Package vdb :: Package extensions :: Module windows
[hide private]
[frames] | no frames]

Module windows

source code

Functions [hide private]
 
teb(vdb, line)
Print the TEB for the current or specified thread.
source code
 
peb(vdb, line)
Print the PEB.
source code
 
regkeys(vdb, line)
Show all the registry keys the target process currently has open.
source code
 
einfo(vdb, line)
Show all the current exception information.
source code
 
seh(vdb, line)
Walk and print the SEH chain for the current (or specified) thread.
source code
 
safeseh(vdb, line)
Show the SafeSEH status of all the loaded DLLs or list the handlers for a particular dll by normalized name.
source code
 
validate_heaps(db)
A simple routine that works like the built in windows heap checkers to show where blocks and/or freelist is potentially dorked.
source code
 
heaps(vdb, line)
Show Win32 Heap Information.
source code
 
showaslr(vdb, base, libname) source code
 
aslr(vdb, line)
Determine which PE's in the current process address space support Vista's ASLR implementation by the presence of the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE (0x0040) bit in the DllCharacteristics field of the PE header.
source code
 
deaslr(vdb, line)
Rebase the specified expression as though the origin library had the suggested base address.
source code
 
_printPageHits(vdb, hits, unique=False) source code
 
pagewatch(vdb, line)
Enable write access watching on a given memory page.
source code
 
stealth(vdb, line)
Enable debugger stealth.
source code
 
gflags(vdb, line)
Support a subset of gflags like behavior on windows.
source code
 
pe(vdb, line)
Show extended info about loaded PE binaries.
source code
 
bindiff(mem1, mem2) source code
 
sympath(vdb, line)
Set the symbol path for the tracer.
source code
 
stepb(vdb, line)
Use the extended intel hardware support to step to the next branch target.
source code
 
hooks(vdb, line)
Check the executable regions of the target process for any hooks by comparing against the PE on disk.
source code
 
jit(vdb, line)
Enable/Disable the current VDB location as the current Just-In-Time debugger for windows applications.
source code
 
svclist(vdb, line)
List the running service names and pids.
source code
 
injectso(vdb, line)
Inject a shared object (DLL) into the target process.
source code
 
uac(db, line)
Display the current UAC status of the target process.
source code
 
hookiat(db, line)
Hook the specified IAT entries by munging a pointer and emulating "breakpoint" like behavior on the resultant memory access errors.
source code
 
gle(db, line)
Shows GetLastError for the current thread or threadid.
source code
 
win32err(db, line)
Shows the message associated with an error code.
source code
 
vdbExtension(db, trace) source code
Variables [hide private]
  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0x0040
  gflag_stuff = [('loader_snaps', 'ntdll.ShowSnaps', '<B', 0, 1)...
  token_elevation_types = {0: 'UAC Not Present', 1: 'Default Ele...
Function Details [hide private]

teb(vdb, line)

source code 

Print the TEB for the current or specified thread.

Usage: teb [threadid]

peb(vdb, line)

source code 

Print the PEB.

Usage: peb

regkeys(vdb, line)

source code 

Show all the registry keys the target process currently has open.

Usage: regkeys

einfo(vdb, line)

source code 

Show all the current exception information.

-P    Toggle the "PendingSignal" meta key which controls
      delivery (or handling) of the current exception.

Usage: einfo [options]

seh(vdb, line)

source code 

Walk and print the SEH chain for the current (or specified) thread.

Usage: seh [threadid]

safeseh(vdb, line)

source code 

Show the SafeSEH status of all the loaded DLLs or list the handlers for a particular dll by normalized name.

Usage: safeseh [libname]

heaps(vdb, line)

source code 

Show Win32 Heap Information.

Usage: heaps [-F <heapaddr>] [-C <address>] [-L <segmentaddr>] -F <heapaddr> print the freelist for the heap -C <address> Find and print the heap chunk containing <address> -S <segmentaddr> Print the chunks for the given heap segment -L <heapaddr> Print the look aside list for the given heap -V Validate the heaps (check next/prev sizes and free list) -l <heapaddr> Leak detection (list probable leaked chunks) -U <heapaddr> Show un-commited ranges for the specified heap (no options lists heaps and segments)

aslr(vdb, line)

source code 

Determine which PE's in the current process address space support Vista's ASLR implementation by the presence of the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE (0x0040) bit in the DllCharacteristics field of the PE header.

