diff --git a/doc/source/exception.rst b/doc/source/exception.rst index c966e8d..c9dbb4e 100644 --- a/doc/source/exception.rst +++ b/doc/source/exception.rst @@ -7,11 +7,14 @@ Exception and Context related structures This module regroups all the Exception/Context related structures and functions. Most of the structures are the Windows structure with a prefix ``E`` (For enhanced) -Those structure have the same fields that the normal windows ones but its types might vary for a simpler use. +Those structure have the same fields that the normal windows ones but their types might vary for a simpler use. This module also define the decorator :func:`VectoredException` which allows to play with ``Vectored Exception Handler`` in Python -See sample :ref:`sample_vectoredexception` + +.. note:: + + See sample :ref:`sample_vectoredexception` samples Exception Records ''''''''''''''''' diff --git a/samples/debugger.py b/samples/debugger.py new file mode 100644 index 0000000..9ea288a --- /dev/null +++ b/samples/debugger.py @@ -0,0 +1,41 @@ +import windows +import windows.test +import windows.debug + +from windows.generated_def.winstructs import * + + + +class MyDebugger(windows.debug.Debugger): + def on_exception(self, exception): + code = exception.ExceptionRecord.ExceptionCode + addr = exception.ExceptionRecord.ExceptionAddress + print("Got exception {0} at 0x{1:x}".format(code, addr)) + + +class PrintUnicodeString(windows.debug.Breakpoint): + def __init__(self, addr, argument_position): + super(PrintUnicodeString, self).__init__(addr) + self.arg_pos = argument_position + + + def trigger(self, dbg, exc): + p = dbg.current_process + t = dbg.current_thread + esp = t.context.Esp + + unicode_string_addr = p.read_ptr(esp + (self.arg_pos + 1) * 4) + wstring_addr = p.read_ptr(unicode_string_addr + 4) + dll_loaded = p.read_wstring(wstring_addr) + print("Loading <{0}>".format(dll_loaded)) + + if dll_loaded.endswith("ole32.dll"): + print("Ask to load : exiting process") + dbg.current_process.exit() + + +calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS) +d = MyDebugger(calc, already_debuggable=True) +d.add_bp(PrintUnicodeString("ntdll.dll!LdrLoadDll", argument_position=2)) +d.loop() + diff --git a/setup.py b/setup.py index 4653d6b..80344e9 100644 --- a/setup.py +++ b/setup.py @@ -14,6 +14,5 @@ setup( license = 'BSD', keywords = 'windows python', url = '', - py_modules= ['windows'], - packages = ['windows'], + packages = ['windows', 'windows.generated_def', 'windows.native_exec', 'windows.utils'], ) \ No newline at end of file diff --git a/windows/winobject.py b/windows/winobject.py index 8acc36e..e986a5a 100644 --- a/windows/winobject.py +++ b/windows/winobject.py @@ -331,8 +331,8 @@ class Process(AutoHandle): def execute(self, code, parameter=0): """Execute some native code in the context of the process - :return: The return value of the native code - :rtype: :class:`int`""" + :return: The thread executing the code + :rtype: :class:`WinThread` or :class:`DeadThread`""" x = self.virtual_alloc(len(code)) #Todo: free this ? when ? how ? reuse ? self.write_memory(x, code) return self.create_thread(x, parameter)