ERC.Xdbg
An X64dbg plugin built around the ERC library designed to assist in the exploit development process.
Installation
Installing the plugin is reasonably straight forward. Simply download the appropriate zip package for your architecture from the releases page of this repository and save then unzip it in the plugins directory of X64dbg. If X64dbg does not currently have a plugins directory then run it once to create the initial directory structure.
If you wish to build the plugin from source simply clone the Git repository, open the solution in Visual Studio and build the project targeted for your architecture of choice. Then copy the binaries into the plugins directory of your X64dbg installation.
It should be noted that if you are running Windows 7 you will need to ensure .Net Framework 4.7.2 is installed on your system or X64dbg will crash immediately on startup.
Documentation
This library contains the fundamental specifications, documentation, and architecture that underpin ERC.Xdbg. If you're looking to understand the system better, or want to know how to integrate the various components, there is a lot of valuable information contained here.
📄 Documentation and Specifications
API
ERC.Net is the API used to develop ERC.Xdbg, all of the functionality in this plugin stems from the API. ERC.Net is a collection of tools designed to assist in debugging Windows application crashes.
📁 Source - https://github.com/Andy53/ERC.net
📦 32 bit Package - ERC.Net-x86.SDK
📦 64 bit Package - ERC.Net-x64.SDK
Articles
A list of articles covering common usage scenarios using ERC.Xdbg.
📄 The Basics of Exploit Development 1: Win32 Buffer Overflows
📄 The Basics of Exploit Development 2: SEH Overflows
📄 The Basics of Exploit Development 3: Egg Hunters
📄 The Basics of Exploit Development 4: Unicode Overflows
📄 The Basics of Exploit Development 5: x86-64 Buffer Overflows
Globals
Global variables are variables which are set and stored for one session. They are reset to the defaults each time X64dbg is restarted.
-ASLR
Used to exclude pointers from modules implementing ASLR in search output. Can be reset by supplying false
as a parameter.
Example: ERC --help -ASLR
Remove pointers from ASLR enabled modules from all search results.
Example: ERC --help -ASLR false
Include pointers from ASLR enabled modules in all search results.
-SafeSEH
Used to exclude pointers from modules implementing SafeSEH in search output. Can be reset by supplying false
as a parameter.
Example: ERC --help -SafeSEH
Remove pointers from SafeSEH enabled modules from all search results.
Example: ERC --help -SafeSEH false
Include pointers from SafeSEH enabled modules in all search results.
-Rebase
Used to exclude pointers from modules implementing Rebase in search output. Can be reset by supplying false
as a parameter.
Example: ERC --help -Rebase
Remove pointers from Rebase enabled modules from all search results.
Example: ERC --help -Rebase false
Include pointers from Rebase enabled modules in all search results.
-NXCompat
Used to exclude pointers from modules implementing NXCompat in search output. Can be reset by supplying false
as a parameter.
Example: ERC --help -NXCompat
Remove pointers from NXCompat enabled modules from all search results.
Example: ERC --help -NXCompat false
Include pointers from NXCompat enabled modules in all search results.
-OSdll
Used to exclude pointers from modules that are OSdll's in search output. Can be reset by supplying false
as a parameter.
Example: ERC --help -OSdll
Remove pointers from OSdll's from all search results.
Example: ERC --help -OSdll false
Include pointers from OSdll's in all search results.
-Bytes
Used to exploit pointers containing specific bytes from all search results and from being added to bytearrays generated by the plugin. Can be disabled by passing switch with no arguments. Bytes must be passed without spaces.
Example: ERC --help -Bytes 0x0A0x0D
Remove pointers containing bytes 0A or 0D from all search results.
Example: ERC --help -Bytes 740D
Remove pointers containing bytes 74 or 0D from all search results.
Example: ERC --help -Bytes
Remove any previous byte restrictions from all further search results.
-Protection
Used to specify the protection value of all pointers returned in search results. Generic values of read
, write
and exec
are used to specify which the returned pointers should have and can be used in combination. Options must be separated with commas and no spaces.
Example: ERC --help -Protection exec
Remove pointers that do not have exec permission from all search results.
Example: ERC --help -Protection read,exec
Remove pointers that do not have read and exec permission from all search results.
Example: ERC --help -Protection all
Remove any previous protection restrictions from all further search results.
-Extended
Used to specify that the extended character set should be used when using FindNRP and Pattern create and offset functionality. Can be reset by supplying false
as a parameter.
