PyDbg 접근 위반 핸들

권한이 없는 메모리에 접근하려고할 때 Access violation 발생

디버깅 대상 프로세스에서 접근 위반이 발생하면 디버거가 그것을 처리해야 한다.

예외가 발생했을 때 디버거는 스택프레임, 레지스터, 예외를 발생시킨 명령 등의 정보를 추적할 수 있다.

이런 정보를 기반으로 취약점 공격코드를 작성하거나 바이너리 패치를 만들어낼 수 있다.

bof

from ctypes import *
 
msvcrt = cdll.msvcrt
 
raw_input("Debugger is Running??")
 
buffer = c_char_p("AAAAA")
 
overflow = "A" * 100
 
msvcrt.strcpy(buffer, overflow)
 
 

accessv_handler

from pydbg import *
from pydbg.defines import *
 
import utils
 
def check_accessv(dbg):
 
    if dbg.dbg.u.Exception.dwFirstChance:
        return DBG_EXCEPTION_NOT_HANDLED
 
    crash_bin = utils.crash_binning.crash_binning()
    crash_bin.record_crash(dbg)
    print crash_bin.crash_synopsis()
 
    dbg.terminate_process()
 
    return DBG_EXCEPTION_NOT_HANDLED
 
pid = raw_input("Enter the process id: ")
 
dbg = pydbg()
dbg.attach(int(pid))
dbg.set_callback(EXCEPTION_ACCESS_VIOLATION, check_accessv)
dbg.run()

결과

Enter the process id: 10416
0x6b4fa2ba test dword [eax+0x54],0x4000 from thread 14244 caused access violation
when attempting to read from 0x41414195
 
CONTEXT DUMP
  EIP: 6b4fa2ba test dword [eax+0x54],0x4000
  EAX: 41414141 (1094795585) -> N/A
  EBX: 0382e150 (  58909008) -> Lpkl7Vk-9@w6X8x, ? Lpk7VkL{O )8]) (heap)
  ECX: 00fefbe8 (  16710632) -> w6OkPOkH+q,t1q,9,<YkhI3,TYkqkYkhY4Yk_a:)Yk0ski4YkxokH4_kt1q.q&Pkx3U/H/H (stack)
  EDX: 033677b0 (  53901232) -> w6pUww6 (heap)
  EDI: 6b4fa2b0 (1800381104) -> N/A
  ESI: 038112c0 (  58790592) -> >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAA (heap)
  EBP: 00fefbc4 (  16710596) -> >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAA (heap)
  ESP: 00fefbc0 (  16710592) -> m_Vkqkqk@w6OkPOkH+q,t1q,9,<YkhI3,TYkqkYkhY4Yk_a:)Yk0ski4YkxokH4_kt1q (stack)
  +00: 00000000 (         0) -> N/A
  +04: 00fefbec (  16710636) -> OkPOkH+q,t1q,9,<YkhI3,TYkqkYkhY4Yk_a:)Yk0ski4YkxokH4_kt1q.q&Pkx3U/H/H (stack)
  +08: 6b565f6d (1800822637) -> N/A
  +0c: 038112c0 (  58790592) -> >AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@AAAAAAAAAAAAAAAAAAAAAAA (heap)
  +10: 00000000 (         0) -> N/A
  +14: 6b71f5a8 (1802630568) -> @Denable() -> NoneEnable automatic garbage collection.isenabled() -> statusReturns true if automatic garbage collection is enabled.collect([generation]) -> nWith no arguments, run a full collection.  The optional argu (python27.dll.data)
 
disasm around:
    0x6b4fa2b0 push ebp
    0x6b4fa2b1 mov ebp,esp
    0x6b4fa2b3 push esi
    0x6b4fa2b4 mov esi,[ebp+0x8]
    0x6b4fa2b7 mov eax,[esi+0x4]
    0x6b4fa2ba test dword [eax+0x54],0x4000
    0x6b4fa2c1 jz 0x6b4fa2e2
    0x6b4fa2c3 mov eax,[eax+0xa4]
    0x6b4fa2c9 test eax,eax
    0x6b4fa2cb jz 0x6b4fa2d7
    0x6b4fa2cd push esi
 
stack unwind:
    6b565f6d
    6b4fabe5
    6b5fd81c
    1c551180
    747a8744
    777e587d
    777e584d
 
SEH unwind:
    00fefdc4 -> 1c551775: mov edi,edi
    00fefddc -> 777fa000: mov edi,edi
    ffffffff -> 77806321: nop
 
 
 
***Repl Closed***