From 5f5ad2531bedf734be718986c0ae926a52a9306d Mon Sep 17 00:00:00 2001 From: hakril Date: Fri, 1 Aug 2025 09:21:07 +0200 Subject: [PATCH] Fixing a bug in FunctionParamDumpBPAbstract triggering remote null deref --- windows/debug/breakpoints.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/debug/breakpoints.py b/windows/debug/breakpoints.py index 1dc5d0b..8e9d308 100644 --- a/windows/debug/breakpoints.py +++ b/windows/debug/breakpoints.py @@ -126,14 +126,15 @@ class FunctionParamDumpBPAbstract(object): def extract_arguments_64bits(self, cproc, cthread): x = windows.debug.X64ArgumentRetriever() res = OrderedDict() - for i, (name, type) in enumerate(zip(self.target_params, self.target_args)): + for i, (name, atype) in enumerate(zip(self.target_params, self.target_args)): value = x.get_arg(i, cproc, cthread) - rt = windows.remotectypes.transform_type_to_remote64bits(type) + rt = windows.remotectypes.transform_type_to_remote64bits(atype) if issubclass(rt, windows.remotectypes.RemoteValue): t = rt(value, cproc) else: t = rt(value) - if not hasattr(t, "contents"): + + if not isinstance(t, (windows.remotectypes.RemotePtr64, windows.remotectypes.RemotePtr32)): try: t = t.value except AttributeError: