ROP绕过片段简略科普一下，你能够了解成一个能够关闭系统本身内存保护的一段机器指令，这段代码须要咱们本人结构，这就波及到在对端内存搜查这样的指令，LyScript插件加强了指令片段的查找性能，但须要咱们在LyScript插件根底上封装一些办法，实现起来也不难。
- 插件地址：https://github.com/lyshark/Ly...
封装机器码获取性能: 首先封装一个办法，当用户传入指定汇编指令的时候，主动的将其转换成对应的机器码，这是为搜寻ROP片段做铺垫的，代码很简略，首先dbg.create_alloc(1024)在过程内存中开拓堆空间，用于寄存咱们的机器码，而后调用dbg.assemble_write_memory(alloc_address,"sub esp,10")将一条汇编指令变成机器码写到对端内存，而后再op = dbg.read_memory_byte(alloc_address + index)顺次将其读取进去即可。
from LyScript32 import MyDebug# 传入汇编指令,获取该指令的机器码def get_assembly_machine_code(dbg,asm): passif __name__ == "__main__": dbg = MyDebug() connect_flag = dbg.connect() print("连贯状态: {}".format(connect_flag)) machine_code_list = [] # 开拓堆空间 alloc_address = dbg.create_alloc(1024) print("调配堆: {}".format(hex(alloc_address))) # 失去汇编机器码 machine_code = dbg.assemble_write_memory(alloc_address,"sub esp,10") if machine_code == False: dbg.delete_alloc(alloc_address) # 失去汇编指令长度 machine_code_size = dbg.assemble_code_size("sub esp,10") if machine_code == False: dbg.delete_alloc(alloc_address) # 读取机器码 for index in range(0,machine_code_size): op = dbg.read_memory_byte(alloc_address + index) machine_code_list.append(op) # 开释堆空间 dbg.delete_alloc(alloc_address) # 输入机器码 print(machine_code_list) dbg.close()咱们持续封装如上办法，封装成一个能够间接应用的get_assembly_machine_code函数。
from LyScript32 import MyDebug# 传入汇编指令,获取该指令的机器码def get_assembly_machine_code(dbg,asm): machine_code_list = [] # 开拓堆空间 alloc_address = dbg.create_alloc(1024) print("调配堆: {}".format(hex(alloc_address))) # 失去汇编机器码 machine_code = dbg.assemble_write_memory(alloc_address,asm) if machine_code == False: dbg.delete_alloc(alloc_address) # 失去汇编指令长度 machine_code_size = dbg.assemble_code_size(asm) if machine_code == False: dbg.delete_alloc(alloc_address) # 读取机器码 for index in range(0,machine_code_size): op = dbg.read_memory_byte(alloc_address + index) machine_code_list.append(op) # 开释堆空间 dbg.delete_alloc(alloc_address) return machine_code_listif __name__ == "__main__": dbg = MyDebug() connect_flag = dbg.connect() print("连贯状态: {}".format(connect_flag)) # 转换第一对 opcode = get_assembly_machine_code(dbg,"mov eax,1") for index in opcode: print("0x{:02X} ".format(index),end="") print() # 转换第二对 opcode = get_assembly_machine_code(dbg,"sub esp,10") for index in opcode: print("0x{:02X} ".format(index),end="") print() dbg.close()执行后即可失去后果：
扫描符合条件的内存: 通过应用上方封装的get_assembly_machine_code()并配合scan_memory_one(scan_string)函数，在对端内存搜寻是否存在符合条件的指令。
from LyScript32 import MyDebug# 传入汇编指令,获取该指令的机器码def get_assembly_machine_code(dbg,asm): machine_code_list = [] # 开拓堆空间 alloc_address = dbg.create_alloc(1024) print("调配堆: {}".format(hex(alloc_address))) # 失去汇编机器码 machine_code = dbg.assemble_write_memory(alloc_address,asm) if machine_code == False: dbg.delete_alloc(alloc_address) # 失去汇编指令长度 machine_code_size = dbg.assemble_code_size(asm) if machine_code == False: dbg.delete_alloc(alloc_address) # 读取机器码 for index in range(0,machine_code_size): op = dbg.read_memory_byte(alloc_address + index) machine_code_list.append(op) # 开释堆空间 dbg.delete_alloc(alloc_address) return machine_code_listif __name__ == "__main__": dbg = MyDebug() connect_flag = dbg.connect() print("连贯状态: {}".format(connect_flag)) # 转换成列表 opcode = get_assembly_machine_code(dbg,"push eax") print("失去机器码列表: ",opcode) # 列表转换成字符串 scan_string = " ".join([str(_) for _ in opcode]) print("搜寻机器码字符串: ", scan_string) address = dbg.scan_memory_one(scan_string) print("第一个符合条件的内存块: {}".format(hex(address))) dbg.close()扫描后果如下：
将咱们须要搜寻的ROP指令集片段放到数组内间接搜寻，即可间接返回ROP内存地址。
from LyScript32 import MyDebug# 传入汇编指令,获取该指令的机器码def get_assembly_machine_code(dbg,asm): machine_code_list = [] # 开拓堆空间 alloc_address = dbg.create_alloc(1024) print("调配堆: {}".format(hex(alloc_address))) # 失去汇编机器码 machine_code = dbg.assemble_write_memory(alloc_address,asm) if machine_code == False: dbg.delete_alloc(alloc_address) # 失去汇编指令长度 machine_code_size = dbg.assemble_code_size(asm) if machine_code == False: dbg.delete_alloc(alloc_address) # 读取机器码 for index in range(0,machine_code_size): op = dbg.read_memory_byte(alloc_address + index) machine_code_list.append(op) # 开释堆空间 dbg.delete_alloc(alloc_address) return machine_code_listif __name__ == "__main__": dbg = MyDebug() connect_flag = dbg.connect() print("连贯状态: {}".format(connect_flag)) for item in ["push eax","mov eax,1","jmp eax","pop eax"]: # 转换成列表 opcode = get_assembly_machine_code(dbg,item) #print("失去机器码列表: ",opcode) # 列表转换成字符串 scan_string = " ".join([str(_) for _ in opcode]) #print("搜寻机器码字符串: ", scan_string) address = dbg.scan_memory_one(scan_string) print("第一个符合条件的内存块: {}".format(hex(address))) dbg.close()检索成果如下：