-
-
[原创]windbg调试扩展读取pe信息
-
发表于: 2012-11-5 19:38 10149
-
最近两天在学习pe结构相关的问题, 所以写了这个扩展
到目前为止,没有什么和技术相关的东西,仅仅是把pe头部分给抓取出来了
更多的时间花在了格式化输出结果上,开始不对齐的输出结果看起来是在让人恼火。。。
关于windbg调试扩展,通过在你的dll里面暴漏出如下三个接口,就可以和调试器进行互动了
DebugExtensionInitialize
DebugExtensionUninitialize
KnownStructOutput
还有其他方式的实现方式,不过通过这三个函数的方式比较全面
上面三个是规定必须有的,然后可以添加你自己的接口来实现具体功能,节本上是通过ReadVirtual读取响应的debugee里面的内存,然后分析,显示结果,或者将计算后的数据写回debugee的内存
目前为止,下面dll里面只暴露出一个接口dumphdr,
后面跟一个字符串参数指定要dump的模块名称
0:000>.load peexts.dll
0:000>!peexts.dumphdr ntdll
将输出如下结果:
该扩展还不完善,有些饿地方需要修改,还有些接口自己想实现然后暴漏出来
到目前为止,没有什么和技术相关的东西,仅仅是把pe头部分给抓取出来了
更多的时间花在了格式化输出结果上,开始不对齐的输出结果看起来是在让人恼火。。。
关于windbg调试扩展,通过在你的dll里面暴漏出如下三个接口,就可以和调试器进行互动了
DebugExtensionInitialize
DebugExtensionUninitialize
KnownStructOutput
还有其他方式的实现方式,不过通过这三个函数的方式比较全面
上面三个是规定必须有的,然后可以添加你自己的接口来实现具体功能,节本上是通过ReadVirtual读取响应的debugee里面的内存,然后分析,显示结果,或者将计算后的数据写回debugee的内存
目前为止,下面dll里面只暴露出一个接口dumphdr,
后面跟一个字符串参数指定要dump的模块名称
0:000>.load peexts.dll
0:000>!peexts.dumphdr ntdll
将输出如下结果:
PE Header of component ntdll(7c900000) as:
Dos Header->
e_magic: MZ // Magic number
e_cblp: 0x0090 // Bytes on last page of file
e_cp: 0x0003 // Pages in file
e_crlc: 0x0000 // Relocations
e_cparhdr: 0x0004 // Size of header in paragraphs
e_minalloc: 0x0000 // Minimum extra paragraphs needed
e_maxalloc: 0xffff // Maximum extra paragraphs needed
e_ss: 0x0000 // Initial (relative) SS value
e_sp: 0x00b8 // Initial SP value
e_csum: 0x0000 // Checksum
e_ip: 0x0000 // Initial IP value
e_cs: 0x0000 // Initial (relative) CS value
e_lfarlc: 0x0040 // File address of relocation table
e_ovno: 0x0000 // Overlay number
e_res[4]: 0x0000000000000000 // Reserved words
e_oemid: 0x0000 // OEM identifier (for e_oeminfo)
e_oeminfo: 0x0000 // OEM information; e_oemid specific
e_res2[10]: 0x0000000000000000000000000000000000000000 // Reserved words
e_lfanew: 0x00d0 // File address of new exe header
Dos Stub->
0e 1f ba 0e 00 b4 09 cd ........
21 b8 01 4c cd 21 54 68 !..L.!Th
69 73 20 70 72 6f 67 72 is progr
61 6d 20 63 61 6e 6e 6f am canno
74 20 62 65 20 72 75 6e t be run
20 69 6e 20 44 4f 53 20 in DOS
6d 6f 64 65 2e 0d 0d 0a mode....
24 00 00 00 00 00 00 00 $.......
0d 52 c0 58 49 33 ae 0b .R.XI3..
49 33 ae 0b 49 33 ae 0b I3..I3..
8a 3c f2 0b 48 33 ae 0b .<..H3..
8a 3c f0 0b 48 33 ae 0b .<..H3..
8a 3c a1 0b 08 33 ae 0b .<...3..
8a 3c ce 0b 4a 33 ae 0b .<..J3..
8a 3c f1 0b 9a 33 ae 0b .<...3..
8a 3c f4 0b 48 33 ae 0b .<..H3..
52 69 63 68 49 33 ae 0b RichI3..
00 00 00 00 00 00 00 00 ........
