LyScript icon indicating copy to clipboard operation
LyScript copied to clipboard

您好 那个执行内置命令能加上接受返回值吗

Open AnaCna opened this issue 2 years ago • 7 comments

这样一来除了您提供的API以外 我们还可以用内置命令获取64dbg的信息

AnaCna avatar Apr 25 '22 09:04 AnaCna

下次更新增加

lyshark avatar Apr 26 '22 12:04 lyshark

期待啊 每天打开一看

AnaCna avatar May 05 '22 06:05 AnaCna

您好,更新需要等功能反馈多时一并处理,项目会持续更新请耐心等待

lyshark avatar May 06 '22 02:05 lyshark

您好,已找到方法。

from LyScript32 import MyDebug

dbg = MyDebug()

conn = dbg.connect() ref = dbg.run_command_exec("$addr=1024") ref True ref = dbg.run_command_exec("eax=$addr") ref True dbg.get_register("eax") 4132

hex(dbg.get_register("eax")) '0x1024'

lyshark avatar Jul 21 '22 11:07 lyshark

image

lyshark avatar Jul 21 '22 11:07 lyshark

from LyScript32 import MyDebug

# 得到脚本返回值
def GetScriptValue(dbg,script):
    try:
        ref = dbg.run_command_exec("push eax")
        if ref != True:
            return None
        ref = dbg.run_command_exec(f"eax={script}")
        if ref != True:
            return None
        reg = dbg.get_register("eax")
        ref = dbg.run_command_exec("pop eax")
        if ref != True:
            return None
        return reg
    except Exception:
        return None
    return None

if __name__ == "__main__":
    dbg = MyDebug()
    dbg.connect()

    ref = GetScriptValue(dbg,"teb()")
    print(hex(ref))

    ref = GetScriptValue(dbg,"peb()")
    print(hex(ref))

    eax = dbg.get_register("eax")
    kbase = GetScriptValue(dbg,f"mod.base({eax})")
    print("模块及地址: {}".format(hex(kbase)))

    dbg.close()

lyshark avatar Jul 21 '22 13:07 lyshark

谢谢 学到了

AnaCna avatar Jul 22 '22 04:07 AnaCna