To create COM object you need to:
-
- Describe your ComVtable CODE1
-- Implement the python functions described CODE2
-- Create an instance and pass it to whatever native function expects it CODE3
+- Create your
+COMImplementationwith anIMPLEMENTattribute that should be a cominterface CODE 1- Implements the methods of the interface CODE 2
+- Create an instance CODE3
+- Pass it to whatever native function expects it CODE4
detach(target=None)[source]¶Detach from all debugged processes or process target
debug(path, args=None, dwCreationFlags=0, show_windows=False)[source]¶loop()[source]¶Debugging loop: handle event / dispatch to breakpoint. Returns when all targets are dead
+Debugging loop: handle event / dispatch to breakpoint. Returns when all targets are dead/detached
DBG_EXCEPTION_NOT_HANDLED
-
on_single_step(exception)[source]¶
-Called on requested single step``exception`` is one of the following type:
+Called on requested single step exception is one of the following type:
windows.winobject.exception.EEXCEPTION_DEBUG_INFO32
-
class
windows.debug.FunctionBP(target, addr=None)[source]¶
-A breakpoint that accept a function from windows.winproxy and able to:
+A breakpoint that accepts a function from windows.winproxy and able to:
- Extract the arguments of the functions
- Break at the return of the function
diff --git a/docs/build/html/genindex.html b/docs/build/html/genindex.html
index edc7964..ffc0af2 100644
--- a/docs/build/html/genindex.html
+++ b/docs/build/html/genindex.html
@@ -315,6 +315,10 @@
+ - detach() (windows.debug.Debugger method)
+
+
+
- direction (windows.winobject.network.FirewallRule attribute)
diff --git a/docs/build/html/sample.html b/docs/build/html/sample.html
index 90aa20c..8e6f38a 100644
--- a/docs/build/html/sample.html
+++ b/docs/build/html/sample.html
@@ -965,7 +965,6 @@ No more tracing !
"""Check that BP/dbg can trigger single step and that instruction follows"""
def trigger(self, dbg, exc):
fault_addr = exc.ExceptionRecord.ExceptionInformation[1]
- import pdb;pdb.set_trace()
eip = dbg.current_thread.context.pc
print("Instruction at <{0:#x}> wrote at <{1:#x}>".format(eip, fault_addr))
dbg.single_step_counter = 4
@@ -1065,7 +1064,8 @@ No more tracing !
Ouput:
-NtCreateFile of <\??\C:\Windows\syswow64\en-US\calc.exe.mui>: handle = 0xac
+(cmd λ) python.exe .\samples\debug_functionbp.py
+NtCreateFile of <\??\C:\Windows\syswow64\en-US\calc.exe.mui>: handle = 0xac
Handle manually found! typename=<File>, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\calc.exe.mui>
NtCreateFile of <\Device\DeviceApi\CMApi>: handle = 0x108
@@ -1081,6 +1081,8 @@ Exiting process
12.10.2. LocalDebugger¶
+
+12.10.2.1. In current process¶
import sys
import os.path
import pprint
@@ -1137,6 +1139,9 @@ EXCEPTION !!!! Got a EXCEPTION_SINGLE_STEP(0x80000004L) at 0x770d7c04
Done!
+
+
+12.10.2.2. In remote process¶
import sys
import os.path
import pprint
@@ -1209,6 +1214,7 @@ Done!
+
12.10.3. Make WMI requests¶
import sys
@@ -1351,7 +1357,11 @@ Done!
- 12.10.1.2.
windows.debug.FunctionBP
-- 12.10.2.
LocalDebugger
+- 12.10.2.
LocalDebugger
+
- 12.10.3. Make WMI requests
- 12.10.4. using COM:
INetFwPolicy2
diff --git a/docs/build/html/searchindex.js b/docs/build/html/searchindex.js
index 6d12cee..7a8b610 100644
--- a/docs/build/html/searchindex.js
+++ b/docs/build/html/searchindex.js
@@ -1 +1 @@
-Search.setIndex({envversion:49,filenames:["debug","index"],objects:{"windows.debug":{Breakpoint:[0,1,1,""],Debugger:[0,1,1,""],FunctionBP:[0,1,1,""],HXBreakpoint:[0,1,1,""],LocalDebugger:[0,1,1,""],MemoryBreakpoint:[0,1,1,""]},"windows.debug.Breakpoint":{trigger:[0,2,1,""]},"windows.debug.Debugger":{DisabledMemoryBreakpoint:[0,2,1,""],__init__:[0,2,1,""],add_bp:[0,2,1,""],attach:[0,3,1,""],debug:[0,3,1,""],del_bp:[0,2,1,""],disable_all_memory_breakpoints:[0,2,1,""],get_exception_bitness:[0,2,1,""],get_memory_breakpoint_at:[0,2,1,""],loop:[0,2,1,""],on_create_process:[0,2,1,""],on_create_thread:[0,2,1,""],on_exception:[0,2,1,""],on_exit_process:[0,2,1,""],on_exit_thread:[0,2,1,""],on_load_dll:[0,2,1,""],on_output_debug_string:[0,2,1,""],on_rip:[0,2,1,""],on_single_step:[0,2,1,""],on_unload_dll:[0,2,1,""],restore_all_memory_breakpoints:[0,2,1,""],single_step:[0,2,1,""]},"windows.debug.FunctionBP":{break_on_ret:[0,2,1,""],extract_arguments:[0,2,1,""],ret_trigger:[0,2,1,""],trigger:[0,2,1,""]},"windows.debug.HXBreakpoint":{trigger:[0,2,1,""]},"windows.debug.LocalDebugger":{add_bp:[0,2,1,""],del_bp:[0,2,1,""],get_exception_code:[0,2,1,""],get_exception_context:[0,2,1,""],on_exception:[0,2,1,""],single_step:[0,2,1,""]},"windows.debug.MemoryBreakpoint":{__init__:[0,2,1,""],trigger:[0,2,1,""]},windows:{debug:[0,0,0,"-"]}},objnames:{"0":["py","module","Python module"],"1":["py","class","Python class"],"2":["py","method","Python method"],"3":["py","classmethod","Python class method"]},objtypes:{"0":"py:module","1":"py:class","2":"py:method","3":"py:classmethod"},terms:{"0x10":0,"32b":0,"64bit":0,"break":0,"class":0,"default":0,"function":[0,1],"int":0,"public":0,"return":0,__init__:0,abl:0,accept:0,access:0,add:0,add_bp:0,addr:0,address:0,addvectoredexceptionhandl:0,affect:0,after:0,all:0,ani:0,api:[0,1],apinam:0,arg:0,argument:0,around:0,aspx:0,assembler:1,attach:0,base:0,behaviour:0,bit:0,break_on_ret:0,call:0,callabl:0,callback:0,callind:0,can:0,caus:0,chang:0,check:1,classmethod:0,code:[0,1],com:[0,1],compon:1,content:1,context:[0,1],correspond:0,cproc:0,cpuid:1,creat:0,create_process:0,create_thread:0,cross:1,cthread:0,current:0,current_process:[0,1],current_thread:0,data:0,dbg:0,dbg_continue:0,dbg_exception_not_handled:0,dead:0,debug_exeception_event:0,debug_str:0,debugingg:0,del_bp:0,delet:0,desktop:0,disabl:0,disable_all_memory_breakpoint:0,disabledmemorybreakpoint:0,disassembl:0,dispatch:0,dll:0,document:0,don:0,drive:1,drx:0,dwcreationflag:0,earli:1,eexception_debug_info32:0,eexception_debug_info64:0,els:0,embed:0,event:0,exampl:1,exc:0,except:0,exception:1,exceptioncod:0,exec:0,execut:[0,1],exit:0,exit_process:0,exit_thread:0,expect:0