Example: ERC --help -Extended
Replaces the standard character set with the extended character set.
Example: ERC --help -Extended false
Resets to the standard characters set.
-ASCII
Sets the character encoding as ASCII. All search functions will seach for text in ASCII.
Example: ERC --help -ASCII
Changes the default characters encoding to ASCII.
-Unicode
Sets the character encoding as Unicode. All search functions will seach for text in Unicode.
Example: ERC --help -Unicode
Changes the default characters encoding to Unicode.
-UTF7
Sets the character encoding as UTF-7. All search functions will seach for text in UTF-7.
Example: ERC --help -UTF7
Changes the default characters encoding to UTF-7.
-UTF8
Sets the character encoding as UTF-8. All search functions will seach for text in UTF-8.
Example: ERC --help -UTF8
Changes the default characters encoding to UTF-8.
-UTF32
Sets the character encoding as UTF-32. All search functions will seach for text in UTF-32.
Example: ERC --help -UTF32
Changes the default characters encoding to UTF-32.
Usage
Instructions on usage of the plugin can be seen below. This can also be accessed directly through the debugger using ERC --help
.
Details on each command can be seen below. Commands are not case sensitive.
--Help
Displays the help message below.
Example: ERC --help
--Update
Downloads the latest release of the plugin from Github and extracts it into the X64Dbg plugin directory for the architecture currently in use. Can be passed a ip:port pair in order to specify a proxy.
Example 1: ERC --update 127.0.0.1:8080
--config
The config option can be used to set values in the config.xml file. These options persist between sessions. Can be used to set things such as the project author, current working directory and error log file. These options are predominantly used when writing the output of operations to file.
Example 1: ERC --config SetWorkingDirectory C:\Users\You\Desktop
Example 2: ERC --config GetErrorFilePath
--Pattern
The pattern option can be used to either create a pattern or to identify the location of a string within a pattern. Appending a c and then a number will create a pattern, appending a o and then a string of 3 or more characters will locate the string within the pattern. The plugin will attempt to automatically identify if the extended character set should be used however you can force it's use by adding "extended" to the command.
Example 1: ERC --pattern c 1000
Example 2: ERC --pattern o Aa9
Example 2: ERC --pattern o Aa9 extended
--ByteArray
The ByteArray option allows the generation of a byte array which is displayed in the log and written to the working directory as both a text file and a binary file containing only the binary values the user wants. By default the array will contain all values from 0x00 to 0xFF and values can be omitted by passing them to the -bytes global variable.
Example 1: ERC --bytearray
Example 2: ERC --bytearray -bytes 0xFF0x0A \x0b 0C
--Compare
Generates a table with a byte by byte comparison of an area of memory and the bytes from a file. Takes a memory address from which to start the search and a file path for the binary file.
Example 1: ERC --Compare 0x12345678 C:\Users\You\Desktop\YourBinaryFile.bin
--Convert
Takes a string and converts it to a hex representation. The string can be converted as if it was ASCII, Unicode, UTF-7, UTF-8 or UTF-32.
Valid conversion types:
Ascii to Hex = AtoH
Unicode to Hex = UtoH
UTF-7 to Hex = 7toH
UTF-8 to Hex = 8toH
UTF-32 to Hex = 32toH
Example 1: ERC --Convert AtoH HelloWorld
returns the ASCII bytes for HelloWorld.
Example 2: ERC --convert UtoH HelloWorld
returns the Unicode bytes for HelloWorld.
--Assemble
The assemble option can be used to convert assembly instructions into the associated opcodes. The plugin will attempt to identify the architecture required based on the attached process however a 0 can be passed to force 32 bit and a 1 can be passed to force 64 bit. Instructions must be separated with a comma (,).
Example 1: ERC --Assemble jmp esp
Example 2: ERC --assemble 1 jmp rsp, nop, nop
--Disassemble
The disassemble option can be used to convert opcodes into assembly instructions. The plugin will attempt to identify the architecture required based on the attached process however a 0 can be passed to force 32 bit and a 1 can be passed to force 64 bit.
Example 1: ERC --disAssemble FF E4
Example 2: ERC --disassemble 0 FF E4
--SearchMemory
Search memory can take a string or set of bytes to search for within the attached process memory and loaded modules. Optionally an integer can be passed to specify the search type (0 = bytes, 1 = Unicode, 2 = ASCII, 4 = UTF7, 5 = UTF8). Modules can be excluded based on certain characteristics (Is ASLR/SafeSEH/Is the binary rebasable/NXCompat(DEP)/Is the binary an OS dll) The values are optional however if you wish to exclude a later value all previous ones must be included.
