def init_prototypes(): """Call this function only when the debugger is started""" if LocByName("kernel32_GetCommandLineA") == idaapi.BADADDR: return False global getcmdline, getlasterror, loadlib, releasesem, resetevent, setlasterror, termthread, virtalloc, virtprot, getprocaddr getcmdline = Appcall.proto("kernel32_GetCommandLineA", "const char *__stdcall getcmdline();") getlasterror = Appcall.proto("kernel32_GetLastError", "DWORD __stdcall GetLastError();") loadlib = Appcall.proto("kernel32_LoadLibraryA", "int __stdcall loadlib(const char *fn);") freelib = Appcall.proto("kernel32_FreeLibrary", "BOOL __stdcall FreeLibrary(int hLibModule);") releasesem = Appcall.proto("kernel32_ReleaseSemaphore", "BOOL __stdcall ReleaseSemaphore(HANDLE hSemaphore, LONG lReleaseCount, LPLONG lpPreviousCount);") resetevent = Appcall.proto("kernel32_ResetEvent", "BOOL __stdcall ResetEvent(HANDLE hEvent);") setlasterror = Appcall.proto("kernel32_SetLastError", "void __stdcall SetLastError(int dwErrCode);") termthread = Appcall.proto("kernel32_TerminateThread", "BOOL __stdcall TerminateThread(HANDLE hThread, DWORD dwExitCode);") virtalloc = Appcall.proto("kernel32_VirtualAlloc", "int __stdcall VirtualAlloc(int addr, SIZE_T sz, DWORD alloctype, DWORD protect);") virtprot = Appcall.proto("kernel32_VirtualProtect", "BOOL __stdcall VirtualProtect(LPVOID addr, DWORD sz, DWORD newprot, PDWORD oldprot);") getprocaddr = Appcall.proto("kernel32_GetProcAddress", "int __stdcall GetProcAddress(int hModule, LPCSTR lpProcName);") return True def get_appdata(): hshell32 = loadlib("shell32.dll") if hshell32 == 0: print "failed to load shell32.dll" return False print "%x: shell32 loaded" % hshell32 # make sure you refresh the debugger memory after we load a new library RefreshDebuggerMemory() # resolve the function address p = getprocaddr(hshell32, "SHGetSpecialFolderPathA") if p == 0: print "shell32.SHGetSpecialFolderPathA() not found!" return False # create a prototype shgetspecialfolder = Appcall.proto(p, "BOOL SHGetSpecialFolderPath(HWND hwndOwner, LPSTR lpszPath, int nFolder, BOOL fCreate);") print "%x: SHGetSpecialFolderPath() resolved..." # create a buffer buf = Appcall.buffer("\x00" * 260) # CSIDL_APPDATA = 0x1A if not shgetspecialfolder(0, buf, 0x1A, 0): print "SHGetSpecialFolderPath() failed!" else: print "AppData Path: >%s<" % Appcall.cstr(buf.value) return True init_prototypes()