,explor:1,explorat:1,extract:0,extract_argu:0,fals:0,fault:0,follow:0,form:0,from:0,functionbp:0,gate:1,get:0,get_exception_bit:0,get_exception_cod:0,get_exception_context:0,get_memory_breakpoint_at:0,given:0,handl:[0,1],hardwar:0,hardware_exec_bp:0,have:0,heaven:1,helper:1,hit:0,hook:1,http:0,hxbreakpoint:0,iat:1,implement:[0,1],index:1,int3:0,interest:0,interfac:[0,1],internal:1,know:0,known:0,kwd:0,librari:0,load:[0,1],load_dll:0,logic:1,loop:0,make:[0,1],manag:[0,1],map:0,mean:0,membp:0,memori:0,memory_breakpoint:0,memorybreakpoint:0,method:0,microsoft:0,might:0,model:1,modul:1,ms679286:0,ms679287:0,ms679334:0,ms679335:0,ms680351:0,ms680545:0,ms680587:0,ms681403:0,msdn:0,much:0,must:0,nativ:1,native_exec:1,nativeutil:1,network:1,non:0,none:0,now:0,object:1,occur:0,offset:0,on_create_process:0,on_create_thread:0,on_except:0,on_exit_process:0,on_exit_thread:0,on_load_dl:0,on_output_debug_str:0,on_rip:0,on_single_step:0,on_unload_dl:0,onli:0,ordereddict:0,origin:0,other:0,page:[0,1],param:0,paramet:0,pars:1,pass:0,path:0,peb:1,pefile:1,perform:0,process:[0,1],progress:1,protocol:1,put:[0,1],read:0,real:0,registri:1,relat:1,remot:[0,1],remotectyp:1,repres:0,request:[0,1],restor:0,restore_all_memory_breakpoint:0,result:0,ret_trigg:0,right:0,rip_info:0,rwx:0,sad:0,sampl:[0,1],search:1,see:0,servic:1,setup:0,should:0,show_window:0,signatur:1,simple_x64:1,simple_x86:1,singl:0,single_step:0,size:0,socket:1,some:0,soon:0,sourc:0,standard:0,standard_bp:0,step:0,str:0,string:0,structur:[0,1],subclass:0,system:1,syswow64:1,target:0,tested:0,them:0,thi:0,those:0,thread:[0,1],trigger:0,type:0,unload_dl:0,useful:0,using:1,util:1,utiliti:1,valu:0,vectoredexcept:[0,1],virtual_protect:0,virtualalloc:1,volum:1,wai:0,when:0,where:0,which:0,win32:0,winobject:0,winprocess:[0,1],winproxi:[0,1],wintrust:1,without:0,wmi:1,won:0,work:1,write:0,x64:1,x86:1,you:0},titles:["7. windows.debug – Debugging","Welcome to PythonForWindows’s documentation!"],titleterms:{breakpoint:0,debug:0,debugg:0,document:1,indice:1,localdebugg:0,pythonforwindow:1,tabl:1,welcom:1,window:0}})
\ No newline at end of file
+Search.setIndex({envversion:49,filenames:["index","sample"],objects:{},objnames:{},objtypes:{},terms:{"00c04fc295ee":1,"0x02649b70":1,"0x026ddd00":1,"0x0272d350":1,"0x02941290":1,"0x02b37ef0":1,"0x02dc8210":1,"0x030a2590":1,"0x10":1,"0x1000":1,"0x108":1,"0x12345678":1,"0x12d687":1,"0x1337":1,"0x1337l":1,"0x154":1,"0x1d1ab574":1,"0x1db0000":1,"0x1db0010":1,"0x1l":1,"0x20l":1,"0x2649c60":1,"0x2649d50":1,"0x26ddc60":1,"0x26dde40":1,"0x26ddee0":1,"0x26ddf30":1,"0x272a030":1,"0x272a080":1,"0x272acb0":1,"0x272ad00":1,"0x272ad50":1,"0x272ada0":1,"0x27bd5d0":1,"0x27f7f30":1,"0x27f7f80":1,"0x27fa030":1,"0x2a":1,"0x2e64750":1,"0x2l":1,"0x32d3210":1,"0x3l":1,"0x4":1,"0x41":1,"0x42":1,"0x424242":1,"0x42424242":1,"0x4l":1,"0x5c90000":1,"0x770d7c04":1,"0x774c0000":1,"0x77541128l":1,"0x77a73bad":1,"0x77ae3c7d":1,"0x7ffa3c700000l":1,"0x7ffa3c70f0f0l":1