pcrelame

pcrelame

#!/usr/bin/python

import sys
import re
import subprocess
import winappdbg
from winappdbg import win32

winappdbg.System.request_debug_privileges()
system = winappdbg.System()
system.request_debug_privileges()
system.scan_processes()

if len(sys.argv) < 3:
        print "Usage: ./ pid start end"
        sys.exit(1)
pid = int(sys.argv[1])
start = int(sys.argv[2], 16)
end = int(sys.argv[3], 16)

print "start: 0x%08x, end: 0x%08x, size: %08x" %(start, end, end-start)
process = system.get_process(pid);

buf =process.peek(start, end-start)
triggers = re.findall("ERCP.{40}([^\x00]+)", buf)

print len(triggers)
for trigger in triggers:
        char = trigger[:1]
        print "".join(trigger[:-1].split(char))