[go: up one dir, main page]
Menu ▾ ▴

[r32]: / proc_info.py  Maximize  Restore  History

Download this file

66 lines (52 with data), 1.9 kB 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
#!/usr/bin/env python



import sys,struct

from memutil import virt2phys, PagedOutException



pdb_off = 0x18

peb_off = 0x1b0

image_base_off = 0x08



flink_off = 0x10

blink_off = 0x14



if len(sys.argv) < 3:

    from os.path import basename

    print "usage: %s <memdump> <_EPROCESS offset>" % basename(sys.argv[0])

    sys.exit(1)



memdump = open(sys.argv[1])

eproc_off = int(sys.argv[2],0)



memdump.seek(eproc_off + flink_off)

flink = struct.unpack('<L', memdump.read(4))[0]

blink = struct.unpack('<L', memdump.read(4))[0]



print "Flink: %08x, Blink: %08x" % (flink, blink)



memdump.seek(eproc_off + pdb_off)

pdba = struct.unpack('<L', memdump.read(4))[0]



print "Page directory at: %08x" % pdba



print "Flink real addr: %08x" % virt2phys(memdump, pdba, flink)



memdump.seek(eproc_off + peb_off)

peb_virt_addr = struct.unpack('<L', memdump.read(4))[0]

try:

    peb_phys_addr = virt2phys(memdump, pdba, peb_virt_addr)

except PagedOutException:

    print "FAIL (Process Environment Block paged out)"

    sys.exit(1)



memdump.seek(peb_phys_addr + image_base_off)

img_base_virt = struct.unpack('<L', memdump.read(4))[0]

try:

    img_base_phys = virt2phys(memdump, pdba, img_base_virt)

except PagedOutException:

    print "FAIL (ImageBase paged out)"

    sys.exit(1)



memdump.seek(img_base_phys)

from pefile import PE

try:

    pe = PE(data=memdump.read(4096))

    print pe.dump_info()

    #print "%-8s %-16s %-16s %-16s" % ("Name","Virtual Address",

    #       "Physical Address","Virtual Size")

    #for sect in pe.sections:

    #    try:

    #        sect_realaddr = hex(virt2phys(memdump, pdba, sect.VirtualAddress + img_base_virt))

    #    except PagedOutException:

    #        sect_realaddr = "[paged out]"

    #    print "%-8s %-16s %-16s %-16s" % (sect.Name, hex(sect.VirtualAddress), 

    #                                   sect_realaddr, hex(sect.Misc_VirtualSize))

except Exception, e:

    print e