import windows import windows.winproxy as winproxy import windows.native_exec.simple_x86 as x86 import windows.native_exec.simple_x64 as x64 from windows.generated_def.winstructs import * from .generated_def import windef class DEBUG_EVENT(DEBUG_EVENT): KNOWN_EVENT_CODE = dict((x,x) for x in [EXCEPTION_DEBUG_EVENT, CREATE_THREAD_DEBUG_EVENT, CREATE_PROCESS_DEBUG_EVENT, EXIT_THREAD_DEBUG_EVENT, EXIT_PROCESS_DEBUG_EVENT, LOAD_DLL_DEBUG_EVENT, UNLOAD_DLL_DEBUG_EVENT, OUTPUT_DEBUG_STRING_EVENT, RIP_EVENT]) @property def code(self): return self.KNOWN_EVENT_CODE.get(self.dwDebugEventCode, self.dwDebugEventCode) class Debugger(object): #define EXCEPTION_DEBUG_EVENT 1 #define CREATE_THREAD_DEBUG_EVENT 2 #define CREATE_PROCESS_DEBUG_EVENT 3 #define EXIT_THREAD_DEBUG_EVENT 4 #define EXIT_PROCESS_DEBUG_EVENT 5 #define LOAD_DLL_DEBUG_EVENT 6 #define UNLOAD_DLL_DEBUG_EVENT 7 #define OUTPUT_DEBUG_STRING_EVENT 8 #define RIP_EVENT 9 def __init__(self, target): # Todo: accept PID / String / WinProcess self.target = target winproxy.DebugActiveProcess(target.pid) self._handle_initial_debug_event() def _handle_initial_debug_event(self): pass def _debug_event_generator(self): while True: debug_event = DEBUG_EVENT() winproxy.WaitForDebugEvent(debug_event) yield debug_event def _finish_debug_event(self, event, action): if action not in [windef.DBG_CONTINUE, windef.DBG_EXCEPTION_NOT_HANDLED]: raise ValueError('Unknow action : <0>'.format(action)) winproxy.ContinueDebugEvent(event.dwProcessId, event.dwThreadId, action) def loop(self): for x, i in enumerate(self._debug_event_generator()): print(i, i.code) self._finish_debug_event(i, windef.DBG_CONTINUE) # TODO: exit on process exit if x == 100: break