python灰帽子-修改其他进程中的函数调用参数

#filename:printf_loop.py

from ctypes import *
import time

msvcrt = cdll.msvcrt
counter = 0

for counter in range(0, 100):
    msvcrt.printf(b"loop iteration %d\n", counter)
    time.sleep(2)

# filename:printf_random.py
# -*- coding:utf-8 -*-

from pydbg import *
from pydbg.defines import *

import struct
import random

# 回调处理例程
def printf_randomizer(dbg):
	base_addr = dbg.context.Esp
	param0 = dbg.read_process_memory(base_addr + 0x8, 4)
	
	param0 = struct.unpack("L", param0)[0]
	print("param0={0:d}".format(int(param0)))
	
	random_value = random.randint(1, 100)
	random_value = struct.pack("L", random_value)[0]
	
	dbg.write_process_memory(base_addr + 0x8, random_value)
	return DBG_CONTINUE

dbg = pydbg()
pid = raw_input("input pid of printf_loop.py:")
print(pid)
dbg.attach(int(pid))
printf_func_addr = dbg.func_resolve("msvcrt", "printf")
dbg.bp_set(printf_func_addr, description="printf_func_addr", handler=printf_randomizer)
dbg.run()