[WinAppDbg-users] Using WinAppDbg to run Python code in target process

[Fabio Z. <fa...@gm...>]

Hi All,

I just recently came upon WinAppDbg and I think it's a really nice tool.

I'm the PyDev author (http://pydev.org/) and I was thinking about using it
to execute attach the PyDev debugger to a running process.

The idea would be running something as:

import sys
sys.path.append(r'path/to/pysrc')
import pydevd
pydevd.settrace()

So, in order to do that I'd do something as:

PyGILState_Ensure()
PyRun_SimpleString("python code")
PyGILState_Release()

So, I was wondering how that'd be done using WinAppDbg...

I did try to design some Python code using WinAppDbg (which is below),
which actually runs some code in the console (just a print for now) in the
target process, but crashes right afterwards -- I'm really not well versed
on shellcode, and it was mostly based on the inject_dll from the Process,
so, I was wondering if this is really the best way and if so, if someone
can help me do that properly...

Thanks,

Fabio

---------------------------------------- test code -------------------------
from winappdbg import Process, HexDump, win32
import struct

def run_python_code(pid):
    process = Process(pid)

    # Lookup it's modules.
    process.scan_modules()

    p_gil_start = process.resolve_label('PyGILState_Ensure')
    p_run = process.resolve_label('PyRun_SimpleString')
    p_gil_end = process.resolve_label('PyGILState_Release')

    python_code = 'print "m2"'

    code = ''

    # Shellcode follows...

    # mov eax, PyGILState_Ensure
    code += '\xb8' + struct.pack('<L', p_gil_start)

    # call eax
    code += '\xff\xd0'

    # push python code
    code += '\xe8' + struct.pack('<L', len(python_code) + 1) + python_code
+ '\0'

    # mov eax, PyRun_SimpleString
    code += '\xb8' + struct.pack('<L', p_run)

    # call eax
    code += '\xff\xd0'

    # mov eax, PyGILState_Release
    code += '\xb8' + struct.pack('<L', p_gil_end)

    # call eax
    code += '\xff\xd0'


    process.inject_code(code, 0);