admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
add_ndr_tests
hakril-PythonForWindows/docs/build/html/debug.html
T
hakril 8fa8cf9be1 Regenerating documentation for 1.0.4
2025-08-14 10:37:06 +02:00

1416 lines
154 KiB
HTML
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html lang="en" data-content_root="./">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>9. windows.debug – Debugging &#8212; PythonForWindows 1.0.4 documentation</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="_static/classic.css?v=def86cc0" />
<link rel="stylesheet" type="text/css" href="_static/css/mbasic.css?v=957880af" />
<script src="_static/documentation_options.js?v=71272d9f"></script>
<script src="_static/doctools.js?v=9a2dae69"></script>
<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="10. windows.com - Component Object Model" href="com.html" />
<link rel="prev" title="8. windows.wintrust – Checking signature" href="wintrust.html" />
</head><body>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="com.html" title="10. windows.com - Component Object Model"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="wintrust.html" title="8. windows.wintrust – Checking signature"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">9. </span><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug</span></code> – Debugging</a></li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="module-windows.debug">
<span id="windows-debug-debugging"></span><h1><span class="section-number">9. </span><a class="reference internal" href="#module-windows.debug" title="windows.debug"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug</span></code></a> – Debugging<a class="headerlink" href="#module-windows.debug" title="Link to this heading"></a></h1>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-debugger"><span class="std std-ref">Debugging</span></a></p>
</div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>If you are interrested by symbols (PDB) handling, go to subsection <a class="reference internal" href="#debug-symbols-module"><span class="std std-ref">windows.debug.symbols – Using symbols</span></a>.</p>
<p>You can also look at the symbols-related samples: <a class="reference internal" href="sample.html#sample-symbols"><span class="std std-ref">Symbols</span></a></p>
</div>
<section id="debugger">
<h2><span class="section-number">9.1. </span><a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a><a class="headerlink" href="#debugger" title="Link to this heading"></a></h2>
<p>The <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a> is the base class to perform the debugging of a remote process.
The <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a> have some functions called on given event that can be implemented by subclasses.</p>
<p>All Memory-breakpoint are disabled when callind a public callback or a breakpoint <code class="docutils literal notranslate"><span class="pre">trigger()</span></code> function.</p>
<p>This means that those methods see the original <code class="docutils literal notranslate"><span class="pre">current_process</span></code> memory access rights.</p>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.Debugger">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">Debugger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger" title="Link to this definition"></a></dt>
<dd><p>A debugger based on standard Win32 API. Handle :</p>
<ul class="simple">
<li><p>Standard BP (int3)</p></li>
<li><p>Hardware-Exec BP (DrX)</p></li>
<li><p>Memory BP (virtual_protect)</p></li>
</ul>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.__init__">
<span class="sig-name descname"><span class="pre">__init__</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.__init__"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.__init__" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">target</span></code> must be a debuggable <code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code>.</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.attach">
<em class="property"><span class="pre">classmethod</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">attach</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.attach"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.attach" title="Link to this definition"></a></dt>
<dd><p>attach to <code class="docutils literal notranslate"><span class="pre">target</span></code> (must be a <code class="xref py py-class docutils literal notranslate"><span class="pre">WinProcess</span></code>)</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>see <a class="reference internal" href="sample.html#sample-debugger-attach"><span class="std std-ref">Debugger.attach sample</span></a></p>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.detach">
<span class="sig-name descname"><span class="pre">detach</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.detach"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.detach" title="Link to this definition"></a></dt>
<dd><p>Detach from all debugged processes or process <code class="docutils literal notranslate"><span class="pre">target</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.debug">
<em class="property"><span class="pre">classmethod</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">debug</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">args</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">dwCreationFlags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">show_windows</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.debug"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.debug" title="Link to this definition"></a></dt>
<dd><p>Create a process and debug it.</p>
<dl class="field-list simple">
<dt class="field-odd">Return type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.loop">
<span class="sig-name descname"><span class="pre">loop</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.loop"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.loop" title="Link to this definition"></a></dt>
<dd><p>Debugging loop: handle event / dispatch to breakpoint. Returns when all targets are dead/detached</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.add_bp">
<span class="sig-name descname"><span class="pre">add_bp</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">bp</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">type</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.add_bp"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.add_bp" title="Link to this definition"></a></dt>
<dd><p>Add a breakpoint, bp can be:</p>
<ul class="simple">
<li><p>a <a class="reference internal" href="#windows.debug.Breakpoint" title="windows.debug.Breakpoint"><code class="xref py py-class docutils literal notranslate"><span class="pre">Breakpoint</span></code></a> (addr and type must be <code class="docutils literal notranslate"><span class="pre">None</span></code>)</p></li>
<li><p>any callable (addr and type must NOT be <code class="docutils literal notranslate"><span class="pre">None</span></code>) (NON-TESTED)</p></li>
</ul>
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">STANDARD_BP</span></code> or <code class="docutils literal notranslate"><span class="pre">MEMORY_BREAKPOINT</span></code>, target can be <code class="docutils literal notranslate"><span class="pre">None</span></code> (all targets) or a process.</p>
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">HARDWARE_EXEC_BP</span></code>, target can be <code class="docutils literal notranslate"><span class="pre">None</span></code> (all targets), a process or a thread.</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.del_bp">
<span class="sig-name descname"><span class="pre">del_bp</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">bp</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">targets</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.del_bp"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.del_bp" title="Link to this definition"></a></dt>
<dd><p>Delete a breakpoint, if targets is <code class="docutils literal notranslate"><span class="pre">None</span></code>: delete it from all targets</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.single_step">
<span class="sig-name descname"><span class="pre">single_step</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.single_step"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.single_step" title="Link to this definition"></a></dt>
<dd><p>Make the <code class="docutils literal notranslate"><span class="pre">current_thread</span></code> <code class="docutils literal notranslate"><span class="pre">single_step</span></code>. <code class="docutils literal notranslate"><span class="pre">Debugger.on_single_step</span></code> will be called after that</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.get_memory_breakpoint_at">
<span class="sig-name descname"><span class="pre">get_memory_breakpoint_at</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">process</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.get_memory_breakpoint_at"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.get_memory_breakpoint_at" title="Link to this definition"></a></dt>
<dd><p>Get the memory breakpoint that handle <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<p>Return values are:</p>
<blockquote>
<div><ul class="simple">
<li><p><code class="docutils literal notranslate"><span class="pre">False</span></code> if the page has no memory breakpoint (real fault)</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">None</span></code> if the page as memBP but None handle <code class="docutils literal notranslate"><span class="pre">addr</span></code></p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">bp</span></code> the MemBP that handle <code class="docutils literal notranslate"><span class="pre">addr</span></code></p></li>
</ul>
</div></blockquote>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.disable_all_memory_breakpoints">
<span class="sig-name descname"><span class="pre">disable_all_memory_breakpoints</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.disable_all_memory_breakpoints"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.disable_all_memory_breakpoints" title="Link to this definition"></a></dt>
<dd><p>Restore all pages to their original access rights.
If target is <code class="docutils literal notranslate"><span class="pre">None</span></code>, use <code class="docutils literal notranslate"><span class="pre">current_process</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>a mapping of all disabled breakpoints that must be passed to <a class="reference internal" href="#windows.debug.Debugger.restore_all_memory_breakpoints" title="windows.debug.Debugger.restore_all_memory_breakpoints"><code class="xref py py-func docutils literal notranslate"><span class="pre">restore_all_memory_breakpoints()</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.restore_all_memory_breakpoints">
<span class="sig-name descname"><span class="pre">restore_all_memory_breakpoints</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">data</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.restore_all_memory_breakpoints"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.restore_all_memory_breakpoints" title="Link to this definition"></a></dt>
<dd><p>Re-setup all memory breakpoints, affecting pages access rights.
If target is <code class="docutils literal notranslate"><span class="pre">None</span></code>, use <code class="docutils literal notranslate"><span class="pre">current_process</span></code></p>
<p><code class="docutils literal notranslate"><span class="pre">data</span></code> is the result of the corresponding call to <a class="reference internal" href="#windows.debug.Debugger.disable_all_memory_breakpoints" title="windows.debug.Debugger.disable_all_memory_breakpoints"><code class="xref py py-func docutils literal notranslate"><span class="pre">disable_all_memory_breakpoints()</span></code></a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.DisabledMemoryBreakpoint">
<span class="sig-name descname"><span class="pre">DisabledMemoryBreakpoint</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.DisabledMemoryBreakpoint"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.DisabledMemoryBreakpoint" title="Link to this definition"></a></dt>
<dd><p>A context-manager that disable all memory breakpoints and restore them on exit</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.get_exception_bitness">
<span class="sig-name descname"><span class="pre">get_exception_bitness</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">exc</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.get_exception_bitness"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.get_exception_bitness" title="Link to this definition"></a></dt>
<dd><p>Return the bitness in which the exception occured.
