Foro de elhacker.net

def myload (self, path_to_file, command_line=None, create_new_console=None, show_window = None):
        pi = PROCESS_INFORMATION()
        si = STARTUPINFO()

        si.cb = sizeof(si)

        # these flags control the main window display of the debuggee.
        if not show_window:
                si.dwFlags     = 0x1
                si.wShowWindow = 0x0

        # CreateProcess() seems to work better with command line arguments when the path_to_file is passed as NULL.
        if command_line:
                command_line = path_to_file + " " + command_line
                path_to_file = 0
            
        creation_flags = 4 # CREATE_SUSPENDED

        if create_new_console:
                creation_flags |= CREATE_NEW_CONSOLE

        success = kernel32.CreateProcessA(c_char_p(path_to_file),
                                          c_char_p(command_line),
                                          0,
                                          0,
                                          0,
                                          creation_flags,
                                          0,
                                          0,
                                          byref(si),
                                          byref(pi))

        if not success:
            raise pdx("CreateProcess()", True)

        # store the handles we need.
        self.pid       = pi.dwProcessId
        self.h_process = pi.hProcess

        # resolve the PEB address.
        selector_entry = LDT_ENTRY()
        thread_context = self.get_thread_context(pi.hThread)

        if not kernel32.GetThreadSelectorEntry(pi.hThread, thread_context.SegFs, byref(selector_entry)):
                self.win32_error("GetThreadSelectorEntry()")

        teb  = selector_entry.BaseLow
        teb += (selector_entry.HighWord.Bits.BaseMid << 16) + (selector_entry.HighWord.Bits.BaseHi << 24)

        # add this TEB to the internal dictionary.
        self.tebs[pi.dwThreadId] = teb
        self.h_thread = pi.hThread
        self.dwThreadId = pi.dwThreadId
        
        self.peb = self.read_process_memory(teb + 0x30, 4)
        self.peb = struct.unpack("<L", self.peb)[0]
        
        pef = pefile.PE(path_to_file)
        address = pef.OPTIONAL_HEADER.AddressOfEntryPoint + pef.OPTIONAL_HEADER.ImageBase
        # save the original byte at the requested breakpoint address.
        original_bytes = self.read_process_memory(address, 2)

        self.write_process_memory(address, "\xEB\xFE") #JMP EIP
        kernel32.ResumeThread(pi.hThread)
        self.attach(self.pid)
        self.write_process_memory(address, original_bytes, 2)
        kernel32.FlushInstructionCache(self.h_process, 0, 0)