2

I want to intercept the API calls of a process to know when a process call to the API rtcMsgBox of the msvbvm60 dll. I have tried it with this code but it seems not to work:

from winappdbg import Debug, EventHandler
import sys
import os

class MyEventHandler( EventHandler ):

    # Add the APIs you want to hook
    apiHooks = {

        'msvbvm60.dll' : [( 'rtcMsgBox'  ,   7  ),],'kernel32.dll' : [( 'CreateFileW'  ,   7  ),],
        }

    # The pre_ functions are called upon entering the API

    def pre_CreateFileW(self, event, ra, lpFileName, dwDesiredAccess,
             dwShareMode, lpSecurityAttributes, dwCreationDisposition,
                                dwFlagsAndAttributes, hTemplateFile):

        fname = event.get_process().peek_string(lpFileName, fUnicode=True)
        print "CreateFileW: %s" % (fname)

    # The post_ functions are called upon exiting the API

    def post_CreateFileW(self, event, retval):
        if retval:
            print 'Suceeded (handle value: %x)' % (retval)
        else:
            print 'Failed!'

if __name__ == "__main__":

    if len(sys.argv) < 2 or not os.path.isfile(sys.argv[1]):
        print sys.argv[1]
        print "\nUsage: %s <File to monitor> [arg1, arg2, ...]\n" % sys.argv[0]
        sys.exit()

    # Instance a Debug object, passing it the MyEventHandler instance
    debug = Debug( MyEventHandler() )

    try:
        # Start a new process for debugging
        p = debug.execv(sys.argv[1:], bFollow=True)

        # Wait for the debugged process to finish
        debug.loop()

    # Stop the debugger
    finally:
        debug.stop()

It works with the CreateFileW API of Kernel32.dll but not with the rtcMsgBox of msvbvm60.dll. Why? What I am doing wrong?

EDIT: By the way I don't know why the code I paste is divided in two pieces of code. The webapp don't parse it correctly but it is just all the same piece of code. Thanks

Tim Peters
  • 67,464
  • 13
  • 126
  • 132
Alberto
  • 701
  • 4
  • 9
  • 25
  • FYI, the entire code section has to be indented 4 spaces - I did that for you just now. Easiest is to select the whole code block, then press Ctrl+K. – Tim Peters Oct 04 '13 at 18:26

0 Answers0