Add/Update some doc

samples/current_process.py

@@ -27,13 +27,11 @@ else:
     code += x64.Mov("RAX", 0x41)
     code += x64.Inc("RAX")
     code += x64.Ret()
-    
+
 native_code = code.get_code()
 
 v = windows.current_process.execute(native_code)
-print("Waiting for execution to finish !")
-v.wait()
-print("Native code returned <{0}>".format(hex(v.exit_code)))
+print("Native code returned <{0}>".format(hex(v)))
 
 print("Allocating memory in current process")
 addr = cp.virtual_alloc(0x1000) # Default alloc is RWX (so secure !)

samples/debugger_membp_singlestep.py

@@ -28,20 +28,19 @@ class MyDebugger(windows.debug.Debugger):
         self.single_step_counter -= 1
         if self.single_step_counter > 0:
             return self.single_step()
+        else:
+            print("No more single step: exiting")
+            self.current_process.exit()
 
 
 class SingleStepOnWrite(windows.debug.MemoryBreakpoint):
-    DEFAULT_PROTECT = PAGE_READONLY
     """Check that BP/dbg can trigger single step and that instruction follows"""
     def trigger(self, dbg, exc):
         fault_addr = exc.ExceptionRecord.ExceptionInformation[1]
+        import pdb;pdb.set_trace()
         eip = dbg.current_thread.context.pc
         print("Instruction at <{0:#x}> wrote at <{1:#x}>".format(eip, fault_addr))
         dbg.single_step_counter = 4
-        #import pdb;pdb.set_trace()
-        #if fault_addr == self.addr + 4:
-        #    print("Delete self BP")
-        #    dbg.del_bp(self)
         return dbg.single_step()
 
 
@@ -63,7 +62,7 @@ injected += x86.Nop()
 injected += x86.Ret()
 
 calc.write_memory(code, injected.get_code())
-d.add_bp(SingleStepOnWrite(data + 1, size=5))
+d.add_bp(SingleStepOnWrite(data, size=8, events="W"))
 calc.create_thread(code, 0)
 d.loop()
 

samples/debugger_print_LdrLoaddll.py

@@ -41,6 +41,6 @@ class PrintUnicodeString(windows.debug.Breakpoint):
 
 calc = windows.test.pop_calc_32(dwCreationFlags=DEBUG_PROCESS)
 d = MyDebugger(calc)
-d.add_bp(PrintUnicodeString("ntdll.dll!LdrLoadDll", argument_position=2))
+d.add_bp(PrintUnicodeString("ntdll!LdrLoadDll", argument_position=2))
 d.loop()
 

samples/system.py

@@ -39,4 +39,18 @@ print("    " + str(serv))
 print((" " * 8) + "name = {0}".format(serv.name))
 print((" " * 8) + "description = {0}".format(serv.description))
 print((" " * 8) + "status = {0}".format(serv.status))
-print((" " * 8) + "process = {0}".format(repr(serv.process)))
+print((" " * 8) + "process = {0}".format(repr(serv.process)))
+print("")
+
+print("Enumerating handles:")
+handles = system.handles
+print("    There are {0} handles:".format(len(handles)))
+print("    First handle is: " + str(handles[0]))
+
+print("    Enumerating handles of the current process:")
+cp_handles = [h for h in system.handles if h.dwProcessId == windows.current_process.pid]
+print("        There are {0} handles for this process".format(len(cp_handles)))
+print("    Looking for a File handle:")
+file_h = [h for h in cp_handles if h.type == "File"][0]
+print("        Handle is {0}".format(file_h))
+print("        Name is <{0}>".format(file_h.name))