Python - gray hat python

gray hat Python

Python Programming for hackers and reverse engineers

Just in sei tz

GRAY HAT PYTHON

GR AY HAT PY THON
Python Programming for H ack ers and Re ve rs e E n gi n e ers

b y J u s t in S e i tz

San Francisco

GRAY HAT PYTHON. Copyright © 2009 by Justin Seitz. All rights reserved. No part of this work may be reproduced or transmitted in any form or by anymeans, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. 13 12 11 10 09 123456789

ISBN-10: 1-59327-192-1 ISBN-13: 978-1-59327-192-3 Publisher: William Pollock Production Editor: Megan Dunchak Cover Design: Octopod Studios Developmental Editor: TylerOrtman Technical Reviewer: Dave Aitel Copyeditor: Linda Recktenwald Compositors: Riley Hoffman and Kathleen Mish Proofreader: Rachel Kai Indexer: Fred Brown, Allegro Technical Indexing For information on book distributors or translations, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 555 De Haro Street, Suite 250, San Francisco, CA 94107 phone: 415.863.9900; fax: 415.863.9950;info@nostarch.com; www.nostarch.com Librar y of Congress Cataloging-in-Publication Data:
Seitz, Justin. Gray hat Python : Python programming for hackers and reverse engineers / Justin Seitz. p. cm. ISBN-13: 978-1-59327-192-3 ISBN-10: 1-59327-192-1 1. Computer security. 2. Python (Computer program language) I. Title. QA76.9.A25S457 2009 005.8--dc22 2009009107

No Starch Press and the NoStarch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. Theinformation in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it.

Mom, If there’s one thingI wish for you to remember, it’s that I love you very much. Alzheimer Society of Canada—www.alzheimers.ca

BRIEF CONTENTS

Foreword by Dave Aitel ................................................................................................ xiii Acknowledgments ........................................................................................................ xvii Introduction..................................................................................................................xix Chapter 1: Setting Up Your Development Environment .........................................................1 Chapter 2: Debuggers and Debugger Design ...................................................................13 Chapter 3: Building a Windows Debugger......................................................................25 Chapter 4: PyDbg—A Pure Python Windows Debugger.....................................................57 Chapter 5: Immunity Debugger—The Best of Both Worlds ..................................................69 Chapter 6: Hooking ......................................................................................................85 Chapter 7: DLLand Code Injection..................................................................................97 Chapter 8: Fuzzing .....................................................................................................111 Chapter 9: Sulley ........................................................................................................123 Chapter 10: Fuzzing Windows Drivers...