Useful when debugingg a 32b process from a 64bits one</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code> – 32 or 64</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.kill_on_exit">
<em class="property"><span class="pre">static</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">kill_on_exit</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">choice</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.kill_on_exit"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.kill_on_exit" title="Link to this definition"></a></dt>
<dd><p>If set to True(default in Windows) will kill all attached process on thread exit.
Otherwise, the thread detaches from all processes being debugged on exit.</p>
<p>See: <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-debugsetprocesskillonexit">https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-debugsetprocesskillonexit</a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_setup">
<span class="sig-name descname"><span class="pre">on_setup</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_setup"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_setup" title="Link to this definition"></a></dt>
<dd><p>Called on the first breakpoint event occuring in the debugger.
This callback allow to setup hook / interact with the debugee when ready:</p>
<ul class="simple">
<li><p>If <a class="reference internal" href="#windows.debug.Debugger.on_setup" title="windows.debug.Debugger.on_setup"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_setup()</span></code></a> is overriden by a subclass it will be called and <a class="reference internal" href="#windows.debug.Debugger.on_exception" title="windows.debug.Debugger.on_exception"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_exception()</span></code></a> will NOT be called for this event (first BP).</p></li>
<li><p>If <a class="reference internal" href="#windows.debug.Debugger.on_setup" title="windows.debug.Debugger.on_setup"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_setup()</span></code></a> is not defined the first BP will trigger an <a class="reference internal" href="#windows.debug.Debugger.on_exception" title="windows.debug.Debugger.on_exception"><code class="xref py py-func docutils literal notranslate"><span class="pre">on_exception()</span></code></a>.</p></li>
</ul>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>see sample <a class="reference internal" href="sample.html#sample-debugger-on-setup"><span class="std std-ref">on_setup</span></a></p>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_exception">
<span class="sig-name descname"><span class="pre">on_exception</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_exception"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_exception" title="Link to this definition"></a></dt>
<dd><p>Called on exception event other that known breakpoint or requested single step. <code class="docutils literal notranslate"><span class="pre">exception</span></code> is one of the following type:</p>
<blockquote>
<div><ul class="simple">
<li><p><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO32" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO32"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO32</span></code></a></p></li>
<li><p><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO64" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO64"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO64</span></code></a></p></li>
</ul>
</div></blockquote>
<p>The default behaviour is to return <code class="docutils literal notranslate"><span class="pre">DBG_CONTINUE</span></code> for the known exception code
and <code class="docutils literal notranslate"><span class="pre">DBG_EXCEPTION_NOT_HANDLED</span></code> else</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_single_step">
<span class="sig-name descname"><span class="pre">on_single_step</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_single_step"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_single_step" title="Link to this definition"></a></dt>
<dd><p>Called on requested single step <code class="docutils literal notranslate"><span class="pre">exception</span></code> is one of the following type:</p>
<blockquote>
<div><ul class="simple">
<li><p><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO32" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO32"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO32</span></code></a></p></li>
<li><p><a class="reference internal" href="exception.html#windows.winobject.exception.EEXCEPTION_DEBUG_INFO64" title="windows.winobject.exception.EEXCEPTION_DEBUG_INFO64"><code class="xref py py-class docutils literal notranslate"><span class="pre">windows.winobject.exception.EEXCEPTION_DEBUG_INFO64</span></code></a></p></li>
</ul>
</div></blockquote>
<p>There is no default implementation, if you use <code class="docutils literal notranslate"><span class="pre">Debugger.single_step()</span></code> you should implement <code class="docutils literal notranslate"><span class="pre">on_single_step</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_create_process">
<span class="sig-name descname"><span class="pre">on_create_process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">create_process</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_create_process"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_create_process" title="Link to this definition"></a></dt>
<dd><p>Called on create_process event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>create_process</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.CREATE_PROCESS_DEBUG_INFO" title="windows.generated_def.winstructs.CREATE_PROCESS_DEBUG_INFO"><em>CREATE_PROCESS_DEBUG_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_exit_process">
<span class="sig-name descname"><span class="pre">on_exit_process</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">exit_process</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_exit_process"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_exit_process" title="Link to this definition"></a></dt>
<dd><p>Called on exit_process event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>exit_process</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.EXIT_PROCESS_DEBUG_INFO" title="windows.generated_def.winstructs.EXIT_PROCESS_DEBUG_INFO"><em>EXIT_PROCESS_DEBUG_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_create_thread">
<span class="sig-name descname"><span class="pre">on_create_thread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">create_thread</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_create_thread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_create_thread" title="Link to this definition"></a></dt>
<dd><p>Called on create_thread event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>create_thread</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.CREATE_THREAD_DEBUG_INFO" title="windows.generated_def.winstructs.CREATE_THREAD_DEBUG_INFO"><em>CREATE_THREAD_DEBUG_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_exit_thread">
<span class="sig-name descname"><span class="pre">on_exit_thread</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">exit_thread</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_exit_thread"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_exit_thread" title="Link to this definition"></a></dt>
<dd><p>Called on exit_thread event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>exit_thread</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.EXIT_THREAD_DEBUG_INFO" title="windows.generated_def.winstructs.EXIT_THREAD_DEBUG_INFO"><em>EXIT_THREAD_DEBUG_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_load_dll">
<span class="sig-name descname"><span class="pre">on_load_dll</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">load_dll</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_load_dll"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_load_dll" title="Link to this definition"></a></dt>
<dd><p>Called on load_dll event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>load_dll</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.LOAD_DLL_DEBUG_INFO" title="windows.generated_def.winstructs.LOAD_DLL_DEBUG_INFO"><em>LOAD_DLL_DEBUG_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_unload_dll">
<span class="sig-name descname"><span class="pre">on_unload_dll</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">unload_dll</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_unload_dll"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_unload_dll" title="Link to this definition"></a></dt>
<dd><p>Called on unload_dll event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>unload_dll</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.UNLOAD_DLL_DEBUG_INFO" title="windows.generated_def.winstructs.UNLOAD_DLL_DEBUG_INFO"><em>UNLOAD_DLL_DEBUG_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_output_debug_string">
<span class="sig-name descname"><span class="pre">on_output_debug_string</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">debug_string</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_output_debug_string"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_output_debug_string" title="Link to this definition"></a></dt>
<dd><p>Called on debug_string event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>debug_string</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.OUTPUT_DEBUG_STRING_INFO" title="windows.generated_def.winstructs.OUTPUT_DEBUG_STRING_INFO"><em>OUTPUT_DEBUG_STRING_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Debugger.on_rip">
<span class="sig-name descname"><span class="pre">on_rip</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">rip_info</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/debugger.html#Debugger.on_rip"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Debugger.on_rip" title="Link to this definition"></a></dt>
<dd><p>Called on rip_info event</p>
<dl class="field-list simple">
<dt class="field-odd">Parameters<span class="colon">:</span></dt>
<dd class="field-odd"><p><strong>rip_info</strong> (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.RIP_INFO" title="windows.generated_def.winstructs.RIP_INFO"><em>RIP_INFO</em></a>)</p>
</dd>
</dl>
</dd></dl>
</dd></dl>
</section>
<section id="symboldebugger">
<h2><span class="section-number">9.2. </span><a class="reference internal" href="#windows.debug.SymbolDebugger" title="windows.debug.SymbolDebugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolDebugger</span></code></a><a class="headerlink" href="#symboldebugger" title="Link to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-symbol-debugger"><span class="std std-ref">SymbolDebugger</span></a></p>
</div>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.SymbolDebugger">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">SymbolDebugger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="o"><span class="pre">*</span></span><span class="n"><span class="pre">args</span></span></em>, <em class="sig-param"><span class="o"><span class="pre">**</span></span><span class="n"><span class="pre">kwargs</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symboldbg.html#SymbolDebugger"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.SymbolDebugger" title="Link to this definition"></a></dt>
<dd><p>Bases: <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.debugger.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a></p>
<p>A debugger using the symbol API (hence PDB) for name resolution.
To use PDB, a correct version of dbghelp should be configured as well as <code class="docutils literal notranslate"><span class="pre">_NT_SYMBOL_PATH</span></code>.
(See <a class="reference internal" href="#debug-symbols-module"><span class="std std-ref">windows.debug.symbols – Using symbols</span></a>)</p>
<p>This debugger add a <code class="docutils literal notranslate"><span class="pre">current_resolver</span></code> variable (A <a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler" title="windows.debug.symbols.ProcessSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">ProcessSymbolHandler</span></code></a>) for the <code class="docutils literal notranslate"><span class="pre">current_process</span></code>.</p>
</dd></dl>
</section>
<section id="localdebugger">
<h2><span class="section-number">9.3. </span><a class="reference internal" href="#windows.debug.LocalDebugger" title="windows.debug.LocalDebugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">LocalDebugger</span></code></a><a class="headerlink" href="#localdebugger" title="Link to this heading"></a></h2>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-local-debugger"><span class="std std-ref">LocalDebugger</span></a></p>
</div>
<p>The <a class="reference internal" href="#windows.debug.Debugger" title="windows.debug.Debugger"><code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a> is the base class to perform the debugging the current process.
