32位汇编- 汇编实现调试器

2019-09-26
之前的笔记搬运
实现代码

详细看注释吧,两天写完的比较粗糙, 一大堆bug, 哈哈哈, 就是熟悉下汇编
 .386                 ;32位
 .model flat,stdcall  ;平躺模式, 默认stdcall调用方式
 option casemap:none  ;大小写敏感
 
include  MyDBG.inc

MEMBP STRUCT
  dwMemBP  DWORD ?
  dwLen DWORD ?
  dwOldProtect DWORD ?
MEMBP ENDS

.const
    g_szPath db "winmine.exe",0   
    g_szInputCoomd db "请输入命令:  ",0   
    g_szOutputAsmFormat db "%p:%s        %s ", 0Dh, 0Ah, 0
    g_szHexFormat db "%x", 0
    g_szBigHexFormat db "%X ", 0
    g_szNewLine  db 0Dh, 0Ah, 0
    g_szRegFormat db "eax=%p" , 0Dh, 0Ah, "ecx=%p" , 0Dh, 0Ah, "ebx=%p" , 0Dh, 0Ah, "edx=%p" , 0Dh, 0Ah, "esp=%p" , 0Dh, 0Ah, "ebp=%p" , 0Dh, 0Ah, "esi=%p" , 0Dh, 0Ah, "edi=%p" , 0Dh, 0Ah, "eip=%p" , 0Dh, 0Ah, "Eflags=%p" , 0Dh, 0Ah, 0
    g_szInputError db "输入错误请重新输入! ", 0Dh, 0Ah,0   
    g_szMemBp db "内存断点已断下", 0Dh, 0Ah,0   
    g_szG db "g", 0
    g_szD db "d", 0   
    g_szU db "u", 0   
    g_szR db "r", 0   
    g_szE db "e", 0   
    g_szMBP db "mbp", 0   
    g_szMBL db "mbl", 0   
    g_szMBC db "mbc", 0   
.data
    g_hProc DWORD ?
    g_hThread DWORD ?
    g_dwCCBreakPoint DWORD ?
    g_aryMemBp MEMBP <0>
    g_dwOldCommd DWORD ?
    
.code
SetCCBreakPoint proc  pAddr:ptr DWORD , OldCoed:ptr BYTE
        LOCAL @byCC:BYTE
 ;保存旧指令
    invoke ReadProcessMemory, g_hProc,  pAddr,  OldCoed, sizeof OldCoed, NULL
    .if !eax
        mov eax,FALSE
        ret
    .endif

    mov @byCC, 0CCh
    ;写入CC断点
    invoke WriteProcessMemory, g_hProc,  pAddr,  addr @byCC, sizeof @byCC, NULL

     ret
SetCCBreakPoint endp

;恢复原指令
ResetCCBreakPoint proc pAddr:ptr DWORD , OldCoed:ptr BYTE
    ;还原指令
    invoke WriteProcessMemory, g_hProc,  pAddr,  OldCoed, sizeof OldCoed, NULL
    ret
ResetCCBreakPoint endp


;获取指定地址反汇编
ShowDisAsm proc pAddr:ptr DWORD 
    LOCAL @acCode[32]:BYTE
    LOCAL @szAsmBuf[80]:BYTE
    LOCAL @szOpcodeBuf[80]:BYTE
    LOCAL @nCodeSize:DWORD
    LOCAL @nCodeAddress:DWORD

     ;读取机器码
    invoke ReadProcessMemory, g_hProc,  pAddr,  addr @acCode, sizeof @acCode, NULL

    ;显示汇编指令
    invoke Decode2AsmOpcode, addr @acCode, addr @szAsmBuf, addr @szOpcodeBuf, addr @nCodeSize, pAddr
    invoke crt_printf, offset g_szOutputAsmFormat, pAddr, addr @szOpcodeBuf, addr @szAsmBuf
    ret

