在Python中设置一个x86寄存器以在调用的DLL函数中使用

Question

Background

To use Python to call a non-exported DLL function. The function to be called assumes that one of the General Registers is already set to the location of a buffer - it is not set through stack variables. The buffer will be owned by the Python script. Ideally, the solution should run stand-alone, rather than within the context of a debugger.

Problem

Is it possible to use Python to set one of the x86 registers, in this case ECX, to the memory location of a Python variable prior to calling the DLL function? (and without the process of obtaining/storing the register trashing it).

Considered Approaches

I have looked at several approaches, all of which seem relatively heavyweight, and I quickly reach the extent of my knowledge:

• Using GetThreadContext - I presume this would require running the DLL function in a separate thread, obtaining and updating the thread context - if this would be a good way to go, it would be good to have a high-level approach
• Using some form of corepy/pyasm to build a small program - may risk trashing registers prior to calling DLL function.
• Using the Python script within a debugger such as Immunity Debugger - this would solve most of the issues, but ideally we would like the script to run stand-alone.

I would be very grateful for any suggestions on how to approach this.

Answer 1

I think the only practical way to do this is to write the code that calls the function in asm. Only by controlling it at that level can you be sure that no other party will modify a register.

One way would be to do it statically and have a compiler/linker build a DLL that you can call from your Python code, passing whatever information is needed. Specifically the function address and any parameters needed to pass to the function.

Another way would be to generate the code at runtime with some sort of jitter like dynamic code generator. This approach is probably harder to get right, although it offers the prospect of greater flexibility.