Example 1: ERC --SearchMemory FF E4
Search for bytes FF E4 include all dlls.
Example 2: ERC --SearchMemory FF E4 false false false false true
Search for bytes FF E4 excluding only OS dlls.
Example 3: ERC --SearchMemory 1 HelloWorld
Search for the ASCII string HelloWorld.
--SearchModules
Search modules can take a string or set of bytes to search for within the processes loaded modules. Optionally an integer can be passed to specify the search type (0 = bytes, 1 = Unicode, 2 = ASCII, 4 = UTF7, 5 = UTF8). Modules can be excluded based on certain characteristics (Is ASLR/SafeSEH/Is the binary rebasable/NXCompat(DEP)/Is the binary an OS dll) The values are optional however if you wish to exclude a later value all previous ones must be included. Furthermore the search can be limited to certain modules by passing their name or path as arguments.
Example: ERC --SearchModules FF E4. Search for bytes FF E4 including all dll's
Example: ERC --SearchModules FF E4 module1.dll module2.dll. Search for bytes FF E4 only in module1.dll and module2.dll
--Dump
Dumps the contents of process memory to the log and a file in the working directory. Takes a hex start address and a hex number for number of bytes to be read.
Example 1: ERC --Dump 0x63428401 0x30
--ListProcesses
The list processes option takes no parameters and simply lists all visible processes on the machine.
Example 1: ERC --ListProcesses
--ProcessInfo
Displays information about the attached process, loaded modules and threads. Can be passed a boolean to indicate if the output should be written to disk.
Example 1: ERC --processInfo
Example 2: ERC --processinfo false
Does not write processinfo output to disk.
--ModuleInfo
Displays info about the modules loaded by the attached process. Can be passed a boolean to indicate if the output should be written to disk.
Example 1: ERC --moduleInfo
Example 2: ERC --moduleinfo false
Does not write moduleinfo output to disk.
--ThreadInfo
Displays info about threads associated with the attached process. Can be passed a boolean to indicate if the output should be written to disk.
Example 1: ERC --threadInfo
Example 2: ERC --threadinfo false
Does not write threadinfo output to disk.
--HeapInfo
Displays information about the heap. Takes commands search, stats, ids, and dump. Takes an integer to represent the ID of the heap to utilize. Takes a hex value to specify the address of the heap entry to utilize.
If both heap ID and start address are specified heap ID takes precedence, if start address and a byte pattern to search for are specified start address must be provided first. Takes a boolean value of true/false/1/0
to specify if output should be written to disk.
Example 1: ERC --HeapInfo stats
Display statistics about all heaps associated with the process.
Example 2: ERC --HeapInfo 0x00453563 search FFE4
Search for FFE4 in the Heap entry starting at 0x00453563
Example 3: ERC --HeapInfo 0x00453563 dump
Dump all memory from heap entry starting at 0x00453563
Example 4: ERC --HeapInfo 0x00453563 dump stats
Dump all memory from heap entry starting at 0x00453563 and display stats for the heap entry starting at 0x00453563
--SEH
Displays a list of addresses for pop pop ret instructions. Can be passed a list of module paths to be ignored in the search.
Example 1: ERC --seh
Example 2: ERC --SEH C:\Path\To\Module\To\Exclude C:\Path\To\Other\Module\To\Exclude
--EggHunters
Prints a list of egghunters which can be used for various machine types. Can be passed 4 character string to be used as the egghunter search tag. Default tag is ERCD.
Example 1: ERC --egghunters
Example 2: ERC --egghunters ABCD
Egghunters will be generated with the tag "ABCD"
--FindNRP
Searches process memory for a non repeating pattern specified in the pattern_extended and pattern_standard files. Takes an integer optional to specify the text formatting (1 = Unicode, 2 = ASCII, 3 = UTF8, 4 = UTF7, 5 = UTF32, default = ASCII) and can have the parameter "true" passed to indicate the extended pattern should be used.
Example 1: ERC --FindNRP
Example 2: ERC --FindNRP 2 true
Generates FindNRP table after searching for the extended NRP in Unicode format.
--Debug
Prints information about the plugin.
Example 1: ERC --reset
--Reset
Returns the plugin to a default status. Resets all client variables and configurations.
Example 1: ERC --reset