ShowDisAsm endp
;获取字符串的下一个有效数据
GetNextData proc strInput:ptr DWORD, NewStrInput:ptr DWORD
        .while TRUE
            mov edx, strInput
            mov edx, [edx]
            .if dl == 20h ||  dl == 0h;空格或结束了
                .break
            .endif
            inc strInput
       .endw
      add strInput, 1          ;定位到Data处
      invoke crt_atoi,  strInput ;字符串转整形
      ;跟新strinput指针
      mov edx, NewStrInput
      mov ecx, strInput
      mov [edx], ecx
      ret 
GetNextData endp

;把字符串解析成命令
AnalysisString proc  strInput:ptr DWORD, strCommd:ptr BYTE, pAddr:ptr DWORD, pArg1:ptr DWORD, pArg2:ptr DWORD
    LOCAL @dwResult1:DWORD
    LOCAL @dwResult2:DWORD
    LOCAL @dwTmpAddr:DWORD
     ;确认第一个字符不是空格
     .while TRUE
        mov edx, strInput
        mov edx, [edx]
        .if dl != 20h ;空格
            .break
        .endif
        add strInput, 1
    .endw

    ;获取命令长度并且拷贝至strCommd
    invoke GetNextData, strInput, addr @dwTmpAddr
    mov eax, @dwTmpAddr
    sub eax, strInput
    dec eax  ;去掉空格的命令长度
    invoke crt_memcpy, strCommd, strInput, eax
;    mov edx, strInput
;    mov edx, [edx]
;    mov eax, strCommd
;    mov byte ptr [eax], dl ;把指令给strCommd
    invoke GetNextData, strInput, addr strInput
;    add strInput, 2            ;定位到addr处

    mov edx, strCommd
    mov edx, [edx]
    .if dl == 'g' || dl == 'u' || dl == 'd' || dl == 'r' || dl == 'e'
        invoke crt_sscanf, strInput, offset g_szHexFormat, pAddr    ;获取地址
    .endif

    

    invoke crt_strcmp, strCommd,  offset g_szD
    .if eax == 0
      invoke GetNextData,  strInput, addr strInput
      mov edx, pArg1
      mov [edx], eax             ;获取arg1
    .endif

    invoke crt_strcmp, strCommd, offset g_szE
    .if eax == 0
      invoke GetNextData,  strInput, addr strInput
      mov edx, pArg1
      mov [edx], eax             ;获取arg1
      invoke GetNextData,  strInput, addr strInput
      mov edx, pArg2
      mov [edx], eax             ;获取arg2
    .endif

    invoke crt_strcmp, strCommd, offset g_szMBP
    .if eax == 0
        invoke crt_sscanf, strInput, offset g_szHexFormat, pAddr    ;获取地址
        invoke GetNextData,  strInput, addr strInput
        mov edx, pArg1
        mov [edx], eax             ;获取arg1
        invoke GetNextData,  strInput, addr strInput
        mov edx, pArg2
        mov [edx], eax             ;获取arg2
    .endif

    invoke crt_strcmp, strCommd,  offset g_szMBC
    .if eax == 0
      invoke GetNextData,  strInput, addr strInput
      mov edx, pArg1
      mov [edx], eax             ;获取arg1
    .endif



    mov eax, TRUE
    ret

AnalysisString endp

;接受并处理命令
UseCommd proc Context: ptr CONTEXT
    LOCAL @szInput[255]:BYTE
    LOCAL @byteMemory[300]:BYTE
    LOCAL @szCommd[20]:BYTE
    LOCAL @Addr:DWORD
    LOCAL @Arg1:DWORD
    LOCAL @Arg2:DWORD
    LOCAL @dwCount:DWORD
     

    ;清0
    invoke ZeroMemory, addr @szInput, sizeof @szInput
    invoke ZeroMemory, addr @byteMemory, sizeof @byteMemory
    invoke ZeroMemory, addr @szCommd, sizeof @szCommd
    invoke ZeroMemory, addr @Addr, sizeof @Addr
    invoke ZeroMemory, addr @Arg1, sizeof @Arg1
    invoke ZeroMemory, addr @Arg2, sizeof @Arg2
    

LABLE_INPUT:
    invoke crt_printf, offset  g_szInputCoomd
    invoke crt_gets, addr @szInput
    ;解析字符串
    invoke AnalysisString, addr @szInput,  addr @szCommd, addr @Addr, addr @Arg1, addr @Arg2



