灰帽子Python 学习记录 4

今天一直在撸，以及有点别的事，所幸晚上有点愧疚，还是抽出半个小时搞了一下。

本篇的课题是读取CPU寄存器的值，步骤如下：

1. CreateToolhelp32Snapshot：根据pid获取进程详细信息，如堆、线程、模块等，返回值为一个句柄

2. Thread32First:根据1中句柄获得一个指针，指向包含第一个线程信息的结构

3. Thread32Next：下一个线程的条目，结构跟first一样，通过这个可以写个while循环把进程里所有的线程全遍历出来

4. GetThreadContext获取寄存器的值

5. SetThreadContext改变寄存器的值

这里暂时不改变，只做1~4步。

用notepad ++做实验，结果如下：

Enter pid:75160
OpenProcess Successful, HANDLE 484
Press AnyKey to Continue ...
[*]DumpingregistersforthreadID:0x00016970
[**]EIP:0x75c5896c
[**]ESP:0x0013aec0
[**]EBP:0x0013aed8
[**]EAX:0x00000000
[**]EBX:0x0064be01
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x00027494
[**]EIP:0x77e66bfc
[**]ESP:0x081cf988
[**]EBP:0x081cf9f8
[**]EAX:0x00000000
[**]EBX:0x77be67a0
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x0001240c
[**]EIP:0x77e66bfc
[**]ESP:0x0844f9a8
[**]EBP:0x0844fa18
[**]EAX:0x00000000
[**]EBX:0x00000434
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x000137a4
[**]EIP:0x77e66f1c
[**]ESP:0x0a71fe8c
[**]EBP:0x0a71fef0
[**]EAX:0x00000000
[**]EBX:0x0a71fecc
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x00056ca4
[**]EIP:0x77e6876c
[**]ESP:0x0062fb34
[**]EBP:0x0062fcec
[**]EAX:0x00000000
[**]EBX:0x00678390
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x00058fe0
[**]EIP:0x77e6718c
[**]ESP:0x009ffa60
[**]EBP:0x009ffbf0
[**]EAX:0x00000244
[**]EBX:0x00000000
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x00006778
[**]EIP:0x77e6718c
[**]ESP:0x010ff6d4
[**]EBP:0x010ff864
[**]EAX:0x00000560
[**]EBX:0x00000000
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x000574dc
[**]EIP:0x77e6718c
[**]ESP:0x0329fb58
[**]EBP:0x0329fce8
[**]EAX:0x000005e0
[**]EBX:0x00000000
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x00057738
[**]EIP:0x77e6876c
[**]ESP:0x0382fb54
[**]EBP:0x0382fd0c
[**]EAX:0x00000000
[**]EBX:0x00677fe0
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x00057724
[**]EIP:0x77e6718c
[**]ESP:0x0399f5b0
[**]EBP:0x0399f740
[**]EAX:0x000005f8
[**]EBX:0x00000000
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*]DumpingregistersforthreadID:0x0000b8c0
[**]EIP:0x77e68f00
[**]ESP:0x0311f854
[**]EBP:0x00000000
[**]EAX:0x77e99d20
[**]EBX:0x00000000
[**]ECX:0x00000000
[**]EDX:0x00000000
[*]ENDDUMP
[*] Finished debugging. Exiting...

竟然有11个线程。