It is based on <code class="xref py py-func docutils literal notranslate"><span class="pre">VectoredException()</span></code> (see <a class="reference internal" href="sample.html#sample-vectoredexception"><span class="std std-ref">VectoredException()</span></a>)</p>
<p>There is not much documentation for now as the code might change soon.</p>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.LocalDebugger">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">LocalDebugger</span></span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.LocalDebugger" title="Link to this definition"></a></dt>
<dd><p>A debugger interface around <code class="xref py py-func docutils literal notranslate"><span class="pre">AddVectoredExceptionHandler()</span></code>.</p>
<p>Handle:</p>
<blockquote>
<div><ul class="simple">
<li><p>Standard BP (int3)</p></li>
<li><p>Hardware-Exec BP (DrX)</p></li>
</ul>
</div></blockquote>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.LocalDebugger.add_bp">
<span class="sig-name descname"><span class="pre">add_bp</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">bp</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.add_bp"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.LocalDebugger.add_bp" title="Link to this definition"></a></dt>
<dd><p>Add a breakpoint, bp is a “class:<cite>Breakpoint</cite></p>
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">STANDARD_BP</span></code>, target must be None.</p>
<p>If the <code class="docutils literal notranslate"><span class="pre">bp</span></code> type is <code class="docutils literal notranslate"><span class="pre">HARDWARE_EXEC_BP</span></code>, target can be None (all threads), or some threads of the process</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.LocalDebugger.del_bp">
<span class="sig-name descname"><span class="pre">del_bp</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">bp</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">targets</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.del_bp"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.LocalDebugger.del_bp" title="Link to this definition"></a></dt>
<dd><p>Delete a breakpoint</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.LocalDebugger.get_exception_code">
<span class="sig-name descname"><span class="pre">get_exception_code</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.get_exception_code"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.LocalDebugger.get_exception_code" title="Link to this definition"></a></dt>
<dd><p>Return ExceptionCode of current exception</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.LocalDebugger.get_exception_context">
<span class="sig-name descname"><span class="pre">get_exception_context</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.get_exception_context"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.LocalDebugger.get_exception_context" title="Link to this definition"></a></dt>
<dd><p>Return context of current exception</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.LocalDebugger.on_exception">
<span class="sig-name descname"><span class="pre">on_exception</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">exc</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.on_exception"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.LocalDebugger.on_exception" title="Link to this definition"></a></dt>
<dd><p>Called on exception</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.LocalDebugger.single_step">
<span class="sig-name descname"><span class="pre">single_step</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/localdbg.html#LocalDebugger.single_step"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.LocalDebugger.single_step" title="Link to this definition"></a></dt>
<dd><p>Make the current thread to single step</p>
</dd></dl>
</dd></dl>
</section>
<section id="breakpoint">
<h2><span class="section-number">9.4. </span><a class="reference internal" href="#windows.debug.Breakpoint" title="windows.debug.Breakpoint"><code class="xref py py-class docutils literal notranslate"><span class="pre">Breakpoint</span></code></a><a class="headerlink" href="#breakpoint" title="Link to this heading"></a></h2>
<p>Standard breakpoints types expect an address as argument.</p>
<p>An address can be:</p>
<blockquote>
<div><ul>
<li><p>An <code class="xref py py-class docutils literal notranslate"><span class="pre">int</span></code></p></li>
<li><p>A <code class="xref py py-class docutils literal notranslate"><span class="pre">str</span></code> of form (breakpoint will be put when <code class="docutils literal notranslate"><span class="pre">DLL</span></code> is loaded):</p>
<blockquote>
<div><ul class="simple">
<li><p><code class="docutils literal notranslate"><span class="pre">&quot;DLL!ApiName&quot;</span></code></p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">&quot;DLL!Offset&quot;</span></code> where offset is a int (“16”, “0x10”, ..)</p></li>
</ul>
</div></blockquote>
</li>
</ul>
</div></blockquote>
<p>When a breakpoint is hit, its <code class="docutils literal notranslate"><span class="pre">trigger</span></code> function is called with the debugger and a
<code class="docutils literal notranslate"><span class="pre">DEBUG_EXECEPTION_EVENT</span></code> structure as argument.</p>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.Breakpoint">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">Breakpoint</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#Breakpoint"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Breakpoint" title="Link to this definition"></a></dt>
<dd><p>An standard (Int3) breakpoint (type == <code class="docutils literal notranslate"><span class="pre">STANDARD_BP</span></code>)</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.Breakpoint.trigger">
<span class="sig-name descname"><span class="pre">trigger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#Breakpoint.trigger"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.Breakpoint.trigger" title="Link to this definition"></a></dt>
<dd><p>Called when breakpoint is hit</p>
</dd></dl>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.HXBreakpoint">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">HXBreakpoint</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#HXBreakpoint"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.HXBreakpoint" title="Link to this definition"></a></dt>
<dd><p>An hardware-execution breakpoint (type == <code class="docutils literal notranslate"><span class="pre">HARDWARE_EXEC_BP</span></code>)</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.HXBreakpoint.trigger">
<span class="sig-name descname"><span class="pre">trigger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.HXBreakpoint.trigger" title="Link to this definition"></a></dt>
<dd><p>Called when breakpoint is hit</p>
</dd></dl>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.MemoryBreakpoint">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">MemoryBreakpoint</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">events</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#MemoryBreakpoint"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.MemoryBreakpoint" title="Link to this definition"></a></dt>
<dd><p>A memory breakpoint (type == <code class="docutils literal notranslate"><span class="pre">MEMORY_BREAKPOINT</span></code>)</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.MemoryBreakpoint.__init__">
<span class="sig-name descname"><span class="pre">__init__</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">events</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#MemoryBreakpoint.__init__"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.MemoryBreakpoint.__init__" title="Link to this definition"></a></dt>
<dd><p><code class="docutils literal notranslate"><span class="pre">size</span></code>: the size of the memory breakpoint.</p>
<p><code class="docutils literal notranslate"><span class="pre">events</span></code>: a string representing the events that interest the BP (any of “RWX”)</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.MemoryBreakpoint.trigger">
<span class="sig-name descname"><span class="pre">trigger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#MemoryBreakpoint.trigger"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.MemoryBreakpoint.trigger" title="Link to this definition"></a></dt>
<dd><p>Called when breakpoint is hit</p>
</dd></dl>
</dd></dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>MemoryBreakpoint are triggered based on the fault address only (as I don’t know a way to get the size of the read/write causing the fault without embedding a disassembler).</p>
<p>This means that a MEMBP at address <code class="docutils literal notranslate"><span class="pre">X</span></code> won’t be triggered by a write of size 4 at address <code class="docutils literal notranslate"><span class="pre">X</span> <span class="pre">-</span> <span class="pre">1</span></code>. it’s sad I know.</p>
</div>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.FunctionCallBP">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">FunctionCallBP</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.FunctionCallBP" title="Link to this definition"></a></dt>
<dd><p>A Breakpoint that allow to trigger at the return of a function</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionCallBP.__init__">
<span class="sig-name descname"><span class="pre">__init__</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionCallBP.__init__" title="Link to this definition"></a></dt>
<dd></dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionCallBP.break_on_ret">
<span class="sig-name descname"><span class="pre">break_on_ret</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP.break_on_ret"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.FunctionCallBP.break_on_ret" title="Link to this definition"></a></dt>
<dd><p>Setup a breakpoint at the return address of the function, this breakpoint will call <a class="reference internal" href="#windows.debug.FunctionCallBP.ret_trigger" title="windows.debug.FunctionCallBP.ret_trigger"><code class="xref py py-func docutils literal notranslate"><span class="pre">ret_trigger()</span></code></a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionCallBP.get_ret_addr">
<span class="sig-name descname"><span class="pre">get_ret_addr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP.get_ret_addr"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.FunctionCallBP.get_ret_addr" title="Link to this definition"></a></dt>
<dd><p>Get the return address of the current target, only valid in the trigger() function.</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionCallBP.ret_trigger">
<span class="sig-name descname"><span class="pre">ret_trigger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionCallBP.ret_trigger"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.FunctionCallBP.ret_trigger" title="Link to this definition"></a></dt>
<dd><p>Called at the return of the function if <a class="reference internal" href="#windows.debug.FunctionCallBP.break_on_ret" title="windows.debug.FunctionCallBP.break_on_ret"><code class="xref py py-func docutils literal notranslate"><span class="pre">break_on_ret()</span></code></a> was called</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionCallBP.trigger">
<span class="sig-name descname"><span class="pre">trigger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionCallBP.trigger" title="Link to this definition"></a></dt>
<dd><p>Called when breakpoint is hit</p>
</dd></dl>
</dd></dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-debugger-bp-functioncallbp"><span class="std std-ref">windows.debug.FunctionCallBP</span></a></p>
</div>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.FunctionBP">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.</span></span><span class="sig-name descname"><span class="pre">FunctionBP</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/breakpoints.html#FunctionBP"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.FunctionBP" title="Link to this definition"></a></dt>
<dd><p>A breakpoint that accepts a function from <a class="reference internal" href="winproxy.html#module-windows.winproxy" title="windows.winproxy"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.winproxy</span></code></a> and able to:</p>
<ul class="simple">
<li><p>Extract the arguments of the functions</p></li>
<li><p>Break at the return of the function</p></li>
</ul>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionBP.__init__">
<span class="sig-name descname"><span class="pre">__init__</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">target</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.__init__" title="Link to this definition"></a></dt>
<dd></dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionBP.arguments">
<span class="sig-name descname"><span class="pre">arguments</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.arguments" title="Link to this definition"></a></dt>
<dd><p>TEST PARAM DICT</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionBP.break_on_ret">
<span class="sig-name descname"><span class="pre">break_on_ret</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.break_on_ret" title="Link to this definition"></a></dt>
<dd><p>Setup a breakpoint at the return address of the function, this breakpoint will call <a class="reference internal" href="#windows.debug.FunctionBP.ret_trigger" title="windows.debug.FunctionBP.ret_trigger"><code class="xref py py-func docutils literal notranslate"><span class="pre">ret_trigger()</span></code></a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionBP.extract_arguments">
<span class="sig-name descname"><span class="pre">extract_arguments</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">cproc</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">cthread</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.extract_arguments" title="Link to this definition"></a></dt>
<dd><p>Extracts the functions parameters in an <code class="xref py py-class docutils literal notranslate"><span class="pre">OrderedDict</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionBP.get_ret_addr">
<span class="sig-name descname"><span class="pre">get_ret_addr</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.get_ret_addr" title="Link to this definition"></a></dt>
<dd><p>Get the return address of the current target, only valid in the trigger() function.</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionBP.ret_trigger">
<span class="sig-name descname"><span class="pre">ret_trigger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.ret_trigger" title="Link to this definition"></a></dt>
<dd><p>Called at the return of the function if <a class="reference internal" href="#windows.debug.FunctionBP.break_on_ret" title="windows.debug.FunctionBP.break_on_ret"><code class="xref py py-func docutils literal notranslate"><span class="pre">break_on_ret()</span></code></a> was called</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.FunctionBP.trigger">
<span class="sig-name descname"><span class="pre">trigger</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">dbg</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">exception</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.FunctionBP.trigger" title="Link to this definition"></a></dt>
<dd><p>Called when breakpoint is hit</p>
</dd></dl>
</dd></dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See sample <a class="reference internal" href="sample.html#sample-debugger-bp-functionbp"><span class="std std-ref">windows.debug.FunctionBP</span></a></p>
</div>
</section>
<section id="module-windows.debug.symbols">
<span id="windows-debug-symbols-using-symbols"></span><span id="debug-symbols-module"></span><h2><span class="section-number">9.5. </span><a class="reference internal" href="#module-windows.debug.symbols" title="windows.debug.symbols"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug.symbols</span></code></a> – Using symbols<a class="headerlink" href="#module-windows.debug.symbols" title="Link to this heading"></a></h2>
<p>The <a class="reference internal" href="#module-windows.debug.symbols" title="windows.debug.symbols"><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug.symbols</span></code></a> module provide classes to load PDB and resolve name/address.
In its current state, this module does not handle types.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>See samples <a class="reference internal" href="sample.html#sample-symbols"><span class="std std-ref">Symbols</span></a></p>
</div>
<section id="configuration">
<h3><span class="section-number">9.5.1. </span>Configuration<a class="headerlink" href="#configuration" title="Link to this heading"></a></h3>
<p>In order to be able to automatically download PDB and parse remote <code class="docutils literal notranslate"><span class="pre">_NT_SYMBOL_PATH</span></code>, a debug version of the DLL <cite>dbghelp.dll</cite> must be used.
(See <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/debug/dbghelp-versions">MSDN: DbgHelp Versions</a>)</p>
<p>As it is NOT recommended to replace <code class="docutils literal notranslate"><span class="pre">system32/dbghelp.dll</span></code>, its path must be provided to PythonForWindows.
This path must be provided before any call to the <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> APIs.
Also, the <code class="docutils literal notranslate"><span class="pre">symsrv.dll</span></code> DLL should be present in the same directory as <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> (See <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/debug/using-symsrv#installation">SymSrv Installation</a>)</p>
<p>There is 2 ways to pass this information to <code class="docutils literal notranslate"><span class="pre">PythonForWindows</span></code>:</p>
<blockquote>
<div><ul class="simple">
<li><p>Using the function <a class="reference internal" href="#windows.debug.symbols.set_dbghelp_path" title="windows.debug.symbols.set_dbghelp_path"><code class="xref py py-func docutils literal notranslate"><span class="pre">set_dbghelp_path()</span></code></a></p></li>
<li><dl class="simple">
<dt>Using the environment variable <code class="docutils literal notranslate"><span class="pre">PFW_DBGHELP_PATH</span></code></dt><dd><ul>
<li><p>If this variable exists it will simply trigger a call to <code class="docutils literal notranslate"><span class="pre">set_dbghelp_path(PFW_DBGHELP_PATH)</span></code></p></li>
</ul>
</dd>
</dl>
</li>
</ul>
</div></blockquote>
<p>If the given path is a directory, the final path will be computer as <code class="docutils literal notranslate"><span class="pre">path\&lt;current_process_bitness&gt;\dbghelp.dll</span></code>.
This allow to use the same script (or environment variable) transparently in bot 32b &amp; 64b python interpreters.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>For example, on my computer my setup is done through the environment variable: <code class="docutils literal notranslate"><span class="pre">PFW_DBGHELP_PATH=D:\pysym\bin</span></code></p>
<p>This directory have the following layout:</p>
<blockquote>
<div><div class="line-block">
<div class="line">$ tree /A /F %PFW_DBGHELP_PATH%</div>
<div class="line-block">
<div class="line">D:\PYSYM\BIN</div>
<div class="line">| symsrv.yes</div>
<div class="line">|</div>
<div class="line">+\-\-\-32</div>
<div class="line">| dbghelp.dll</div>
<div class="line">| symsrv.dll</div>
<div class="line">|</div>
<div class="line">\\-\-\-64</div>
<div class="line-block">
<div class="line">dbghelp.dll</div>
<div class="line">symsrv.dll</div>
</div>
</div>
</div>
</div></blockquote>
</div>
</section>
<section id="helpers">
<h3><span class="section-number">9.5.2. </span>Helpers<a class="headerlink" href="#helpers" title="Link to this heading"></a></h3>
<dl class="py function">
<dt class="sig sig-object py" id="windows.debug.symbols.set_dbghelp_path">
<span class="sig-prename descclassname"><span class="pre">windows.debug.symbols.</span></span><span class="sig-name descname"><span class="pre">set_dbghelp_path</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#set_dbghelp_path"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.set_dbghelp_path" title="Link to this definition"></a></dt>
<dd><p>Set the path of the <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> file to use. It allow to configure a different version of the DLL handling PDB downloading.</p>
<p>If <code class="docutils literal notranslate"><span class="pre">path</span></code> is a directory, the final <code class="docutils literal notranslate"><span class="pre">dbghelp.dll</span></code> will be computed as
<code class="docutils literal notranslate"><span class="pre">path\&lt;current_process_bitness&gt;\dbghelp.dll</span></code>.</p>
<p>This allow to use the same script transparently in both 32b &amp; 64b python interpreters.</p>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolEngine">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.symbols.</span></span><span class="sig-name descname"><span class="pre">SymbolEngine</span></span><a class="reference internal" href="_modules/windows/debug/symbols.html#SymbolEngine"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.SymbolEngine" title="Link to this definition"></a></dt>
<dd><p>Represent the global symbol engine. Just a proxy to get/set global engine options</p>
<p>Its instance can be accessed using <code class="docutils literal notranslate"><span class="pre">windows.debug.symbols.engine</span></code></p>
<p>Exemple:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">engine</span><span class="o">.</span><span class="n">options</span>
<span class="go">6L</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">engine</span><span class="o">.</span><span class="n">options</span> <span class="o">=</span> <span class="n">gdef</span><span class="o">.</span><span class="n">SYMOPT_UNDNAME</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">engine</span><span class="o">.</span><span class="n">options</span>
<span class="go">2L</span>
</pre></div>
</div>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolEngine.options">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">options</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolEngine.options" title="Link to this definition"></a></dt>
<dd><p>The options of the Symbol engine
(<a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/nf-dbghelp-symsetoptions#parameters">see options</a>)</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Default options are: <code class="docutils literal notranslate"><span class="pre">gdef.SYMOPT_DEFERRED_LOADS</span> <span class="pre">+</span> <span class="pre">gdef.SYMOPT_UNDNAME</span></code></p>
</div>
</dd></dl>
</dd></dl>
</section>
<section id="virtualsymbolhandler">
<h3><span class="section-number">9.5.3. </span><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler" title="windows.debug.symbols.VirtualSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a><a class="headerlink" href="#virtualsymbolhandler" title="Link to this heading"></a></h3>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.symbols.</span></span><span class="sig-name descname"><span class="pre">VirtualSymbolHandler</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">search_path</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#VirtualSymbolHandler"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler" title="Link to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolHandler</span></code></p>
<p>A SymbolHandler where its handle is not a valid process handle
Allow to create/resolve symbol in a ‘virtual’ process
But all API needing a real process handle will fail</p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.__getitem__">
<span class="sig-name descname"><span class="pre">__getitem__</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">name_or_addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.__getitem__" title="Link to this definition"></a></dt>
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
<p>If its an int -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
If its a string -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
</div>
<p>Exemple:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span>
<span class="go">&lt;SymbolModule name=&quot;kernelbase&quot; type=SymPdb pdb=&quot;wkernelbase.pdb&quot; addr=0x10000000&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">&quot;kernelbase!CreateFileInternal&quot;</span><span class="p">)</span>