    ;G命令
    invoke crt_strcmp, addr @szCommd, offset g_szG
    .if eax == 0
        .if @Addr != NULL
             mov edx, @Addr
             mov g_dwCCBreakPoint, edx
             invoke SetCCBreakPoint, g_dwCCBreakPoint,  offset g_dwOldCommd            
        .endif
         jmp LABLE_GOON
    .endif
    
    ;U命令
    invoke crt_strcmp, addr @szCommd, offset g_szU
    .if eax == 0 && @Addr != NULL
         invoke ShowDisAsm, @Addr
         jmp LABLE_INPUT        
    .endif

    ;R命令
    invoke crt_strcmp,addr  @szCommd, offset  g_szR
    .if eax == 0 
         mov ebx, Context
         assume ebx : ptr CONTEXT
         invoke crt_printf, offset g_szRegFormat, [ebx].regEax, [ebx].regEcx, [ebx].regEbx, [ebx].regEdx, [ebx].regEsp, [ebx].regEbp, [ebx].regEsi, [ebx].regEdi, [ebx].regEip, [ebx].regFlag
         jmp LABLE_INPUT        
    .endif

    ;D命令
    invoke crt_strcmp, addr @szCommd, offset g_szD
    .if eax == 0 
        ;读取内存
        invoke ReadProcessMemory, g_hProc, @Addr,  addr @byteMemory,  @Arg1, NULL
        mov @dwCount, 0
        ;循环把内存打印出来
        .while TRUE
             mov eax, @Arg1
            .if @dwCount >= eax
                .break
            .endif
            invoke crt_printf, offset g_szBigHexFormat, @byteMemory
            inc @byteMemory
            inc @dwCount
        .endw
        invoke crt_printf, offset g_szNewLine
         jmp LABLE_INPUT        
    .endif

    ;E命令
    invoke crt_strcmp, addr @szCommd, offset g_szE
    .if eax == 0 && @Addr != NULL
         invoke WriteProcessMemory, g_hProc,  @Addr,  addr @Arg1, @Arg2, NULL
         jmp LABLE_INPUT        
    .endif

    ;MBP命令
    invoke crt_strcmp, addr @szCommd, offset g_szMBP
    .if eax == 0
         mov eax, @Addr
         mov g_aryMemBp.dwMemBP, eax
         mov eax, @Arg1
         mov g_aryMemBp.dwLen, eax
         invoke VirtualProtectEx, g_hProc, g_aryMemBp.dwMemBP, g_aryMemBp.dwLen, PAGE_NOACCESS, addr g_aryMemBp.dwOldProtect
         jmp LABLE_GOON        
    .endif

    ;到这里说明输入指令有误
    invoke crt_printf, addr g_szInputError
    jmp LABLE_INPUT      

LABLE_GOON:
    ret

UseCommd endp

;断点异常处理
OnExceptionBreakPoint proc pdv:ptr DEBUG_EVENT
    LOCAL @dwRet:DWORD
    LOCAL @Context:CONTEXT


    mov ebx, pdv
    assume ebx : ptr DEBUG_EVENT
    mov @dwRet, DBG_EXCEPTION_NOT_HANDLED
    mov eax, [ebx].u.Exception.pExceptionRecord.ExceptionAddress
    
    .if  eax != g_dwCCBreakPoint
        ;判断是否是自己的断点
        mov eax, @dwRet
        ret
    .endif



    ;获取并设置CONTEXT
    invoke ZeroMemory, addr @Context, sizeof @Context
    or @Context.ContextFlags, CONTEXT_ALL
    invoke GetThreadContext, g_hThread, addr @Context
    ;EIP需要-1 因为int 3已经执行过了才会断下, 需要把执行流程改回去
    dec @Context.regEip