NT Headers->
Signature: PE
//File Header
Machine: 0x014c
NumberOfSections: 0x0004
TimeDateStamp: 0x4d00f27d
PointerToSymbolTable: 0x00000000
NumberOfSymbols: 0x00000000
SizeOfOptionalHeader: 0x00e0
Characteristics: 0x210e(IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_LOCAL_SYMS_STRIPPED | IMAGE_FILE_DEBUG_STRIPPED | IMAGE_FILE_UP_SYSTEM_ONLY)
//Optional header
Magic: 0x010b
MajorLinkerVersion: 02x5
MinorLinkerVersion: 02x1
SizeOfCode: 0x0007d000
SizeOfInitializedData: 0x00033c00
SizeOfUninitializedData: 0x00000000
AddressOfEntryPoint: 0x000120f8
BaseOfCode: 0x00001000
BaseOfData: 0x00079000
ImageBase: 0x7c900000
SectionAlignment: 0x00001000
FileAlignment: 0x00000200
MajorOperatingSystemVersion: 0x0005
MinorOperatingSystemVersion: 0x0001
MajorImageVersion: 0x0004
MinorImageVersion: 0x000a
MajorSubsystemVersion: 0x0000
MinorSubsystemVersion: 0xb2000
Win32VersionValue: 0x00000400
SizeOfImage: 0x000afd30
SizeOfHeaders: 0x00e94360
CheckSum: 0x00e94360
Subsystem: 0x0003(IMAGE_SUBSYSTEM_WINDOWS_CUI)
DllCharacteristics: 0x0000((null))
SizeOfStackReserve: 0x00040000
SizeOfStackCommit: 0x00001000
SizeOfHeapReserve: 0x00100000
SizeOfHeapCommit: 0x00001000
LoaderFlags: 0x00000000
NumberOfRvaAndSizes: 0x00000010
DataDirectory[16]::
Export Directory->
VirtualAddress: 0x00003400
Size: 0x00009a5e
Import Directory->
VirtualAddress: 0x00000000
Size: 0x00000000
Resource Directory->
VirtualAddress: 0x00083000
Size: 0x0002be78
Exception Directory->
VirtualAddress: 0x00000000
Size: 0x00000000
Security Directory->
VirtualAddress: 0x00000000
Size: 0x00000000
Base Relocation Table->
VirtualAddress: 0x000af000
Size: 0x00002ee0
Debug Directory->
VirtualAddress: 0x0007de7c
Size: 0x00000038
Architecture Specific Data->
VirtualAddress: 0x00000000
Size: 0x00000000
RVA of GP->
VirtualAddress: 0x00000000
Size: 0x00000000
TLS Directory->
VirtualAddress: 0x00000000
Size: 0x00000000
Load Configuration Directory->
VirtualAddress: 0x000512a0
Size: 0x00000040
Bound Import Directory in headers->
VirtualAddress: 0x00000000
Size: 0x00000000
Import Address Table->
VirtualAddress: 0x00000000
Size: 0x00000000
Delay Load Import Descriptors->
VirtualAddress: 0x00000000
Size: 0x00000000
COM Runtime descriptor->
VirtualAddress: 0x00000000
Size: 0x00000000
(null)->
VirtualAddress: 0x00000000
Size: 0x00000000
Section headers->
Name: .text
PhysicalAddress/VirtualSize: 0x0007ceda
VirtualAddress: 0x00001000
SizeOfRawData: 0x0007d000
PointerToRawData: 0x00000000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x96e1b8
Characteristics: 0x60000020(IMAGE_SCN_CNT_CODE | (Unassigned Align Bytes) | IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ)
Name: .data
PhysicalAddress/VirtualSize: 0x00004a20
VirtualAddress: 0x0007e000
SizeOfRawData: 0x00003200
PointerToRawData: 0x00000000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x96e1b8
Characteristics: 0xc0000040(IMAGE_SCN_CNT_INITIALIZED_DATA | (Unassigned Align Bytes) | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE)
Name: .rsrc
PhysicalAddress/VirtualSize: 0x0002be78
VirtualAddress: 0x00083000
SizeOfRawData: 0x0002c000
PointerToRawData: 0x00000000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x96e1b8
Characteristics: 0x40000040(IMAGE_SCN_CNT_INITIALIZED_DATA | (Unassigned Align Bytes) | IMAGE_SCN_MEM_READ)
Name: .reloc
PhysicalAddress/VirtualSize: 0x00002ee0
VirtualAddress: 0x000af000
SizeOfRawData: 0x00003000
PointerToRawData: 0x00000000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x96e1b8
Characteristics: 0x42000040(IMAGE_SCN_CNT_INITIALIZED_DATA | (Unassigned Align Bytes) | IMAGE_SCN_MEM_DISCARDABLE | IMAGE_SCN_MEM_READ)
该扩展还不完善,有些饿地方需要修改,还有些接口自己想实现然后暴漏出来
赞赏
他的文章
看原图
赞赏
雪币:
留言: