MindshaRE: An Introduction to PyKDJuly 19, 2018 | Abdul-Aziz Hariri
In our previous MindshaRE blogs, we discussed ways to find variants while bug hunting. In this blog, we decided to talk about something a little bit different, which is dynamic analysis. Specifically, we’ll look at scripting PyKD to achieve certain tasks.
PyKD helps in automating debugging tasks and crash dump analysis using python. The nice thing about PyKD is that it can be used in a standalone script or from inside WinDBG.
Installation of PyKD is straight forward - especially if we want to use it from inside WinDBG. To start, download the bootstrapper from https://githomelab.ru/pykd/pykd, then extract the DLL for the desired architecture (x86 or x64) to the
winext directory of your WinDBG installation.
Once you have it copied, you can verify that it’s functioning correctly by loading pykd then executing “!help”:
You can also get an interactive console through the “!py” command in windbg:
0:008> !pip install pykd
Installing collected packages: pykd
Successfully installed pykd-0.3.3.4
Executing Python scripts from inside WinDBG
PyKD has a rich API that allows us to do most of the functionalities that we do from inside WinDBG but from a python script.
One of the easiest functions to get started with is
dbgCommand, which allows us to execute windbg commands from inside python.
Something a little bit more meaningful
In order to achieve this task, I’ll be using the following PyKD APIs:
pykd.module(mod_name): Takes the name of a loaded module as an argument.
pykd.module(mod_name).begin(): Returns the base address of a loaded module.
pykd.setBp(addr,handler): Takes two arguments the address of where to set the breakpoint and a function handler that handles the breakpoint when it gets hit.
pykd.reg(register): Returns the value of a specific register.
pykd.loadPtrs(addr,num): Dereferences an address and returns pointers in a list.
pykd.loadWStr(addr): Load a unicode string from addr.
pykd.go(): Continues execution.
pykd.dprintln(str): Outputs a string in windbg window.
That’s it for today. In our next PyKD-related MindshaRE blog, we’ll dig deeper in PyKD and show how to write a small script that detects and records crashes for fuzzing purposes.