write_callback

write_callback.py

def write_callback(frame, bp_loc, dict):
	print ("write() detected!")
	print ("dumping python code from $rsi register")

	memory_address = 0

	registerSet = frame.GetRegisters() # Returns an SBValueList.

	for regs in registerSet:
		if 'general purpose registers' in regs.name.lower():
			GPRs = regs
			break

	print('%s (number of children = %d):' % (GPRs.name, GPRs.num_children))
	for reg in GPRs:
		if reg.name == "rsi":
			memory_address = int(reg.value, 0)

	bytes_count = 0
	if memory_address:
		error = lldb.SBError()
		while frame.thread.process.ReadUnsignedFromMemory(memory_address, 1, error):
			c = frame.thread.process.ReadUnsignedFromMemory(memory_address, 1, error)
			open('/tmp/dumped.py', 'ab').write(bytes([c]))
			memory_address += 1
			bytes_count +=1
		if error.Success():
			print("sucessfully written %i bytes" % bytes_count)
		else:
			print('error: %s\n' % error)
	else:
		print ('error getting memory address')

	frame.thread.process.Continue()