Re: [WinAppDbg-users] Using WinAppDbg to run Python code in target process

[Fabio Z. <fa...@gm...>]

Hi Mario,

I think I found an issue there: PyGILState_Ensure() actually returns an int
which has to be passed to PyGILState_Release() later on. Still, I don't
really know how to do this in shellcode... Do you have any pointers on how
to do that?

Thanks,

Fabio


On Tue, Feb 4, 2014 at 5:48 PM, Fabio Zadrozny <fa...@gm...> wrote:

> Hi Mario,
>
> I tried that, but it still didn't work properly (it's still crashing
> afterwards).
>
> Just for completeness, I'm attaching the sources for what I'm testing in
> the e-mail (Python 2.7).
>
> Also, is there any way of doing this without writing shell code? (I'd like
> it to be compatible with a 64 bit process too).
>
> Thanks for taking a look at that :)
>
> --
> Fabio
>
>
> On Tue, Feb 4, 2014 at 5:25 PM, Mario Vilas <mv...@gm...> wrote:
>
>> Hi!
>>
>> I haven't looked at it into detail, but I'd say the problem is the
>> shellcode simply doesn't return - so after the last "call eax" instruction
>> is executed, it just start running whatever happens to be in memory
>> afterwards.
>>
>> So try adding a ret instruction at the end (\xc3 if I recall correctly)
>> and see if that works. If not, let me know and I'll take a deeper look. :)
>>
>> Cheers!
>> -Mario
>>
>>
>> On Tue, Feb 4, 2014 at 7:43 PM, Fabio Zadrozny <fa...@gm...> wrote:
>>
>>> Hi All,
>>>
>>> I just recently came upon WinAppDbg and I think it's a really nice tool.
>>>
>>> I'm the PyDev author (http://pydev.org/) and I was thinking about using
>>> it to execute attach the PyDev debugger to a running process.
>>>
>>> The idea would be running something as:
>>>
>>> import sys
>>> sys.path.append(r'path/to/pysrc')
>>> import pydevd
>>> pydevd.settrace()
>>>
>>>  So, in order to do that I'd do something as:
>>>
>>> PyGILState_Ensure()
>>> PyRun_SimpleString("python code")
>>> PyGILState_Release()
>>>
>>> So, I was wondering how that'd be done using WinAppDbg...
>>>
>>> I did try to design some Python code using WinAppDbg (which is below),
>>> which actually runs some code in the console (just a print for now) in the
>>> target process, but crashes right afterwards -- I'm really not well versed
>>> on shellcode, and it was mostly based on the inject_dll from the Process,
>>> so, I was wondering if this is really the best way and if so, if someone
>>> can help me do that properly...
>>>
>>> Thanks,
>>>
>>> Fabio
>>>
>>> ---------------------------------------- test code
>>> -------------------------
>>> from winappdbg import Process, HexDump, win32
>>> import struct
>>>
>>> def run_python_code(pid):
>>>     process = Process(pid)
>>>
>>>     # Lookup it's modules.
>>>     process.scan_modules()
>>>
>>>      p_gil_start = process.resolve_label('PyGILState_Ensure')
>>>     p_run = process.resolve_label('PyRun_SimpleString')
>>>     p_gil_end = process.resolve_label('PyGILState_Release')
>>>
>>>     python_code = 'print "m2"'
>>>
>>>     code = ''
>>>
>>>     # Shellcode follows...
>>>
>>>     # mov eax, PyGILState_Ensure
>>>     code += '\xb8' + struct.pack('<L', p_gil_start)
>>>
>>>     # call eax
>>>     code += '\xff\xd0'
>>>
>>>     # push python code
>>>     code += '\xe8' + struct.pack('<L', len(python_code) + 1) +
>>> python_code + '\0'
>>>
>>>     # mov eax, PyRun_SimpleString
>>>     code += '\xb8' + struct.pack('<L', p_run)
>>>
>>>     # call eax
>>>     code += '\xff\xd0'
>>>
>>>     # mov eax, PyGILState_Release
>>>     code += '\xb8' + struct.pack('<L', p_gil_end)
>>>
>>>     # call eax
>>>     code += '\xff\xd0'
>>>
>>>
>>>     process.inject_code(code, 0);
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Managing the Performance of Cloud-Based Applications
>>> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
>>> Read the Whitepaper.
>>>
>>> http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> WinAppDbg-users mailing list
>>> Win...@li...
>>> https://lists.sourceforge.net/lists/listinfo/winappdbg-users
>>>
>>>
>>
>>
>> --
>> "There's a reason we separate military and the police: one fights
>> the enemy of the state, the other serves and protects the people. When
>> the military becomes both, then the enemies of the state tend to become the
>> people."
>>
>>
>> ------------------------------------------------------------------------------
>> Managing the Performance of Cloud-Based Applications
>> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
>> Read the Whitepaper.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk
>> _______________________________________________
>> WinAppDbg-users mailing list
>> Win...@li...
>> https://lists.sourceforge.net/lists/listinfo/winappdbg-users
>>
>>
>