使用python在Windows中的系统dll(ntdll.dll)中查找字节序列

不知道为什么，我也try 了当前的模块大小，因为你传递的大小比我在最新的Windows10上获得的模块大小略大，但我也遇到了相同的解释器崩溃……

用ReadProcessMemory代替，很容易就解决了这个问题.代码非常简单:

• 调用GetModuleHandleW获取模块句柄.
• 拨打GetModuleInformation获取模块大小.
• 拨打ReadProcessMemory读取模块.

显然，只要将模块加载到进程地址空间中，这就可以正常工作.

#!/usr/bin/env python3
# -*- coding: UTF-8 -*-
import ctypes
import ctypes.wintypes as wt

# Windows Structs


class MODULEINFO(ctypes.Structure):
    _fields_ = (
        ('lpBaseOfDll', ctypes.c_void_p),
        ('SizeOfImage', ctypes.c_uint32),
        ('EntryPoint', ctypes.c_void_p)
    )

# Windows API


kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
GetModuleHandle = kernel32.GetModuleHandleW
GetModuleHandle.restype = wt.HMODULE
GetModuleHandle.argtypes = (wt.LPCWSTR, )

ReadProcessMemory = kernel32.ReadProcessMemory
ReadProcessMemory.argtypes = (
    ctypes.c_void_p,  # HANDLE hProcess
    ctypes.c_void_p,  # LPCVOID lpBaseAddress
    ctypes.c_void_p,  # LPVOID  lpBuffer
    ctypes.c_size_t,  # SIZE_T  nSize
    ctypes.POINTER(ctypes.c_size_t)  # SIZE_T  *lpNumberOfBytesRead
)
ReadProcessMemory.restype = wt.BOOL

psapi = ctypes.WinDLL("psapi", use_last_error=True)
GetModuleInformation = psapi.GetModuleInformation
GetModuleInformation.restype = wt.BOOL
GetModuleInformation.argtypes = (
    ctypes.c_void_p,  # HANDLE hProcess
    ctypes.c_void_p,  # HMODULE hModule
    ctypes.POINTER(MODULEINFO),  # LPMODULEINFO lpModinfo
    ctypes.c_uint32,  # cb
)


def get_module_info(h_module) -> MODULEINFO:
    """Get Module information for a module loaded into the python interpreter address space.

    Args:
        h_module: The HMODULE (module base address) to the module for which to get the information.

    Returns:
        An instance of the MODULEINFO structure.
    """
    h_current_proc = ctypes.c_void_p(-1)  # pseudo handle to current process.
    module_info = MODULEINFO()
    ret_val = GetModuleInformation(h_current_proc, h_module, ctypes.byref(module_info), ctypes.sizeof(module_info))
    if ret_val == 0:
        raise ctypes.WinError(ctypes.get_last_error())
    return module_info


def read_module(base_addr: int, size: int) -> bytes:
    """Read the entirety of a module loaded in the Python interpreter.

    Args:
        base_addr: base address of the module to read.
        size: Size of the module.

    Returns:
        A bytes instance containing the bytes read from the module.
    """
    h_current_proc = ctypes.c_void_p(-1)  # pseudo handle to current process.

    buffer = ctypes.create_string_buffer(b'', size)
    nobr = ctypes.c_size_t(0)
    ret_val = ReadProcessMemory(h_current_proc, base_addr, buffer, size, ctypes.byref(nobr))
    if not ret_val and ctypes.get_last_error() != 299:  # ERROR_PARTIAL_COPY
        raise ctypes.WinError()
    return buffer.raw[:nobr.value]


def find_bytes_in_module(module_name: str, search_bytes: bytes) -> int:
    # Get the handle of the module
    h_module = GetModuleHandle(module_name)
    if h_module == 0:
        raise ctypes.WinError(ctypes.get_last_error())
    module_info = get_module_info(h_module)
    print(f"{module_name}: Base: {module_info.lpBaseOfDll:#016x}; Image Size: {module_info.SizeOfImage:#016x}")

    # Read the contents of the module into a ctypes array and convert to a bytes array
    module_data = read_module(h_module, module_info.SizeOfImage)

    # Search for the wanted bytes in the module data
    index = module_data.find(search_bytes)
    if index == -1:
        # oops, pattern not found...
        return -1

    return h_module + index


def main():
    module_name = 'ntdll.dll'
    search_bytes = b'\xff\xe4'

    # no need to load ntdll, it's already in the process address space.
    addr = find_bytes_in_module(module_name, search_bytes)
    if addr < 0:
        print("Could not find the pattern in the module.")
        return 0

    print(f'`jmp esp` gadget found inside {module_name} at the absolute address: {addr:#016x}')

    return 0


if __name__ == '__main__':
    main()