Guest User

dllfinder

a guest
Jun 28th, 2016
176
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 0.94 KB | None | 0 0
  1. import gdb
  2.  
  3. while True:
  4.     try:
  5.         gdb.execute('target remote :5555')
  6.         break
  7.     except:
  8.         pass
  9.  
  10. print "connected"
  11. lines = gdb.execute('info proc mappings', to_string=True).splitlines()
  12.  
  13. file_count = 0
  14. for line in lines:
  15.     arr = line.split()
  16.     if len(arr) > 0:
  17.         start = arr[0]
  18.         end = arr[1]
  19.         if start[0:2] == "0x" and end[0:2] == "0x":
  20.             #find dll magic number
  21.             statement = 'find/w {0},{1},{2}'.format(start,end,'0x00905A4D')
  22.             res = gdb.execute(statement,to_string=True).splitlines()
  23.             if res[0].find("not found") == -1:
  24.                 for d in res:
  25.                     if d != res[-1]:
  26.                         dll_start = d
  27.                         #dump mapping with dll inside
  28.                         dump = "dump binary memory file_{0} {1} {2}".format(file_count, dll_start, end)
  29.                         gdb.execute(dump)
  30.                         file_count += 1
Advertisement
Add Comment
Please, Sign In to add comment