Gray Hat Python by Seitz, Justin -- Read -- Imperial Library of Trantor

Index

Gray Hat Python

FOREWORD ACKNOWLEDGMENTS INTRODUCTION 1. SETTING UP YOUR DEVELOPMENT ENVIRONMENT

Operating System Requirements Obtaining and Installing Python 2.5

Installing Python on Windows Installing Python for Linux

Setting Up Eclipse and PyDev

The Hacker's Best Friend: ctypes Using Dynamic Libraries

chapter1-printf.py Code on Windows chapter1-printf.py Code on Linux

Constructing C Datatypes Passing Parameters by Reference Defining Structures and Unions

In C In Python In C In Python chapter1-unions.py

2. DEBUGGERS AND DEBUGGER DESIGN

General-Purpose CPU Registers The Stack

Function Call in C

Function Call in C Function Call in x86 Assembly

Debug Events Breakpoints

Soft Breakpoints

Opcode Before Breakpoint Is Set Modified Opcode After Breakpoint Is Set

Hardware Breakpoints Memory Breakpoints

3. BUILDING A WINDOWS DEBUGGER

Debuggee, Where Art Thou?

my_debugger_defines.py

my_debugger_defines.py my_debugger.py my_test.py my_debugger.py my_test.py

Obtaining CPU Register State

Thread Enumeration Putting It All Together

my_debugger.py my_test.py

Implementing Debug Event Handlers

my_debugger.py

my_debugger.py my_test.py my_debugger.py

The Almighty Breakpoint

Soft Breakpoints

my_debugger.py my_debugger.py printf_loop.py my_test.py

Hardware Breakpoints

my_debugger.py my_debugger.py my_test.py

Memory Breakpoints

my_debugger.py my_debugger.py

Conclusion

4. PYDBG—A PURE PYTHON WINDOWS DEBUGGER

Extending Breakpoint Handlers

printf_random.py

Access Violation Handlers

buffer_overflow.py access_violation_handler.py

Process Snapshots

Obtaining Process Snapshots

snapshot.py

Putting It All Together

danger_track.py

5. IMMUNITY DEBUGGER—THE BEST OF BOTH WORLDS

Installing Immunity Debugger Immunity Debugger 101

PyCommands PyHooks

Exploit Development

Finding Exploit-Friendly Instructions

findinstruction.py

Bad-Character Filtering

badchar.py

Bypassing DEP on Windows

findantidep.py

Defeating Anti-Debugging Routines in Malware

IsDebuggerPresent Defeating Process Iteration

6. HOOKING

Soft Hooking with PyDbg

firefox_hook.py

Hard Hooking with Immunity Debugger

hippie_easy.py

7. DLL AND CODE INJECTION

Remote Thread Creation

DLL Injection

dll_injector.py

Code Injection

code_injector.py

Getting Evil

File Hiding

file_hider.py

Coding the Backdoor

backdoor.py backdoor.py backdoor.py

Compiling with py2exe

setup.py backdoor_shell.py

8. FUZZING

Bug Classes

Buffer Overflows Integer Overflows Format String Attacks

File Fuzzer

file_fuzzer.py

file_fuzzer.py file_fuzzer.py file_fuzzer.py file_fuzzer.py

Future Considerations

Code Coverage Automated Static Analysis

9. SULLEY

Sulley Installation Sulley Primitives

Strings Delimiters Static and Random Primitives Binary Data Integers Blocks and Groups

Slaying WarFTPD with Sulley

FTP 101 Creating the FTP Protocol Skeleton

ftp.py

Sulley Sessions

ftp_session.py

Network and Process Monitoring Fuzzing and the Sulley Web Interface

10. FUZZING WINDOWS DRIVERS

Driver Communication Driver Fuzzing with Immunity Debugger

ioctl_fuzzer.py

Driverlib—The Static Analysis Tool for Drivers

Discovering Device Names Finding the IOCTL Dispatch Routine

Determining Supported IOCTL Codes Building a Driver Fuzzer

ioctl_dump.py

ioctl_dump.py my_ioctl_fuzzer.py

11. IDAPYTHON—SCRIPTING IDA PRO

IDAPython Installation IDAPython Functions

Utility Functions Segments Functions Cross-References Debugger Hooks

Example Scripts

Finding Dangerous Function Cross-References

cross_ref.py

Function Code Coverage

func_coverage.py

Calculating Stack Size

stack_calc.py

12. PYEMU—THE SCRIPTABLE EMULATOR

Installing PyEmu PyEmu Overview

PyCPU PyMemory PyEmu Execution Memory and Register Modifiers Handlers Register Handlers Library Handlers Exception Handlers Instruction Handlers Opcode Handlers Memory Handlers High-Level Memory Handlers Program Counter Handler

IDAPyEmu

addnum.cpp

Function Emulation

addnum_function_call.py addnum_function_call.py addnum_function_call.py addnum_function_call.py

PEPyEmu Executable Packers UPX Packer Unpacking UPX with PEPyEmu

upx_unpacker.py upx_unpacker.py upx_unpacker.py

Colophon

← Prev
Back
Next →

← Prev
Back
Next →