#filename:printf_loop.py
from ctypes import *
import time
msvcrt = cdll.msvcrt
counter = 0
for counter in range(0, 100):
msvcrt.printf(b"loop iteration %d\n", counter)
time.sleep(2)
# filename:printf_random.py
# -*- coding:utf-8 -*-
from pydbg import *
from pydbg.defines import *
import struct
import random
# 回调处理例程
def printf_randomizer(dbg):
base_addr = dbg.context.Esp
param0 = dbg.read_process_memory(base_addr + 0x8, 4)
param0 = struct.unpack("L", param0)[0]
print("param0={0:d}".format(int(param0)))
random_value = random.randint(1, 100)
random_value = struct.pack("L", random_value)[0]
dbg.write_process_memory(base_addr + 0x8, random_value)
return DBG_CONTINUE
dbg = pydbg()
pid = raw_input("input pid of printf_loop.py:")
print(pid)
dbg.attach(int(pid))
printf_func_addr = dbg.func_resolve("msvcrt", "printf")
dbg.bp_set(printf_func_addr, description="printf_func_addr", handler=printf_randomizer)
dbg.run()