    ;还原代码
    invoke ResetCCBreakPoint, g_dwCCBreakPoint, offset g_dwOldCommd
    ;显示反汇编
    invoke ShowDisAsm, g_dwCCBreakPoint

    invoke UseCommd, addr @Context

    invoke SetThreadContext, g_hThread, addr @Context
    ;修改返回值表示这个断点异常已经被调试器处理
    mov @dwRet, DBG_CONTINUE
  
    mov eax, @dwRet
    ret
OnExceptionBreakPoint endp

OnExceptionSingleStep proc pdv:ptr DEBUG_EVENT
    LOCAL @dwRet:DWORD
    LOCAL @Context:CONTEXT
    LOCAL @byCC:BYTE
    LOCAL @dwCodeLen:DWORD


    mov ebx, pdv
    assume ebx : ptr DEBUG_EVENT
    mov @dwRet, DBG_EXCEPTION_NOT_HANDLED   
    
      ;获取并设置CONTEXT
    invoke ZeroMemory, addr @Context, sizeof @Context
    or @Context.ContextFlags, CONTEXT_ALL
    invoke GetThreadContext, g_hThread, addr @Context
    ;invoke ShowDisAsm, @Context.regEip
    
    ;重新设置内存
    invoke VirtualProtectEx, g_hProc, g_aryMemBp.dwMemBP, g_aryMemBp.dwLen, PAGE_NOACCESS, addr g_aryMemBp.dwOldProtect

    invoke SetThreadContext, g_hThread, addr @Context
    ;修改返回值表示这个断点异常已经被调试器处理
    mov @dwRet, DBG_CONTINUE
    mov eax, @dwRet
    ret    
    
OnExceptionSingleStep endp

OnExceptionAccessViolation proc pdv:ptr DEBUG_EVENT
    LOCAL @dwRet:DWORD
    LOCAL @Context:CONTEXT
    LOCAL @dwAccessVioAddr:DWORD
    LOCAL @dwAccessVioType:DWORD    
    LOCAL @dwAcessVoiBase:DWORD
    LOCAL @dwMmAddrBase:DWORD


    mov ebx, pdv
    assume ebx : ptr DEBUG_EVENT
    mov @dwRet, DBG_EXCEPTION_NOT_HANDLED   
    ;获取异常地址和异常类型
    lea eax, [ebx].u.Exception.pExceptionRecord.ExceptionInformation
    mov edx,[eax]
    mov @dwAccessVioType, edx
    add eax, 4
    mov edx, [eax]
    mov @dwAccessVioAddr , edx

    ;判断是不是自己造成异常的页
    mov eax, @dwAccessVioAddr
    and eax, 0fffff000h
    mov @dwAcessVoiBase, eax
    mov eax, g_aryMemBp.dwMemBP
    and eax, 0fffff000h
    mov @dwMmAddrBase, eax
    .if @dwAcessVoiBase != eax
        mov eax, @dwRet
        ret
    .endif


    invoke ZeroMemory, addr @Context, sizeof @Context
    or @Context.ContextFlags, CONTEXT_ALL
    invoke GetThreadContext, g_hThread, addr @Context
    
    mov eax, g_aryMemBp.dwMemBP
    .if eax <= @dwAccessVioAddr
        add eax, g_aryMemBp.dwLen
        .if @dwAccessVioAddr <= eax
                invoke ShowDisAsm, @dwAccessVioAddr
                invoke crt_printf, offset  g_szMemBp 
                invoke UseCommd, addr @Context
        .endif
    .endif



    ;断步配合
    ;恢复原来的属性
    invoke VirtualProtectEx, g_hProc, g_aryMemBp.dwMemBP, g_aryMemBp.dwLen, g_aryMemBp.dwOldProtect, addr g_aryMemBp.dwOldProtect
    or @Context.regFlag, 100h
    invoke SetThreadContext, g_hThread, addr @Context

    mov @dwRet, DBG_CONTINUE
    mov eax, @dwRet
    ret

OnExceptionAccessViolation endp

;EXCEPTION事件处理
OnExceptionDebugEvent proc pdv:ptr DEBUG_EVENT
    LOCAL @dwRet:DWORD


    mov ebx, pdv
    assume ebx : ptr DEBUG_EVENT

    mov @dwRet, DBG_EXCEPTION_NOT_HANDLED
    .if [ebx].u.Exception.pExceptionRecord.ExceptionCode == EXCEPTION_BREAKPOINT
        ;断点异常
        invoke OnExceptionBreakPoint, ebx
        mov @dwRet, eax
    .elseif [ebx].u.Exception.pExceptionRecord.ExceptionCode == EXCEPTION_SINGLE_STEP
        ;单步异常
        invoke OnExceptionSingleStep, ebx
        mov @dwRet, eax
    .elseif [ebx].u.Exception.pExceptionRecord.ExceptionCode == EXCEPTION_ACCESS_VIOLATION
        ;单步异常
        invoke OnExceptionAccessViolation, ebx
        mov @dwRet, eax
    .endif
    mov eax, @dwRet
    ret
OnExceptionDebugEvent endp

