mirror of
https://github.com/mandiant/speakeasy.git
synced 2026-10-12 02:18:47 +00:00
Willi Ballenthin
38b1baa98c
Handlers set the report display of an argument through ctx.args, by parameter name where the signature is usable on x86 and x64 and by slot index otherwise. argv holds the raw slots, and the transitional copy of argv writes in handle_import_func is gone. Variadic handlers use ctx.args.clear() and append(); delegating handlers pass ctx, so the inner handler's displays apply to the outer call. The display setter ignores values that are not strings, such as None from a failed constant lookup or the raw pointer of a NULL string argument. API hooks get raw argv. WindowsEmulator.get_api_args() returns the arguments of the hooked call as the report shows them, and the emu_dll and dbgview examples use it.
50 lines
1.3 KiB
Python
50 lines
1.3 KiB
Python
import argparse
|
|
|
|
import speakeasy
|
|
|
|
|
|
class DbgView(speakeasy.Speakeasy):
|
|
"""
|
|
Print debug port prints to the console
|
|
"""
|
|
|
|
def __init__(self, debug=False):
|
|
super().__init__(debug=debug)
|
|
|
|
def debug_print_hook(self, emu, api_name, func, params):
|
|
# Call the DbgPrint* function and print the formatted string to the console
|
|
rv = func(params)
|
|
|
|
formatted_str = emu.get_api_args()[-1].display
|
|
print(formatted_str)
|
|
|
|
return rv
|
|
|
|
def debug_printex_hook(self, emu, api_name, func, params):
|
|
# Call the DbgPrintEx function and print the formatted string to the console
|
|
rv = func(params)
|
|
|
|
formatted_str = emu.get_api_args()[-1].display
|
|
print(formatted_str)
|
|
|
|
return rv
|
|
|
|
|
|
def main(args):
|
|
dbg = DbgView()
|
|
module = dbg.load_module(args.file)
|
|
|
|
dbg.add_api_hook(dbg.debug_print_hook, "ntoskrnl", "DbgPrint")
|
|
|
|
dbg.add_api_hook(dbg.debug_printex_hook, "ntoskrnl", "DbgPrintEx")
|
|
|
|
# Emulate the module
|
|
dbg.run_module(module, all_entrypoints=True)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description="Print debug port prints to the console")
|
|
parser.add_argument("-f", "--file", action="store", dest="file", required=True, help="Path of driver to emulate")
|
|
args = parser.parse_args()
|
|
main(args)
|