Traum Library - БИБЛИОТЕКА ТРАУМА

Недавно наткнулся в сети на Traum library - это огромнейшая библиотека электронных книг в

формате fb2, epub и т.п. Советую всем - тут можно взять уже готовый сборник .

python script which finds hex values in a file

Recently I needed to parse a few log files and then to compare them in WinMerge utility. Files had different structure, but they both contained HEX values which had to be verified for compliance.

Thus, I created a simple python script ( thanx Google :) )  which looks for hex values in a file using regexp . Actually, this script walks through a specified folder where files are and then creates parsed output files containing HEX values with an additional '_hex.txt' extension in their names

Here is a script:

import os
import re
def look_for_hex_in_files(filepath,writefilepath):
    f = open(filepath, 'r')
    fwr = open(writefilepath, 'w')
    for line in f:
        b = line
        for b1 in re.finditer('0x0*[0-9a-fA-F][0-9a-fA-F]*', b):
            a = (b1.group(0))
            print(a)
            fwr.write(a+'\n')
    f.close()
    fwr.close()

#this is a path to folder containing input log files to be parsed
dirname = "C:\ProgramData\log1"

for filename in os.listdir(dirname):
    b1 = (os.path.join(dirname,filename))
    if os.path.isfile(b1):
        print(b1)
        filepath = b1;
        writefilepath = (b1+"_hex.txt")
        look_for_hex_in_files(filepath,writefilepath)

the case of inline hook by RkU

One day RkU showed an inline hook:

RkUnhooker report generator v0.7
==============================================
Rootkit Unhooker kernel version: 3.8.380.580
==============================================
Windows Major Version: 5
Windows Minor Version: 1
Windows Build Number: 2600
==============================================
 ntkrnlpa.exe+0x0006ECBE, Type: Inline - RelativeJump 0x80545CBE [ntkrnlpa.exe]


I've decided to investigate what the real problem was.
First thing I did was checking nt image loaded into memory:

kd>  !chkimg -d nt
 80537028-8053702c 5 bytes - nt!ExAllocatePool (+0x3c7ae )
 also here were about 4 hooks with 5 bytes each ....



Here we can see that real address of nt!ExAllocatePool  (0x8053702c) is changed to 0x80537028

I viewed disassembling of the real 0x8053702c address

0: kd> u 8053702c
nt!ExAllocatePool+0x4:
8053702c 39684e cmp dword ptr [eax+4Eh],
ebp
8053702f 6f outs dx,dword ptr [esi]
80537030 6e outs dx,byte ptr [esi]
80537031 65ff750c push dword ptr gs:[ebp+0Ch]
80537035 ff7508 push dword ptr [ebp+8]
80537038 e82b490100 call nt!ExAllocatePoolWithTag (8054b968)
8053703d 5d pop ebp
8053703e c20800 ret 8

Then I wanted to see what code has been at 0x80537028 address:

0: kd> u 80537028
nt!ExAllocatePool:
*** ERROR: Module load completed but symbols could not be loaded for svenbowm.SYS
80537028 e90c98e939 jmp svenbowm+0x839 (ba3d0839)
8053702d 684e6f6e65 push 656E6F4Eh
80537032 ff750c push dword ptr [ebp+0Ch]
80537035 ff7508 push dword ptr [ebp+8]
80537038 e82b490100 call nt!ExAllocatePoolWithTag (8054b968)
8053703d 5d pop ebp
8053703e c20800 ret 8
80537041 cc int 3

So here's an answer: the module svenbown made inline hook at address 0x80537028 .
This module <svenbown> refers to RkU driver.
So I had no fear that my system had been infected by some malicious software. It was only RkU's inline hook :-) which had been set as soon as RkU's driver had been loaded .