Immunity Debugger Plugin - BpHook 예제

Bufferoverflow 예제로, 취약한 strcpy 함수를 후킹하여 두 번째 인자인 source(쉘코드!?)를 로그에 출력한다. 

import immlib
from immlib import BpHook
 
DESC = "BpHook Basic Demonstration for the SPSE course"
 
class StrcpyBpHook(BpHook):
    def _init_(self):
        BpHook.__init__(self)
 
    def run(self, regs):
        imm = immlib.Debugger()
        imm.log("StrcpyBpHook Called!")
 
        # strcpy(char *destination, char *source)
        
        eipOnStack = imm.readLong(regs['ESP'])
        strcpyFirstArg = imm.readLong(regs['ESP'] + 4)
        strcpySecondArg = imm.readLong(regs['ESP'] + 8)
 
        imm.log("EIP on Stack: 0x%08x" % eipOnStack)
        imm.log("First Arg: 0x%08x" % strcpyFirstArg)
        imm.log("Second Arg: 0x%08x" % strcpySecondArg)
 
        # print the source string
        receivedString = imm.readString(strcpySecondArg)
        imm.log(receivedString)
        imm.log("Received String: %s with length %d" % (str(receivedString), len(receivedString)))
 
def main(args):
    imm = immlib.Debugger()
 
    # find strcpy address
    functionToHook = "msvcrt.strcpy"
    
    functionAddress = imm.getAddress(functionToHook)
 
    newHook = StrcpyBpHook()
 
    newHook.add(functionToHook, functionAddress)
 
    imm.log("Hook for %s : 0x%08x added successfully !" % (functionToHook, functionAddress))
 
    return "Hook Installed"