当前位置：网站首页>Lyscript plug-in command return encapsulation

Lyscript plug-in command return encapsulation

2022-07-23 20:28:00 【51CTO】

LyScript The automation plug-in adds the encapsulation of command line return parameters , because x64dbg The command execution function provided in the development document cannot realize parameter return , Lead to LyScript The plug-in cannot get the return parameters after the execution of the built-in command , So I thought for a while , Found the solution .

LyScript The plugin documentation ： https://github.com/lyshark/LyScript

In fact, we can transfer through a register , For example, stack a register before using it , And put the execution result of the built-in script into the register , Finally using get_register Function can directly get the parameters in the register , Enter the following writing method .

from LyScript32 import MyDebug

dbg = MyDebug()
conn = dbg.connect()

#  First define a script variable 
ref = dbg.run_command_exec("$addr=1024")

#  Put the script return value into eax register , Or open up a pile into the pile 
dbg.run_command_exec("eax=$addr")

#  Finally, get the value of the register 
hex(dbg.get_register("eax"))

     1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.

Then package it into GetScriptValue() function , Just pass in a built-in command, such as teb() Just a string .

from LyScript32 import MyDebug

#  Get the script return value 
def GetScriptValue(dbg,script):
    try:
        ref = dbg.run_command_exec("push eax")
        if ref != True:
            return None
        ref = dbg.run_command_exec(f"eax={script}")
        if ref != True:
            return None
        reg = dbg.get_register("eax")
        ref = dbg.run_command_exec("pop eax")
        if ref != True:
            return None
        return reg
    except Exception:
        return None
    return None

if __name__ == "__main__":
    dbg = MyDebug()
    dbg.connect()

    ref = GetScriptValue(dbg,"teb()")
    print(hex(ref))

    ref = GetScriptValue(dbg,"peb()")
    print(hex(ref))

    eax = dbg.get_register("eax")
    kbase = GetScriptValue(dbg,f"mod.base({eax})")
    print(" Module and address : {}".format(hex(kbase)))

    dbg.close()

     1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.