;创建进程事件处理
OnCreateProcessDebugEvent proc pdv:ptr DEBUG_EVENT
    LOCAL @dwRet:DWORD
    LOCAL @byCC:BYTE
    
    mov ebx, pdv
    assume ebx : ptr DEBUG_EVENT
    mov @dwRet, DBG_EXCEPTION_NOT_HANDLED
    
    ;把入口点设置断点
    mov eax, [ebx].u.CreateProcessInfo.lpStartAddress
    mov g_dwCCBreakPoint, eax

    invoke SetCCBreakPoint, g_dwCCBreakPoint,  offset g_dwOldCommd

    
    mov eax, @dwRet
    ret
OnCreateProcessDebugEvent endp

;进入处理事件循环
EnterDebugLoop proc  dv : ptr DEBUG_EVENT
   LOCAL @dwRet: DWORD
   LOCAL @szBuf[50]: BYTE
     .while TRUE
        ;默认返回值是调试器不处理
        mov @dwRet, DBG_EXCEPTION_NOT_HANDLED
        ;等待调试事件
        invoke WaitForDebugEvent, dv, INFINITE
        .if !eax
            invoke GetLastError
            ret
        .endif
        
        mov ebx, dv
        assume ebx : ptr DEBUG_EVENT
        ;判断事件类型
        .if [ebx].dwDebugEventCode == CREATE_PROCESS_DEBUG_EVENT
            invoke OnCreateProcessDebugEvent, ebx
            mov @dwRet, eax
        .elseif [ebx].dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT
        .elseif [ebx].dwDebugEventCode == LOAD_DLL_DEBUG_EVENT
; ;           invoke OnLoadDllDebugEvent, ebx
;            mov @dwRet, eax
        .elseif [ebx].dwDebugEventCode == UNLOAD_DLL_DEBUG_EVENT
        .elseif [ebx].dwDebugEventCode == CREATE_THREAD_DEBUG_EVENT
        .elseif [ebx].dwDebugEventCode == EXIT_THREAD_DEBUG_EVENT
        .elseif [ebx].dwDebugEventCode == OUTPUT_DEBUG_STRING_EVENT
        .elseif [ebx].dwDebugEventCode == RIP_EVENT
        .elseif [ebx].dwDebugEventCode == EXCEPTION_DEBUG_EVENT
            invoke OnExceptionDebugEvent, ebx
            mov @dwRet, eax
        .endif
        
        invoke ContinueDebugEvent, [ebx].dwProcessId, [ebx].dwThreadId, @dwRet


    .endw
EnterDebugLoop endp

;;创建事件
CreateDebugDialog proc
	LOCAL @si:STARTUPINFO
	LOCAL @pi:PROCESS_INFORMATION
        LOCAL @dv:DEBUG_EVENT

	invoke ZeroMemory, addr @si, sizeof @si
	mov eax, sizeof @si
	mov @si.cb, eax
	invoke ZeroMemory, addr @pi, sizeof @si
       
         ;DEBUG_ONLY_THIS_PROCESS 模式创建进程
	invoke CreateProcess, NULL, offset g_szPath, NULL, NULL, FALSE, \
	                                     DEBUG_ONLY_THIS_PROCESS, NULL, NULL, addr @si,  addr @pi
	.if !eax
            ret
	.endif

        ;保存进程和线程ID
        mov eax, @pi.hProcess
        mov g_hProc, eax
        mov eax, @pi.hThread
        mov g_hThread, eax
        ;处理会话事件
        invoke EnterDebugLoop, addr @dv
       
CreateDebugDialog endp

start:

	invoke CreateDebugDialog
	invoke ExitProcess, 0
end start
效果图

QQ图片20190922135553.png