<span class="go">&lt;SymbolInfoA name=&quot;CreateFileInternal&quot; addr=0x100f2120 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
<span class="go">&lt;SymbolInfoA name=&quot;ReadFile&quot; addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
<span class="go">&#39;kernelbase!ReadFile+0x162&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.handle">
<span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.handle" title="Link to this definition"></a></dt>
<dd><p>The handle of the symbol handler</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.load">
<span class="sig-name descname"><span class="pre">load</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">name</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.load" title="Link to this definition"></a></dt>
<dd><p>An alias for <a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.load_file" title="windows.debug.symbols.VirtualSymbolHandler.load_file"><code class="xref py py-func docutils literal notranslate"><span class="pre">VirtualSymbolHandler.load_file()</span></code></a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.load_file">
<span class="sig-name descname"><span class="pre">load_file</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">name</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.load_file" title="Link to this definition"></a></dt>
<dd><p>Load the module <code class="docutils literal notranslate"><span class="pre">path</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.load_module">
<span class="sig-name descname"><span class="pre">load_module</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">file_handle</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">path</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">name</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.load_module" title="Link to this definition"></a></dt>
<dd><p>Load a module at a given <code class="docutils literal notranslate"><span class="pre">addr</span></code>. The module to load can be pass via a <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>
or the direct <code class="docutils literal notranslate"><span class="pre">path</span></code> of the file to load.</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The logic of <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> seems somewhat strange about the naming of the loaded module.
A custom module <code class="docutils literal notranslate"><span class="pre">name</span></code> is only taken into account if the file is passed via a File handle.
To make it more intuitive, if this function is call with a <code class="docutils literal notranslate"><span class="pre">path</span></code> and <code class="docutils literal notranslate"><span class="pre">name</span></code> and no <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>,
it will open the path and directly call <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> with a file handle and a name.</p>
</div>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.modules">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">modules</span></span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.modules" title="Link to this definition"></a></dt>
<dd><p>The list of loaded modules</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a>] – A list of modules</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.refresh">
<span class="sig-name descname"><span class="pre">refresh</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#VirtualSymbolHandler.refresh"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.refresh" title="Link to this definition"></a></dt>
<dd><p>Do nothing for a <a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler" title="windows.debug.symbols.VirtualSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.resolve">
<span class="sig-name descname"><span class="pre">resolve</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">name_or_addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.resolve" title="Link to this definition"></a></dt>
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
<p>If its an int -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
If its a string -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
</div>
<p>Exemple:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span>
<span class="go">&lt;SymbolModule name=&quot;kernelbase&quot; type=SymPdb pdb=&quot;wkernelbase.pdb&quot; addr=0x10000000&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">&quot;kernelbase!CreateFileInternal&quot;</span><span class="p">)</span>
<span class="go">&lt;SymbolInfoA name=&quot;CreateFileInternal&quot; addr=0x100f2120 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
<span class="go">&lt;SymbolInfoA name=&quot;ReadFile&quot; addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
<span class="go">&#39;kernelbase!ReadFile+0x162&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.search">
<span class="sig-name descname"><span class="pre">search</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">mask</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">mod</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">tag</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">options</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">SYMSEARCH_ALLITEMS(0x8)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">callback</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.search" title="Link to this definition"></a></dt>
<dd><p>Search the symbols matching <code class="docutils literal notranslate"><span class="pre">mask</span></code> (<code class="docutils literal notranslate"><span class="pre">Windbg</span></code> like).</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a>] – A list of <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></p>
</dd>
</dl>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="s2">&quot;kernelbase!CreateFile*&quot;</span><span class="p">)</span>
<span class="go">[&lt;SymbolInfoW name=&quot;CreateFileInternal&quot; addr=0x100f2120 tag=SymTagFunction&gt;,</span>
<span class="go"> &lt;SymbolInfoW name=&quot;CreateFileMoniker&quot; addr=0x10117d80 tag=SymTagFunction&gt;,</span>
<span class="go"> &lt;SymbolInfoW name=&quot;CreateFile2&quot; addr=0x1011e690 tag=SymTagFunction&gt;,</span>
<span class="go"> ...]</span>
</pre></div>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.VirtualSymbolHandler.unload">
<span class="sig-name descname"><span class="pre">unload</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.VirtualSymbolHandler.unload" title="Link to this definition"></a></dt>
<dd><p>Unload the module at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
</dd></dl>
</section>
<section id="processsymbolhandler">
<h3><span class="section-number">9.5.4. </span><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler" title="windows.debug.symbols.ProcessSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">ProcessSymbolHandler</span></code></a><a class="headerlink" href="#processsymbolhandler" title="Link to this heading"></a></h3>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.symbols.</span></span><span class="sig-name descname"><span class="pre">ProcessSymbolHandler</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">process</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">search_path</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">invade_process</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">False</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#ProcessSymbolHandler"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler" title="Link to this definition"></a></dt>
<dd><p>Bases: <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolHandler</span></code></p>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.__getitem__">
<span class="sig-name descname"><span class="pre">__getitem__</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">name_or_addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.__getitem__" title="Link to this definition"></a></dt>
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
<p>If its an int -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
If its a string -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
</div>
<p>Exemple:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span>
<span class="go">&lt;SymbolModule name=&quot;kernelbase&quot; type=SymPdb pdb=&quot;wkernelbase.pdb&quot; addr=0x10000000&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">&quot;kernelbase!CreateFileInternal&quot;</span><span class="p">)</span>
<span class="go">&lt;SymbolInfoA name=&quot;CreateFileInternal&quot; addr=0x100f2120 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
<span class="go">&lt;SymbolInfoA name=&quot;ReadFile&quot; addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
<span class="go">&#39;kernelbase!ReadFile+0x162&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.handle">
<span class="sig-name descname"><span class="pre">handle</span></span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.handle" title="Link to this definition"></a></dt>
<dd><p>The handle of the symbol handler</p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.load">
<span class="sig-name descname"><span class="pre">load</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">name</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#ProcessSymbolHandler.load"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.load" title="Link to this definition"></a></dt>
<dd><p>Load the <a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> associated with the loaded module <code class="docutils literal notranslate"><span class="pre">name</span></code> (as found in the PEB)</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a></p>
</dd>
</dl>
<p>Exemple:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">ProcessSymbolHandler</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">())</span>
<span class="go">&lt;windows.debug.symbols.ProcessSymbolHandler object at 0x033A2C30&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span>
<span class="go">&lt;windows.debug.symbols.ProcessSymbolHandler object at 0x033A2C30&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">load</span><span class="p">(</span><span class="s2">&quot;kernelbase.dll&quot;</span><span class="p">)</span>
<span class="go">&lt;SymbolModule name=&quot;kernelbase&quot; type=SymDeferred pdb=&quot;&quot; addr=0x7ffb5b090000&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="p">[</span><span class="s2">&quot;kernelbase!CreateProcessA&quot;</span><span class="p">]</span>
<span class="go">&lt;SymbolInfoA name=&quot;CreateProcessA&quot; start=0x7ffb5b2371f0 tag=SymTagPublicSymbol&gt;</span>
</pre></div>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.load_file">
<span class="sig-name descname"><span class="pre">load_file</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">path</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">name</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.load_file" title="Link to this definition"></a></dt>
<dd><p>Load the module <code class="docutils literal notranslate"><span class="pre">path</span></code> at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.load_module">
<span class="sig-name descname"><span class="pre">load_module</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">file_handle</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">path</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">name</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">addr</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">size</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">data</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">flags</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.load_module" title="Link to this definition"></a></dt>
<dd><p>Load a module at a given <code class="docutils literal notranslate"><span class="pre">addr</span></code>. The module to load can be pass via a <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>
or the direct <code class="docutils literal notranslate"><span class="pre">path</span></code> of the file to load.</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a> – The loaded module</p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The logic of <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> seems somewhat strange about the naming of the loaded module.
