winpwn: pwntools for windows

windows debug and exploit toolset for both user and kernel mode

pre

1. support python2/python3
2. support windbg/windbgx

setup

1. pip/pip3 install winpwn
2. optional:
   • launch debugger: modify file .winpwn and copy it to windows HOMEDIR(python: os.path.expanduser("~\\.winpwn"))
   • pip install pefile
   • pip install keystone
   • pip install capstone

usage

process

p=process("./pwn")
p=process(["./pwn", "argv[1]", "argv[2]"])
p.readm(addr, n) # read process memoryp.writem(addr, con="") # write process memory

remote

r=remote("127.0.0.1", 65535)

context

context.timeout=512context.debugger="gdb"# or "windbg" or "x64dbg" or "windbgx"context.endian="little"context.log_level=""# or "debug"context.terminal= []
context.newline="\r\n"context.arch="i386"# or "amd64"content.pie=Nonecontext.dbginit=None# used to set debugger init scriptcontext.windbg=None# set debugger path, or use .winpwn to find debugger pathcontext.windbgx=Nonecontent.gdb=Nonecontext.x64dbg=Nonecontext.nocolor=None# if set, will print non-colorful output to terminal

debug: windbg/windbgx

for details, take a look at dbg.py

windbgx.attach(p, script="bp 0x401000") # debug local processwindbgx.remote("127.0.0.1,1234") # attach to dbgsrv to debug process remotelywindbgx.com(...) # debug kernel with serial portwindbgx.net(...) # debug kernel with kdnet

asm/disasm:

asm("push ebp")
disasm("\x55")

configure

if you want to use debugger like gdb-peda, you need to deal with the deps yourself

windbgx/windbg

1. pykd
2. bywin

photos

windbgx/windbg

refs

1. https://github.com/masthoon/pwintools
2. https://github.com/hakril/PythonForWindows