أداة لتسهيل إستخراج عدد البايتات الازمة للكتابة على المسجّل eip أو seh

AAAAAAAAAAAAABBBBBBBBBBBBBBBBBCCCCCCCCCCCDDDDDDDD
AAAAAAAAAAAAABBBBBBBBBBBBBBBBBCCCCCCCCCCCDDDDDDDD
AAAAAAAAAAAAABBBBBBBBBBBBBBBBBCCCCCCCCCCCDDDEEEEEE
....

#!/usr/bin/env python
#
#    Copyright 2011 B4r4k47 [Barakat] <b4r4k47[at]hotmail[dot]com>
#
#    This tool is available for free under the GNU General Public License V3 (GPL).
#    To read the full license, please visit: http://www.gnu.org/licenses/lgpl.html
#    I hope you find it useful :)
#

from sys import argv
from random import choice

def randomdata(file_name,chars_eip):

    if (chars_eip <= 0) :
        help()

    elif (len(str(file_name)) == 0 ):
        help()

    else :
        pass

    # If there were bad characters, you can remove them from this list :
    characters_list = [
    "\x41", "\x42", "\x43", "\x44", "\x45", "\x46", "\x47", "\x48", "\x49", "\x4a",
    "\x4b", "\x4c", "\x4d", "\x4e", "\x4f", "\x50", "\x51", "\x52", "\x53", "\x54",
    "\x55", "\x56", "\x57", "\x58", "\x59", "\x5a", "\x61", "\x62", "\x63", "\x64",
    "\x65", "\x66", "\x67", "\x68", "\x69", "\x6a", "\x6b", "\x6c", "\x6d", "\x6e",
    "\x6f", "\x70", "\x71", "\x72", "\x73", "\x74", "\x75", "\x76", "\x77", "\x78",
    "\x79", "\x7a", "\x31", "\x32", "\x33", "\x34", "\x35", "\x36", "\x37", "\x38",
    "\x39", "\x21", "\x40", "\x23", "\x24", "\x25", "\x26"]

    file = open(file_name,"w")
    number = chars_eip

    while (chars_eip != 0):
    
        file.write(choice(characters_list))
        chars_eip -= 1
    file.close()

    print "\n[*] Done:",number,"charscters has been written to the file",file_name,"\n"


def geteip(file_name,chars_eip):

    chars_eip = chars_eip.upper()

    char1 = chr(int(chars_eip[6:8],16))
    char2 = chr(int(chars_eip[4:6],16))
    char3 = chr(int(chars_eip[2:4],16))
    char4 = chr(int(chars_eip[0:2],16))
    eip = char1 + char2 + char3 + char4

    file = open(file_name,"r").read()
    order =  file.find(eip)

    if (order == -1):
        print "\n[!] Not found, please check that you've typed the new EIP value correctly.\n"
    else:
        print "\n[*] Done: [", order , "junk bits ] [ The next 4 bits(charscters) will overwrite the EIP ]\n"

def help():
    print '''\n usage: tool.py [Option: -c -g] [File name] [Charscters length / EIP Address]

 Options:

    -c    :Generate random characters and write them into a file.
    -g    :Get the characters length that's needed in order to
         overwrite the EIP value from an existing file.

 Examples:

    tool.py -c file.txt 1500
    tool.py -g file.txt 41242A6C
'''
    exit()


if (__name__ == "__main__"):

    try:
        option        = argv[1]
        file_name    = argv[2]
        chars_eip    = argv[3]

        if (option == "-c"):
            chars_eip = int(chars_eip)
            randomdata(file_name,chars_eip)

        elif (option == "-g"):

            if (len(chars_eip) < 8):
                help()
            else:
                geteip(file_name,chars_eip)
        else:
            help()

    except:
        help()

usage: tool.py [Option: -c -g] [File name] [Charscters length / EIP Address]

 Options:

    -c    :Generate random characters and write them into a file.
    -g    :Get the characters length that's needed in order to
         overwrite the EIP value from an existing file.

 Examples:

    tool.py -c file.txt 1500
    tool.py -g file.txt 41242A6C

> python tool.py -c file.m3u 1500

> python tool.py -g file.m3u  696E2F65

[*] Done: [ 1223 junk bits ] [ The next 4 bits(charscters) will overwrite the EIP ]