import labeless failed

[HongThatCong]

The same bug happened to me as #62

After debugging, using IDA and ProcMon, with the exe being debugged are x32dbg and x64dbg, I found the "import site" Python statement line had no effect.

I patched the labeless plugin for x32dbg and x64dbg to "import site; site.main()" but it still failed

PyRun_SimpleStringFlags "import labeless" still fails. Still returns 0, "ModuleNotFound" exception str return
Procmon watch shows: Lib\site-packages dir is not added to sys.path so when "import labeless" will not find the Lib\site-packages\labless directory (which was installed before using release .whl files)
I worked around by explicitly pointing Lib\site-packages dir in the python311._pth file (on my machine) and everything is OK. Labeless imported successfully
I used this method for both Python 3.11 x86 and x64,
and tested OK with OllyDbg1, OllyDbg2, x32dbg and x64dbg.

I still don't know why Lib\site-packages is not added to sys.path
It might be due to some Python Flags

PS: another way to temproray fix is move labeless and google dir from Lib\site-packages to Lib\

Thank you for this great plugin

[a1ext]

hi @HongThatCong, could you try to print out the sys.path before your patch? and could you also attach your system's %PATH%? I will try to reproduce

[a1ext]

First of all, I'm using Python 3.10 for a release bundle, so I'm not sure how you are able to work with Python 3.11, could you tell more about your environment?
I just did a clean win 11 install, then installed Python 3.10.11 both 32 and 64 bit adding them to system's PATH and then installed labeless python module in powershell it appeared that if you don't specify full path to executable, it runs the first one it found in PATH telling me that it is already installed, so to make sure it is installed to proper python I visited their both site-packages folder.
I just needed to run a python like this .\python.exe -m pip install labeless from corresponding folder.

Btw, could you try attached binaries, I fixed one issue when debugger closes it was hanging on Py_Finalyze for some reason, only on win 11, so I added a fix there. If it start to work for you - I will add that to new release

bin.zip

[HongThatCong]

Thanks alex very much, for taking the time to this issue

I am also re-reading your code, and checking how x32/x64dbg loads plugins and dlls imported from plugins

Can you check for me, on your machine:

1. python310.dll is loaded from which directory

2. Are the PYTHONHOME and PYTHONPATH environment variables set, what are the values

On my machine I installed Python311 global, so there is only python311.dll
I just patched import python310.dll to python311.dll
It still works fine because the CPython API of these 2 versions is almost the same

API Monitor with x32/x64dbg, I see the author of x32/x64dbg has changed Dll Search Order path. Only load dll from .exe, plugins and Windows\SystemXX dir
So Dlls from %PATH% enviroment variable will be ignored, not loaded

Best regards

[a1ext]

Hi @HongThatCong

I just patched import python310.dll to python311.dll

Why? if you so much want to use python 3.11 just overwrite its includes and libs in the corresponding folder in 3rdparty\Python310\ and 3rdparty\Python310x64\ and build both plugins with them... patching imports is not a good idea...

1. python310.dll is loaded from which directory
   as I added both of pythons' folders to PATH:

PS C:\> echo $env:PATH
C:\Python310-32\Scripts\;C:\Python310-32\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Python310\;C:\Users\user\AppData\Local\Microsoft\WindowsApps

here you can spot C:\Python310-32\ and C:\Python310\

2. Are the PYTHONHOME and PYTHONPATH environment variables set, what are the values

None of them are set

API Monitor with x32/x64dbg, I see the author of x32/x64dbg has changed Dll Search Order path. Only load dll from .exe, plugins and Windows\SystemXX dir

Do you use some updated x64dbg, not from the bundle?

[a1ext]

I got the source of your problem, it seems like x64dbg experienced sideloading of somemalicious DLL in the past, here is the security fix they applied https://github.com/x64dbg/x64dbg/blob/development/src/exe/x64dbg_exe.cpp#L30

    if(!InitializeSignatureCheck())
        MessageBoxA(nullptr, "Failed to initialize signature check.", "Error", MB_SYSTEMMODAL | MB_ICONERROR);

and here https://github.com/x64dbg/x64dbg/blob/development/src/exe/signaturecheck.cpp#L431 is what you've seen in the apimon.
just put python310.dll (actually the pyhtonXXX.dll which you chose to use) into the same folder as x32dbg.exe/x64dbg.exe