whatobj.py

whatobj.py

### THE AMAZING OBJECT IDENTIFIER #####
# By Konrads Smelkovs <[email protected]>
# Math.cos(1);
# x=document.createElement("div")
# Math.atan2(1,"Allocated div");
# x.className="foo";
# Math.sin(1);
# Math.atan(1);
#
#

import re,sys
from pykd import *
ATTRIBUTE_TYPES = {
	0x0000:'VT_EMPTY',
	0x0001:'VT_NULL',
	0x0002:'VT_I2',
	0x0003:'VT_I4',
	0x0004:'VT_R4',
	0x0005:'VT_R8',
	0x0006:'VT_CY',
	0x0007:'VT_DATE',
	0x0008:'VT_BSTR',
	0x0009:'VT_DISPATCH',
	0x000A:'VT_ERROR',
	0x000B:'VT_BOOL',
	0x000C:'VT_VARIANT',
	0x000D:'VT_UNKNOWN',
	0x000E:'VT_DECIMAL',
	0x0010:'VT_I1',
	0x0011:'VT_UI1',
	0x0012:'VT_UI2',
	0x0013:'VT_UI4',
	0x0014:'VT_I8',
	0x0015:'VT_UI8',
	0x0016:'VT_INT',
	0x0017:'VT_UINT',
	0x0018:'VT_VOID',
	0x0019:'VT_HRESULT',
	0x001A:'VT_PTR',
	0x001B:'VT_SAFEARRAY',
	0x001C:'VT_CARRAY',
	0x001D:'VT_USERDEFINED',
	0x001E:'VT_LPSTR',
	0x001F:'VT_LPWSTR',
	0x0024:'VT_RECORD',
	0x0025:'VT_INT_PTR',
	0x0026:'VT_UINT_PTR',
	0x2000:'VT_ARRAY',
	0x4000:'VT_BYREF',
}


def getDWord(addr):
	return loadDWords(addr,1)[0]

def getByte(addr):
	return loadBytes(addr,1)[0]

def ieElement(addr):
	symtype=findSymbol(getDWord(addr))
	m=re.match("^MSHTML!([^:]+)::`vftable'",symtype)
	if m:
		elem=m.group(1)
		refcount=getDWord(addr +0x4)
		attrptr=getDWord(addr +0x10)	
		domtreeptr=getDWord(addr +0x1c)
		objid=getDWord(addr +0x20)
		cmarkupptr=getDWord(addr +0x2c)
		print "[+] <%s#%x> recount: %d, objid: 0x%x, domtreeptr 0x%x, attrptr: 0x%x, cmarkupptr: 0x%x" % \
			(elem,addr,refcount,objid,domtreeptr,attrptr,cmarkupptr)
		try:
			attrcount=getDWord(attrptr+0x4)
			attrtblptr=getDWord(attrptr+0x8)
			print "[+] <%s#%x> has 0x%x attributes at 0x%x" % (elem,addr,attrcount,attrtblptr)		
			for offset in xrange(0,attrcount):
				attrbase=attrtblptr+offset*0x10
				attrtype=getByte(attrbase+0x1)

				attrnamehashid=getDWord(attrbase+0x4)
				print "[+] Attribute (base 0x%x) 0x%x has type 0x%x(%s)" % (attrbase,offset,attrtype,ATTRIBUTE_TYPES[attrtype])
		except MemoryException as e:
			print "[W] Could not read attributes, perhaps there aren't any?"

	else:
		print "[E] Can't process " + symtype

if __name__=="__main__":
	ieElement(int(sys.argv[1],16))