits(self.trace) > 2)
Ejemplo n.º 2
0
    def test_vdb_stalker(self):
        plat = self.trace.getMeta('Platform')
        symname = breakpoints.get(plat)
        entry = self.trace.parseExpression(symname)
        v_stalker.addStalkerEntry(self.trace, entry)

        self.runUntilExit()
        self.assertTrue(len(v_stalker.getStalkerHits(self.trace)) > 2)
Ejemplo n.º 3
0
def load_binary(filepath, base=None):

    # Get the current trace object from vtrace
    trace = vtrace.getTrace()
    trace.setMode("FastBreak", True)

    # If attempting to attach to a 64 bit process
    # 64 bit python is required.
    trace.execute(filepath)

    # Call a function to set BP on OEP
    oep = v_api.getOEP(trace, filepath)
    print "OEP: %x" % oep

    #######################################################################
    # Add a breakpoint on CreateProcessA
    # Run until the breakpoint
    pattern = "kernel32.CreateProcessA"
    v_api.setBpOnPattern(trace, pattern)
    trace.run()
    trace = v_api.followCreateProcessA(trace)
    ##########################################################
    # Stalker
    #addr is here since child process doens't start at oep
    addr = 0x004015ac

    try:
        v_stalker.addStalkerEntry(trace, addr)
    except:
        pass
    print('Added 0x%.8x to Stalker list' % addr)
    ######################################################################
    ## Beyond this point the debugger is attached to the child process
    ##
    trace.setMode("FastBreak", True)
    while trace.isAttached():
        trace.run()

    f = file("zTest.stalk", "wb")

    # Prints out the current stalker hits
    # Not currently working....
    #print('Current Stalker Hits:')
    for hitva in v_stalker.getStalkerHits(trace):
        print('\t 0x%.8x' % hitva)
        f.write('\t 0x%.8x\n' % hitva)
    f.close()
Ejemplo n.º 4
0
    def run(self):
        trace = vtrace.getTrace()
        trace.execute("c:\\nc.exe -l -p 4040")
        trace.setMode("RunForever", True)
        notif = libnotify()
        trace.registerNotifier(vtrace.NOTIFY_LOAD_LIBRARY, notif)
        stalker.addStalkerEntry(trace, 0x00403047)
        while trace.isAttached():
            trace.run()

        hits = stalker.getStalkerHits(trace)

        for hit in hits:
            print "+ hit: %08x" % hit

        data = pickle.dumps(hits)
        self.sendResults(data)
Ejemplo n.º 5
0
    def executeTrace(self, cmdline, startVA):
        import vtrace
        import vdb.stalker as stalker
        print "[*] executeTrace: %s %s" % (cmdline, startVA)
        self.trace = vtrace.getTrace()
        self.trace.execute(cmdline)
        self.trace.setMode("RunForever", True)
#        stalker.addStalkerEntry(self.trace, 0x00403047)
        stalker.addStalkerEntry(self.trace, int(startVA, 16))

        while self.trace.isAttached():
            self.trace.run()

        hits = stalker.getStalkerHits(self.trace)

        for hit in hits:
            print "[*] hit: %08x" % hit

        data = pickle.dumps(hits)
        self.sendResults(data)
Ejemplo n.º 6
0
def load_binary(filepath, base=None):
    
    # Get the current trace object from vtrace
    trace = vtrace.getTrace()
    trace.setMode("FastBreak", True)

    # If attempting to attach to a 64 bit process
    # 64 bit python is required.
    trace.execute(filepath)

    # Call a function to set BP on OEP
    oep = v_api.getOEP(trace, filepath)
    print "OEP: %x" % oep
##########################################################
    # Stalker
    #addr is here since child process doens't start at oep
    addr = oep

    try:
        v_stalker.addStalkerEntry(trace, addr)
    except:
        pass
    print('Added 0x%.8x to Stalker list' % addr)
######################################################################
## Beyond this point the debugger is attached to the child process
##
    trace.setMode("FastBreak", True)
    while trace.isAttached():
        trace.run()
    
    f = file("zTest.stalk", "wb")

    # Prints out the current stalker hits
    # Not currently working.... 
    #print('Current Stalker Hits:')
    for hitva in v_stalker.getStalkerHits(trace):
        print('\t 0x%.8x' % hitva)
        f.write('\t 0x%.8x\n' % hitva)
    f.close()