Skip to content

Commit 867352f

Browse files
jdavidbergerjdavidberger
authored
Create README.md
1 parent 0695b83 commit 867352f

1 file changed

Lines changed: 120 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# chaiScriptPlugin
2+
Plugin which enables [chai scripts](https://github.com/ChaiScript/ChaiScript) to run inside of [x64dbg](https://github.com/x64dbg/x64dbg).
3+
4+
# Why
5+
6+
x64dbg has a basic scripting language, but without most control flow or ability to make functions. The plugin API is very thorough but isn't well suited for rapid prototyping.
7+
8+
# Basics
9+
10+
The plugin adds three commands:
11+
12+
- chaiLoad <filename>: If given a filename as an argument, it evals the file. Without a filename specified, it opens a file dialog.
13+
- chaiEval <statement>: Uses the chai engine to evaluate the given statement.
14+
- chaiShowEnv <regex>: Shows all the locals / functions currently defined. The regex is optional, and defaults to showing everything.
15+
16+
The same file can be loaded multiple times; and if there are top level statements then they will be ran. If there are globals set, they will be loaded into the current global scope.
17+
18+
Given a file:
19+
20+
~~~~
21+
global hello_world = fun() {
22+
print("hello world!");
23+
};
24+
hello_world();
25+
~~~~
26+
27+
loading it with 'chaiLoad' will print "hello world!". It also has loaded that function into scope, so chaiEval hello_world() will print the message again.
28+
29+
# Debugger Interaction
30+
31+
Many functions available for plugins to the debugger are exposed to chaiscript. For instance:
32+
33+
~~~~
34+
var thisPtr = DbgValFromString("ecx");
35+
var firstArg = DbgValFromString("[esp + 4]");
36+
var mem = DbgMemRead(thisPtr, 16);
37+
38+
for(var i = 0;i < v.size();++i) {
39+
puts("${to_hex(v[i], 2)}, ");
40+
}
41+
print(" ${to_hex(thisPtr, 8)}: firstArg ${firstArg} ");
42+
~~~~
43+
44+
might be useful at the top of a thiscall invocation as it prints the first argument given, as well as the first 16 bytes of what ecx points to.
45+
46+
Available functions are:
47+
48+
- DbgMemWrite
49+
- DbgMemRead
50+
- DbgMemGetPageSize
51+
- DbgCmdExec
52+
- DbgCmdExecDirect
53+
- DbgIsValidExpression
54+
- DbgIsDebugging
55+
- DbgIsJumpGoingToExecute
56+
- DbgSetLabelAt
57+
- DbgClearLabelRange
58+
- DbgSetCommentAt
59+
- DbgClearCommentRange
60+
- DbgGetBookmarkAt
61+
- DbgSetBookmarkAt
62+
- DbgClearBookmarkRange
63+
- DbgGetBpxTypeAt
64+
- DbgValFromString
65+
- DbgGetRegDump
66+
- DbgValToString
67+
- DbgMemIsValidReadPtr
68+
- DbgGetFunctionTypeAt
69+
- DbgGetLoopTypeAt
70+
- DbgGetBranchDestination
71+
- DbgScriptLoad
72+
- DbgScriptUnload
73+
- DbgScriptRun
74+
- DbgScriptStep
75+
- DbgScriptBpToggle
76+
- DbgScriptBpGet
77+
- DbgScriptCmdExec
78+
- DbgScriptAbort
79+
- DbgScriptGetLineType
80+
- DbgScriptSetIp
81+
- DbgSymbolEnum
82+
- DbgAssembleAt
83+
- DbgModBaseFromName
84+
- DbgSettingsUpdated
85+
- DbgMenuEntryClicked
86+
- DbgFunctionOverlaps
87+
- DbgFunctionAdd
88+
- DbgFunctionDel
89+
- DbgArgumentOverlaps
90+
- DbgArgumentAdd
91+
- DbgArgumentDel
92+
- DbgLoopOverlaps
93+
- DbgLoopAdd
94+
- DbgLoopDel
95+
- DbgXrefAdd
96+
- DbgXrefDelAll
97+
- DbgGetXrefCountAt
98+
- DbgGetXrefTypeAt
99+
- DbgIsRunLocked
100+
- DbgIsBpDisabled
101+
- DbgSetAutoCommentAt
102+
- DbgClearAutoCommentRange
103+
- DbgSetAutoLabelAt
104+
- DbgClearAutoLabelRange
105+
- DbgSetAutoBookmarkAt
106+
- DbgClearAutoBookmarkRange
107+
- DbgSetAutoFunctionAt
108+
- DbgClearAutoFunctionRange
109+
- DbgWinEvent
110+
- DbgWinEventGlobal
111+
- DbgIsRunning
112+
- DbgGetTimeWastedCounter
113+
- DbgGetArgTypeAt
114+
- DbgReleaseEncodeTypeBuffer
115+
- DbgGetEncodeTypeAt
116+
- DbgGetEncodeSizeAt
117+
- DbgSetEncodeType
118+
- DbgDelEncodeTypeRange
119+
- DbgDelEncodeTypeSegment
120+

0 commit comments

Comments
 (0)