ANTICHAT — форум по информационной безопасности, OSINT и технологиям

 
from ollylib import*

GReg(имя_регистра)

eax = GReg("Eax")
Log("eax is %X" % int(str(eax)))
esp = GReg("eSp")
Log("esp is %X" % int(str(esp)))
ebp = GReg("ebp")
Log("ebp is %X" % int(str(ebp)))
esi = GReg("esi")
Log("esi is %X" % int(str(esi)))
edi = GReg("edi")
Log("edi is %X" % int(str(edi)))
eip = GReg("eip")
Log("eip is %X" % int(str(eip)))
ss = GReg("ss")
Log("ss is %X" % int(str(ss)))
ds = GReg("ds")
Log("ds is %X" % int(str(ds))) 
efl = GReg("efl")
Log("efl is %X" % int(str(efl)))

Log(”message”) – запись в лог
Flashmes(“message”)  
msg(адрес,”message”)
Err(“message”) – вывод сообщения об ошибке 
Info(“message”)

addr_ = Getfuncaddr("kernel32.LoadLibraryA")

Info("LoadLibraryA address %X" %int(addr_))

Asm(“команда”,адрес)

Asm("sub eax,eax",0x0401000)

Sethardbp(address,size,type)

HB_CODE  бряк на исполнение      
HB_ACCESS  бряк на доступ     
HB_WRITE                    бряк на запись

 
laddr = Getfuncaddr("kernel32.LoadLibraryA")
Sethardbp(long(laddr),4,HB_CODE)

Deletehardbp(index)

  
Deletehardbpbyaddr(адрес)

Attach(pid)

Attachbyname(procname)

Setmembp(type,addr,size)

MEMBP_READ               мемори-бряк на чтение
MEMBP_WRITE              мемори-бряк на запись

Browsefile(title,buf,ext,mode)

buf = ""
Browsefile("Test browse",buf,".exe",0)

Runfile(path)

Runfile(buf)

 
Suspend()

Restoreallthrd()

Runthread(thread_id)

Dumpreg(file_name,base,size)

Findmem(адрес_принадлежащий_региону)

typedef struct t_memory {      // Memory block descriptor
  ulong      base;             // Base address of memory block
  ulong      size;             // Size of block
  ulong      type;             // Service information, TY_xxx
  ulong      owner;            // Address of owner of the memory
  ulong      initaccess;       // Initial read/write access
  ulong      access;           // Actual status and read/write access

  ulong      threadid;         // Block belongs to this thread or 0
  char       sect[SHORTLEN];   // Name of module section
  char       *copy;            // Copy used in CPU window or NULL
  ulong      reserved[8];      // Reserved for plugin compatibility
} t_memory;



OllyDbg Plugin API v1.10

Writemem(addr,buf,size)

Disassm(addr,type)

DISASM_SIZE    получение длины команды
DISASM_ALL полное дизассемблирование

typedef struct t_disasm {         // Results of disassembling
  ulong     ip;                   // (*) Instrucion pointer
  char      dump[TEXTLEN];      // Hexadecimal dump of the command
  char      result[TEXTLEN];    // Disassembled command
  char      comment[TEXTLEN];   // Brief comment
  char      opinfo[3][TEXTLEN]; // Comments to command's operands
  int       cmdtype;              // (*) One of C_xxx
  int       memtype;              // (*) Type of addressed variable in memory

  int       nprefix;              // (*) Number of prefixes
  int       indexed;              // Address contains register(s)
  ulong     jmpconst;             // (*) Constant jump address
  ulong     jmptable;             // (*) Possible address of switch table
  ulong     adrconst;             // (*) Constant part of address
  ulong     immconst;             // (*) Immediate constant
  int       zeroconst;            // (*) Whether contains zero constant
  int       fixupoffset;          // (*) Possible offset of 32-bit fixups

  int       fixupsize;            // (*) Possible total size of fixups or 0
  ulong     jmpaddr;              // Destination of jump/call/return
  int       condition;            // 0xFF:unconditional, 0:false, 1:true
  int       error;                // (*) Error while disassembling command
  int       warnings;             // (*) Combination of DAW_xxx
  int       optype[3];            // Type of operand (extended set DEC_xxx)
  int       opsize[3];            // Size of operand, bytes

  int       opgood[3];            // Whether address and data valid
  ulong     opaddr[3];            // Address if memory, index if register
  ulong     opdata[3];            // Actual value (only integer operands)
  t_operand op[3];                // Full description of operand
  ulong     regdata[8];           // Registers after command is executed
  int       regstatus[8];         // Status of registers, one of RST_xxx
  ulong     addrdata;             // Traced memory address

  int       addrstatus;           // Status of addrdata, one of RST_xxx
  ulong     regstack[NREGSTACK];  // Stack tracing buffer
  int       rststatus[NREGSTACK]; // Status of stack items
  int       nregstack;            // Number of items in stack trace buffer
  ulong     reserved[29];         // Reserved for plugin compatibility
} t_disasm;



