diff --git a/TODO b/TODO index 31ea754..f796c61 100644 --- a/TODO +++ b/TODO @@ -10,6 +10,10 @@ TODO: - Test !! (bp, BP_HX, bp on only on process, bp_hx on only one thread..) - test breakpoint with specific target + - Rethink/adapt Debugger._explicit_single_step + Does not handle case where EEFlags.TF was by the debugge before trigering the exception + Should set the flag explicitly in single_step ? and not just use EEFlags.TF ? + - remotectypes - pretty sur I can get rid of PointerToStruct64/PointerToStruct32 diff --git a/windows/debug/breakpoints.py b/windows/debug/breakpoints.py index b4ed3cb..4ab485f 100644 --- a/windows/debug/breakpoints.py +++ b/windows/debug/breakpoints.py @@ -80,11 +80,12 @@ class FunctionParamDumpBP(Breakpoint): super(FunctionParamDumpBP, self).__init__(addr) self.target = target self.target_args = target.prototype._argtypes_ + self.target_params = target.params def extract_arguments_32bits(self, cproc, cthread): x = windows.debug.X86ArgumentRetriever() res = OrderedDict() - for i, (name, type) in enumerate(zip(self.target.params, self.target_args)): + for i, (name, type) in enumerate(zip(self.target_params, self.target_args)): value = x.get_arg(i, cproc, cthread) rt = windows.remotectypes.transform_type_to_remote32bits(type) if issubclass(rt, windows.remotectypes.RemoteValue): @@ -102,7 +103,7 @@ class FunctionParamDumpBP(Breakpoint): def extract_arguments_64bits(self, cproc, cthread): x = windows.debug.X64ArgumentRetriever() res = OrderedDict() - for i, (name, type) in enumerate(zip(self.target.params, self.target_args)): + for i, (name, type) in enumerate(zip(self.target_params, self.target_args)): value = x.get_arg(i, cproc, cthread) rt = windows.remotectypes.transform_type_to_remote64bits(type) if issubclass(rt, windows.remotectypes.RemoteValue): diff --git a/windows/debug/debugger.py b/windows/debug/debugger.py index 3db61d4..13553e5 100644 --- a/windows/debug/debugger.py +++ b/windows/debug/debugger.py @@ -135,7 +135,6 @@ class Debugger(object): if target.pid == self.target.pid: self.target = None - windows.winproxy.DebugActiveProcessStop(target.pid) def _killed_in_action(self): @@ -192,6 +191,7 @@ class Debugger(object): return x def _resolve(self, addr, target): + dbgprint("Resolving <{0}> in <{1}>".format(addr, target), "DBG") if not isinstance(addr, basestring): return addr dll, api = addr.split("!") @@ -212,6 +212,7 @@ class Debugger(object): pass exports = mod[0].exports if api not in exports: + dbgprint("Error resolving <{0}> in <{1}>".format(addr, target), "DBG") raise ValueError("Unknown API <{0}> in DLL {1}".format(api, dll)) return exports[api] @@ -409,6 +410,8 @@ class Debugger(object): for bp in self._pending_breakpoints_new[None]: if isinstance(bp.addr, basestring): target_dll = bp.addr.lower().split("!")[0] + # Cannot work AS-IS yet. Implement it ? + # if target_dll == "*" or target_dll == dll_name: if target_dll == dll_name: _setup_method = getattr(self, "_setup_breakpoint_" + bp.type) if bp.apply_to_target(self.current_process): @@ -511,6 +514,8 @@ class Debugger(object): continue_flag = self.on_single_step(exception) if self._killed_in_action(): return continue_flag + # Does not handle case where EEFlags.TF was by the debugge before trigering the exception + # Should set the flag explicitly in single_step ? and not just use EEFlags.TF ? self._explicit_single_step[self.current_thread.tid] = self.current_thread.context.EEFlags.TF return continue_flag else: @@ -518,6 +523,8 @@ class Debugger(object): continue_flag = self.on_exception(exception) if self._killed_in_action(): return continue_flag + # Does not handle case where EEFlags.TF was by the debugge before trigering the exception + # Should set the flag explicitly in single_step ? and not just use EEFlags.TF ? self._explicit_single_step[self.current_thread.tid] = self.current_thread.context.EEFlags.TF return continue_flag