,"0x7ffa3c70f0f5l":1,"0x7ffa3c70f0fal":1,"0x7ffa3c70f0ffl":1,"0x7ffa3c70f100l":1,"0x80000001l":1,"0x80000003l":1,"0x80000004l":1,"0x800b0100l":1,"0x8984848":1,"0x8d0006":1,"0x8d000c":1,"0x8d0011":1,"0x8d0017":1,"0x8d001c":1,"0x8d0022":1,"0x8d0023":1,"0x8e0000":1,"0x8e0004":1,"0xac":1,"0xcf0002":1,"0xcf0003":1,"0xcf0004":1,"0xcf0005":1,"0xd60000":1,"11d1":1,"129l":1,"17415_none_dad8722c5bcc2d8f":1,"2001566688l":1,"2001570704l":1,"2001635616l":1,"2001647872l":1,"31bf3856ad364e35":1,"38ee":1,"41ac":1,"6ae1":1,"817a":1,"85e5":1,"\u03bb":1,"case":1,"class":1,"default":1,"export":1,"function":[0,1],"import":1,"int":1,"return":1,"super":1,"true":1,"try":1,__file__:1,__init__:1,_winreg:1,about:1,abspath:1,access:1,acpi:1,add:1,add_bp:1,additionalinfo:1,addr:1,address:1,addvectoredexceptionhandl:1,adv_import:1,advapi32:1,all:1,all_calc:1,alloc:1,allocat:1,also:1,amd64:1,anoth:1,api:[0,1],append:1,appevent:1,appinfo:1,applicat:1,appxbackupcontenttyp:1,arg:1,arg_po:1,argument_posit:1,ask:1,asked:1,asking:1,assembl:1,assembler:0,base:1,baseaddr:1,basic:1,bbbb:1,becaus:1,begin:1,bit:1,break_on_ret:1,breakpoint:[0,1],buffer:1,c_uint:1,c_void_p:1,calc:1,call:1,can:1,caption:1,cast:1,cat:1,catalog:1,catalogsign:1,catroot:1,check:[0,1],check_is_elev:1,check_signatur:1,choos:1,close:1,clsid:1,cmapi:1,cmd:1,code:0,code_addr:1,code_s:1,com:0,com_inetfwpolicy2:1,comctl32:1,command:1,commandlin:1,complet:1,compon:0,computer_nam:1,condrv:1,conn:1,connect:1,consol:1,content:[0,1],context:[0,1],contextrecord:1,control:1,control_accept:1,counter:1,cp_handl:1,cpuid:0,creat:1,create_connect:1,create_consol:1,create_funct:1,create_inst:1,create_process:1,create_suspended:1,create_thread:1,createfilea:1,cross:0,ctype:1,current_process:0,current_thread:1,current_us:1,currentprocess:1,currentvers:1,dat:1,data:1,dbg:1,debug:0,debug_functionbp:1,debug_process:1,debugg:0,debugger_membp_singlestep:1,debugger_print_ldrloaddl:1,def:1,demo:1,depend:1,deref:1,descript:1,devic:1,deviceapi:1,dict:1,dll:1,dll_load:1,don:1,done:1,drive:[0,1],drive_fixed:1,driver:1,dump:1,dwcreationflag:1,dwprocessid:1,e2b3c97f:1,earli:0,easi:1,eax:1,eeflag:1,eip:1,elev:1,els:1,enabl:1,endswith:1,entri:1,entry:1,enumer:1,environ:1,errno:1,error:1,esp:1,establish:1,eudc:1,event:1,exampl:0,exc:1,except:1,exception:[0,1],exception_access_violation:1,exception_breakpoint:1,exception_continue_execution:1,exception_single_step:1,exceptionaddress:1,exceptioncod:1,exceptioninform:1,exceptionrecord:1,execut:[0,1],execute_python:1,exist:1,exit:1,exit_cod:1,exite:1,exp:1,explor:0,explorat:0,explore:1,extract_argu:1,f6f92166d7dd:1,f750e6c3:1,fail:1,failed:1,fake_module:1,fals:1,fat32:1,fault_addr:1,fhandl:1,file:1,file_h:1,filehandl:1,filenam:1,filesystem:1,find:1,firewal:1,first:1,fixedinteractiveconsol:1,flag:1,follow:1,font:1,forcibl:1,format:1,found:1,freespac:1,from:1,from_address:1,from_str:1,full_signature_inform:1,fullnam:1,func:1,func_result:1,gate:0,gdef:1,gdi32:1,gdiplu:1,gdiplus_6595b64144ccf1df_1:1,gener:1,generated_def:1,get:1,get_cod:1,get_exception_cod:1,get_exception_context:1,get_firewallen:1,get_optionalhead:1,getpeernam:1,got:1,hakril:1,handl:[0,1],handle_addr:1,handle_valu:1,handler:1,harddisk0:1,harddiskvolume2:1,have:1,heaven:0,hello:1,helper:0,here:1,hex:1,hkei:1,hkey_current_user:1,hkey_local_machine:1,hook:0,host:1,hxbp:1,hxbreakpoint:1,iat:0,iat_hook:1,iatentry:1,identiti:1,iid:1,imagepath:1,imm32:1,implement:0,importerror:1,inc:1,index:0,infinit:1,infitin:1,info:1,informat:1,init:1,initialis:1,inject:1,installdat:1,instanc:1,instr:1,instruct:1,instruction:1,interact:1,interfac:[0,1],internal:0,ipv4:1,is_sign:1,is_wow_64:1,item:1,jmp:1,join:1,k32:1,k32pe:1,kei:1,kernel32:1,kernelbas:1,keyboard:1,keyvalu:1,kill:1,kwarg:1,label:1,lait:1,last:1,layout:1,ldr:1,ldrloaddll:1,len:1,let:1,line:1,listen:1,load:[0,1],loadedmodul:1,loading:1,local_debugg:1,local_debugger_remote_process:1,local_port:1,localdebugg:0,localhost:1,logic:[0,1],logicaldr:1,look:1,loop:1,lpsubkei:1,magic:1,make:0,manag:0,manual:1,mem:1,memori:1,memorybreakpoint:1,method:1,microsoft:1,model:0,modul:[0,1],module_to_trac:1,more:1,most:1,mov:1,msctf:1,msvcr90:1,msxml6:1,mui:1,multipleinstr:1,must:1,my_fail_key:1,my_secret_key:1,mydebugg:1,myfunctionbp:1,name:1,nativ:[0,1],native_cod:1,native_exec:[0,1],nativeutil:0,nb_repeat:1,need:1,net_fw_profile2_domain:1,net_fw_profile2_private:1,net_fw_profile2_public:1,netfwpolicy2clsid:1,network:0,nfunc:1,non:1,none:1,nop:1,normal:1,now:1,ntcreatefil:1,ntcreatefile_iat:1,ntdll:1,ntfs:1,object:[0,1],objectattribut:1,objectnam:1,ole32:1,oleacc:1,oleaut32:1,on_except:1,on_single_step:1,open:1,open_reg_hook:1,opene:1,openkei:1,ordin:1,osname:1,ouput:1,our:1,our_connect:1,ourself:1,output:1,owner:1,package_35_for_kb3128650:1,page:[0,1],page_execute_readwrite:1,page_noaccess:1,page_readwrite:1,panel:1,param:1,pars:0,partition2:1,path:1,pathnam:1,pe_pars:1,peb:0,pefile:[0,1],pesection:1,phkresult:1,pid:1,plai:1,pop_calc_32:1,pop_calc_64:1,port:1,ppid:1,pprint:1,print:1,printer:1,printunicodestr:1,pro:1,proc:1,process:0,processid:1,product_typ:1,profil:1,progress:0,protect:1,protocol:0,put:0,pvoid:1,pyhkei:1,python27:1,python32:1,python:1,python_cod:1,python_execut:1,pythondll_modul:1,pythonxx:1,rais:1,rax:1,rdata:1,read:1,read_memori:1,read_ptr:1,read_wstr:1,real_funct:1,recent:1,regist:1,registered_own:1,registeredown:1,registri:0,regopenkeyexa:1,regopenkeyexa_iat:1,regopenkeyexacallback:1,relat:0,reloc:1,remot:0,remote_addr:1,remote_calc:1,remote_cod:1,remote_port:1,remote_veh_segv:1,remotectyp:0,remoteloadedmodul:1,remotepeb:1,remotepythonerror:1,remotewinunicodestr:1,repr:1,represent:1,request:0,requir:1,reset:1,respect:1,result:1,resum:1,ret:1,ret_trigg:1,ret_valu:1,rewrit:1,rewritebreakpoint:1,rsrc:1,run:1,rwx:1,safe:1,samdesir:1,sampl:0,search:0,secret:1,section:1,secur:1,see:1,select:1,self:1,send:1,serv:1,servic:[0,1],service_kernel_driver:1,service