Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
import immlib
imm = immlib.Debugger()
jmp_table1 = 0x4011F4
table1_entries = 35
jmp_table2 = 0x401330
table2_entries = 8
jmp_table3 = 0x405D88
table3_entries = 278
# Get the file name of the process, for demo.exe it is demo
filename = imm.getDebuggedName().split('.')[0]
def traceImport(start):
global imm
i = 0
addr = start
maxTrace = 10 # maximum number of instructions to tarce
while i < maxTrace:
# decode current address to a string representation
decode = imm.decodeAddress(addr)
# check if current address is already in a dll
if not decode.startswith(filename):
imm.log('[.] %08X -> %s (%08X)' %(start, decode, addr), address = start)
return addr
# continue tracing
op = imm.disasm(addr)
i += 1
# follow the jump for conditional/unconditional jump instructions
if op.isJmp() or op.isConditionalJmp():
jmpTarget = op.getJmpConst()
addr = jmpTarget
# for non jump instructions go to next instruction
else:
addr += op.getSize()
# if we reach here, it means tracing failed
imm.log('[!] %08X -> TRACING FAILED...' %start, address = start, highlight=True)
return -1
def rebuildImports():
global imm
# parse table 1
address = jmp_table1
for i in xrange(table1_entries):
address = jmp_table1 + (i*8)
realEntry = traceImport(address)
# parse table 2
imm.log('')
address = jmp_table2
for i in xrange(table2_entries):
address = jmp_table2 + (i*8)
realEntry = traceImport(address)
# parse table 3
imm.log('')
address = jmp_table3
for i in xrange(table3_entries):
address = jmp_table3 + (i*8)
realEntry = traceImport(address)
def main(args):
imm.log('[*] Rebuilding imports...')
rebuildImports()
return 'Done'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment