[原创]ImmunityDebugger 观察程序udp发送及接收的数据 python脚本

本代码希望对一些想关注程序的网络行为的童鞋有所帮助，就是想看看发了什么数据，接收了什么数据，仅为参考。

   

#udp_sendto_recvfrom.py

import immlib

from libhook import *

import debugtypes

import struct

imm = immlib.Debugger()

code_base = 0x401000 # .code start address

code_end = 0x401000 + 0x110000 #.code end address

def put_data_format(msg, addr=None, data_len=0):

    data = imm.readMemory(addr, data_len)

    if msg:

        imm.log(msg, address=addr, highlight=1)

    total_row, left_data_len = divmod(data_len, 16)

    def prt_ln(line_len, line_no):

        head = '# %08X  ' % (line_no*16)

        tail = ''

        for j in range(line_len):

            if 0x20 <= ord(data[line_no*16+j]) <= 0x7F: tail = tail + data[line_no*16+j]

            else: tail = tail + '.'

        hex_str = ' '.join(['%02X' % ord(x) for x in data[line_no*16:(line_no+1)*16]])

        s = head + hex_str + '   '*(16-line_len) + ' ' + tail

        imm.log(s, address=(addr+line_no*16), highlight=1)

    for i in range(total_row):

        prt_ln(16, i)

    if left_data_len:

        prt_ln(left_data_len, total_row)

    imm.log('', address=addr)

class recvfrom_ret(LogBpHook):

    def __int__(self):

        LogBpHook.__init__(self)

    def run(self, regs):

        data_addr = imm.readLong(regs["ESP"] + 8)

        ip_addr = imm.readMemory(imm.readLong(regs["ESP"] + 0x14), 0x10)

        info = "recvfrom data  "

        if ip_addr[0] == '\x02':

            port = struct.unpack('H',ip_addr[0x2:0x4])[0]

            ip = struct.unpack('I',ip_addr[0x4:0x8])[0]

            info = " ip %u.%u.%u.%u:%u" % (ip&0xff, (ip>>8)&0xff, (ip>>16)&0xff, (ip>>24)&0xff, ((port>>8)&0xff) +((port&0xff)<<8))

        if regs["EAX"] != 0xffffffff:

            data_len = regs["EAX"]

            if regs["EAX"] > 0x100:

                 data_len = 0x100

            put_data_format("recv data", data_addr, data_len)

        info_str = "%s    length :%08X" % (info, regs["EAX"])

        imm.log(info_str, highlight = 1)

        stackList = imm.callStack()

        statckinfo = "recvfrom stack <0x%08x>" % imm.readLong(regs["ESP"])

        for l in stackList:

            call_addr = imm.readLong(l.getAddress())

            if (call_addr>code_base) and (call_addr<code_end):

                statckinfo +="0x%x  " % call_addr

        imm.log(statckinfo)

class sendto_data(LogBpHook):

    def __init__(self):

        LogBpHook.__init__(self)

    def run(self, regs):

        data_addr = imm.readLong(regs["ESP"] + 8)

        data_len = imm.readLong(regs["ESP"] + 0xc)

        ip_addr = imm.readMemory(imm.readLong(regs["ESP"] + 0x14), 0x10)

        port = struct.unpack('H',ip_addr[0x2:0x4])[0]

        ip = struct.unpack('I',ip_addr[0x4:0x8])[0]

        info = "sendto data   ip %u.%u.%u.%u:%u" % (ip&0xff, (ip>>8)&0xff, (ip>>16)&0xff, (ip>>24)&0xff, ((port>>8)&0xff) +((port&0xff)<<8))

        put_data_format(info, data_addr, data_len)

        stackList = imm.callStack()

        statckinfo = "sendto stack <0x%08x>" % imm.readLong(regs["ESP"])

        for l in stackList:

            call_addr = imm.readLong(l.getAddress())

            if (call_addr>code_base) and (call_addr<code_end):

                statckinfo +="0x%x  " % call_addr

        imm.log(statckinfo)

def main(args):

    imm.cleanHooks()

    pk1 = recvfrom_ret()

    pk1.add("recvfrom_ret", 0x71a230a0) # window xp sp3  recvfrom ret address

    pk2 = sendto_data()

    pk2.add("sendto_data", 0x71a22f51) # window xp sp3 sendto start address

    return "udp_sendto_recvfrom_success"

#!udp_sendto_recvfrom