Added a sample for windows.debug.FunctionCallBP : change_function_ret_value.py

samples/debug/change_function_ret_value.py

@@ -0,0 +1,51 @@
+import sys
+import os.path
+import pprint
+import threading
+sys.path.append(os.path.abspath(__file__ + "\..\.."))
+
+import windows
+import windows.test
+import windows.debug
+import windows.generated_def as gdef
+
+# The debugge python will just print the result of
+# 3 call to IsDebuggerPresent
+TARGET_PYTHON_CODE = '"\
+import ctypes;\
+import time;\
+IsDebuggerPresent = ctypes.windll.kernel32.IsDebuggerPresent;\
+print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\
+time.sleep(1);\
+print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\
+time.sleep(1);\
+print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\
+"'
+
+# This breakpoint now nothing about its target argument
+# It only now how to break at the return of the function
+# This allow us to change the return value of any function
+class IncrementReturnValue(windows.debug.FunctionCallBP):
+    def __init__(self, addr, initialvalue):
+        super(IncrementReturnValue, self).__init__(addr)
+        self.initialvalue = initialvalue
+
+    def trigger(self, dbg, exc):
+        # Ask to break a the return of the function
+        # callback is ret_trigger
+        self.break_on_ret(dbg, exc)
+
+    def ret_trigger(self, dbg, exc):
+        ctx = dbg.current_thread.context
+        # Func result is an alias to EAX/RAX
+        ctx.func_result = self.initialvalue
+        # Set the new context for the target thread
+        dbg.current_thread.set_context(ctx)
+        self.initialvalue += 1
+
+d = windows.debug.Debugger.debug(sys.executable, [sys.executable, "-c", TARGET_PYTHON_CODE])
+# We could also give the direct address of the function
+# But it would require to wait for the module to be loaded
+d.add_bp(IncrementReturnValue("kernelbase!IsDebuggerPresent", 42))
+d.loop()
+

windows/debug/breakpoints.py

@@ -213,6 +213,7 @@ class FunctionRetBP(Breakpoint):
 
 
 class FunctionCallBP(Breakpoint):
+    """A Breakpoint that allow to trigger at the return of a function"""
     def break_on_ret(self, dbg, exception):
         """Setup a breakpoint at the return address of the function, this breakpoint will call :func:`ret_trigger`"""
         cproc = dbg.current_process