diff --git a/samples/debug_functionbp.py b/samples/debug_functionbp.py new file mode 100644 index 0000000..59b997f --- /dev/null +++ b/samples/debug_functionbp.py @@ -0,0 +1,49 @@ +import sys +import os.path +import pprint +sys.path.append(os.path.abspath(__file__ + "\..\..")) + +import windows +import windows.test +import windows.debug + +from windows.generated_def.winstructs import * + +class MyFunctionBP(windows.debug.FunctionBP): + def __init__(self, target, addr=None): + super(MyFunctionBP, self).__init__(target, addr) + self.target_name = target.target_func + self.counter = 3 + + def trigger(self, dbg, exc): + if not self.counter: + print("Exiting process") + dbg.current_process.exit() + return + params = self.extract_arguments(dbg.current_process, dbg.current_thread) + filename = params["ObjectAttributes"].contents.ObjectName.contents.Buffer + handle_addr = params["FileHandle"].value + self.data = (filename, handle_addr) + self.break_on_ret(dbg, exc) + + def ret_trigger(self, dbg, exc): + filename, handle_addr = self.data + ret_value = dbg.current_thread.context.func_result # EAX / RAX depending of bitness + handle_value = dbg.current_process.read_ptr(handle_addr) + if ret_value: + print("NtCreateFile of <{0}> FAILED (result={1:#x})".format(filename, ret_value)) + return + print("NtCreateFile of <{0}>: handle = {1:#x}".format(filename, handle_value)) + # Manual verification + fhandle = [h for h in windows.system.handles if h.dwProcessId == dbg.current_process.pid and h.wValue == handle_value] + if not fhandle: + raise ValueError("handle not found!") + fhandle = fhandle[0] + print("Handle manually found! typename=<{0}>, name=<{1}>".format(fhandle.type, fhandle.name)) + print("") + self.counter -= 1 + +calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS) +d = windows.debug.Debugger(calc) +d.add_bp(MyFunctionBP(windows.winproxy.NtCreateFile)) +d.loop() \ No newline at end of file