Process32First_Process32Next.py

Process32First_Process32Next.py

from immlib import *
from immutils import *
import getopt
import pefile
imm = Debugger()

def main(args):
    
    if args:
        usage()
        return "!patch, no args, just !patch"    

    debugged_name = imm.getDebuggedName()
    debuggee = imm.getModule(debugged_name)
    base_address = debuggee.getBaseAddress()
    
    process32first = imm.getAddress("kernel32.Process32FirstW")
    process32next = imm.getAddress("kernel32.Process32NextW")

    function_list = [process32first, process32next]

    patch_bytes = imm.assemble("SUB EAX, EAX\nRET")

    for address in function_list:
        opcode = imm.disasmForward(address, nlines = 10)
        imm.writeMemory(opcode.address, patch_bytes)

    result = debugged_name
    return result