Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
import sys
from idc import *
from idaapi import *
from idautils import *
import time
import ntpath
def path_leaf(path):
head, tail = ntpath.split(path)
return tail or ntpath.basename(head)
class DbgHook(DBG_Hooks):
MSVBVM_LOADED = False
MSVBVM_BASE = 0
MSVBVM_SIZE = 0
MSVBVM_PROCCALLENGINE = 0x660FD05D
MSVBVM_METHCALLENGINE = 0x66103B68
def dbg_library_load(self, pid, tid, ea, name, base, size):
loadedName = path_leaf(name)
if loadedName == "msvbvm60.dll":
print "%s at %s - %s (%d bytes)" % (loadedName, hex(base), hex(base+size), size)
idaapi.load_and_run_plugin("pdb", 3)
self.MSVBVM_BASE = base
self.MSVBVM_SIZE = size
self.MSVBVM_LOADED = True
print "Adding Breakpoint On Name: ProcCallEngine @ %s\n" % (hex(self.MSVBVM_PROCCALLENGINE))
idaapi.add_bpt(self.MSVBVM_PROCCALLENGINE, 0, BPT_SOFT)
print "Adding Breakpoint On Name: MethCallEngine @ %s\n" % (hex(self.MSVBVM_METHCALLENGINE))
idaapi.add_bpt(self.MSVBVM_METHCALLENGINE, 0, BPT_SOFT)
idaapi.continue_process()
def dbg_bpt(self, tid, ea):
#print "Break point at 0x%x pid=%d" % (ea, tid)
if self.MSVBVM_LOADED and ea == self.MSVBVM_PROCCALLENGINE:
print "ProcCallEngine: %s - %s" % (hex(idc.GetRegValue('EDX')), idc.Name(idc.GetRegValue('EDX')))
idaapi.continue_process()
elif self.MSVBVM_LOADED and ea == self.MSVBVM_METHCALLENGINE:
print "ProcCallEngine: %s - %s" % (hex(idc.GetRegValue('EDX')), idc.Name(idc.GetRegValue('EDX')))
idaapi.continue_process()
return 0
try:
debughook.unhook()
except:
print "Debug Hook not set yet..."
debughook = DbgHook()
debughook.hook()
print "Installed debug hook ..."
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.