python - GetProcAddress 返回值

Question

我正在学习如何在 Windows 7 上使用 ctypes 在 python 中创建一个简单的调试器。我的问题是下面给出的代码似乎返回了一个无效地址(这是我对问题的猜测)，但我可以弄清楚为什么。我想这可能是因为返回的句柄在我的代码使用它时不再有效，或者我返回的句柄与我的脚本无关，因为我只是提供“msvcrt.dll”作为模块。我已经做了很多修补，但还没有找到解决方案。

编辑: 地址返回为 False。我从下面的代码片段中收到以下错误:

错误 126:找不到指定的模块。

def func_resolve(self, dll, function):
    error = None

    handle = kernel32.GetModuleHandleA(dll)
    if handle == False:
        print "Handle is FALSE"
        error = GetLastError()

    address = kernel32.GetProcAddress(handle, function)
    if address == False:
        print "Address is FALSE"
        error = GetLastError()

    if error is not None:
        print "ERROR %d : %s" % (error, FormatError(error))
        return False

    kernel32.CloseHandle(handle)

    return address

上面的代码是从这个简短的测试脚本中调用的:

import my_debugger

debugger = my_debugger.debugger()

pid = raw_input("Input PID of process to attach to: ")
debugger.attach(int(pid))

printf_address = debugger.func_resolve("msvcrt.dll", "printf")
print "[*] Address of printf: 0x%08x" % printf_address
debugger.bp_set(printf_address)

debugger.run()
debugger.detach()

这是我附加到其进程的脚本:

from ctypes import *
import time

msvcrt = cdll.msvcrt
counter = 0

while True:
    msvcrt.printf("Loop iteration %d /n", counter)
    time.sleep(2)
    counter += 1

所以我运行上面的脚本，在任务管理器中找到 PID，然后运行我的测试脚本并给它 PID。我每次都会得到以下输出。永远不会到达 printf 处的用户定义断点，它的地址总是给出 0x00000000，这似乎不对。

Input PID of process to attach to: 8124
Process PID: 8124
[*] Address of printf: 0x00000000       
[*] Setting breakpoint at 0x00000000    
[*] Waiting for debug events...
[*] Event Code: 3       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 6       Thread ID: 7664
[*] Event Code: 2       Thread ID: 7124
[*] Event Code: 1       Thread ID: 7124
[*] Exception address: 0x76e00590
[*] Hit the first breakpoint
[*] Event Code: 4       Thread ID: 7124

谁能看出我做错了什么？如果需要，我可以提供所有代码。

Answer 1

我也一直在研究 GreyHat Python 这本书，并顽固地将 my_debugger.py 文件转换为支持 64 位调试。我找到了解决这个问题的方法。

将您的 func_resolve 设置为:

def func_resolve(self,dll,function):

    _GetModuleHandleA = kernel32.GetModuleHandleA
    _GetModuleHandleA.restype = POINTER(c_void_p)

    _GetProcAddress = kernel32.GetProcAddress
    _GetProcAddress.restype = c_void_p

    handle = _GetModuleHandleA(dll)
    if handle is None:
        print 'Error getting handle'

    address = _GetProcAddress(handle, function)
    if address is None:
        print 'Error getting address'

    kernel32.CloseHandle(handle)
    return address

这应该为该函数返回一个有效的 64 位地址。