Re: [WinAppDbg-users] Process Created Callback Bug

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi,

another (mildly related) issue I found is that module.get_filename()
usually seems to return the path to the corresponding dll when invoked
from the load_dll event.
However, for ntdll I only get the filename itself ("ntdll.dll"), but
never the full path to it (e.g. "C:\\windows\\system32\\ntdll.dll").

I can reproduce this issue on XP and Win7 64bit.

On 25.11.2014 18:02, Mario Vilas wrote:
> Ah, then it's my fault alright xD
> 
> I'll try to reproduce the bug, I'll send you a private email if I can't
> and need your input :)
> 
> Thanks!
> 
> On Tue, Nov 25, 2014 at 5:41 PM, Jan Newger <jan...@ne...
> <mailto:jan...@ne...>> wrote:
> 
>     Hey Mario,
> 
>     Yes, the same behaviour seems to trigger for load_dll events as well.
> 
>     If there's anything you want me to do / test in order to track down the
>     issue I'd be happy to help!
> 
>     Thanks!
>     Jan
> 
>     On 11/25/2014 05:31 PM, Mario Vilas wrote:
>     > Hi, sorry for the late reply, I've quite a backlog :(
>     >
>     > The error message seems to be coming from the Win32 API, so I'm not sure
>     > if it's a bug in winappdbg itself or just that some operations can't be
>     > performed while the process is still being initialized when the
>     > create_process event is triggered. Does the bug still occur with other
>     > events?
>     >
>     > On Fri, Nov 14, 2014 at 2:39 PM, Jan Newger <jan...@ne... <mailto:jan...@ne...>
>     > <mailto:jan...@ne... <mailto:jan...@ne...>>> wrote:
>     >
>     >     on top of that, the code also fails if i obtain the module
>     from the
>     >     event object itself, i.e.,:
>     >
>     >
>     >     def create_process(self, event):
>     >         main_module = event.get_module()
>     >         module_start = main_module.get_base()
>     >         module_end = main_module.get_base() + main_module.get_size()
>     >         print "Process started: [%X, %X)" % (main_module_start,
>     >     main_module_end)
>     >
>     >     Above code produces the same error.
>     >
>     >     On 11/14/2014 12:48 PM, Jan Newger wrote:
>     >      > Hi there,
>     >      >
>     >      > I'm using the latest version of WinAppDbg on Win7 32bit
>     with python
>     >      > 2.7.5 with the following simple script:
>     >      >
>     >      >
>     >      > === script start ===
>     >      >
>     >      > import sys
>     >      >
>     >      > from winappdbg import Debug
>     >      > from winappdbg import EventHandler
>     >      >
>     >      > class DebugEventHandler(EventHandler):
>     >      >
>     >      >    def create_process(self, event):
>     >      >      main_module = event.get_process().get_main_module()
>     >      >      main_module_start = main_module.get_base()
>     >      >      main_module_end = main_module.get_base() +
>     >     main_module.get_size()
>     >      >      print "Process started: [%X, %X)" % (main_module_start,
>     >      > main_module_end)
>     >      >
>     >      > def start_debugger(cmd_line):
>     >      >    with Debug(DebugEventHandler(), bKillOnExit=True) as debug:
>     >      >      debug.execv(cmd_line)
>     >      >      debug.loop()
>     >      >
>     >      > def main():
>     >      >    start_debugger(sys.argv[1:])
>     >      >
>     >      > === script end ===
>     >      >
>     >      >
>     >      > Invoking the script like this:
>     >      >
>     >      > python test.py C:\windows\system32\notepad.exe
>     >      >
>     >      > gives me an error saying:
>     >      >
>     >      > "C:\Python27\lib\site-packages\winappdbg\module.py:291:
>     >     RuntimeWarning:
>     >      > Cannot get size and entry point of module notepad, reason: The
>     >     handle is
>     >      > invalid"
>     >      >
>     >      >
>     >      > Btw, is there a publicly available issue tracker somewhere?
>     It seems
>     >      > none is listed on the sourceforge page.
>     >      >
>     >      > Thanks and best regards
>     >      > Jan
>     >
>     >
>     >   
>      ------------------------------------------------------------------------------
>     >     Comprehensive Server Monitoring with Site24x7.
>     >     Monitor 10 servers for $9/Month.
>     >     Get alerted through email, SMS, voice calls or mobile push
>     >     notifications.
>     >     Take corrective actions from your mobile device.
>     >   
>      http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>     >     _______________________________________________
>     >     WinAppDbg-users mailing list
>     >     Win...@li...
>     <mailto:Win...@li...>
>     >     <mailto:Win...@li...
>     <mailto:Win...@li...>>
>     >     https://lists.sourceforge.net/lists/listinfo/winappdbg-users
>     >
>     >
>     >
>     >
>     > --
>     > “There's a reason we separate military and the police: one fights
>     > the enemy of the state, the other serves and protects the people. When
>     > the military becomes both, then the enemies of the state tend to
>     > become the people.”
>     >
>     >
>     >
>     ------------------------------------------------------------------------------
>     > Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>     > from Actuate! Instantly Supercharge Your Business Reports and
>     Dashboards
>     > with Interactivity, Sharing, Native Excel Exports, App Integration
>     & more
>     > Get technology previously reserved for billion-dollar
>     corporations, FREE
>     >
>     http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>     >
>     >
>     >
>     > _______________________________________________
>     > WinAppDbg-users mailing list
>     > Win...@li...
>     <mailto:Win...@li...>
>     > https://lists.sourceforge.net/lists/listinfo/winappdbg-users
>     >
> 
> 
>     ------------------------------------------------------------------------------
>     Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>     from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>     with Interactivity, Sharing, Native Excel Exports, App Integration &
>     more
>     Get technology previously reserved for billion-dollar corporations, FREE
>     http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>     _______________________________________________
>     WinAppDbg-users mailing list
>     Win...@li...
>     <mailto:Win...@li...>
>     https://lists.sourceforge.net/lists/listinfo/winappdbg-users
> 
> 
> 
> 
> -- 
> “There's a reason we separate military and the police: one fights
> the enemy of the state, the other serves and protects the people. When
> the military becomes both, then the enemies of the state tend to
> become the people.”
> 
> 
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> 
> 
> 
> _______________________________________________
> WinAppDbg-users mailing list
> Win...@li...
> https://lists.sourceforge.net/lists/listinfo/winappdbg-users
> 