A custom module <code class="docutils literal notranslate"><span class="pre">name</span></code> is only taken into account if the file is passed via a File handle.
To make it more intuitive, if this function is call with a <code class="docutils literal notranslate"><span class="pre">path</span></code> and <code class="docutils literal notranslate"><span class="pre">name</span></code> and no <code class="docutils literal notranslate"><span class="pre">file_handle</span></code>,
it will open the path and directly call <code class="docutils literal notranslate"><span class="pre">SymLoadModuleEx</span></code> with a file handle and a name.</p>
</div>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.modules">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">modules</span></span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.modules" title="Link to this definition"></a></dt>
<dd><p>The list of loaded modules</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a>] – A list of modules</p>
</dd>
</dl>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.refresh">
<span class="sig-name descname"><span class="pre">refresh</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#ProcessSymbolHandler.refresh"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.refresh" title="Link to this definition"></a></dt>
<dd><p>Update the list of loaded modules to match the modules present in the target process</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This function only call <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/nf-dbghelp-symrefreshmodulelist">SymRefreshModuleList</a> for now.
It seems that this function do not handle refreshing a 64b target from a 32b python</p>
<p>Also, on a 32b target from a 64b python it seems to only load symbols for the 64b modules (ntdll + syswow dll)</p>
</div>
<p>Exemple:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">ProcessSymbolHandler</span><span class="p">(</span><span class="n">windows</span><span class="o">.</span><span class="n">test</span><span class="o">.</span><span class="n">pop_proc_64</span><span class="p">())</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">modules</span>
<span class="go">[]</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">refresh</span><span class="p">()</span>
<span class="go">44</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">modules</span>
<span class="go">[&lt;SymbolModule name=&quot;notepad&quot; type=SymDeferred pdb=&quot;&quot; addr=0x7ff772b80000&gt;,</span>
<span class="go"> &lt;SymbolModule name=&quot;ntdll&quot; type=SymDeferred pdb=&quot;&quot; addr=0x7ffb5d860000&gt;,</span>
<span class="go"> &lt;SymbolModule name=&quot;KERNEL32&quot; type=SymDeferred pdb=&quot;&quot; addr=0x7ffb5bb90000&gt;,</span>
<span class="go"> &lt;SymbolModule name=&quot;KERNELBASE&quot; type=SymDeferred pdb=&quot;&quot; addr=0x7ffb5b090000&gt;,</span>
<span class="go"> ...]</span>
</pre></div>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.resolve">
<span class="sig-name descname"><span class="pre">resolve</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">name_or_addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.resolve" title="Link to this definition"></a></dt>
<dd><p>Resolve <code class="docutils literal notranslate"><span class="pre">name_or_addr</span></code>.</p>
<p>If its an int -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> at the address.
If its a string -&gt; Return the <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a> corresponding to the symbol name</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></p>
</dd>
</dl>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p><code class="docutils literal notranslate"><span class="pre">__getitem__</span></code> is an alias for <code class="docutils literal notranslate"><span class="pre">resolve()</span></code></p>
</div>
<p>Exemple:</p>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span>
<span class="go">&lt;SymbolModule name=&quot;kernelbase&quot; type=SymPdb pdb=&quot;wkernelbase.pdb&quot; addr=0x10000000&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">resolve</span><span class="p">(</span><span class="s2">&quot;kernelbase!CreateFileInternal&quot;</span><span class="p">)</span>
<span class="go">&lt;SymbolInfoA name=&quot;CreateFileInternal&quot; addr=0x100f2120 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">]</span>
<span class="go">&lt;SymbolInfoA name=&quot;ReadFile&quot; addr=0x100f1ee0 displacement=0x162 tag=SymTagFunction&gt;</span>
<span class="gp">&gt;&gt;&gt; </span><span class="nb">str</span><span class="p">(</span><span class="n">sh</span><span class="p">[</span><span class="mh">0x100f2042</span><span class="p">])</span>
<span class="go">&#39;kernelbase!ReadFile+0x162&#39;</span>
</pre></div>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.search">
<span class="sig-name descname"><span class="pre">search</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">mask</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">mod</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">tag</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">0</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">options</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">SYMSEARCH_ALLITEMS(0x8)</span></span></em>, <em class="sig-param"><span class="n"><span class="pre">callback</span></span><span class="o"><span class="pre">=</span></span><span class="default_value"><span class="pre">None</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.search" title="Link to this definition"></a></dt>
<dd><p>Search the symbols matching <code class="docutils literal notranslate"><span class="pre">mask</span></code> (<code class="docutils literal notranslate"><span class="pre">Windbg</span></code> like).</p>
<dl class="field-list simple">
<dt class="field-odd">Returns<span class="colon">:</span></dt>
<dd class="field-odd"><p>[<a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a>] – A list of <a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></p>
</dd>
</dl>
<div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span><span class="o">.</span><span class="n">search</span><span class="p">(</span><span class="s2">&quot;kernelbase!CreateFile*&quot;</span><span class="p">)</span>
<span class="go">[&lt;SymbolInfoW name=&quot;CreateFileInternal&quot; addr=0x100f2120 tag=SymTagFunction&gt;,</span>
<span class="go"> &lt;SymbolInfoW name=&quot;CreateFileMoniker&quot; addr=0x10117d80 tag=SymTagFunction&gt;,</span>
<span class="go"> &lt;SymbolInfoW name=&quot;CreateFile2&quot; addr=0x1011e690 tag=SymTagFunction&gt;,</span>
<span class="go"> ...]</span>
</pre></div>
</div>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.ProcessSymbolHandler.unload">
<span class="sig-name descname"><span class="pre">unload</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">addr</span></span></em><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.ProcessSymbolHandler.unload" title="Link to this definition"></a></dt>
<dd><p>Unload the module at <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
</dd></dl>
</section>
<section id="symbolmodule">
<h3><span class="section-number">9.5.5. </span><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a><a class="headerlink" href="#symbolmodule" title="Link to this heading"></a></h3>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolModule">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.symbols.</span></span><span class="sig-name descname"><span class="pre">SymbolModule</span></span><span class="sig-paren">(</span><em class="sig-param"><span class="n"><span class="pre">resolver</span></span></em><span class="sig-paren">)</span><a class="reference internal" href="_modules/windows/debug/symbols.html#SymbolModule"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.SymbolModule" title="Link to this definition"></a></dt>
<dd><p>Bases: <a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs._IMAGEHLP_MODULEW64" title="windows.generated_def.winstructs._IMAGEHLP_MODULEW64"><code class="xref py py-class docutils literal notranslate"><span class="pre">_IMAGEHLP_MODULEW64</span></code></a></p>
<p>Represent a loaded symbol module
(see <a class="reference external" href="https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_modulew64">MSDN _IMAGEHLP_MODULEW64</a>)</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This represent a module in the <code class="docutils literal notranslate"><span class="pre">symbol</span> <span class="pre">space</span></code> for symbol resolution.
