diff --git a/samples/debug/change_function_ret_value.py b/samples/debug/change_function_ret_value.py new file mode 100644 index 0000000..74b885d --- /dev/null +++ b/samples/debug/change_function_ret_value.py @@ -0,0 +1,51 @@ +import sys +import os.path +import pprint +import threading +sys.path.append(os.path.abspath(__file__ + "\..\..")) + +import windows +import windows.test +import windows.debug +import windows.generated_def as gdef + +# The debugge python will just print the result of +# 3 call to IsDebuggerPresent +TARGET_PYTHON_CODE = '"\ +import ctypes;\ +import time;\ +IsDebuggerPresent = ctypes.windll.kernel32.IsDebuggerPresent;\ +print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\ +time.sleep(1);\ +print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\ +time.sleep(1);\ +print(\'[DEBUGGE] IsDebuggerPresent={0}\'.format(IsDebuggerPresent()));\ +"' + +# This breakpoint now nothing about its target argument +# It only now how to break at the return of the function +# This allow us to change the return value of any function +class IncrementReturnValue(windows.debug.FunctionCallBP): + def __init__(self, addr, initialvalue): + super(IncrementReturnValue, self).__init__(addr) + self.initialvalue = initialvalue + + def trigger(self, dbg, exc): + # Ask to break a the return of the function + # callback is ret_trigger + self.break_on_ret(dbg, exc) + + def ret_trigger(self, dbg, exc): + ctx = dbg.current_thread.context + # Func result is an alias to EAX/RAX + ctx.func_result = self.initialvalue + # Set the new context for the target thread + dbg.current_thread.set_context(ctx) + self.initialvalue += 1 + +d = windows.debug.Debugger.debug(sys.executable, [sys.executable, "-c", TARGET_PYTHON_CODE]) +# We could also give the direct address of the function +# But it would require to wait for the module to be loaded +d.add_bp(IncrementReturnValue("kernelbase!IsDebuggerPresent", 42)) +d.loop() + diff --git a/windows/debug/breakpoints.py b/windows/debug/breakpoints.py index 095bfab..de78bd5 100644 --- a/windows/debug/breakpoints.py +++ b/windows/debug/breakpoints.py @@ -213,6 +213,7 @@ class FunctionRetBP(Breakpoint): class FunctionCallBP(Breakpoint): + """A Breakpoint that allow to trigger at the return of a function""" def break_on_ret(self, dbg, exception): """Setup a breakpoint at the return address of the function, this breakpoint will call :func:`ret_trigger`""" cproc = dbg.current_process