kamikaze.py

# -*- coding: utf-8 -*-

# LICENSE INFORMATION:
#   Please treat this script as CC0

from immlib import *

imm = Debugger()

class KamikazeHook(LogBpHook):
    def __init__(self):
        LogBpHook.__init__(self)

    def run(self, regs):
        log = imm.getKnowledge("KamikazeLog")
        log[regs["EAX"]] = imm.readString(regs["EAX"])
        imm.addKnowledge("KamikazeLog", log, 0x01)

def usage():
    return "You must specify an argument: set, unset, dump"

def main(args):
    HOOK_NAME = "kamikaze_bp"
    BP_ADDRESS = 0x005B8C1E

    if not args:
        return usage()

    mode = args[0]

    if (mode == "set"):
        imm.addKnowledge("KamikazeLog", {}, 0x01)

        hook = KamikazeHook()
        hook.add(HOOK_NAME, BP_ADDRESS)
        return "Set kamikaze bp"

    if (mode == "unset"):
        imm.addKnowledge("KamikazeLog", {}, 0x01)

        imm.removeHook(HOOK_NAME)
        return "Unset kamikaze bp"

    if (mode == "dump"):
        log = imm.getKnowledge("KamikazeLog")

        for k in sorted(log.keys()):
            imm.log("[kamikaze] {:x} : {}".format(k, log[k]))

        imm.addKnowledge("KamikazeLog", {}, 0x01)
        return "Dumped"

    return usage()