OllyDbg Plugin API v1.10

Getlng(title,size)

 
Tempbp(addr,type)

Setbp(addr,type,cmd)

Findmod(addr)

typedef struct t_module {          // Executable module descriptor
  ulong          base;             // Base address of module
  ulong          size;             // Size occupied by module
  ulong          type;             // Service information, TY_xxx
  ulong          codebase;         // Base address of module code block
  ulong          codesize;         // Size of module code block

  ulong          resbase;          // Base address of resources
  ulong          ressize;          // Size of resources
  t_stringtable  *stringtable;     // Pointers to string resources or NULL
  int            nstringtable;     // Actual number of used stringtable
  int            maxstringtable;   // Actual number of allocated stringtable
  ulong          entry;            // Address of <ModuleEntryPoint> or NULL
  ulong          database;         // Base address of module data block

  ulong          idatatable;       // Base address of import data table
  ulong          idatabase;        // Base address of import data block
  ulong          edatatable;       // Base address of export data table
  ulong          edatasize;        // Size of export data table
  ulong          reloctable;       // Base address of relocation table
  ulong          relocsize;        // Size of relocation table
  char           name[SHORTLEN];   // Short name of the module

  char           path[MAXPATH];    // Full name of the module
  int            nsect;            // Number of sections in the module
  IMAGE_SECTION_HEADER *sect;      // Copy of section headers from file
  ulong          headersize;       // Total size of headers in executable
  ulong          fixupbase;        // Base of image in executable file
  int            nfixup;           // Number of fixups in executable
  t_fixup        *fixup;           // Extracted fixups or NULL
…..
  
} t_module;

OllyDbg Plugin API v1.10

Getcputhrdid()

Findthrd(id)

Decodethrdname(buf, tid,mode)

IsVmWare()

 
 Gettxt(title,text,letter,type,ind)

Disasmin(addr,str)

Disasmback(addr,str)

 
Disasminbyopcode(addr,str)

 
Disasmbackbyopcode(addr,str)

 
asmfindmodel(model)

typedef struct t_asmmodel {   // Model to search for assembler command
  char      code[MAXCMDSIZE]; // Binary code
  char      mask[MAXCMDSIZE]; // Mask for binary code (0: bit ignored)
  int       length;           // Length of code, bytes (0: empty)
  int       jmpsize;          // Offset size if relative jump
  int       jmpoffset;        // Offset relative to IP
  int       jmppos;           // Position of jump offset in command

} t_asmmodel;

Findallcmds(pd,model,origin,title)

typedef struct t_dump {         // Current status of dump window
  t_table    table;             // Treat dump window as custom table
  int        dimmed;            // Draw in lowcolor if nonzero
  ulong      threadid;          // Use decoding and registers if not 0
  int        dumptype;          // Current dump type, DU_xxx+count+size
  SPECFUNC   *specdump;         // Decoder of DU_SPEC dump types
  int        menutype;          // Standard menus, MT_xxx

  int        itemwidth;         // Length of displayed item, characters
  int        showstackframes;   // Show stack frames in address dump
  int        showstacklocals;   // Show names of locals in stack
  int        showsource;        // Show source as comment in disassembler
  char       filename[MAXPATH]; // Name of displayed or backup file
  ulong      base;              // Start of memory block or file
  ulong      size;              // Size of memory block or file

  ulong      addr;              // Address of first displayed byte
  ulong      lastaddr;          // Address of last displayed byte + 1
  ulong      sel0;              // Address of first selected byte
  ulong      sel1;              // Last selected byte (not included!)
  ulong      startsel;          // Start of last selection
  int        captured;          // Mouse is captured by dump
  ulong      reladdr;           // Addresses relative to this
  char       relname[SHORTLEN]; // Symbol for relative zero address base

  char       *filecopy;         // Copy of the file or NULL
  char       *backup;           // Old backup of memory/file or NULL
  int        runtraceoffset;    // Offset back in run trace
  ulong      reserved[8];       // Reserved for the future extentions
} t_dump;



OllyDbg Plugin API v1.10

Searchfileoffset(pmod,addr)

GetMmx(title,data,mode)

GetMmxXY(title,data,mode)

Getnumberofmods()

Getmodule(number)

typedef struct mod_info {            
ulong base;
ulong size;
...
ulong code_begin;
ulong code_size;
ulong resource;
....
ulong Entry;
ulong data_addr;
ulong imp;
....
....
char path[256];
};

Getnumberofblocks()

Getmemoryblock(number)

typedef struct mem_blocks {
ulong addr; 
ulong size; 
}mem_blocks;