From 3f6131d6218962ac59a2de4a1c1ce4c054c6104d Mon Sep 17 00:00:00 2001 From: Clement Rouault Date: Fri, 21 Apr 2017 17:30:18 +0200 Subject: [PATCH] Fix implem of bp exe!(offset|API) + add test for this case --- TODO | 12 +++++++++--- windows/debug/debugger.py | 2 +- windows/test/test_debugger.py | 37 +++++++++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 4 deletions(-) diff --git a/TODO b/TODO index b2b5f9a..44de29d 100644 --- a/TODO +++ b/TODO @@ -11,9 +11,15 @@ TODO: - Test !! (bp, BP_HX, bp on only on process, bp_hx on only one thread..) - test breakpoint with specific target - - Rethink/adapt Debugger._explicit_single_step - Does not handle case where EEFlags.TF was by the debugge before trigering the exception - Should set the flag explicitly in single_step ? and not just use EEFlags.TF ? + -Debugger + - Rethink/adapt Debugger._explicit_single_step + Does not handle case where EEFlags.TF was by the debugge before trigering the exception + Should set the flag explicitly in single_step ? and not just use EEFlags.TF ? + - _handle_load_dll + - error in keys of 'self._module_by_process[self.current_process.pid]' + - if I have a ntdll32 and ntdll64: both would have the same name in the list.. + + - remotectypes - pretty sur I can get rid of PointerToStruct64/PointerToStruct32 diff --git a/windows/debug/debugger.py b/windows/debug/debugger.py index f36f28d..7d30e1a 100644 --- a/windows/debug/debugger.py +++ b/windows/debug/debugger.py @@ -181,7 +181,7 @@ class Debugger(object): exe_name = os.path.basename(exe_path) #print("Exe name is {0}".format(exe_name)) self._module_by_process[self.current_process.pid][exe_name] = windows.pe_parse.GetPEFile(create_process_event.lpBaseOfImage, self.current_process) - self._setup_pending_breakpoints_load_dll(exe_name) + #self._setup_pending_breakpoints_load_dll(exe_name) # Already setup in _setup_pending_breakpoints_new_process def _update_debugger_state(self, debug_event): diff --git a/windows/test/test_debugger.py b/windows/test/test_debugger.py index 71e943d..2c69c02 100644 --- a/windows/test/test_debugger.py +++ b/windows/test/test_debugger.py @@ -2,6 +2,7 @@ from test_utils import * from windows.generated_def.winstructs import * import threading +import os class DebuggerTestCase(unittest.TestCase): def debuggable_calc_32(self): @@ -683,6 +684,42 @@ class DebuggerTestCase(unittest.TestCase): d.loop() + def test_exe_in_module_list(self): + class MyDbg(windows.debug.Debugger): + def on_exception(self, exception): + exe_name = self.current_process.peb.modules[0].name + this_process_modules = self._module_by_process[self.current_process.pid] + TEST_CASE.assertIn(exe_name, this_process_modules.keys()) + self.current_process.exit() + + TEST_CASE = self + calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) + d = MyDbg(calc) + d.loop() + + def test_bp_exe_by_name(self): + NBCALL = [0] + TEST_CASE = self + CALC_ALIVE = True + class TSTBP(windows.debug.Breakpoint): + def trigger(self, dbg, exc): + NBCALL[0] += 1 + TEST_CASE.assertEqual(NBCALL[0], 1) + # Kill the target in 0.5s + # It's not too long + # It's long enought to get trigger being recalled if implem is broken + threading.Timer(0.5, calc.exit).start() + + calc = pop_calc_32(dwCreationFlags=DEBUG_PROCESS) + exepe = windows.pe_parse.GetPEFile(calc.peb.ImageBaseAddress, calc) + entrypoint = exepe.get_OptionalHeader().AddressOfEntryPoint + exename = os.path.basename(calc.peb.imagepath.str) + d = windows.debug.Debugger(calc) + # The goal is to test bp of format 'exename!offset' so we craft a string based on the entrypoint + d.add_bp(TSTBP("{name}!{offset}".format(name=exename, offset=entrypoint))) + d.loop() + self.assertEqual(NBCALL[0], 1) + if __name__ == '__main__': alltests = unittest.TestSuite() alltests.addTest(unittest.makeSuite(DebuggerTestCase))