This can be completly virtual (particularly in the case of <a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler" title="windows.debug.symbols.VirtualSymbolHandler"><code class="xref py py-class docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a></p>
</div>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolModule.addr">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">addr</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolModule.addr" title="Link to this definition"></a></dt>
<dd><p>The load address of the module</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolModule.name">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolModule.name" title="Link to this definition"></a></dt>
<dd><p>The name of the module</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolModule.path">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">path</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolModule.path" title="Link to this definition"></a></dt>
<dd><p>The full path and file name of the file from which symbols were loaded.</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolModule.pdb">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">pdb</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolModule.pdb" title="Link to this definition"></a></dt>
<dd><p>The local path of the loaded PDB if present</p>
<dl>
<dt>Exemple:</dt><dd><div class="doctest highlight-default notranslate"><div class="highlight"><pre><span></span><span class="gp">&gt;&gt;&gt; </span><span class="n">sh</span> <span class="o">=</span> <span class="n">windows</span><span class="o">.</span><span class="n">debug</span><span class="o">.</span><span class="n">symbols</span><span class="o">.</span><span class="n">VirtualSymbolHandler</span><span class="p">()</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span> <span class="o">=</span> <span class="n">sh</span><span class="o">.</span><span class="n">load_file</span><span class="p">(</span><span class="sa">r</span><span class="s2">&quot;c:\windows\system32\kernelbase.dll&quot;</span><span class="p">)</span>
<span class="gp">&gt;&gt;&gt; </span><span class="n">mod</span><span class="o">.</span><span class="n">pdb</span>
<span class="go">&#39;d:\\symbols\\wkernelbase.pdb\\017FA9C5278235B7E6BFBA74A9A5AAD91\\wkernelbase.pdb&#39;</span>
</pre></div>
</div>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolModule.type">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">type</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolModule.type" title="Link to this definition"></a></dt>
<dd><p>The type of module (<a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.SYM_TYPE" title="windows.generated_def.winstructs.SYM_TYPE"><code class="xref py py-class docutils literal notranslate"><span class="pre">SYM_TYPE</span></code></a>),
which can be one of:</p>
<blockquote>
<div><table class="docutils align-default">
<tbody>
<tr class="row-odd"><td><p>SymCoff</p></td>
<td><p>COFF symbols.</p></td>
</tr>
<tr class="row-even"><td><p>SymCv</p></td>
<td><p>CodeView symbols.</p></td>
</tr>
<tr class="row-odd"><td><p>SymDeferred</p></td>
<td><p>Symbol loading deferred.</p></td>
</tr>
<tr class="row-even"><td><p>SymDia</p></td>
<td><p>DIA symbols.</p></td>
</tr>
<tr class="row-odd"><td><p>SymExport</p></td>
<td><p>Symbols generated from a DLL export table.</p></td>
</tr>
<tr class="row-even"><td><p>SymNone</p></td>
<td><p>No symbols are loaded.</p></td>
</tr>
<tr class="row-odd"><td><p>SymPdb</p></td>
<td><p>PDB symbols.</p></td>
</tr>
<tr class="row-even"><td><p>SymSym</p></td>
<td><p>.sym file.</p></td>
</tr>
<tr class="row-odd"><td><p>SymVirtual</p></td>
<td><p>The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL.</p></td>
</tr>
</tbody>
</table>
</div></blockquote>
</dd></dl>
</dd></dl>
</section>
<section id="symbolinfo">
<h3><span class="section-number">9.5.6. </span><a class="reference internal" href="#windows.debug.symbols.SymbolInfo" title="windows.debug.symbols.SymbolInfo"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a><a class="headerlink" href="#symbolinfo" title="Link to this heading"></a></h3>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfo">
<span class="sig-prename descclassname"><span class="pre">windows.debug.symbols.</span></span><span class="sig-name descname"><span class="pre">SymbolInfo</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfo" title="Link to this definition"></a></dt>
<dd><p>alias of <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfoW</span></code></p>
</dd></dl>
<dl class="py class">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA">
<em class="property"><span class="pre">class</span><span class="w"> </span></em><span class="sig-prename descclassname"><span class="pre">windows.debug.symbols.</span></span><span class="sig-name descname"><span class="pre">SymbolInfoA</span></span><a class="reference internal" href="_modules/windows/debug/symbols.html#SymbolInfoA"><span class="viewcode-link"><span class="pre">[source]</span></span></a><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA" title="Link to this definition"></a></dt>
<dd><p>Bases: <a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs._SYMBOL_INFO" title="windows.generated_def.winstructs._SYMBOL_INFO"><code class="xref py py-class docutils literal notranslate"><span class="pre">_SYMBOL_INFO</span></code></a>, <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfoBase</span></code></p>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.displacement">
<span class="sig-name descname"><span class="pre">displacement</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.displacement" title="Link to this definition"></a></dt>
<dd><p>The displacement between the addresse and the start of the symbol (name)</p>
</dd></dl>
<dl class="py attribute">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.CHAR_TYPE">
<span class="sig-name descname"><span class="pre">CHAR_TYPE</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.CHAR_TYPE" title="Link to this definition"></a></dt>
<dd><p>alias of <code class="xref py py-class docutils literal notranslate"><span class="pre">c_char</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.__int__">
<span class="sig-name descname"><span class="pre">__int__</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.__int__" title="Link to this definition"></a></dt>
<dd><p>An alias for <code class="docutils literal notranslate"><span class="pre">addr</span></code></p>
</dd></dl>
<dl class="py method">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.__str__">
<span class="sig-name descname"><span class="pre">__str__</span></span><span class="sig-paren">(</span><span class="sig-paren">)</span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.__str__" title="Link to this definition"></a></dt>
<dd><p>The fullname of the symbol in the windbg format <code class="docutils literal notranslate"><span class="pre">mod!sym+displacement</span></code></p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.addr">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">addr</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.addr" title="Link to this definition"></a></dt>
<dd><p>The address of the symbol</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.fullname">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">fullname</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.fullname" title="Link to this definition"></a></dt>
<dd><p>The fullname of the symbol in the windbg format <code class="docutils literal notranslate"><span class="pre">mod!sym+displacement</span></code></p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.module">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">module</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.module" title="Link to this definition"></a></dt>
<dd><p>The module containing the symbol</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="#windows.debug.symbols.SymbolModule" title="windows.debug.symbols.SymbolModule"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a></p>
</dd>
</dl>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.name">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">name</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.name" title="Link to this definition"></a></dt>
<dd><p>The name of the symbol</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.start">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">start</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.start" title="Link to this definition"></a></dt>
<dd><p>The address of the start of the symbol
If the symbol include a displacement, it is not taken into account</p>
</dd></dl>
<dl class="py property">
<dt class="sig sig-object py" id="windows.debug.symbols.SymbolInfoA.tag">
<em class="property"><span class="pre">property</span><span class="w"> </span></em><span class="sig-name descname"><span class="pre">tag</span></span><a class="headerlink" href="#windows.debug.symbols.SymbolInfoA.tag" title="Link to this definition"></a></dt>
<dd><p>The Tag of the module</p>
<dl class="field-list simple">
<dt class="field-odd">Type<span class="colon">:</span></dt>
<dd class="field-odd"><p><a class="reference internal" href="winstructs_generated.html#windows.generated_def.winstructs.SymTagEnum" title="windows.generated_def.winstructs.SymTagEnum"><code class="xref py py-class docutils literal notranslate"><span class="pre">SymTagEnum</span></code></a></p>
</dd>
</dl>
</dd></dl>
</dd></dl>
</section>
</section>
</section>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="main navigation">
<div class="sphinxsidebarwrapper">
<div>
<h3><a href="index.html">Table of Contents</a></h3>
<ul>
<li><a class="reference internal" href="#">9. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug</span></code> – Debugging</a><ul>
<li><a class="reference internal" href="#debugger">9.1. <code class="xref py py-class docutils literal notranslate"><span class="pre">Debugger</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.Debugger"><code class="docutils literal notranslate"><span class="pre">Debugger</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.Debugger.__init__"><code class="docutils literal notranslate"><span class="pre">__init__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.attach"><code class="docutils literal notranslate"><span class="pre">attach()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.detach"><code class="docutils literal notranslate"><span class="pre">detach()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.debug"><code class="docutils literal notranslate"><span class="pre">debug()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.loop"><code class="docutils literal notranslate"><span class="pre">loop()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.add_bp"><code class="docutils literal notranslate"><span class="pre">add_bp()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.del_bp"><code class="docutils literal notranslate"><span class="pre">del_bp()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.single_step"><code class="docutils literal notranslate"><span class="pre">single_step()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.get_memory_breakpoint_at"><code class="docutils literal notranslate"><span class="pre">get_memory_breakpoint_at()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.disable_all_memory_breakpoints"><code class="docutils literal notranslate"><span class="pre">disable_all_memory_breakpoints()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.restore_all_memory_breakpoints"><code class="docutils literal notranslate"><span class="pre">restore_all_memory_breakpoints()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.DisabledMemoryBreakpoint"><code class="docutils literal notranslate"><span class="pre">DisabledMemoryBreakpoint()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.get_exception_bitness"><code class="docutils literal notranslate"><span class="pre">get_exception_bitness()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.kill_on_exit"><code class="docutils literal notranslate"><span class="pre">kill_on_exit()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_setup"><code class="docutils literal notranslate"><span class="pre">on_setup()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_exception"><code class="docutils literal notranslate"><span class="pre">on_exception()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_single_step"><code class="docutils literal notranslate"><span class="pre">on_single_step()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_create_process"><code class="docutils literal notranslate"><span class="pre">on_create_process()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_exit_process"><code class="docutils literal notranslate"><span class="pre">on_exit_process()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_create_thread"><code class="docutils literal notranslate"><span class="pre">on_create_thread()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_exit_thread"><code class="docutils literal notranslate"><span class="pre">on_exit_thread()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_load_dll"><code class="docutils literal notranslate"><span