Usage: aslr [libname]

deaslr(vdb, line)

source code 

Rebase the specified expression as though the origin library had the suggested base address. (rather than whatever it was re-based to)

Usage: deaslr <expression>

Example: deaslr calc+0x1234

pagewatch(vdb, line)

source code 

Enable write access watching on a given memory page. This works by setting the page to read-only and then specially handling the access violations as though they were hardware Watchpoints.

Usage: pagewatch [options] [<addr_expression>] -C - Clear the current pagewatch log -F - Toggle auto-continue behavior (run and record vs. stop on hit) -L - List the current hits from the pagewatch log -M - Add page watches to the entire memory map from addr_expression -R - Use to enable *read* watching while adding a page watch -S <addr> - Show touches to the specified address -P <addr> - Show memory touched by specifed program counter (eip) -u - When listing, show only *unique* entries

stealth(vdb, line)

source code 

Enable debugger stealth. See options -l.

stealth <on/off> <options>

Options: peb - enable/disable static peb + heap offset patching ZwQueryInformationProcess - patch ZwQueryInformationProcess parameter CheckRemoteDebuggerPresent - patch CheckRemoteDebuggerPresent GetTickCount - patch GetTickCount timer checks OutputDebugString - patch check that returns if debugger is attached ZwSetInformationThread - patch the hide debugger trick ZwClose - patch invalid handle check all - enable or disable all patches

WARNING: break/sendBreak() behave VERY strange with this because the kernel aparently doesn't think he needs to post the exception to the debugger?

gflags(vdb, line)

source code 

Support a subset of gflags like behavior on windows. This enables features *exclusively* by direct process manipulation and does NOT set any registry settings or persist across processes...

Usage: gflags [toggle_type]

NOTE: Most of these options require symbols!

pe(vdb, line)

source code 

Show extended info about loaded PE binaries.

Usage: pe [opts] [<libname>...]
-I      Show PE import files.
-m      Toggle inmem/ondisk behavior (directly mapped DLLs)
-N      Show full NT header
-t      Show PE timestamp information
-E      Show PE exports
-S      Show PE sections
-v      Show FileVersion from VS_VERSIONINFO
-V      Show all keys from VS_VERSIONINFO

NOTE: "libname" may be a vtrace expression:

Examples:

    # Show the imports from a PE loaded at 0x777c0000
    pe -I 0x777c0000

    # Show the exports from advapi32.dll
    pe -E advapi32

    # Show the build timestamp of the PE pointed to by a register
    pe -t esi

sympath(vdb, line)

source code 

Set the symbol path for the tracer. This will currently only effect *subsequent* library loads!

Usage: sympath <new_path>

stepb(vdb, line)

source code 

Use the extended intel hardware support to step to the next branch
target.

Usage: stepb

NOTE: This will *not* work inside VMware / VirtualBox.  Other hypervisors
      may vary... (it will simply single step)

hooks(vdb, line)

source code 

Check the executable regions of the target process for any hooks by comparing against the PE on disk. This will account for relocations and import entries.

jit(vdb, line)

source code 

Enable/Disable the current VDB location as the current Just-In-Time debugger for windows applications.

Usage: jitenable [-D] -E Enable VDB JIT debugging -D Disable JIT debugging

svclist(vdb, line)

source code 

List the running service names and pids.

Usage: svclist

injectso(vdb, line)

source code 

Inject a shared object (DLL) into the target process.

Usage: injectso <dllname>

uac(db, line)

source code 

Display the current UAC status of the target process. (User Account Control)

Usage: uac

hookiat(db, line)

source code 

Hook the specified IAT entries by munging a pointer and emulating
"breakpoint" like behavior on the resultant memory access errors.  Basically,
break on import call...

Usage: hookiat <libname> [ <implibname> [ <impfuncname> ] ]

Example:
    hookiat calc
    hookiat calc kernel32
    hookiat calc kernel32 LoadLibraryA

NOTE: Once added, you may use "bp" and commands like "bpedit" to modify,
remove, or add code to "iat hooks"

gle(db, line)

source code 

Shows GetLastError for the current thread or threadid.

Usage: gle [threadid]

win32err(db, line)

source code 

Shows the message associated with an error code. Defaults to win32, -n looks up NTSTATUS codes.

Usage: win32err [-n] <error code>


Variables Details [hide private]

gflag_stuff

Value:
[('loader_snaps', 'ntdll.ShowSnaps', '<B', 0, 1), ('loader_debug', 'nt\
dll.LdrpDebugFlags', '<I', 0, 0xffffffff),]

token_elevation_types

Value:
{0: 'UAC Not Present', 1: 'Default Elevation', 2: 'Elevated', 3: 'Low'\
,}