_running:1,service_win32_share_process:1,servicea:1,servicestatu:1,set:1,set_hook:1,setup:1,shell32:1,sign:1,sign_info:1,signatur:[0,1],simpl:1,simple_x64:[0,1],simple_x86:[0,1],single_step:1,single_step_count:1,singlesteponwrit:1,singlesteppingdebugg:1,size:1,sizeofcod:1,sleep:1,socket:0,softwar:1,software:1,softwaretyp:1,sofwar:1,some:1,some_export:1,startswith:1,state:1,staticcach:1,statu:1,str:1,string:1,structur:0,stuff:1,subkei:1,subkeys_nam:1,suspend:1,svchost:1,system32:1,system:0,syswow64:[0,1],target:1,target_addr:1,target_file:1,target_func:1,target_host:1,target_nam:1,target_pag:1,target_port:1,tcp:1,test:1,text:1,thei:1,thi:1,thread:[0,1],time:1,trace:1,traceback:1,trigger:1,trust_e_nosignature:1,type:1,typenam:1,uloption:1,unicode_string_addr:1,use:1,user:1,usermodetim:1,using:0,util:[0,1],utiliti:0,uxthem:1,valu:1,valueerror:1,variabl:1,variant_bool:1,vectoredexcept:0,veh:1,veh_segv:1,ver_nt_workstation:1,verif:1,version:1,version_nam:1,via:1,virtual_alloc:1,virtualalloc:[0,1],virtualprotect:1,vol:1,volatil:1,volum:0,wait:1,win32_logicaldisk:1,win32_process:1,windef:1,window:0,windows_info:1,windowserror:1,windowsvers:1,winfunc:1,winmm:1,winobject:1,winoject:1,winprocess:0,winproxi:[0,1],winstruct:1,winsxs:1,winthread:1,wintrust:0,winunicodestr:1,without:1,wmi:0,wmi_request:1,wmirequest:1,work:[0,1],write:1,write_memori:1,wrote:1,wstring_addr:1,wvalu:1,x00:1,x64:[0,1],x86:[0,1],x86_microsoft:1,x90:1,yolohxbp:1,yop:1,you:1},titles:["Welcome to PythonForWindows’s documentation!","12. Samples of code"],titleterms:{code:1,com:1,current:1,current_process:1,debug:1,debugg:1,document:0,explor:1,functionbp:1,hook:1,iat:1,indice:0,inetfwpolicy2:1,local:1,localdebugg:1,make:1,network:1,peb:1,process:1,pythonforwindow:0,registri:1,remot:1,request:1,sampl:1,singl:1,socket:1,step:1,system:1,tabl:0,vectoredexcept:1,welcom:0,window:1,winprocess:1,wintrust:1,wmi:1}})
\ No newline at end of file
diff --git a/docs/build/html/windows.html b/docs/build/html/windows.html
index b82a6a9..916fef5 100644
--- a/docs/build/html/windows.html
+++ b/docs/build/html/windows.html
@@ -143,7 +143,7 @@ It also offers some submodules aimed to help the interfacing with
-
-
network = <windows.winobject.network.Network object at 0x04A61CF0>¶
+network = <windows.winobject.network.Network object at 0x04FC0C30>¶
Object of class windows.winobject.network.Network
-
-
registry = <windows.winobject.registry.Registry object at 0x04A61D10>¶
+registry = <windows.winobject.registry.Registry object at 0x04FC0C50>¶
Object of class windows.winobject.registry.Registry
, name=<\Device\HarddiskVolume2\Windows\SysWOW64\en-US\calc.exe.mui>
@@ -407,7 +408,7 @@ Ouput::
''''''''''''''''''''''
In current process
-^^^^^^^^^^^^^^^^^^
+~~~~~~~~~~~~~~~~~~
.. literalinclude:: ..\..\samples\local_debugger.py
@@ -424,7 +425,7 @@ Ouput::
In remote process
-^^^^^^^^^^^^^^^^^
+~~~~~~~~~~~~~~~~~
.. literalinclude:: ..\..\samples\local_debugger_remote_process.py