First try at MemBP.on_error callback

ctypes_generation/definitions/windef.txt

@@ -1053,7 +1053,6 @@
 #define ALPC_MESSAGE_CONTEXT_ATTRIBUTE 0x20000000
 #define ALPC_MESSAGE_HANDLE_ATTRIBUTE 0x10000000
 
-#define ALPC_VIEWFLG_NOT_SECURE 0x40000
 
 #define ALPC_MSGFLG_REPLY_MESSAGE 0x1
 #define ALPC_MSGFLG_LPC_MODE 0x2
@@ -1067,6 +1066,13 @@
 #define ALPC_CANCELFLG_NO_CONTEXT_CHECK 0x8
 #define ALPC_CANCELFLGP_FLUSH 0x10000
 
+#define ALPC_HANDLEFLG_DUPLICATE_SAME_ACCESS 0x10000
+#define ALPC_HANDLEFLG_DUPLICATE_SAME_ATTRIBUTES 0x20000
+#define ALPC_HANDLEFLG_DUPLICATE_INHERIT 0x80000
+
+#define ALPC_SECFLG_CREATE_HANDLE 0x20000
+#define ALPC_VIEWFLG_NOT_SECURE 0x40000
+
 
 #define OWNER_SECURITY_INFORMATION       (0x00000001L)
 #define GROUP_SECURITY_INFORMATION       (0x00000002L)

ctypes_generation/definitions/winfunc.txt

@@ -921,6 +921,40 @@ NTSTATUS RtlDecompressBuffer(
     PULONG FinalUncompressedSize
 );
 
+NTSTATUS NtCreateSection(
+    PHANDLE            SectionHandle,
+    ACCESS_MASK        DesiredAccess,
+    POBJECT_ATTRIBUTES ObjectAttributes,
+    PLARGE_INTEGER     MaximumSize,
+    ULONG              SectionPageProtection,
+    ULONG              AllocationAttributes,
+    HANDLE             FileHandle
+);
+
+NTSTATUS NtOpenSection(
+    PHANDLE            SectionHandle,
+    ACCESS_MASK        DesiredAccess,
+    POBJECT_ATTRIBUTES ObjectAttributes
+);
+
+NTSTATUS NtMapViewOfSection(
+    HANDLE          SectionHandle,
+    HANDLE          ProcessHandle,
+    PVOID           *BaseAddress,
+    ULONG_PTR       ZeroBits,
+    SIZE_T          CommitSize,
+    PLARGE_INTEGER  SectionOffset,
+    PSIZE_T         ViewSize,
+    SECTION_INHERIT InheritDisposition,
+    ULONG           AllocationType,
+    ULONG           Win32Protect
+);
+
+NTSTATUS NtUnmapViewOfSection(
+    HANDLE ProcessHandle,
+    PVOID  BaseAddress
+);
+
 HANDLE WINAPI OpenEventA(
     __in DWORD dwDesiredAccess,
     __in BOOL bInheritHandle,

ctypes_generation/definitions/winstruct.txt

@@ -268,6 +268,10 @@ typedef enum  _WELL_KNOWN_SID_TYPE{
   WinCapabilityRemovableStorageSid             = 94
 } WELL_KNOWN_SID_TYPE;
 
+typedef enum _SECTION_INHERIT {
+  ViewShare = 1,
+  ViewUnmap = 2
+} SECTION_INHERIT;
 
 typedef enum _MEMORY_INFORMATION_CLASS {
     MemoryBasicInformation,

windows/debug/debugger.py

@@ -377,12 +377,28 @@ class Debugger(object):
         for page_addr in affected_pages:
             cp_watch_page[page_addr].bps.remove(bp)
             if not cp_watch_page[page_addr].bps:
-                target.virtual_protect(page_addr, PAGE_SIZE, cp_watch_page[page_addr].original_prot, None)
+                try:
+                    target.virtual_protect(page_addr, PAGE_SIZE, cp_watch_page[page_addr].original_prot, None)
+                except WindowsError as e:
+                     # TODO
+                     # What should we do if the virtual protect fail on a Non-Free page ?
+                     # It may be because the page was dealloc + map as a view..
+                     # For now: keep the page as-is
+                     if not target.query_memory(page_addr).State == MEM_FREE:
+                        pass
+                     # If page is MEM_FREE ignore the error
                 del cp_watch_page[page_addr]
             else:
                 full_page_events = set.union(*[bp.events for bp in cp_watch_page[page_addr].bps])
                 protection_for_page = self._compute_page_access_for_event(target, full_page_events)
-                target.virtual_protect(page_addr, PAGE_SIZE, protection_for_page, None)
+                try:
+                    target.virtual_protect(page_addr, PAGE_SIZE, protection_for_page, None)
+                except Exception as e:
+                    # if not target.query_memory(page_addr).State == MEM_FREE:
+                    #     raise
+                    for bp in cp_watch_page[page_addr].bps:
+                        bp.on_error(self, page_addr)
+                # TODO: handle case were it is mem-free ?
         return True
 
 
@@ -881,7 +897,18 @@ class Debugger(object):
         cp_watch_page = self._watched_pages[target.pid]
         page_protection = DWORD()
         for page_addr, watched_page in cp_watch_page.items():
-            target.virtual_protect(page_addr, PAGE_SIZE, watched_page.original_prot, page_protection)
+            try:
+                target.virtual_protect(page_addr, PAGE_SIZE, watched_page.original_prot, page_protection)
+            except WindowsError as e:
+                # Check if page have been unmapped
+                # print("disable_all_memory_breakpoints failed on page {0:#x} in state {1:#x}".format(page_addr, target.query_memory(page_addr).State))
+                # if not target.query_memory(page_addr).State == MEM_FREE:
+                #     import pdb;pdb.set_trace()
+                #     raise
+                # If page have been unmap, warn the concerned Breakpoints.
+                for bp in watched_page.bps:
+                    # TODO: Document
+                    bp.on_error(self, page_addr)
             res[page_addr] = page_protection.value
         return res
 

windows/generated_def/winstructs.py

@@ -311,6 +311,14 @@ class _WELL_KNOWN_SID_TYPE(EnumType):
 WELL_KNOWN_SID_TYPE = _WELL_KNOWN_SID_TYPE
 
 
+ViewShare = EnumValue("_SECTION_INHERIT", "ViewShare", 0x1)
+ViewUnmap = EnumValue("_SECTION_INHERIT", "ViewUnmap", 0x2)
+class _SECTION_INHERIT(EnumType):
+    values = [ViewShare, ViewUnmap]
+    mapper = {x:x for x in values}
+SECTION_INHERIT = _SECTION_INHERIT
+
+
 MemoryBasicInformation = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryBasicInformation", 0x0)
 MemoryWorkingSetList = EnumValue("_MEMORY_INFORMATION_CLASS", "MemoryWorkingSetList", 0x1)
 MemorySectionName = EnumValue("_MEMORY_INFORMATION_CLASS", "MemorySectionName", 0x2)