灰帽子Python 学习记录 8 内存断点

内存断点原理：就是通过设置内存块页面的权限，使其成为保护页。这样当CPU访问该页面时，就会触发保护页的访问异常，产生中断。需要调用异常处理函数将权限恢复从而继续执行。

实现步骤：

1. 找函数的地址还是和前面一样

2. 通过VirtualQueryEx传入地址，获取一个填充好的MEMORY_BASIC_INFORMATION结构，里面包含页基址、页大小等信息。

3. VirtualProtectEx设置页面权限为PAGE_GUARD以上

这里注意一个断点函数地址可能跨2个页，所以需要判别基质+大小是否已经跨过了断点地址之后

实验结果：

Enter pid:12808
OpenProcess Successful, HANDLE 520
Get Module Handle 1989869568
Get Address: 0x76a27960
[*]Address of wprintf: 0x76a27960
Event Code: 3 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 2 Thread ID: 13828
Event Code: 2 Thread ID: 13328
Event Code: 2 Thread ID: 14236
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 6 Thread ID: 2812
Event Code: 2 Thread ID: 13348
Event Code: 1 Thread ID: 13348
[*] Exception address: 0x77318d20
[*] Hit the first breakpoint.
Event Code: 4 Thread ID: 13348
Event Code: 1 Thread ID: 2812
Guard Page Access Detected.