class="pre">on_load_dll()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_unload_dll"><code class="docutils literal notranslate"><span class="pre">on_unload_dll()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_output_debug_string"><code class="docutils literal notranslate"><span class="pre">on_output_debug_string()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.Debugger.on_rip"><code class="docutils literal notranslate"><span class="pre">on_rip()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#symboldebugger">9.2. <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolDebugger</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.SymbolDebugger"><code class="docutils literal notranslate"><span class="pre">SymbolDebugger</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#localdebugger">9.3. <code class="xref py py-class docutils literal notranslate"><span class="pre">LocalDebugger</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.LocalDebugger"><code class="docutils literal notranslate"><span class="pre">LocalDebugger</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.LocalDebugger.add_bp"><code class="docutils literal notranslate"><span class="pre">add_bp()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.LocalDebugger.del_bp"><code class="docutils literal notranslate"><span class="pre">del_bp()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.LocalDebugger.get_exception_code"><code class="docutils literal notranslate"><span class="pre">get_exception_code()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.LocalDebugger.get_exception_context"><code class="docutils literal notranslate"><span class="pre">get_exception_context()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.LocalDebugger.on_exception"><code class="docutils literal notranslate"><span class="pre">on_exception()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.LocalDebugger.single_step"><code class="docutils literal notranslate"><span class="pre">single_step()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#breakpoint">9.4. <code class="xref py py-class docutils literal notranslate"><span class="pre">Breakpoint</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.Breakpoint"><code class="docutils literal notranslate"><span class="pre">Breakpoint</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.Breakpoint.trigger"><code class="docutils literal notranslate"><span class="pre">trigger()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.debug.HXBreakpoint"><code class="docutils literal notranslate"><span class="pre">HXBreakpoint</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.HXBreakpoint.trigger"><code class="docutils literal notranslate"><span class="pre">trigger()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.debug.MemoryBreakpoint"><code class="docutils literal notranslate"><span class="pre">MemoryBreakpoint</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.MemoryBreakpoint.__init__"><code class="docutils literal notranslate"><span class="pre">__init__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.MemoryBreakpoint.trigger"><code class="docutils literal notranslate"><span class="pre">trigger()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.debug.FunctionCallBP"><code class="docutils literal notranslate"><span class="pre">FunctionCallBP</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.FunctionCallBP.__init__"><code class="docutils literal notranslate"><span class="pre">__init__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionCallBP.break_on_ret"><code class="docutils literal notranslate"><span class="pre">break_on_ret()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionCallBP.get_ret_addr"><code class="docutils literal notranslate"><span class="pre">get_ret_addr()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionCallBP.ret_trigger"><code class="docutils literal notranslate"><span class="pre">ret_trigger()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionCallBP.trigger"><code class="docutils literal notranslate"><span class="pre">trigger()</span></code></a></li>
</ul>
</li>
<li><a class="reference internal" href="#windows.debug.FunctionBP"><code class="docutils literal notranslate"><span class="pre">FunctionBP</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.FunctionBP.__init__"><code class="docutils literal notranslate"><span class="pre">__init__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionBP.arguments"><code class="docutils literal notranslate"><span class="pre">arguments()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionBP.break_on_ret"><code class="docutils literal notranslate"><span class="pre">break_on_ret()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionBP.extract_arguments"><code class="docutils literal notranslate"><span class="pre">extract_arguments()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionBP.get_ret_addr"><code class="docutils literal notranslate"><span class="pre">get_ret_addr()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionBP.ret_trigger"><code class="docutils literal notranslate"><span class="pre">ret_trigger()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.FunctionBP.trigger"><code class="docutils literal notranslate"><span class="pre">trigger()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#module-windows.debug.symbols">9.5. <code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug.symbols</span></code> – Using symbols</a><ul>
<li><a class="reference internal" href="#configuration">9.5.1. Configuration</a></li>
<li><a class="reference internal" href="#helpers">9.5.2. Helpers</a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.set_dbghelp_path"><code class="docutils literal notranslate"><span class="pre">set_dbghelp_path()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolEngine"><code class="docutils literal notranslate"><span class="pre">SymbolEngine</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolEngine.options"><code class="docutils literal notranslate"><span class="pre">options</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#virtualsymbolhandler">9.5.3. <code class="xref py py-class docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler"><code class="docutils literal notranslate"><span class="pre">VirtualSymbolHandler</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.__getitem__"><code class="docutils literal notranslate"><span class="pre">__getitem__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.load"><code class="docutils literal notranslate"><span class="pre">load()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.load_file"><code class="docutils literal notranslate"><span class="pre">load_file()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.load_module"><code class="docutils literal notranslate"><span class="pre">load_module()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.modules"><code class="docutils literal notranslate"><span class="pre">modules</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.refresh"><code class="docutils literal notranslate"><span class="pre">refresh()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.resolve"><code class="docutils literal notranslate"><span class="pre">resolve()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.search"><code class="docutils literal notranslate"><span class="pre">search()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.VirtualSymbolHandler.unload"><code class="docutils literal notranslate"><span class="pre">unload()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#processsymbolhandler">9.5.4. <code class="xref py py-class docutils literal notranslate"><span class="pre">ProcessSymbolHandler</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler"><code class="docutils literal notranslate"><span class="pre">ProcessSymbolHandler</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.__getitem__"><code class="docutils literal notranslate"><span class="pre">__getitem__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.handle"><code class="docutils literal notranslate"><span class="pre">handle</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.load"><code class="docutils literal notranslate"><span class="pre">load()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.load_file"><code class="docutils literal notranslate"><span class="pre">load_file()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.load_module"><code class="docutils literal notranslate"><span class="pre">load_module()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.modules"><code class="docutils literal notranslate"><span class="pre">modules</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.refresh"><code class="docutils literal notranslate"><span class="pre">refresh()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.resolve"><code class="docutils literal notranslate"><span class="pre">resolve()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.search"><code class="docutils literal notranslate"><span class="pre">search()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.ProcessSymbolHandler.unload"><code class="docutils literal notranslate"><span class="pre">unload()</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#symbolmodule">9.5.5. <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolModule</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolModule"><code class="docutils literal notranslate"><span class="pre">SymbolModule</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolModule.addr"><code class="docutils literal notranslate"><span class="pre">addr</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolModule.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolModule.path"><code class="docutils literal notranslate"><span class="pre">path</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolModule.pdb"><code class="docutils literal notranslate"><span class="pre">pdb</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolModule.type"><code class="docutils literal notranslate"><span class="pre">type</span></code></a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#symbolinfo">9.5.6. <code class="xref py py-class docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfo"><code class="docutils literal notranslate"><span class="pre">SymbolInfo</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA"><code class="docutils literal notranslate"><span class="pre">SymbolInfoA</span></code></a><ul>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.displacement"><code class="docutils literal notranslate"><span class="pre">displacement</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.CHAR_TYPE"><code class="docutils literal notranslate"><span class="pre">CHAR_TYPE</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.__int__"><code class="docutils literal notranslate"><span class="pre">__int__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.__str__"><code class="docutils literal notranslate"><span class="pre">__str__()</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.addr"><code class="docutils literal notranslate"><span class="pre">addr</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.fullname"><code class="docutils literal notranslate"><span class="pre">fullname</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.module"><code class="docutils literal notranslate"><span class="pre">module</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.name"><code class="docutils literal notranslate"><span class="pre">name</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.start"><code class="docutils literal notranslate"><span class="pre">start</span></code></a></li>
<li><a class="reference internal" href="#windows.debug.symbols.SymbolInfoA.tag"><code class="docutils literal notranslate"><span class="pre">tag</span></code></a></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</div>
<div>
<h4>Previous topic</h4>
<p class="topless"><a href="wintrust.html"
title="previous chapter"><span class="section-number">8. </span><code class="docutils literal notranslate"><span class="pre">windows.wintrust</span></code> – Checking signature</a></p>
</div>
<div>
<h4>Next topic</h4>
<p class="topless"><a href="com.html"
title="next chapter"><span class="section-number">10. </span><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.com</span></code> - Component Object Model</a></p>
</div>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="_sources/debug.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="related navigation">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="com.html" title="10. windows.com - Component Object Model"
>next</a> |</li>
<li class="right" >
<a href="wintrust.html" title="8. windows.wintrust – Checking signature"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="index.html">PythonForWindows 1.0.4 documentation</a> &#187;</li>
<li class="nav-item nav-item-this"><a href=""><span class="section-number">9. </span><code class="xref py py-mod docutils literal notranslate"><span class="pre">windows.debug</span></code> – Debugging</a></li>
</ul>
</div>
<div class="footer" role="contentinfo">
&#169; Copyright 2015-2020, Clement Rouault.
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.3.7.
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink